Privacy Policy

Effective: May 2026

1. About this policy

Anova Health Services Pty Ltd (Anova, we, us, our) respects your privacy. This policy explains how we handle personal information when you visit our website at anovahealth.com.au, join our waitlist, complete an enquiry form, or otherwise interact with us.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set out in that Act. As a health service provider, we are bound by the Privacy Act regardless of our annual turnover.

We are also bound by relevant State and Territory health privacy laws where they apply to us, including the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW), and the Health Records (Privacy and Access) Act 1997 (ACT). Where State or Territory law imposes obligations in addition to the Privacy Act, we comply with those additional obligations.

This policy applies to information we collect through our website and pre-launch activities. Once Anova launches its clinical service, a separate Patient Privacy Notice will apply to clinical information we collect in providing care to you. That notice will be provided to you at the time you become a patient.

2. What information we collect

2.1 Information you give us

When you join our waitlist, complete an enquiry form, contact us about a GP partnership, or otherwise communicate with us, we may collect:

• Your name
• Your email address
• Your phone number (optional, where you provide it)
• Your state or territory of residence (optional, where you provide it)
• Your AHPRA registration details, if you contact us as a registered health practitioner
• Any other information you choose to include in messages to us

We do not currently collect health information through our website. Anova’s clinical service is not yet live. We do not ask for, and ask that you do not send us, information about your health, medications, conditions, weight, or other clinical matters through the website, contact forms, or email. If you do send us such information, we will delete it and ask you not to send further clinical detail until our clinical service is operating.

2.2 Information collected automatically

When you visit our website, we and our service providers automatically collect:

• Device and browser information (browser type, operating system, screen size)
• Internet protocol (IP) address and approximate location derived from it
• Pages you view, links you click, time spent on pages, and how you arrived at the site
• Cookies and similar technologies (see section 7)

We use this information to operate the site, understand how it is used, and improve the experience.

2.3 Information from third parties

We may receive information about you from third parties only where you have asked them to share it with us (for example, a referring GP) or where the law permits. We do not buy contact lists or marketing data.

3. Why we collect personal information

We collect personal information for the following purposes:

• To respond to your enquiry, including waitlist sign-up confirmation and updates about our service launch
• To send you the content you have asked to receive (for example, our newsletter, where you have opted in)
• To communicate with health practitioners who have expressed interest in partnering with Anova
• To operate, secure, and improve our website
• To comply with our legal obligations

We will not use your personal information for a purpose other than the one you provided it for, unless you consent or the law requires or permits it.

4. How we use and disclose your information

4.1 Use

We use your personal information for the purposes listed in section 3. We do not sell your personal information. We do not use your personal information for direct marketing of products or services other than Anova’s own service, and you can opt out of any direct marketing at any time using the unsubscribe link in our emails or by contacting us.

4.2 Disclosure

We disclose personal information only to:

• Service providers who help us operate our website, send our communications, and analyse site usage (for example, our website host, our email platform, and our analytics provider). These providers handle your information only for purposes we authorise.
• Our professional advisers (lawyers, accountants, auditors) where they need it to advise us, bound by professional confidentiality obligations.
• Government, regulatory, or law enforcement bodies where we are required or authorised by law to disclose information.
• A purchaser or successor of our business, in the event of a sale, merger, or restructure, subject to the same privacy commitments set out in this policy.

We do not disclose your personal information to advertisers or data brokers.

When Anova’s clinical service launches, we will disclose personal and health information to additional parties involved in your care (for example, treating practitioners, dispensing pharmacies, and any allied health providers you are referred to). The Patient Privacy Notice provided at the time you become a patient will set out the specific parties and purposes that apply to that disclosure.

5. Overseas storage and disclosure

Some of the service providers we use store data outside Australia, including in the United States and the European Union. At the date of this policy, the providers we use that may store data outside Australia include:

• Our website platform and hosting (United States and global edge locations)
• Our email and newsletter platform (likely United States)
• Our website analytics provider (likely United States)

We will update this list as our service providers change.

Your consent to overseas disclosure. By providing us with your personal information through our website, you consent to the disclosure of that information to overseas recipients of the kinds described above for the purposes set out in this policy. Where the law permits us to rely on your consent under Australian Privacy Principle 8, we may not be required to take steps to ensure the overseas recipient complies with the APPs in relation to that information, and you acknowledge that you may not be able to seek redress under the Privacy Act from the overseas recipient or from us in relation to any breach by the overseas recipient.

Where we do not rely on your consent, we take reasonable steps to ensure that any overseas recipient handles your personal information in a way consistent with the Australian Privacy Principles, including through contractual protections.

6. How we protect your information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These steps include:

• Storing information with reputable service providers that maintain industry-standard security practices
• Using encrypted connections (HTTPS) for all interactions with our website
• Limiting access to personal information to people who need it for their role
• Reviewing our security practices regularly and updating them as our service grows

No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your information. If you become aware of any security issue affecting your information, please contact us using the details in section 11.

If a data breach occurs that is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

7. Cookies and tracking

Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help us recognise you across pages, remember your preferences, and understand how the site is used.

Essential cookies. These are necessary for the site to function (for example, to remember your form responses while you complete a multi-step form). You cannot opt out of essential cookies.

Analytics cookies. These help us understand how visitors use the site so we can improve it. We use these to aggregate usage information; we do not use them to identify individual visitors. You can opt out of analytics cookies through your browser settings or, where offered, our cookie banner.

Most browsers let you refuse or delete cookies. Doing so may mean some parts of the website do not work as intended.

8. Your rights

Under the Privacy Act, you have the right to:

• Access the personal information we hold about you
• Ask us to correct information you believe is inaccurate, out of date, incomplete, or misleading
• Ask us to delete your information, subject to any legal obligations we have to retain it
• Withdraw your consent to receive our communications at any time
• Make a complaint about how we have handled your personal information (see section 10)

To exercise any of these rights, contact us using the details in section 11. We will respond within 30 days. We do not charge for access requests.

9. How long we keep your information

We keep personal information only as long as we need it for the purpose we collected it for, or as required by law.

• Waitlist and enquiry information: retained until you ask us to delete it, or for two years after our service launches and you have not become a patient, whichever is sooner
• Health practitioner contact information: retained while a partnership is being explored, and for the duration of any partnership we enter into
• Information we are required to keep by law: retained for the period the law requires (including, where applicable, health record retention periods under State legislation)

When we no longer need personal information, we delete it or de-identify it.

10. Complaints

If you believe we have breached your privacy or mishandled your personal information, please tell us first. Contact us using the details in section 11. We will acknowledge your complaint within seven days and respond substantively within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner GPO Box 5288, Sydney NSW 2001 Phone: 1300 363 992 Online: oaic.gov.au

You may also have a right to complain to the relevant State or Territory health privacy regulator (for example, the Health Complaints Commissioner in Victoria, or the Information and Privacy Commission in New South Wales) where State or Territory health privacy laws apply.

11. Contact us

Privacy queries, requests, and complaints can be sent to:

Privacy Officer Anova Health Services Pty Ltd Email: contact@anovahealth.com.au

12. Children and young people

Anova’s website and service are intended for adults. We do not knowingly collect personal information from people under 18. If you believe a person under 18 has provided us with personal information, please contact us so we can delete it.

From 10 December 2026, the Children’s Online Privacy Code will apply additional protections for the personal information of children. We will update this policy at that time to reflect those obligations.

13. Automated decisions

At the date of this policy, Anova does not use automated systems (including AI) to make decisions that significantly affect your rights or interests. From 10 December 2026, additional transparency obligations under the Privacy Act apply where automated decisions are used. If our use of automated systems changes, we will update this policy before the change takes effect and explain what information is used, what decisions are made, and how you can ask for a human review.

14. Changes to this policy

We may update this policy from time to time. The version date at the top of the policy shows when it was last updated. Material changes will be notified through our website or by email to people who have given us their email address.

Your continued use of our website after changes take effect indicates your acceptance of the updated policy.