## 1. Introduction

Celluscripts respects your privacy and is committed to protecting the personal and health information you provide to us.

This Privacy Policy explains how **[Celluscripts legal entity name] ABN [ABN]**, trading as **Celluscripts** (“Celluscripts”, “we”, “us” or “our”), collects, holds, uses and discloses personal information when you use our website, communicate with us, book or participate in a consultation, or otherwise access services facilitated through Celluscripts.

Celluscripts provides access to healthcare services through telehealth. As part of providing and facilitating these services, we may collect sensitive information about your health.

We handle personal information in accordance with applicable Australian privacy laws, including the **Privacy Act 1988 (Cth)** and the **Australian Privacy Principles (APPs)**, as applicable to us, together with other applicable health-records and privacy legislation.

The Australian Privacy Principles govern matters including collection, use and disclosure, security, access, correction and cross-border disclosure of personal information.

This Privacy Policy applies to our website, appointment and enquiry forms, patient communications, telehealth services facilitated through Celluscripts, and related administrative activities.

## 2. Personal Information We Collect

We collect personal information that is reasonably necessary for our business activities and the healthcare services we provide or facilitate.

Depending on your interaction with Celluscripts, this may include the following categories.

### 2.1 Personal and Contact Information

- Full name and preferred name
- Date of birth and age
- Residential or postal address
- Email address and telephone number
- Emergency contact details, where appropriate
- Information required to verify your identity
- Appointment preferences and communication details

### 2.2 Health and Medical Information

Health information is classified as sensitive information under Australian privacy law and is subject to additional protections.

Where reasonably necessary and permitted by law, we may collect:

- Current and previous medical conditions
- Medical history and relevant family medical history
- Symptoms, health concerns and reasons for seeking a consultation
- Current and previous medications, treatments and allergies
- Relevant lifestyle information and health-related goals
- Clinical assessments, consultation notes and recommendations
- Relevant pathology requests, test results and diagnostic information
- Prescriptions and medication-related records, where applicable
- Referrals and correspondence with other healthcare professionals
- Information relevant to assessing the suitability and safety of healthcare services
- Other information voluntarily disclosed during a consultation or through a secure patient questionnaire

We seek to collect only the health information reasonably necessary for the relevant healthcare purpose.

### 2.3 Appointment and Consultation Information

We may collect information relating to:

- Appointment bookings and cancellations
- Consultation dates and times
- Healthcare practitioner allocations
- Appointment attendance and follow-up requirements
- Communications about consultations
- Consent records and patient acknowledgements
- Relevant administrative and billing records

### 2.4 Payment and Transaction Information

Where fees apply, we may collect information necessary to process and administer payments, including:

- Billing name and contact information
- Transaction amounts and dates
- Payment status and transaction references
- Refund and cancellation information

Payments may be processed through third-party payment providers.

**[Confirm payment arrangements and whether Celluscripts receives, stores or has access to payment card details.]**

### 2.5 Website and Technical Information

When you visit our website, we may automatically collect certain technical information, including:

- Internet Protocol (IP) address
- Browser type and device information
- Operating system
- Pages visited and general website usage
- Referral sources
- Website performance and security information
- Cookies and similar technical identifiers, where used

We do not intentionally collect sensitive health information through advertising tracking technologies.

Any website analytics, cookies or other tracking technologies will be assessed for compliance with applicable privacy and healthcare advertising requirements before implementation.

## 3. How We Collect Personal Information

We may collect personal information in several ways.

### 3.1 Directly From You

We collect information when you:

- Complete a website contact or appointment form
- Submit a pre-consultation questionnaire
- Book or attend a telehealth consultation
- Communicate with us by email, telephone or other approved channels
- Provide medical history or supporting documents
- Request information about our services
- Make a payment or request a refund
- Subscribe to communications where an appropriate opt-in is provided

### 3.2 From Healthcare Professionals and Service Providers

Where permitted by law, and with consent where required, we may receive relevant information from:

- Treating medical practitioners
- Referring healthcare professionals
- Pathology laboratories
- Pharmacies
- Other healthcare providers involved in your care
- Healthcare administration and booking service providers

### 3.3 From Other Sources

In limited circumstances, we may collect information from other sources where authorised or required by law, or where you have provided the necessary consent.

Where reasonable and practicable, we collect personal information directly from you.

## 4. Why We Collect and Use Personal Information

We collect, hold, use and disclose personal information for purposes reasonably necessary to provide or facilitate healthcare services and operate Celluscripts.

These purposes may include:

### 4.1 Healthcare Services

- Arranging and facilitating telehealth consultations
- Verifying patient identity and contact information
- Assessing the suitability of requested consultations
- Providing relevant information to treating healthcare professionals
- Supporting clinical assessments and continuity of care
- Facilitating referrals, pathology requests or prescriptions where clinically appropriate
- Coordinating follow-up consultations
- Maintaining accurate patient and clinical records

Clinical decisions, including whether any treatment or prescription is appropriate, remain the responsibility of the treating registered healthcare practitioner.

### 4.2 Administration and Patient Support

- Managing appointments and scheduling
- Responding to enquiries
- Sending appointment confirmations and reminders
- Processing payments and refunds
- Managing complaints and feedback
- Maintaining internal administrative records
- Improving the accessibility and operation of our services

### 4.3 Legal, Regulatory and Safety Requirements

We may use personal information where reasonably necessary to:

- Meet applicable legal and regulatory obligations
- Maintain records required under healthcare legislation
- Respond to lawful requests from authorised regulatory bodies
- Investigate suspected fraud, misuse or security incidents
- Protect patient safety
- Establish, exercise or defend legal claims where permitted by law

### 4.4 Service Communications

We may contact you regarding:

- Appointment confirmations and changes
- Consultation preparation
- Important administrative information
- Follow-up arrangements
- Privacy or security notifications
- Changes affecting services you have requested

These communications are separate from promotional or marketing communications.

## 5. Consent and Sensitive Health Information

Celluscripts recognises that health information is particularly sensitive.

Where required by law, we obtain your consent before collecting sensitive health information.

Consent may be obtained through:

- An appointment booking form
- A pre-consultation health questionnaire
- A patient registration process
- An informed consent process conducted by a healthcare practitioner
- Another appropriate method relevant to the circumstances

Where consent is relied upon, we aim to ensure it is informed, voluntary, current and sufficiently specific to the relevant purpose.

You may withdraw consent where permitted by law by contacting us using the details at the end of this policy.

Withdrawal of consent may affect our ability to arrange or provide certain services. It will not necessarily require us to delete information that must be retained under applicable law.

We do not treat consent to healthcare administration as consent to receive promotional marketing.

## 6. Disclosure of Personal Information

We may disclose personal information to third parties where reasonably necessary for the purposes described in this policy, where you have consented, or where otherwise permitted or required by law.

### 6.1 Treating Medical Practitioners

Relevant personal and health information may be disclosed to Australian-registered medical practitioners involved in your consultation or ongoing care.

This may include medical history, consultation information, relevant test results and other information reasonably necessary for clinical assessment.

### 6.2 Pathology and Diagnostic Providers

Where clinically appropriate, information may be disclosed to pathology laboratories or diagnostic providers to facilitate requested investigations, testing and the communication of results.

### 6.3 Pharmacy Partners

Where a treating practitioner determines that a prescription is clinically appropriate, relevant information may be disclosed to a pharmacy involved in dispensing or supplying prescribed medication.

Such information may include identity and contact details, prescription information and other details reasonably necessary to process the prescription.

Celluscripts does not guarantee that any consultation will result in a prescription.

### 6.4 Technology and Administrative Service Providers

We may use third-party service providers to support our operations, including providers of:

- Website hosting and infrastructure
- Online appointment booking
- Telehealth communication platforms
- Secure patient management and clinical record systems
- Email and SMS communications
- Payment processing
- Information technology support
- Website security and maintenance

These providers may process or store personal information on our behalf, subject to applicable legal requirements and contractual arrangements.

### 6.5 Professional Advisers and Regulators

Where permitted or required by law, information may be disclosed to legal advisers, accountants, insurers, professional advisers, government authorities or regulatory bodies.

### 6.6 Other Healthcare Providers

Where appropriate and lawful, relevant information may be shared with other healthcare professionals involved in your care.

We do not sell patient health information to advertisers or data brokers.

## 7. Storage and Security of Personal Information

We take reasonable steps to protect personal information against misuse, interference, loss, and unauthorised access, modification or disclosure.

Depending on the systems used, safeguards may include:

- Access controls and user authentication
- Role-based restrictions on access to patient information
- Encryption in transit and, where supported, at rest
- Secure hosting and communication platforms
- Appropriate confidentiality obligations
- System monitoring and security updates
- Backup and recovery arrangements
- Procedures for responding to suspected data breaches
- Secure disposal or de-identification of information when appropriate

Access to health information should be limited to authorised individuals who require it for legitimate clinical or administrative purposes.

Although we take reasonable precautions, no method of electronic storage or internet transmission can be guaranteed to be completely secure.

If you believe your information has been accessed or disclosed without authorisation, please contact us promptly.

**[Confirm that the safeguards listed above accurately reflect Celluscripts' implemented security controls.]**

## 8. Website Hosting and Third-Party Platforms

The Celluscripts website uses third-party website infrastructure, including Webflow and Cloudflare.

These providers may process technical information associated with website delivery, performance, availability and security.

Information submitted through website forms may also be processed by Webflow or other configured service providers, depending on the form and integration arrangements.

Appointment bookings, telehealth consultations, clinical records and payment processing may involve separate third-party systems.

**[Before publication, identify all relevant providers, establish which systems receive personal and health information, and confirm where that information is processed and stored.]**

We take reasonable steps to assess the privacy and security arrangements of service providers handling personal information on our behalf.

## 9. Overseas Disclosure of Personal Information

Some technology and service providers may operate infrastructure, support services or data-processing facilities outside Australia.

As a result, personal information may be disclosed to overseas recipients in circumstances permitted by applicable privacy laws.

Before disclosing personal information overseas, we take reasonable steps where required by law to ensure that overseas recipients handle the information consistently with applicable Australian privacy requirements, unless an exception applies.

**Overseas recipient countries: [Insert verified countries, or state the basis on which countries cannot practicably be specified.]**

The countries and arrangements must be confirmed by reviewing the services actually used, including website hosting, booking systems, telehealth platforms, patient record systems, communications and technical support.

Overseas storage or access is not automatically equivalent to an overseas disclosure under Australian privacy law. The relevant arrangements must be assessed.

We will update this policy where necessary to reflect our actual overseas disclosure practices.

## 10. Cookies and Website Analytics

Our website may use cookies and similar technologies that support its operation, functionality and security.

These technologies may be used to:

- Maintain essential website functionality
- Support website security
- Understand technical performance
- Identify and resolve errors
- Remember permitted website preferences

Where non-essential analytics or other tracking technologies are implemented, we will assess their privacy implications and provide appropriate information and choices where required.

You may be able to manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

We do not authorise advertising technologies to collect or receive identifiable patient health information for targeted advertising.

**[Confirm the actual cookies, analytics tools, scripts and third-party integrations operating on the published website.]**

## 11. Marketing Communications

Where permitted by law, we may send information about Celluscripts services, news or updates.

We will comply with applicable direct marketing requirements, including the Privacy Act and Spam Act 2003 (Cth).

Where consent is required, we will obtain it before sending marketing communications.

You may unsubscribe from marketing emails using the unsubscribe link provided or by contacting us.

We will not treat consent to the collection of health information, appointment booking or clinical care as automatic consent to marketing.

We will not use sensitive health information for direct marketing unless expressly permitted by law and supported by any required consent.

Essential appointment, administrative, safety and service-related communications may continue where appropriate.

## 12. Accessing Your Personal and Health Information

You may request access to personal information that we hold about you, including relevant health information.

Requests can be made using the contact details at the end of this policy.

We may take reasonable steps to verify your identity before providing access.

We will respond within a reasonable period and in accordance with applicable law.

In some circumstances, access may be refused or limited where permitted or required by law. If this occurs, we will generally provide an explanation and information about available complaint mechanisms, unless doing so would be unlawful or unreasonable.

Where clinical records are held by an independent treating practitioner or another healthcare provider, we may direct you to the appropriate record holder or assist with your request where reasonably practicable.

Any applicable access charges will be handled in accordance with relevant legal requirements.

## 13. Correcting Your Personal Information

We take reasonable steps to ensure that personal information we hold is accurate, up to date, complete, relevant and not misleading, having regard to the purposes for which it is used.

If you believe information held about you is inaccurate or incomplete, you may request a correction.

We will consider correction requests in accordance with applicable law.

Where appropriate, we may update records, add a clarification or annotation, or refer a request concerning clinical records to the relevant healthcare practitioner or record holder.

If we decline to make a requested correction, we will generally explain the reasons and applicable complaint options, and consider a request to associate a statement with the information.

## 14. Retention and Disposal of Information

We retain personal and health information for as long as reasonably necessary for the purposes for which it was collected, or as required by applicable laws and professional obligations.

Clinical record retention periods may differ depending on the relevant Australian state or territory, the patient's age, the type of record and the responsible healthcare provider.

Where information is no longer required for a lawful purpose, and retention is not otherwise required, we take reasonable steps to securely destroy or de-identify it.

Clinical records may need to be retained even after a patient stops using Celluscripts services or requests deletion.

We will assess requests for deletion in accordance with applicable legal and record-keeping obligations.

## 15. Data Breaches and Security Incidents

We maintain processes for identifying, assessing and responding to suspected privacy and information security incidents.

Where an incident involves personal information, we will assess the circumstances and take appropriate steps to contain the incident, reduce potential harm and investigate its cause.

Where the Notifiable Data Breaches scheme applies and an eligible data breach occurs, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

We may also be subject to other applicable health information, contractual or regulatory notification obligations.

If you suspect that your information has been compromised, please contact us using the details below.

## 16. Anonymous and Pseudonymous Enquiries

Where practicable and lawful, you may be able to make a general enquiry without identifying yourself or by using a pseudonym.

However, identity information will ordinarily be required to arrange or participate in healthcare consultations, maintain appropriate clinical records and meet applicable legal obligations.

We will explain where identifying information is necessary for the relevant service.

## 17. Children and Young People

Healthcare services involving children and young people require particular care in relation to privacy, consent and decision-making capacity.

Where services are available to minors, the collection, use and disclosure of their personal information will be managed in accordance with applicable laws and the clinical circumstances.

Depending on the circumstances, consent may need to be obtained from a parent or legal guardian, or from a young person who has the legal capacity to make the relevant decision.

**[Confirm whether Celluscripts accepts patients under 18 and document the applicable eligibility, consent and safeguarding procedures.]**

## 18. Third-Party Websites and External Links

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices of independent third-party websites that we do not control.

We encourage you to review the privacy policies of any external services you choose to access.

Where third-party services are used to facilitate healthcare, we will provide relevant information about those arrangements where required.

## 19. Complaints and Privacy Concerns

If you have a question, concern or complaint about how Celluscripts has handled your personal information, please contact us.

**Privacy Contact**

Celluscripts  
Legal entity: [Legal entity name]  
Email: [Privacy contact email]  
Phone: [Business phone number]  
Location: [City, State, Australia]

Please include sufficient details for us to understand your concern and investigate it.

We will acknowledge and assess privacy complaints within a reasonable period, investigate relevant circumstances and communicate the outcome.

If you are dissatisfied with our response, or believe your privacy concern has not been appropriately resolved, you may be entitled to complain to the **Office of the Australian Information Commissioner (OAIC)**.

**Office of the Australian Information Commissioner**

Website: https://www.oaic.gov.au  
Phone: 1300 363 992

The OAIC generally expects individuals to raise their privacy complaint with the relevant organisation first and allow an opportunity for it to respond.

You may also have rights under applicable state or territory health privacy laws, including the ability to contact a relevant health complaints or privacy authority.

## 20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, information handling practices or legal obligations.

The current version will be published on our website with its last updated date.

Where a change materially affects how personal information is handled, we will take additional steps to notify affected individuals or obtain consent where required by law.

We encourage you to review this policy periodically.

## 21. Contact Us

For privacy enquiries, requests to access or correct personal information, or complaints about how your information is handled, please contact:

**Celluscripts**

Legal entity: [Full registered legal entity name]  
ABN: [ABN]  
Email: [Privacy contact email]  
Phone: [Business contact number]  
Location: [City, State, Australia]  
Website: https://celluscripts-website.webflow.io/

Celluscripts operates as a telehealth service and does not offer in-person appointments at a physical clinic.