Privacy Policy

Anova Health Services Pty Ltd (ACN 700 589 439) (Anova, we, us) contact@anovahealth.com.au

Last updated: 11 August 2026

Anova provides a clinician-led weight-management program through our website and the Anova Health app. We handle health information and other personal information in providing that service.

Anova is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) as a private-sector health service provider that holds health information. Health information handled in Victoria may also be subject to the Health Records Act 2001 (Vic) and the Victorian Health Privacy Principles.

This policy explains the kinds of information we collect and hold, how we collect and use it, who we disclose it to, where it is processed, how long we keep it, and how you can exercise your privacy rights.

1. Information we collect and hold

Account and profile information

We may collect your name, email address, account credentials, timezone and other information needed to create and secure your account. Where relevant to app features or your care, this may include your date of birth, sex and height.

Health and program information

We may collect health information you or your care team enter into Anova, including weigh-ins, symptoms, injection logs, medication and dose information, treatment-plan information, appointments, blood-test results you upload, behavioural-program responses, wellbeing check-ins and questions or messages you send to the care team.

Health information is sensitive information under Australian privacy law. We collect it only where it is reasonably necessary for our functions and activities and with your consent or as otherwise permitted or required by law.

Device-health information

If you choose to connect Apple Health, Health Connect or another supported health-data export tool, we receive only supported data types you authorise the service to share, such as weight, steps, sleep, heart rate or exercise information.

Device-health sharing is optional. You can change or withdraw device permissions through the relevant device settings. Anova does not write information back to your phone’s health store.

Administrative and practice-management information

We may collect or hold referral, appointment, billing and invoicing information needed to administer your program. Halaxy is used for practice-management functions including referral intake, patient and appointment synchronisation and invoicing. The Anova app does not read clinical resources from Halaxy as part of the current integration design.

Technical and security information

When you use the website or app, our systems and service providers may generate limited technical information needed to operate and secure the service, such as request times and status, IP or network information, basic device or app information, authentication events and security logs. We do not use advertising trackers or analytics to build advertising profiles about patients.

2. How we collect information

We collect information:

• directly from you when you register, complete forms, upload information, enter measurements, connect a device-health service or contact the care team;
• from Anova clinicians and care-team members when they enter information needed to support your program;
• from connected device-health services when you have authorised access; and
• from service providers such as Halaxy where limited administrative, referral or appointment information is needed for the service.

At or before relevant collections, we provide privacy information and seek consent where the law requires it. Optional device-health permissions are requested separately through the relevant device platform.

3. Why we use and disclose information

We use and disclose information where reasonably necessary to:

• provide, administer and personalise the Anova program;
• display your record and progress to you;
• support the work of your treating clinicians and care team;
• manage appointments, referrals, invoicing and program administration;
• operate safety features and route matters for human review;
• provide customer and technical support;
• secure, monitor, maintain and improve the service;
• meet legal, regulatory, clinical-governance and record-keeping obligations; and
• produce de-identified or aggregated information to evaluate and improve the program where individuals are no longer reasonably identifiable.

We do not sell personal information. We do not disclose health information to advertisers or use health information for advertising or marketing.

4. AI-generated summaries and automated safety rules

During the current trial, the app’s labelled “Today’s read-out” may use an artificial-intelligence model to summarise recent information in your Anova record, such as a recent weigh-in or device-health measures you have chosen to share.

The AI workload runs on Amazon Web Services infrastructure configured in Sydney, Australia. Anova does not permit patient information submitted for this feature to be used to train the AI model used by Anova. Each generation is logged for safety and audit purposes.

AI-generated summaries are general supportive information. They do not diagnose, prescribe, recommend a dose or replace a clinician, and they may contain errors or omit relevant context.

The app may also apply automated safety rules to information in your record to determine whether certain behavioural content or an AI-generated summary should be displayed and whether a matter should be routed to a person for review. Those rules do not independently determine whether you may receive healthcare and do not make prescribing or dosing decisions. Clinical decisions remain with appropriately qualified clinicians.

5. Who we disclose information to

We may disclose personal or health information to the following recipients where reasonably necessary for the purposes described above:

• your treating clinicians and authorised members of the Anova care team;
• Supabase, which hosts Anova’s primary app database in Sydney;
• Amazon Web Services (AWS), which provides the Sydney-region infrastructure used for the current AI inference feature;
• Cloudflare, which provides website/app delivery and security services;
• Halaxy, which provides practice-management functions including referrals, appointments and invoicing;
• your regular GP or another health provider where you have consented to coordinated care, or where disclosure is otherwise authorised or required by law; and
• regulators, courts, law-enforcement bodies or other persons where disclosure is required or authorised by law.

We require service providers handling personal information for us to use it only for authorised purposes and to protect it appropriately. We limit access to people and systems that need the information for their role.

6. Australia and overseas processing

Anova’s primary app database is hosted in Sydney, Australia. The current AI inference workload is also configured to run in Sydney.

Cloudflare operates a global delivery and security network. Depending on network routing and service configuration, limited technical or network traffic may be processed outside Australia. Because routing can vary dynamically, it is not practicable to list every country through which such traffic may be processed.

Where Anova discloses personal information to an overseas recipient, we take reasonable steps required by Australian privacy law to ensure the information is appropriately protected. If our material overseas-disclosure practices change, we will update this policy.

7. Security

We use technical and organisational safeguards designed to protect personal and health information against misuse, interference, loss and unauthorised access, modification or disclosure.

For the primary app database, information is encrypted in transit and at rest and row-level access controls are used to restrict account access. We also use role-based access, authentication controls and audit/security logging appropriate to the service.

No online system can be guaranteed to be completely secure. If you believe your account or information may have been compromised, contact us promptly at contact@anovahealth.com.au.

8. Retention and account deletion

You can initiate deletion of your Anova app account from within the app. We will close the account and delete information that we are not legally required or otherwise permitted to retain.

Because Anova is a health service provider, deleting an app account does not necessarily mean that all health information can be destroyed immediately. Health information collected in providing your health service may need to be retained for the period required by health-record law. For adult patients in Victoria, this is generally at least seven years after the last health service is provided. This can include relevant health information held in the app as well as records held in the clinical/practice-management record.

Information retained for legal, clinical, security or dispute-resolution purposes is access-restricted and is not kept in the active account merely so that Anova can continue to use it. When information is no longer required to be retained and there is no lawful reason to keep it, we take reasonable steps to securely destroy it or permanently de-identify it as appropriate.

The account-deletion screen explains, before you confirm deletion, that legally required health records may be retained.

9. Access, correction and transfer

You can view and update some information in the app. You may also contact us to request access to personal or health information we hold about you or to ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We may need to verify your identity before acting on a request. We will respond within the time required by applicable law and will explain any lawful reason for refusing or limiting access or correction.

Where applicable health-record law gives you the right to have health information made available to another health service provider, you may ask us to facilitate that transfer.

10. Withdrawing consent and changing choices

You may withdraw an optional consent or permission at any time, including device-health permissions, subject to the settings and functionality of the relevant platform.

Withdrawal does not affect handling that was lawful before withdrawal and does not require us to destroy information that we must or are permitted to retain by law. If a particular item of health information is necessary to provide a requested service, withdrawing consent to that collection may mean we cannot provide that part of the service safely or at all. We will explain the consequence where relevant.

11. Privacy complaints

If you have a privacy question or complaint, contact us at contact@anovahealth.com.au. Please describe the issue and provide enough information for us to investigate it. We will acknowledge and investigate privacy complaints and aim to provide a substantive response within 30 days.

If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. For matters concerning Victorian health information, you may also be able to complain to the Health Complaints Commissioner (Victoria) at hcc.vic.gov.au.

12. Data breaches

Anova maintains processes for identifying, containing, assessing and responding to suspected data breaches. If an eligible data breach occurs under the Privacy Act 1988 (Cth), we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.

13. Changes to this policy

We may update this policy when our service, technology, legal obligations or information-handling practices change. If a change is material, we will take reasonable steps to notify affected users through the app, website or another appropriate channel before or when the change takes effect.

The current version will be available through the Anova website and app.