Privacy Policy – Myleaf Pty Ltd

Introduction
Myleaf Pty Ltd (“we”, “us”, or “our”) is committed to protecting your privacy and the confidentiality of your personal information, in accordance with the Privacy Act 1988 (Cth), Australian Privacy Principles (APPs), the National Safety and Quality Health Service (NSQHS) Standards, Australian Digital Health Agency (ADHA) guidelines, and the United States Health Insurance Portability and Accountability Act (HIPAA) to the extent applicable.

What is “personal information”?
“Personal information” is information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined by the Privacy Act 1988 (Cth), whether the information is true or not, or recorded in material form or not. This policy covers health information and sensitive information such as medical records, prescriptions, government-issued identification, and information collected via telehealth and pharmacy services.

What information do we collect?
The types of personal information we may collect include:

• Contact and identification details

• Personal medical history

• Prescription and pharmacy records

• Credit card and payment information

• Username, email address and login credentials

• Information required for compliance with federal and state agencies (including ID verification)

• Telehealth consultation details

How do we collect your personal information?
We collect personal information directly from you via:

• Website forms and online registration

• In-person or telehealth consultations

• Secure electronic ID verification with federal government systems, especially for telehealth

• Pharmacy and prescription workflows with our partner pharmacies

We may also collect cookies from your device to improve your website experience; these generally do not personally identify you.

Purpose of collection
We collect your personal information to:

• Deliver safe, high-quality clinical, pharmacy, and telehealth services

• Comply with federal, state, and regulatory requirements (including mandatory reporting and ID verification)

• Monitor and report medicinal cannabis prescriptions and patient management

• Fulfil our obligations under the NSQHS, ADHA, and HIPAA standards (where required)

• Communicate with you about our services and provide marketing material you would reasonably expect (with a clear opt-out)

• Improve service quality and patient outcomes

Data sharing with government departments and partner pharmacies
As a regulated healthcare provider, we may share your personal information with the following parties where required by law or for patient care:

• Commonwealth and State/Territory government agencies such as the Department of Health, Queensland Health, and the Australian Digital Health Agency, for statutory reporting, identity verification, regulation, and monitoring the supply of medicinal cannabis and prescribed medicines.

• Partner pharmacies: We may share relevant personal and prescription information with trusted partner pharmacies solely for the purpose of dispensing medications, including medicinal cannabis or other treatments. Partner pharmacies are required to comply with strict privacy, confidentiality, and security standards as outlined by Australian law and, where relevant, HIPAA, NSQHS, and ADHA guidelines.

All sharing of information is performed securely and limited to what is necessary for your care and compliance. We do not sell your information or use it for commercial gain unrelated to your treatment, except as required or permitted by law. All data is securely stored and retained on servers physically located in Australia.

Identity verification and telehealth
For telehealth services, we use secure electronic ID verification with federal government systems to confirm patient identities, ensure safety, and meet regulatory obligations.

Data storage and security
Your personal information is stored securely on-shore within Australia, using industry-standard safeguards, in compliance with the Privacy Act 1988 (Cth), NSQHS, ADHA, and HIPAA as applicable.

Direct marketing
We use your personal information for direct marketing (such as service updates) only with your consent, and include an easy way to opt out. We never use sensitive health details for marketing purposes.

Access and correction
You have the right to request access to or correction of your personal information, subject to identity verification and applicable laws.

Complaints
If you have concerns about the privacy of your information, please contact us. If your concern is not addressed, you may escalate the matter to the Office of the Australian Information Commissioner or relevant health regulators.

Overseas disclosure
We do not share your personal information with overseas recipients unless you explicitly request this in writing. Overseas recipients may not be subject to Australian privacy laws.

Contact us
For privacy queries, access requests, or complaints, please contact:
[email protected]