HIGHR®

Data & Privacy Policy
DRAFT v0.2 | 13 August 2026 | Incorporates compliance review + entity restructure |

1. About this policy

HIGHR is operated by two related Australian companies. Eterna Health Services Pty Ltd (ABN 52 698 519 381) operates the HIGHR platform and provides administrative, technology, account, payment and customer-support services. Eterna Medical Pty Ltd (ABN 73 698 520 642) provides the clinical services offered through HIGHR and is responsible for the clinical records held in our practice-management system. In this policy, ‘HIGHR’, ‘we’, ‘us’ and ‘our’ mean one or both entities, depending on the activity described — you do not need to work out which entity holds particular information; we coordinate privacy requests between them. We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which apply nationally to how we handle your information.

This policy explains how we collect, use, store and disclose your personal and health information.

Last updated: 14^th August 2026

2. What information we collect

Personal information

We collect information that identifies you, including:

• Full name, date of birth, and contact details (email, phone, residential address)
• Medicare card number and individual reference number
• Payment information processed through our payment processor

Sensitive health information

We collect health information essential to your treatment, including:

• Medical history, current medications, allergies
• Clinical questionnaire responses (health goals, lifestyle factors, symptoms)
• Pathology results (for Performance-pathway patients)
• Consultation notes and treatment plans prepared by your doctor
• Prescription and dispensing records

How we separate your data

HIGHR maintains a strict boundary between clinical and non-clinical data:

Your clinical notes, consultation records, pathology results and prescriptions are never used for marketing and are never stored in our patient relationship management system. Nominated health goals and HIGHR plan type are stored in that system for service purposes (such as appointments and account management) and are only used for marketing where you have given separate, specific consent, which you may withdraw at any time — see our Terms of Use.

3. Medicare details and patient identification

Eterna Medical may collect your Medicare and other entitlement details and retrieve your Individual Healthcare Identifier (IHI) to verify your identity, match your clinical record, and support electronic prescribing, claims and My Health Record transactions where applicable. A Medicare number is not the source of a doctor’s authority to prescribe, and Medicare enrolment does not by itself mean an IHI has been established. This is handled in accordance with the Healthcare Identifiers Act 2010 (Cth) and Australian Privacy Principle 9 (adoption, use or disclosure of government related identifiers).

To do this, we collect your Medicare card number, individual reference number and expiry date, together with your given name, surname, date of birth and sex, exactly as recorded with Medicare.

We ask you to provide these details exactly as they appear on your Medicare card. Inaccurate details may prevent us from confirming your IHI, which may delay or prevent your prescription being issued.

Your Medicare details are held by Eterna Medical in our clinical records system and are never passed to our patient relationship management system (see the data separation table in section 2).

4. How we collect your information

We collect information directly from you when you:

• Complete our online health questionnaire
• Book a consultation
• Attend a telehealth consultation with your doctor
• Make a payment through our website
• Contact us via email, phone, or our website

We may also collect information from third parties with your consent, including:

• Pathology providers (your blood test results)
• Your nominated GP or other healthcare providers
• My Health Record, where you have authorised access

We strive to collect information directly from you. Where this is not practicable, we will seek your consent before collecting information from third parties.

You may choose to remain anonymous or use a pseudonym when interacting with us. However, we may not be able to provide clinical services without verified identity.

5. How we use your information

We use your information to:

• Assess your eligibility for our services
• Provide telehealth consultations and clinical care
• Generate prescriptions and refer you for pathology testing
• Process payments and manage your treatment subscription
• Dispense and deliver prescribed medications through our partner pharmacy
• Communicate with you about your treatment, appointments and account
• Where you have given separate, specific consent, personalise marketing communications using your nominated health goals or HIGHR plan type
• Comply with our legal and regulatory obligations

We will only use your information for the purpose for which it was collected, or a directly related purpose you would reasonably expect.

6. Who we share your information with

To provide your care, we may share your information with:

Your clinical data is only shared with your treating doctor, pathology provider, and pharmacy — and only to the extent necessary for your care. We do not sell or rent your information to any third party.

7. Overseas disclosure

Some of the third-party service providers we use to run HIGHR may store or process personal information outside Australia — for example, on servers located in the United States, as part of standard global infrastructure for services such as payment processing. Where personal information is disclosed overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including by requiring contractual protections or relying on the recipient being subject to a substantially similar privacy law.

Our patient relationship management system, which holds non-clinical contact and communication data, currently stores this information in Australia. If this changes, we will update this policy.

Your clinical information is never disclosed overseas — it is held by Eterna Medical in our clinical records system, hosted in Australia (see section 2).

8. Data storage and security

Your information is stored on secure servers, primarily located in Australia. Certain information may be processed overseas by third-party service providers, as described in section 7. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.

Our technology infrastructure includes:

• Access to systems based on role and business need
• Unique user accounts and multi-factor authentication
• Encryption in transit and, where appropriate, at rest
• Logging and monitoring of access, vendor due diligence, and regular security reviews with tested backups

9. Data breach notification

If we experience a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

We maintain internal procedures to detect, assess, contain and respond to data breaches, including breaches affecting our third-party service providers.

10. Data retention

We retain your information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Clinical records (consultation notes, prescriptions, pathology results): retained for a minimum of 7 years from your last consultation, or until you turn 25 if you were a minor at the time of treatment, whichever is later. Where you are located in Victoria or New South Wales, this minimum is required under the Health Records Act 2001 (Vic) or the Health Records and Information Privacy Act 2002 (NSW). In other states and territories, we apply this as our minimum retention standard under the Privacy Act 1988 (Cth) and Australian medical indemnity industry practice
• Account and billing information: retained for 7 years in accordance with Australian tax and corporate records requirements
• Non-clinical account data (contact details, preferences, communications history): retained for 2 years after your account is closed, unless a longer period is required by law
• Website analytics and cookies data: retained in accordance with our cookie settings; you may clear cookies at any time through your browser
• Marketing contact data: retained for as long as you remain subscribed to our marketing communications; if you unsubscribe, we retain your email address on a suppression list only, to honour your opt-out
• Quiz responses where you do not go on to become a patient: retained for no longer than 3 years from collection, after which they are deleted or de-identified

When information is no longer required, we take reasonable steps to destroy or de-identify it securely.

11. Accessing and correcting your information

You have the right to:

• Request access to the personal and health information we hold about you
• Request correction of any inaccurate or incomplete information
• Request deletion of your information where we are not required by law to retain it

To make a request, contact our Privacy Officer at care@highr.health.

We will respond to your request within a reasonable timeframe, typically within 30 days.

12. Complaints

If you believe we have breached your privacy rights, please contact us at care@highr.health. We take privacy complaints seriously and will investigate and respond promptly.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

13. Cookies and website data

Our website uses cookies and similar technologies to improve your experience and understand how our site is used. You can control cookie preferences through your browser settings.

We use analytics tools to understand website usage patterns. Where we use tracking technologies (such as pixels) that could reveal your interest in a specific health service, we will seek your consent before this occurs and will not use that information for targeted advertising without your consent, consistent with the Australian Privacy Principles.

14. Use of artificial intelligence

HIGHR’s doctors do not currently use artificial intelligence tools (such as AI scribes or note-taking software) during consultations. If we introduce these tools in future, we will tell you before your consultation and explain how the tool is used, consistent with AHPRA’s telehealth guidance.

15. Automated decision-making

Our online health questionnaire uses automated logic to help assess your eligibility for certain treatment pathways based on your responses. Automated logic is not used to issue prescriptions or make final clinical decisions — these are always made by your treating doctor.

We are reviewing this process ahead of the Privacy Act’s automated decision-making transparency requirements, which commence on 10 December 2026, and will update this policy with further detail before that date.

16. Changes to this policy

We may update this policy from time to time. The current version will always be available on our website. We will notify you of material changes.

Contact: care@highr.health
Entities: Eterna Health Services Pty Ltd, ABN 52 698 519 381, and Eterna Medical Pty Ltd, ABN 73 698 520 642
Last updated: 14^th August 2026