Privacy Policy

Greenhouse Dispensary (Greenhouse, we, us, our) is a medicinal cannabis telehealth clinic that connects patients with independent AHPRA-registered medical practitioners and a TGA-licensed dispensary partner. Greenhouse Dispensary Pty Ltd (ACN 697 200 534) operates the Platform and coordinates the service; it does not itself provide medical advice or dispense medicines.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information, including the sensitive health information required to coordinate our services. It applies to information collected through the Greenhouse website, patient portal, mobile applications (together, the Platform), and through our coordination services (the Services).

Independent Practitioners and the Dispensary Partner have their own privacy obligations under the Privacy Act, AHPRA, and the Pharmacy Board of Australia.

Greenhouse handles your information in accordance with:

• the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs);
• state and territory health records legislation, including the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW), and equivalent legislation in other jurisdictions;
• the My Health Records Act 2012 (Cth), where relevant; and
• the professional, ethical and confidentiality obligations that apply to telehealth practice under AHPRA and the Medical Board of Australia.

By accessing or using the Platform, you acknowledge that your personal information will be collected, held, used and disclosed in the manner described in this Privacy Policy. Consent to the collection and use of your sensitive information (including health information) is obtained separately — typically during the intake and consultation process — as required by APP 3.3. You may withdraw consent to future uses of your sensitive information at any time by contacting us, subject to our professional record-keeping obligations.

1.1 Personal information

We collect the following categories of personal information:

• Identity information — name, date of birth, gender, Medicare number (where provided for telehealth rebate purposes), and identity documents where required for verification.
• Contact information — residential address, email address, mobile number.
• Financial information — tokenised payment information processed by our payment provider; we do not store full card numbers.
• Transaction information — purchase history, consultation bookings, shipping records.
• Technical and usage information — IP address, device identifiers, browser type, operating system, referring URLs, and interactions with the Platform.
• Profile information — patient preferences, communication preferences, and program selections.
• Interaction information — correspondence with patient support, survey responses, feedback.
• Marketing information — ongoing care status, engagement with marketing communications.
• Professional information — occupation and lifestyle indicators where relevant to clinical assessment.

1.2 Sensitive information (including health information)

Because Greenhouse coordinates telehealth consultations, we collect and hold sensitive information, including:

• health and medical history, current medications, allergies, and symptoms;
• pathology, diagnostic imaging and laboratory results;
• consultation notes prepared by the independent AHPRA-registered medical practitioner (Practitioner);
• family medical history, where clinically relevant;
• lifestyle, mental health and wellbeing indicators disclosed through intake questionnaires or consultations.

We treat sensitive information with a higher standard of protection, as required by APP 3 and APP 6.

We collect information:

• Directly from you — when you create an Account, complete intake questionnaires, communicate with patient support, book a consultation, or interact with the Platform;
• Through the Platform — automatically, through cookies and analytics tools (see section 9);
• From third parties — including Practitioners who consult through the Platform, pathology providers, our Dispensary Partner;
• From public sources — where required for identity verification or regulatory compliance.

We collect information by lawful and fair means, and only when it is reasonably necessary for our functions and activities.

3.1 Personal information — primary purposes

We use personal information to:

• operate and maintain the Platform and provide the Services;
• verify your identity and eligibility;
• coordinate telehealth consultations with Practitioners;
• coordinate pathology, diagnostics and product fulfilment;
• process payments and manage care plans;
• provide patient support and respond to enquiries;
• communicate with you about your Account, treatment and Services;
• send you service updates and, with your consent, marketing communications;
• comply with legal, regulatory and professional obligations;
• improve the Platform, our services, and patient experience.

3.2 Sensitive information — consent-based use

We collect, hold, use and disclose sensitive information only:

• with your consent, for the purposes of providing telehealth services, prescriptions and ongoing clinical care; or
• where otherwise permitted by the Privacy Act — for example, where required or authorised by law, where necessary to prevent a serious threat to life or health, or for permitted health research conducted in accordance with National Health and Medical Research Council (NHMRC) guidelines.

You may withdraw consent to future uses of your sensitive information at any time by contacting us, subject to our professional record-keeping obligations.

We disclose personal and, where relevant, sensitive information to the following categories of recipient, only to the extent reasonably necessary:

• Independent Practitioners who consult with you through the Platform;
• Pathology and diagnostic providers engaged to perform tests ordered by a Practitioner;
• Our Dispensary Partner and any additional dispensing pharmacies engaged to prepare and dispatch prescribed products;
• IT, hosting and infrastructure providers (including cloud hosting providers), subject to contractual confidentiality and security obligations;
• Payment processors, including Stripe, for the secure processing of payments;
• Marketing and communications vendors that assist us with transactional and marketing email, SMS and patient engagement;
• App store operators (Apple and Google), to the extent required for distribution of the Greenhouse mobile application;
• Professional advisers — including lawyers, auditors, accountants and insurers — under duties of confidentiality;
• Regulators, courts and law enforcement, where required by law, subpoena, warrant or other lawful process;
• Purchasers or potential purchasers of Greenhouse's business or assets, subject to confidentiality and privacy obligations.

4.1 Google Analytics and equivalent tools

We use Google Analytics (and may use equivalent analytics tools) to understand how the Platform is used. These tools collect technical and usage information (not sensitive health information). You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on.

Greenhouse's primary infrastructure — including cloud hosting and data storage — is located in Australia (AWS Asia Pacific, Sydney region).

Some third-party service providers we engage may store or process limited categories of data outside Australia:

• Payment processors (including Stripe) may process tokenised transaction data in the United States and other jurisdictions in order to complete payment transactions. This does not include your health or sensitive information.
• Analytics and communications providers may process technical and usage data (not health information) in the United States or elsewhere.

We do not transfer sensitive health information offshore. Before disclosing any personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles the information in a way consistent with the APPs, in accordance with our obligations under APP 8.

6.1 Choice

You can choose not to provide certain information, but doing so may prevent us from providing some or all of the Services.

6.2 Third-party information

If you provide information about another person (for example, emergency contact details), you must have that person's consent and make them aware of this Privacy Policy.

6.3 Marketing opt-out

You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email, adjusting preferences in the patient portal, or contacting us. Transactional and clinical communications will continue to be sent while you hold an Account.

6.4 Access

You may request access to the personal information we hold about you. We will respond within a reasonable period (usually 30 days). Some exceptions apply under the Privacy Act.

6.5 Correction

You may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading. We will respond within a reasonable period.

6.6 Anonymity and pseudonymity

Where it is lawful and practicable, you may deal with us anonymously or by using a pseudonym — for example, when making a general enquiry. Because we coordinate regulated telehealth services, prescribing, and the dispatch of prescription products, we will generally need to verify your identity, and anonymity or pseudonymity will not be practicable for those Services (APP 2).

If you believe we have breached the APPs, state or territory health privacy law, or this Privacy Policy:

1. Contact Greenhouse at the address in section 12. We will acknowledge your complaint within 5 business days and aim to respond substantively within 30 days.
2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
3. For complaints relating to the handling of health information specifically, you may also contact the relevant state or territory health complaints body. In Victoria, this is the Health Complaints Commissioner (hcc.vic.gov.au, 1300 582 113). Equivalent bodies exist in each other state and territory.

8A Notifiable data breaches

We maintain a data breach response plan. If a data breach occurs that is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Our measures include:

• Physical safeguards — restricted-access offices and secure disposal of physical records;
• Electronic safeguards — encryption in transit (TLS) and at rest, access controls, multi-factor authentication for staff, logging and monitoring;
• Managerial safeguards — staff training on privacy and information security, contractual obligations on service providers, and periodic review of our practices.

8.1 Data breach notification

In the event of a notifiable data breach, Greenhouse will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. Affected individuals and the OAIC will be notified without undue delay.

8.2 Retention

We retain health records for the minimum periods required by state and territory health legislation — typically 7 years from the date of last service for adults, or until the age of 25 for persons who were minors at the date of the record. Other personal information is retained for no longer than necessary for the purposes for which it was collected, or as required by law.

8.3 Government related identifiers

Where you provide a government related identifier (such as a Medicare number) for telehealth or rebate purposes, we do not adopt that identifier as our own means of identifying you. We use and disclose it only as permitted under APP 9 — including as reasonably necessary to fulfil our obligations to the relevant agency, or as required or authorised by law.

We use cookies and similar technologies to operate the Platform and to understand how it is used.

• Functional cookies are necessary for the Platform to function (for example, session cookies).
• Analytics cookies help us measure and improve Platform performance (for example, Google Analytics).
• Marketing cookies help us understand the effectiveness of our marketing, where you have consented.

You can manage cookies through your browser settings. Disabling certain cookies may affect Platform functionality.

The Platform may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We recommend you review their privacy policies before providing personal information.

We may amend this Privacy Policy from time to time. The current version will be published on our website with a revised effective date. Where changes are material, we will notify patients by email or through the patient portal.

Privacy Officer

Greenhouse Dispensary

• Email: info@greenhousedispensary.au
• Registered office: 2/207–211 Buckley St, Essendon VIC 3040

This notice is provided at the point of collection, as required by APP 5.

• Who is collecting — Greenhouse Dispensary (trading name), operating as Greenhouse Dispensary Pty Ltd (ACN 697 200 534).
• Why — to verify your eligibility, coordinate telehealth consultations with independent AHPRA-registered Practitioners, arrange pathology and product fulfilment, process payments, provide patient support, comply with our legal and regulatory obligations, and (with your consent) keep you informed about our services.
• Who we disclose to — Practitioners, pathology providers, our Dispensary Partner, payment processors (including Stripe), IT and hosting providers, marketing and communications vendors (where you consent), regulators, and others as described in sections 4 and 5 of this Privacy Policy.
• Overseas recipients — Greenhouse's infrastructure is hosted in Australia. Some service providers (payment processors and analytics tools) may process limited non-health data overseas; see section 5.
• Consequences of not providing information — if you do not provide the information we reasonably require, we may be unable to verify your identity, coordinate your consultation, arrange dispatch of your order, or continue to provide the Services.
• Access, correction and complaints — contact the Privacy Officer as set out in section 12. You may also complain to the OAIC.
• Full Privacy Policy — the full policy is available at greenhousedispensary.au/privacy-policy.