Privacy Policy & Collection Notice

01Collection notice

Under Australian Privacy Principle 5, Cloud9 Peak Health Pty Ltd (“Cloud9”) collects personal and health information to provide telehealth care.

02What we collect

We collect only what we need.

Personal & identity information

• Name, date of birth, gender and contact details.
• Medicare or healthcare identifiers where relevant.
• Account and authentication details.

Health & sensitive information

• Biomarker and pathology results.
• Medical history, symptoms, medications, allergies and family history.
• Consultation notes, correspondence and care plans.
• Assessment and intake responses.

Technical information

• Device, browser and security logs.
• Essential cookie data. We do not use advertising or tracking cookies.

03How we use it

We use information to:

• Provide consultations, diagnostics and plans.
• Coordinate pathology, prescriptions and referrals.
• Manage appointments, results and membership.
• Maintain required clinical records.
• Secure and improve the service.

We do not sell personal information or use health information for advertising.

04When we disclose it

We disclose information only for care or where authorised by law, including to:

• Your care team.
• Accredited pathology and diagnostic partners.
• Pharmacies you nominate.
• Other treating practitioners with your consent.
• Regulators, courts or authorities where authorised by law.

05Data location

Cloud9's production Supabase database, authentication service and object storage are deployed in the Sydney, Australia region. Some operational metadata, support, security and service-provider processing may occur outside Australia and is assessed separately.

06Overseas processors

Support providers may process limited data overseas. Under Australian Privacy Principle 8, we:

• Share only what the provider needs.
• Require contractual handling consistent with the APPs.
• Avoid offshore health-data processing where practicable.

Our current database processor is Supabase Pte. Ltd. Supabase and its approved subprocessors may operate from Australia and overseas, including Singapore and the United States. We maintain a vendor register, subscribe to subprocessor changes and assess the categories of information each service can access before enabling it.

07Security & retention

We use encryption, role-based access, audit logs and regular security reviews to protect information from misuse, loss and unauthorised access.

We retain clinical records as required by Australian and state laws, then securely destroy or de-identify information no longer needed.

08Your rights

Under the Privacy Act and APPs, you can:

• Access information we hold about you.
• Correct inaccurate, outdated or incomplete information.
• Copy records for another practitioner.
• Withdraw consent for optional processing.
• Ask how information was handled or disclosed.

We respond within a reasonable period and explain any refusal.

09Complaints

Contact our Privacy Officer if you believe we mishandled information. If unresolved, complain to the Office of the Australian Information Commissioner at oaic.gov.au.