Privacy policy

TestSmart Pty Ltd • Privacy Policy

TestSmart

Privacy Policy

TestSmart Pty Ltd

Effective date: 23 June 2026

Last updated: 25 June 2026

Website: testsmart.com.au

Contact: hello@testsmart.com.au

1. About this Privacy Policy

TestSmart Pty Ltd (ACN 692 728 840) (TestSmart, we, us or our) is committed to protecting your privacy and handling your personal information openly, lawfully and securely.

This Privacy Policy explains how we collect, hold, use and disclose personal information (including sensitive health information) when you access or use the TestSmart website, mobile platform, telehealth services, screening kits and related services (the Services).

We handle your personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs), and applicable state and territory health records legislation.

This Privacy Policy forms part of, and should be read together with, our Terms of Service.

2. Who this policy applies to

This Privacy Policy applies to all users of the Services, including:

● Visitors to our website at testsmart.com.au.

● Account holders and customers who purchase or use our screening services.

● Individuals whose information is provided to us in connection with the Services.

TestSmart operates an e-commerce platform that coordinates the dispatch of self-collection test kits. The independent registered medical practitioners, accredited pathology laboratories and pharmacy partners involved in your care are separate health service providers. Each of these providers handles your personal information under its own privacy policy and legal obligations.

3. The information we collect

3.1 Personal information

We collect personal information that you provide to us or that is generated through your use of the Services. This may include:

Page 1 of 8 TestSmart Pty Ltd • Privacy Policy

• Identity information: full name, date of birth, gender, Medicare number and reference, individual healthcare identifier (IHI) where provided.

• Contact information: email address, postal address, mobile and telephone numbers.

• Account information: username, password (stored in encrypted form), account preferences and settings.

• Payment information: payment card details and billing information (processed by our third-party payment processor — we do not store full card numbers on our systems).

• Identity verification information where required to confirm you are at least 18 years of age or to comply with applicable law.

3.2 Sensitive and health information

Because TestSmart provides health-related services, we collect sensitive information, including health information. This is given a higher level of protection under the Privacy Act. Health information we collect may include:

• Your responses to online health questionnaires, including symptoms, sexual health history, medical history, current medications, allergies and other clinical information.

• Information about the tests you order and the results of those tests (received from the accredited pathology laboratory).

• Notes and clinical records relating to telehealth consultations conducted through the platform.

• Prescriptions issued and medications dispensed in connection with your care.

• Any other health information you choose to provide to us or to a GP using the platform.

We only collect sensitive and health information with your consent and where it is reasonably necessary to provide, or directly related to providing, the Services.

3.3 Technical and usage information

When you use our website and platform we may automatically collect:

• Device and connection information: IP address, device type, operating system, browser type, language settings.

• Usage information: pages visited, time spent on the platform, links clicked, referring URL, and the date and time of access.

• Cookies and similar technologies (see clause 9).

3.4 Information from third parties

We may receive information about you from the businesses and practitioners who help deliver the Services to you, including:

Page 2 of 8 TestSmart Pty Ltd • Privacy Policy

● The independent GP who reviews your questionnaire and provides clinical care (for example, clinical notes and assessments).

● The accredited pathology laboratory that processes your sample and returns results.

● The pharmacy partner that dispenses any medications prescribed in connection with your care.

● Payment processors, identity verification providers, and logistics or courier partners that support the order, payment and delivery process.

● Government agencies, where you have authorised them to share information with us or where required or permitted by law.

4. How we collect information

We collect information directly from you whenever practical, including when you:

• Create an account or complete a profile on the platform.

• Complete an online health questionnaire or order a test.

• Participate in a telehealth consultation.

• Contact us by email, phone, web form or chat.

• Respond to a survey, request information, or otherwise interact with the Services.

Where it is not reasonable or practical to collect information directly from you, we may collect information from third parties as described in clause 3.4. If we receive information about you that we did not request and do not require, we will take reasonable steps to destroy or de-identify it in accordance with APP 4, unless we are required by law to retain it.

5. Why we collect, hold and use your information

We collect, hold and use your personal information for the primary purpose of providing the Services to you. This includes:

• Assessing your clinical eligibility for a particular test, prescription or treatment via independent GP review.

• Coordinating the dispatch and return of test collection kits.

• Facilitating pathology testing and the return of results.

• Facilitating telehealth consultations and follow-up care.

• Facilitating the dispensing and delivery of any prescribed medication.

• Processing payments, refunds and managing your account.

• Communicating with you about your orders, test results, appointments and account.

• Providing customer support and responding to your enquiries and complaints.

Page 3 of 8 TestSmart Pty Ltd • Privacy Policy

We may also use your personal information for related secondary purposes that you would reasonably expect, including:

• Improving the quality, safety, security and functionality of the Services.

• Quality assurance, clinical governance and internal audit.

• De-identified research and analytics conducted in accordance with applicable law and ethical standards.

• Direct marketing — but only where permitted by law and where you have not opted out (see clause 10).

• Detecting, investigating and preventing fraud, misuse of the Services, and breaches of our Terms of Service.

• Complying with our legal, regulatory and professional obligations.

6. Who we disclose your information to

We disclose your personal information only where it is necessary for the purposes described in this Privacy Policy or otherwise permitted or required by law. We may disclose your information to:

6.1 Independent healthcare providers

Independent GPs who review your questionnaire, conduct telehealth consultations, issue prescriptions or referrals, and otherwise provide clinical care through the platform.

6.2 Pathology laboratories

Accredited third-party pathology laboratories that receive and test your samples and return results to the treating GP and (where appropriate) to you.

6.3 Pharmacy partners

Third-party pharmacy partners that dispense and deliver medications prescribed by the treating GP.

6.4 Service providers and contractors

Trusted service providers who help us operate the Services, including cloud hosting, software platforms, customer support tools, payment processors, identity verification providers, courier and logistics partners, communications providers, analytics and security providers. These providers are only permitted to use your information for the purposes for which we engage them and are required to handle it in accordance with this Privacy Policy and applicable law.

6.5 Government and regulators

Where required or authorised by law, we may disclose your information to government agencies, regulators, professional bodies and law enforcement. This includes, for example, the Therapeutic Goods Administration, AHPRA, the Office of the Australian Information Commissioner, and state or

Page 4 of 8 TestSmart Pty Ltd • Privacy Policy

territory public health authorities (including for notifiable disease reporting, which is mandatory for certain STIs).

6.6 Professional advisers and business transactions

We may disclose your information to our professional advisers (such as lawyers, accountants and auditors), and in connection with a sale, merger, restructure, financing or transfer of all or part of our business, subject to appropriate confidentiality protections.

6.7 With your consent

We may disclose your information to other recipients with your consent, or in a manner that you direct (for example, providing a copy of your results to your regular treating doctor at your request).

7. Cross-border disclosure of information (APP 8)

We store most personal information on servers located in Australia. However, some of our service providers (for example, cloud, analytics or communications providers) may store or process information on servers located overseas, including in the United States and the European Union.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information, including by entering into contractual arrangements requiring the recipient to handle the information in accordance with Australian privacy standards.

8. How we hold and protect your information

8.1 Security measures

We take the security of your personal information seriously and have implemented reasonable physical, technical and administrative safeguards designed to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:

• Encryption of data in transit (TLS) and at rest where appropriate.

• Role-based access controls and authentication for staff and contractors.

• Network security controls, monitoring and logging.

• Secure cloud infrastructure provided by reputable hosting partners.

• Confidentiality and privacy obligations imposed on our personnel and contractors.

• Periodic review of our security practices and policies.

8.2 No absolute guarantee

No method of transmission over the internet or method of electronic storage is completely secure. While we use commercially reasonable measures to protect your personal information, we cannot guarantee its absolute security.

Page 5 of 8 TestSmart Pty Ltd • Privacy Policy

8.3 Eligible data breaches

If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will assess and respond to the breach in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

9. Cookies and similar technologies

Our website is built on Shopify and uses cookies and similar technologies to operate, secure and improve the Services. Cookies are small text files placed on your device when you visit a website.

The categories of cookies used on our website include:

● Strictly necessary cookies — required for core functionality such as shopping cart, checkout, login sessions, and security (for example, Shopify's _shopify_essential, cart, and secure_customer_sig cookies). These cannot be disabled.

● Analytics and performance cookies — help us understand how visitors use our website so we can improve it (for example, Shopify Analytics cookies, and where enabled, Google Analytics).

● Marketing cookies — placed by our marketing platforms (including Klaviyo) and any advertising pixels we use (such as Meta Pixel or Google Ads) to help us deliver relevant communications and measure campaign performance.

● Preference cookies — remember your choices such as language and region.

Where required by law, we will ask for your consent before placing non-essential cookies. You can manage your cookie preferences at any time using the cookie banner on our website, or through your browser settings. Disabling certain cookies may affect the functionality of the Services.

For a full list of cookies set by the Shopify platform, please see the Shopify Cookie Policy.

10. Direct marketing and communications

We will send you communications that are necessary to provide the Services, including order confirmations, dispatch notifications, test result notifications, appointment reminders and account-related messages. You cannot opt out of these communications while you have an active account.

From time to time we may also send you general health-related information, service updates, and information about new TestSmart services that we think may be of interest to you. We will only do so where permitted by law, including the Spam Act 2003 (Cth), the Therapeutic Goods Act 1989 (Cth) and the advertising requirements of the Health Practitioner Regulation National Law. We do not, and will not, send marketing communications about specific prescription-only medicines.

You can opt out of non-essential communications at any time by using the unsubscribe link in any electronic message we send you or by contacting us at hello@testsmart.com.au.

Page 6 of 8 TestSmart Pty Ltd • Privacy Policy

11. How long we keep your information

We are required by law to keep health records for minimum periods set by Australian state and territory legislation. This means we generally retain clinical records for at least 7 years from the date we last provided you with a service. These requirements come from legislation including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic).

Other personal information that is not a clinical record is kept only for as long as we need it for the purposes described in this Privacy Policy, plus any additional period required by law.

When information is no longer required and we are not required by law to retain it, we take reasonable steps to securely destroy it or to permanently de-identify it.

12. Your rights — access, correction and complaints

12.1 Access to your information

You have a right to request access to the personal information we hold about you. We will respond to your request within a reasonable time and, where appropriate, give you access in the manner you request. In some circumstances we may decline to provide access (for example, where required or authorised by law, where access would pose a serious threat to life or health, or where the request is frivolous or vexatious). If we decline a request, we will tell you why in writing.

12.2 Correction of your information

You have a right to request correction of personal information we hold about you if it is inaccurate, out of date, incomplete, irrelevant or misleading. If we agree the information needs to be corrected we will do so without delay. If we disagree, we will tell you why, and you may request that we attach a statement to the record noting your view.

12.3 How to make a request

To request access to or correction of your information, contact us at hello@testsmart.com.au. We may need to verify your identity before responding.

12.4 Complaints

If you have a concern about how we have handled your personal information, please contact us first at hello@testsmart.com.au and we will do our best to resolve the matter. We aim to acknowledge complaints within 5 business days and to provide a substantive response within 30 days.

If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au

• Phone: 1300 363 992

• Post: GPO Box 5288, Sydney NSW 2001

Page 7 of 8 TestSmart Pty Ltd • Privacy Policy

Depending on the nature of your concern, you may also be able to complain to a state or territory privacy commissioner or health complaints body.

13. Children

The Services are not intended for, and we do not knowingly collect personal information from, anyone under 18 years of age. If you become aware that a person under 18 has provided personal information to us, please contact us and we will take reasonable steps to delete that information.

14. Compliance with regulatory frameworks

TestSmart's communications about therapeutic goods and health services comply with the Therapeutic Goods Advertising Code, the Health Practitioner Regulation National Law, and AHPRA's Guidelines for advertising a regulated health service.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or the law. We will publish the updated Privacy Policy on our website and update the "Last updated" date above. Your continued use of the Services after changes take effect constitutes acceptance of the updated Privacy Policy.

16. Contact us

If you have questions or concerns about this Privacy Policy, or how we handle your personal information, please contact us:

TestSmart Pty Ltd

Email: hello@testsmart.com.au

Website: testsmart.com.au

ACN: 692 728 840

Registered office: 3 Howard Rd, Padstow NSW 2211

Page 8 of 8