This document (privacy policy) describes how Reach Pharmaceuticals ACN 623 897 183, of Ground Floor, Corporate One, 84 Hotham Street, Preston VIC 3072 (“Reach Pharmaceuticals”, “we”, “us” and “our”) collects, uses, discloses and otherwise handles personal information (as defined in this privacy policy) that we collect from you, including through your access to and use of our website at https://www.reach-pharma.com (Website) including our over-the-counter products online store (OTC Store) and our Controlled Substance Registration Portal (Portal).

 

We take our obligations under the Privacy Act 1988 (Cth) (Privacy Act) seriously. We are committed to providing quality products and services to you. This privacy policy outlines our ongoing obligations to you in respect of how we manage your personal information, including in relation to the Australian Privacy Principles (APPs) under the Privacy Act. A copy of the APP’s may be obtained from the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.

 

We reserve the right to change, replace or update this privacy policy from time to time. We will make the new version of the privacy policy available on our Website. We encourage you to regularly review the Website to ensure that you are familiar with our current privacy policy.

 

By submitting your personal information to us, using our Website, or accessing our services, you consent to the collection, use, disclosure, sharing, transferring, storing and handling of your personal information in accordance with this privacy policy.

 

1.What is personal information and what personal information do we collect from you? 

For the purposes of this privacy policy, personal information is any information or opinion about an identified individual or an individual who is reasonably identifiable, regardless of whether the information or opinion is true or not.

As described in detail below, we may collect certain personal information about you in connection with your use of, or your submissions to, the Website and the content made available on the Website. We may collect one or more of the following type(s) of personal information, depending on how you interact with us:

1.1your name and other information that may be used to identify you;

1.2your mail and/or street address information;

1.3your email address and your telephone number (including land line and mobile phone number);

1.4information that you provide to us when completing client surveys, questionnaires and promotions;

1.5your payment detail, such as your credit card details;

1.6your order history, delivery address and delivery preferences;

1.7your device identity and type, your IP address, geo-location information, page view statistics, advertising data and standard web log information; and

1.8any other information that can be used (either singly or in combination with other information) to identify you.

Additionally, for registered health practitioners accessing the Portal or placing orders for controlled substances, we may collect:

1.9your Australian Health Practitioner Regulation Agency (AHPRA) registration number and registration status;

1.10your gender;

1.11your tertiary qualifications;

1.12details of any licences, permits, authorities or endorsements required under applicable laws to prescribe, supply or otherwise deal with Controlled Substances.

We may also collect sensitive information about you.

Sensitive information that we may collect about you includes health information, including to the extent it can be determined from your ordering of products from our Website, enquires you make to our Website, or when your registered health practitioner places orders for controlled substances for your use.  This information may include:

1.13your initials;

1.14your date of birth, height and weight;

1.15your gender;

1.16your address;

1.17your Aboriginal and/or Torres Strait Islander status;

1.18details of medications you are currently taking; and

1.19any other information relevant to your medical history or otherwise required for the purposes of prescribing controlled substances.

This privacy policy explains why we collect this personal information (including sensitive information), how we may use this information and potential recipients of our usual disclosures of personal information.

2.How we collect personal information about you?

We collect personal information in a number of ways, as explained in further detail below. While we use reasonable efforts to collect personal information about you directly from you, we may also collect personal information about you from third parties, for example, where a registered health practitioner places orders for controlled substances for your use.

We only collect personal information which is reasonably necessary for one or more of our functions or activities and we only collect personal information by lawful and fair means, in accordance with the Privacy Act.

We may collect personal information using any one or more of the following means:

2.1When you communicate with us, sign up for materials from us, and when you interact with us via our Website: We may collect personal information when you communicate with us and when you submit information to us (including via our Website). We may also collect personal information about you when you interact with our Website, provide your practitioner information through our Controlled Substance Registration Portal, or otherwise use Website features, tools and functionality, and when you sign up to receive newsletters, updates or other information from us.

2.2When we leverage and/or collect information from cookies, device IDs, geo-location data, data from the environment and data from other tracking technologies: We may collect personal information about you by using cookies and other technologies (such as web beacons, device IDs, geo-location information, HTML 5 local storage, Flash cookies and IP addresses). For further information about our use of such technologies, please see below at section 13 of this privacy policy.

2.3When we collect personal information from third parties or from publicly available sources of information: in certain circumstances, we may obtain certain personal information about you from third party sources, such as AHPRA. We may combine your personal information with data that we obtain from our services, other users and third parties.

2.4When you place orders through our OTC Store: We collect personal information when you create an account, place orders, and arrange for delivery of products through our OTC Store, including your account details, payment information, delivery address and order history.

2.5When registered health practitioners register on the Portal or place orders for controlled substances: We collect personal information when you create an account with us on the Portal or when you place orders for controlled substances, including your practitioner details and any prescription or patient information you provide to us in connection with your order.

3.Anonymity and pseudonymity

Where it is lawful and reasonable for you to do so, you have the right to deal with us on an anonymous or pseudonymous basis. As permitted by law, and subject to the following, we will give you the option of not identifying yourself, or of using a pseudonym, in dealing with us.

However, if you choose to interact with us in an anonymous or pseudonymous fashion, or you do not provide us with personal information on request, then we may be unable to provide you with the products or services you request.

Further, we reserve the right to verify your identity in certain circumstances. For example, we may need to verify your identity when you request that we provide certain products or services to you, in order to liaise with other service providers and in order to comply with our statutory and regulatory obligations. Additionally, when you request access to or correction of the personal information we hold about you, or when you wish to make a complaint regarding how we have handled your personal information, we reserve the right to verify your identity and contact details in order to facilitate our satisfaction of your access or correction request, or to investigate and to deal with your complaint.

We may create de-identified or anonymous data from personal information by removing data components (such as your name, email address, or linkable tracking ID) that makes the data personally identifiable to you or through obfuscation or through other means. Our use of de-identified or anonymised data is not subject to this privacy policy.

4.Receipt of unsolicited personal information

Generally, we only collect personal information when it is specifically requested or when we take active steps to collect that information. From time to time, however, personal information about an individual may be provided or volunteered to us on an unsolicited basis.

Where we receive personal information on an unsolicited basis, then (in accordance with our statutory obligations), we will promptly determine whether such personal information could lawfully have been collected had we requested the information or had otherwise actively sought the provision of such information.

5.Why we collect personal information

We may collect, use, disclose and process personal information for a number of different purposes as set out in detail below. We collect and use personal information for one or more of the following purposes:

5.1To operate our business and to provide the Website (including to maintain the Website and to communicate with you regarding the Website, such as to provide you with notices regarding changes to the terms and conditions applicable to the Website, the OTC Store and the Portal and/or this privacy policy and to enforce the terms and conditions applicable to the Website, the OTC Store and the Portal, and to develop, provide and improve the Website, the OTC Store and the Portal, such as to better tailor the features, performance, security and support of the Website, the OTC Store and the Portal and for statistical and analytics purposes in relation to the Website);

5.2To provide products, services and information to you, to our service providers, and to take steps in response to information requests or inquiries you may submit prior to entering into a contract with us;

5.3To ask that you participate in and to complete questionnaires and surveys, to administer questionnaires and surveys that you have agreed to complete, and to gather information and feedback about our performance;

5.4To comply with our contractual and legal obligations, to resolve disputes and to enforce our agreements with third parties;

5.5To share information with our related bodies corporate and other members of the group of companies that includes Reach Pharmaceuticals;

5.6For record keeping and administrative purposes, and to consider applications for employment with us;

5.7For fraud, loss, and other crime prevention purposes;

5.8For direct marketing purposes, including to enable us to send you marketing and promotional messages and other information that may be of interest to you, via email, SMS, social media or direct mail (subject to you not exercising your right to opt out of your receipt of such messages);

5.9To assist in the investigation of suspected illegal or wrongful activity, and to protect and to defend our rights and property, or the rights or safety of third parties;

5.10To comply with laws, regulators, court orders and other legal obligations, or pursuant to legal processes;

5.11Subject to applicable contractual or legal restrictions, in connection with contemplated reorganisation or an actual reorganisation of our business, in connection with financing, a sale or other transaction involving the disposal of all or part of our business or assets, including for the purpose of permitting due diligence required to decide whether to proceed with a transaction; and

5.12To maintain a safe working environment for our staff and contractors.

Additionally, for registered health practitioners accessing our Controlled Substance Registration Portal or placing orders for controlled substances, we collect, use, disclose and process personal information for one or more of the following purposes:

5.13To confirm active practitioner registration with AHPRA;

5.14To otherwise ensure practitioner compliance with Reach Pharmaceuticals’ requirements for the approval and fulfilment of controlled substance orders;

5.15To process and fulfil orders for controlled substances, including verifying your authority to order, processing payments, and arranging delivery to your nominated business or practice address;

5.16To maintain records of controlled substance orders as required by applicable laws and for regulatory compliance purposes; and

5.17To report to AHPRA, law enforcement agencies or other regulatory authorities as required or permitted by applicable laws.

Additionally, for customers using our OTC Store, we collect and use personal information for one or more of the following purposes:

5.18To process and fulfil orders for products, including processing payments, arranging delivery, and communicating with you regarding your order status;

5.19To manage returns and refunds in accordance with our Return Policy; and

5.20To detect and prevent payment-related fraud or misuse of our OTC Store.

6.What third parties do we disclose your personal information to, and why?

We may disclose personal information we collect to third parties but only on an as-needs basis and only to fulfil one or more of the purposes for which we collected the information, any secondary purpose related to the primary purpose(s) of collection, and otherwise as required or authorised by law.

6.1Your organisation. Where you deal or engage with us on behalf of an organisation, we may disclose some or all of your personal information to other persons from your organisation to operate our business, to provide the Website and to provide our products, services and information to you and your organisation.

6.2Related bodies corporate. We may disclose some or all of your personal information to our related bodies corporate for the purposes described in this privacy policy. Where we disclose such information with our related bodies corporate, we will require our related bodies corporate to honour this privacy policy.

6.3Service providers. We may disclose personal information to our business partners, distributors, service providers, marketing providers, and vendors in order to maintain the Website and to provide, improve and personalise the products and services. We may also disclose personal information for other technical and processing functions, such as sending emails on our behalf, technical support, or otherwise operating the Website, for analytics, and for marketing purposes. Such third parties may have access to personal information only as needed to perform their functions for us, and they may not use personal information for other purposes.

6.4Persons authorised by you. We may disclose some or all of your personal information to persons to whom you authorise us to disclose your personal information.

6.5As authorised by law. We may also disclose some or all of your personal information to comply with applicable laws and regulations, to respond to a lawful request for information we received, or as otherwise pursuant, authorised or required by law (including under the Privacy Act). We may also use and disclose personal information to establish or exercise our legal rights, to enforce our Terms of Use and other contracts with you or your organisation, this Privacy Policy, or agreements with third parties, to assert and defend against legal claims, or if we believe such disclosure is necessary to investigate, prevent, or take other action regarding actual or suspected illegal or fraudulent activities or potential threats to the physical safety or well-being of any person.

6.6Professional advisers, insurers and auditors. We may also disclose some or all of your personal information to our professional advisers (including our lawyers and accountants), our insurers and our auditors for the purpose of our advisers, insurers and auditors completing their obligations owed to us.

6.7Delivery service providers. We may disclose your personal information (including your delivery address, contact details and order information) to delivery service providers, including Team Global Express, for the purpose of delivering products you have ordered through our OTC Store or controlled substances you have ordered as a registered health practitioner.

6.8Payment processors. We may disclose your personal information to payment processors and financial institutions for the purpose of processing payments for orders placed through our OTC Store or for controlled substance orders placed by registered health practitioners.

6.9AHPRA and regulatory authorities. For registered health practitioners using our Portal or placing orders for controlled substances, we may query the AHPRA public register or other publicly available databases to verify your registration information and authority to prescribe or supply controlled substances. We may also disclose information about you, your Account or your orders to AHPRA, law enforcement agencies or other regulatory authorities where required or permitted by applicable laws or where we reasonably believe such disclosure is necessary to comply with our regulatory obligations.

6.10New owner. If the ownership or control of all or part of our business changes, we may transfer your personal information to the new owner.

7.Disclosure of personal information to recipients located outside Australia.

7.1Generally, we do not disclose personal information to recipients located outside Australia.

7.2However, we may engage third party service providers (including cloud providers and website hosting providers) that provide some or all of their services to us from location(s) outside Australia. If we do so, then we will take reasonable steps to ensure that such service providers deal with the personal information to which they have access in a manner consistent with this privacy policy and in compliance with the requirements of the Privacy Act.

7.3If you communicate with us via email, through a social network service or through some other electronic process, the communication may be routed through servers that are located outside Australia and, in relation to a message sent to us through a social network service (such as Twitter or Facebook), the social network provider and its partners may collect, hold and process personal information in a jurisdiction outside Australia.

8.Links to other websites. The Website may contain links or otherwise provide access to other websites, mobile applications or Internet locations (Third Party Sites). This privacy policy does not apply to Third Party Sites. We encourage you to read the privacy policies of any Third Party Site with which you choose to interact.

9.Security. We take reasonable steps to ensure that your personal information is kept secure and protected from misuse, interference and loss, and from unauthorised access, modification or disclosure. We use technical and organisational security measures designed to secure and protect personal information. Please note, however, that we cannot eliminate security risks associated with the storage and transmission of personal information.

10.Data security and how we hold and store personal information

10.1We hold personal information in a number of ways, which may include:

(a)as part of customer records and other electronic documents on which personal information is contained;

(b)on our information technology systems and servers, including those operated by third parties who provide services to us in connection with our business; and

(c)by securely storing hard copy documents, at our various premises and using third party document management and archiving services.

10.2We will take reasonable steps to protect all personal information which we hold from misuse, interference, loss and from unauthorised access, modification or disclosure. In particular:

(a)we use regular anti-virus and malware scanning; and

(b)our Website is secured by a trusted SSL certificate.

10.3You should be aware that, when using our Website, or our services, no data transmission over the internet can be guaranteed as completely secure. We do not warrant the security of any information you transmit to us over the internet and you do so at your own risk.

10.4We will continue to store and hold your personal information indefinitely, until such time as we no longer need it for any purpose for which the information may be used or disclosed under this privacy policy or under applicable privacy or data protection laws or a reasonable time after you ask us to delete it.

10.5For practitioners using our Portal, we may retain records of your registration information, acknowledgments and account activity for the period required by applicable laws or as we reasonably consider necessary for our regulatory compliance purposes.

10.6We typically retain personal information for as long as we are providing products or services to you and for a period of up to 10 years after we stop providing services to you (or longer if the legal limitation period is greater).

11.Quality of personal information. We take reasonable steps to ensure that personal information collected, used and disclosed is accurate, complete and up-to-date. However, the accuracy, completeness and currency of the personal information we hold largely depends on the accuracy of the information you supply to us. If at any time you discover that any personal information held about you is inaccurate, incomplete, outdated, irrelevant or misleading, please contact us to request correction of the information. We will handle a correction request in accordance with the procedures set out in this privacy policy. In doing so, we reserve the right to verify the identity of the person making a correction request before processing the request.

12.Access to and correction of personal information

12.1We will provide access to your personal information within a reasonable period of time following our receipt of your request, unless an exception applies. The exceptions include:

(a)where the access poses a serious threat to the life or health or safety of the individual, public health or public safety;

(b)where giving access would have an unreasonable impact on the privacy of other individuals;

(c)where the request is frivolous or vexatious;

(d)where the request relates to existing or anticipated legal proceedings or to current negotiations between you and us;

(e)the request is unlawful, would impede or prejudice any investigation of unlawful activity; or

(f)where we are required or authorised by or under Australian law or a court/tribunal order to not comply with the request.

12.2Where we do not provide you with access to your personal information, we will explain to you the reason for denying access and provide details in relation to the relevant complaint process, should you not agree with our reasons.

12.3While we will not charge a fee for making an access request, we are authorised by law to charge a reasonable fee to cover our costs incurred in providing access to your personal information, and we reserve the right to charge a reasonable fee to cover our costs incurred in providing access to your personal information.

12.4If you can establish that the personal information we hold about you is not accurate, complete or up-to-date, or is irrelevant or misleading, we will take reasonable steps to correct the information. If we have disclosed inaccurate, incomplete, out-of-date, irrelevant or misleading information to a third party, we will take reasonable steps to ensure that the recipient is aware of the correction.

12.5We may request from you information in order to verify your identity and your connection to the individual about whom you request personal information, if required. Further, we reserve the right to redact information included in the personal information, in order to protect the privacy of other individuals.

13.Cookies

13.1We may utilise "cookies" and other tracking software which enable us to monitor traffic patterns and to serve you more efficiently if you revisit the Website and to assist with your use of our services as well as for our general analytics purposes.

13.2A cookie does not identify you personally but it does identify your computer. You can set your browser to notify you when you receive a cookie and this will provide you with an opportunity to either accept or reject it in each instance. If you turn cookies off, some features that may make your experience of our Website more efficient may not function properly.

13.3If you have registered with us and have an account on our Website, our software may identify you personally based on the information you have provided on your account. Otherwise, non-registered users will not be personally identified by our software.

14.Complaints procedure. If you have any query or complaint about how we have handled your personal information, please contact us, at the details set out below. We will provide a response to you within a reasonable time period following receipt, in accordance with applicable law. We reserve the right to verify the identity of the person making the complaint and to seek (where appropriate or reasonable) further information from the complainant about the circumstances of the complaint. We reserve the right to refuse to investigate or to otherwise deal with a complaint where permitted by law. For example, we may refuse to investigate or to otherwise deal with a complaint if we consider the complaint to be vexatious or frivolous. If you are not satisfied with our determination, then you may escalate the complaint to the Office of the Australian Information Commissioner.

15.Contact us. For further information about our privacy policy or practices, or to request access to or correction of your personal information we hold about you, or to make a complaint, please contact us using the details below:

15.1Email: info@reach-pharma.com

15.2Mail address: Ground Floor, Corporate One, 84 Hotham Street, Preston VIC 3072

For more information about privacy generally, or if your concerns are not resolved to your satisfaction, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au and on 1300 363 992.

 

Effective date: 28th of September 2026

 

​