Privacy Policy

Privacy Policy

1. Introduction

Inmunotek Australia is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, and store personal information when supplying pharmaceutical products or medical devices to approved clinics, hospitals, pharmacies, wholesalers, and healthcare providers.

2. Scope of this Policy

This policy applies to personal information collected through:

• Our website and ordering platform
• Customer accounts (clinics, hospitals, healthcare providers, pharmacies, and wholesalers)
• Communications with customers, suppliers, and patients

We do not dispense products directly to patients or the general public.

3. Types of Personal Information We Collect

3.1 Customer (Healthcare Provider) Information

We may collect and store:

• • • Name, title, and contact details
    • Clinic and/or hospital details including address
    • Professional credentials including AHPRA number for account verification
    • Account login details
      
      

3.2 Patient Information (Provided by Healthcare Providers)

In fulfilling orders, we may collect and store personal and health information including:

• • • Patient name
    • Date of birth
    • Shipping and billing address
    • Contact information such as: email address and phone number
    • Prescribed medication and treatment information
      
      

Under division 1 of the Privacy act 1988 (Cth), identifiable information is classified as ‘personal information’, and health information is classified as 'sensitive information’.

4. How We Collect Personal Information

We collect information:

• Directly from healthcare providers placing orders
• Through our online ordering system
• Via email, phone, or other communications
• Promotional activities such as but not limited to: forms and invitations, meetings, conference activities

We do not collect personal information directly from patients unless required for purposes of processing an order, accounts reconciliation, complaints, reporting adverse events, or requests to amend information on file.

Where patient information is provided to us by a healthcare provider, we rely on that provider to ensure the patient has been informed about the disclosure and has provided any required consent.

5. Purpose of Collection

We collect and use personal information for the following purposes:

• Processing and fulfilling medication orders including billing and payments. This includes communication of relevant updates in relation to their order, including supply disruption.
• Verifying orders and lawful supply
• Delivering products to clinics and hospitals
• Maintaining account records and transaction history
• Regulatory compliance (e.g. pharmacovigilance, audit, legal obligations)
• Customer support and service improvement
• Promotional activities limited to Hospitals, clinics, healthcare providers
• Dissemination of information including but not limited to: business updates, clinical trials, regulatory notifications, changes to operating procedures
• De-identified patient information for aggregated data analytics to improve our service offering, customer service, or corporate objectives.
• We only collect personal information that is reasonably necessary for these purposes.

We may also use personal information for internal training, quality assurance, auditing, and system improvement purposes, provided such use is consistent with the original purpose of collection.

6. Disclosure of Personal Information

We may disclose personal information to:

• Logistics and delivery providers (for order fulfilment)
• Warehousing and distribution partners
• Our manufacturing facility
• Regulatory & legal authorities where required (e.g. TGA, state health authorities)
• Professional advisers if required (legal, compliance, audit)
• IT service providers contracted by us to maintain and service our IT infrastructure
• De-identified, aggregated data for use in educational, or promotional activities

We do not sell or rent personal information to third party organisations.

7. Overseas Disclosure

Some of our service providers (e.g. servers, cloud hosting, IT systems) and staff may be located overseas.

Our head office and manufacturing facility is located in Spain and abides by Spanish and European privacy regulations such as the General Data Protection Regulation (GDPR).

8. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure, including:

• Secure servers and data encryption
• Access controls and authentication
• Staff confidentiality obligations
• Staff training for secure handling of health and financial information
• Confidentiality agreements as required for contractors and third parties providing services to improve our product offering

We can not guarantee the security of, nor be held liable for theft of information during transmission over the internet.

In the event of a data breach involving personal information, we will take immediate steps to contain the breach, assess the impact, and comply with the Notifiable Data Breaches (NDB) Scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

9. Data Retention

We retain personal information only as long as necessary to:

• Fulfil the purposes outlined in this policy
• Meet legal, financial, and regulatory obligations (e.g. record-keeping requirements)

When no longer required, information is archived, securely destroyed or de-identified.

10. Access and Correction

Individuals may request access to, correction, or deletion of their personal information by contacting us, provided these actions do not contravene Section 9.

We will respond within a reasonable timeframe.

11. Complaints

If you believe we have breached the Australian Privacy Principles, you may contact us.

We will investigate and respond promptly.

If you are not satisfied with our response, you may contact the
Office of the Australian Information Commissioner (OAIC).

Website: www.oaic.gov.au Phone: 1300 363 992 Email: enquiries@oaic.gov.au Mail: GPO Box 5218, Sydney NSW 2001

12. Cookies and Website Data

Our website may use cookies and analytics tools to improve functionality and user experience.

Users may adjust their browser settings to refuse cookies; however, this may impact website performance.

13. Changes to this Policy

We may update this Privacy Policy from time to time.

The latest version will always be available on our website.

14. Contact Us

General enquiries: info@inmunotek.com.au

Privacy officer: privacyofficer@inmunotek.com.au

Safety and adverse events: safety@inmunotek.com.au

Phone: 1300 706 908

Inmunotek Australia Pty Ltd

L13/99 Walker st, North Sydney. NSW 2060

Date of Preparation: April 2026

Document Number: 1.0