Privacy policy

The Trustee for Lid.Doc Trust & The Trustee for Sachha Projects Trust trading as LidMate ("LidMate", "we", "us", "our"), operates an Australian telehealth service for the assessment and treatment of hair loss.

We are a health service provider that holds health information. Under section 6D(4)(b) of the Privacy Act 1988 (Cth), the small business operator exemption does not apply to us. We are bound by the Australian Privacy Principles ("APPs") regardless of our turnover.

This policy explains how we handle personal information, and is published to meet our obligations under APP 1.

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (Schedule 1)
• Privacy Act 1988 (Cth), Part IIIC - the Notifiable Data Breaches scheme
• Health Records and Information Privacy Act 2002 (NSW) - for patients in New South Wales
• Health Records Act 2001 (Vic) - for patients in Victoria
• Health Records (Privacy and Access) Act 1997 (ACT) - for patients in the Australian Capital Territory
• Healthcare Identifiers Act 2010 (Cth) - where we use an Individual Healthcare Identifier
• Spam Act 2003 (Cth) and Do Not Call Register Act 2006 (Cth) - for our marketing

We are an Australian service for patients in Australia. We do not provide services to patients in the United States.

Identity and contact information Your full name, date of birth, residential and delivery address, email address and mobile phone number.

Health information This is sensitive information under the Privacy Act and attracts stronger protection than ordinary personal information. It includes: your responses to our intake questionnaire; your medical history, current medications, allergies and relevant family history; photographs of your scalp or hairline where you provide them; the clinical notes your treating practitioner makes during and after your consultation; prescriptions issued to you; and any messages you exchange with your practitioner.

Payment information Your subscription plan, billing history and the last four digits and expiry of your card. We do not store your full card number. Card details are captured and stored by our payment processor, Stripe, which is PCI-DSS compliant.

Technical information Your IP address, device and browser type, and how you use our website, collected through cookies and analytics tools. See section 14.

We collect information directly from you wherever possible - through your account registration, your intake questionnaire, your consultation with a practitioner, and your messages to us.

We may also collect information from third parties, including: the practitioner who treats you (their clinical notes); the pharmacy that dispenses your medicine (dispensing records); and our delivery partner (delivery confirmation). Where we collect information about you from someone other than you, we will tell you, unless it would be unreasonable or impracticable to do so.

We do not buy personal information or collect it from data brokers.

We collect, hold, use and disclose your information to:

• assess your suitability for treatment and provide you with clinical care;
• allow a registered medical practitioner to consult with you, diagnose you and, where clinically appropriate, prescribe for you;
• transmit your prescription to a pharmacy for dispensing and arrange delivery of your medicine to you;
• verify your identity and confirm you are eligible to use the service;
• process your payments and manage your subscription;
• contact you about your treatment, including reminders, review consultations and safety information;
• respond to your questions and complaints;
• maintain and secure our systems, and improve our service;
• report adverse events to the Therapeutic Goods Administration where required; and
• comply with our legal obligations, including record-keeping obligations and lawful requests from regulators, courts and law enforcement.

Consent to collect health information. Under APP 3.3 we may only collect health information about you with your consent (or where the collection is required or authorised by law). You give that consent when you complete our intake questionnaire and agree to our terms. You may withdraw it at any time - see section 7.

We disclose your information only to those who need it to deliver your care or run the service:

• Your treating practitioner - your full clinical record.
• The dispensing pharmacy
• Delivery partner: AusPost
• Payment processor: Stripe
• Our IT and hosting providers
• Our clinical software provider

We do not sell your personal information. We do not disclose your health information to advertisers, data brokers, or social media platforms, and we do not use it to target advertising to you.

We may also disclose your information where we are required or authorised by law to do so, where necessary to lessen or prevent a serious threat to life, health or safety, or to our professional advisers and insurers.

You may withdraw your consent to our collection, use or disclosure of your health information at any time by emailing hello@mail.lidmate.com.au.

If you withdraw consent we will stop using your information for the purposes you have withdrawn, and we will tell you what that means for your treatment.

Withdrawing consent does not require us to delete your clinical record. We are required by law to retain clinical records for minimum periods - see section 11.

Under APP 8, if we disclose your personal information to a recipient outside Australia, we must take reasonable steps to ensure the recipient does not breach the APPs, and in most cases we remain accountable for what that recipient does with your information.

Where your information is stored. Your personal and health information is stored and processed in the United States by our platform provider, Go High Level.

Before disclosing your information to an overseas recipient we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. Those steps include written contractual obligations requiring the provider to handle your information in accordance with the APPs, restrictions on use and further disclosure, security and encryption requirements, and obligations to notify us of any suspected data breach.

Our platform provider maintains HIPAA-compliant security controls. We remain responsible to you for how your information is handled, whether it is held in Australia or overseas.

In exceptional cases we may ask you to consent to an overseas disclosure where APP 8.1 does not apply. If you give that consent, you acknowledge that the overseas recipient may not be bound by the Australian Privacy Principles and that you may not be able to seek redress under the Privacy Act.

We will only use your health information to send you marketing material if you have expressly consented to that, separately from your consent to treatment. Consent to treatment is never bundled with consent to marketing.

We may use your name and contact details to send you marketing about our services. Every marketing message includes an unsubscribe facility, and we will action an unsubscribe request promptly, as required by the Spam Act 2003 (Cth). You can also opt out at any time by emailing hello@mail.lidmate.com.au.

Where we contact you by telephone for marketing purposes, we will do so between 9am and 8pm AEST on business days.

Messages about your treatment, refill reminders, review consultation prompts, safety notices and dispatch confirmations, are service messages, not marketing, and you will continue to receive them while you are a patient.

We hold your information in secure systems and take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. That includes encryption, access controls that limit information to the people who need it to provide your care, and written privacy and security obligations on our staff, our practitioners and our service providers. We securely destroy or de-identify information we no longer need.

We keep clinical records for at least seven years from the date of the last entry, or where the patient was under 18 at that time, until they turn 25 - the retention periods required by Australian health records law. We then securely destroy or permanently de-identify them, unless we are required to keep them longer.

Other information, such as marketing contact details, is deleted when it is no longer needed or when you ask us to delete it.

We maintain a data breach response plan. If an eligible data breach occurs, one likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Privacy Act 1988 (Cth).

You have the right to ask for a copy of the personal and health information we hold about you (APP 12), and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13). Patients in NSW, Victoria and the ACT have equivalent rights under State legislation.

To make a request, email hello@mail.lidmate.com.au. We will:

• acknowledge your request within 7 days;
• respond within 30 days;
• verify your identity before releasing anything; and
• give you the information in the format you ask for where reasonable.

We do not charge for making a request. We may charge a reasonable, non-excessive fee for the cost of providing access - we will tell you the amount before we do the work.

We can refuse access in limited circumstances set out in APP 12.3, for example where giving access would pose a serious threat to the life, health or safety of any person, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to complain.

Our website uses cookies, pixels and similar technologies to keep you signed in, remember your preferences, understand how the site is used, and measure our advertising.

What this means in practice. Information sent to advertising and analytics platforms is not only technical data. Depending on which pages you visit, it can indicate that you browsed pages about hair loss, or how far you progressed through our medical questionnaire.

We use this to measure which advertising leads to sign-ups, and to show you relevant advertising on third-party platforms, including through retargeting and audience matching using hashed identifiers.

Where required, we will obtain your consent before placing non-essential cookies. You can manage cookies through your browser settings, and you can adjust ad preferences directly with Google, Meta and TikTok through your account settings on those platforms. Blocking some cookies may stop parts of our site working.

If a practitioner or a member of our team forms a professional view that you may be at imminent risk of serious harm, we may disclose relevant information to emergency services or another appropriate party in order to request a welfare check or urgent assistance.

We would do this only where necessary to lessen or prevent a serious threat to your life, health or safety, as permitted under APP 6.2(c).

If you think we have breached the Australian Privacy Principles or mishandled your information, please tell us first so we can fix it.

Step 1 - Complain to us at hello@mail.lidmate.com.au or write to 104/135-137 Macquarie St, Sydney, 2000 NSW, marked to the attention of the Privacy Officer. We will acknowledge your complaint within 7 days and respond within 30 days.

Step 2 - Escalate. If you are not satisfied with our response, you can complain to:

• Office of the Australian Information Commissioner - 1300 363 992, oaic.gov.au, GPO Box 5218 Sydney NSW 2001
• NSW patients: Information and Privacy Commission NSW - 1800 472 679, ipc.nsw.gov.au
• Victorian patients: Health Complaints Commissioner (Vic) - 1300 582 113, hcc.vic.gov.au
• ACT patients: ACT Human Rights Commission - (02) 6205 2222, hrc.act.gov.au

Complaints about the conduct of a registered health practitioner can be made to the Australian Health Practitioner Regulation Agency (Ahpra) at 1300 419 495 or ahpra.gov.au, or in NSW to the Health Care Complaints Commission at 1800 043 159.

We may update this policy from time to time. The current version is always available at www.lidmate.com.au/privacypolicy. If we make a change that materially affects how we handle your information, we will notify you by email before it takes effect.