Privacy policy

TestSmart

TestSmart Pty Ltd

Effective date: 23 June 2026

Last updated: 21 October 2026

Website: testsmart.com.au

Contact: hello@testsmart.com.au

1. About this Privacy Policy

TestSmart Pty Ltd (ACN 692 728 840) (TestSmart, we, us or our) is committed to protecting your privacy and handling your personal information openly, lawfully and securely.

This Privacy Policy explains how we collect, hold, use and disclose personal information (including sensitive health information) when you access or use the TestSmart website, telehealth services, screening kits and related services (the Services).

We handle your personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles (APPs), and applicable state and territory health records legislation.

This Privacy Policy forms part of, and should be read together with, our Terms of Service.

1A. Your consent

By using our Services, including placing an order, creating an account or completing a health questionnaire, you confirm that you have read this Privacy Policy. You also agree that we can collect, use, store and share your personal information, including your health information, in the ways this policy describes.

You can withdraw your consent at any time by contacting us at hello@testsmart.com.au. If you do, we may not be able to keep providing the Services to you, and we may still need to keep some information where the law requires it (see clause 11).

2. Who this policy applies to

This Privacy Policy applies to all users of the Services, including:

Visitors to our website at testsmart.com.au.
Account holders and customers who purchase or use our screening services.
Individuals whose information is provided to us in connection with the Services.

TestSmart operates an e-commerce platform that coordinates the dispatch of self-collection test kits. The independent registered medical practitioners and accredited pathology laboratories involved in your care are separate health service providers. Each of these providers handles your personal information under its own privacy policy and legal obligations.

3. The information we collect

3.1 Personal information

We collect personal information that you provide to us or that is generated through your use of the Services. This may include:

Identity information: full name, date of birth, gender, Medicare number and reference, individual healthcare identifier (IHI) where provided.
Contact information: email address, postal address, mobile and telephone numbers.
Account information: if you create an account on our online store, your login details, order history and account preferences.
Payment information: payment card details and billing information (processed by our third-party payment processor — we do not store full card numbers on our systems).
Medicare information: we verify your Medicare details with Services Australia through our practice management system.

3.2 Sensitive and health information

Because TestSmart provides health-related services, we collect sensitive information, including health information. This is given a higher level of protection under the Privacy Act. Health information we collect may include:

Your responses to online health questionnaires, including symptoms, sexual health history, medical history, current medications, allergies and other clinical information.
Information about the tests you order and the results of those tests (received from the accredited pathology laboratory).
Notes and clinical records relating to telehealth consultations conducted through the platform.
Prescriptions issued by the GP in connection with your care.
Any other health information you choose to provide to us or to a GP using the platform.

We only collect sensitive and health information with your consent and where it is reasonably necessary to provide, or directly related to providing, the Services.

3.3 Technical and usage information

When you use our website and platform we may automatically collect:

Device and connection information: IP address, device type, operating system, browser type, language settings.
Usage information: pages visited, time spent on the platform, links clicked, referring URL, and the date and time of access.
Cookies and similar technologies (see clause 9).

3.4 Information from third parties

We may receive information about you from the businesses and practitioners who help deliver the Services to you, including:

The independent GP who reviews your questionnaire and provides clinical care (for example, clinical notes and assessments).
The accredited pathology laboratory that processes your sample and returns results.
Payment processors and courier partners that support the order, payment and delivery process.
Government agencies, where you have authorised them to share information with us or where required or permitted by law.

4. How we collect information

We collect information directly from you whenever practical, including when you:

Create an account or complete a profile on the platform.
Complete an online health questionnaire or order a test.
Participate in a telehealth consultation.
Contact us by email, phone, web form or chat.
Request information or otherwise interact with the Services.

Where it is not reasonable or practical to collect information directly from you, we may collect information from third parties as described in clause 3.4. If we receive information about you that we did not request and do not require, we will take reasonable steps to destroy or de-identify it in accordance with APP 4, unless we are required by law to retain it.

5. Why we collect, hold and use your information

We collect, hold and use your personal information for the primary purpose of providing the Services to you. This includes:

Assessing your clinical eligibility for a particular test, prescription or treatment via independent GP review.
Coordinating the dispatch and return of test collection kits.
Facilitating pathology testing and the return of results.
Facilitating telehealth consultations and follow-up care.
Processing payments, refunds and managing your account.
Communicating with you about your orders, test results, appointments and account.
Providing customer support and responding to your enquiries and complaints.

We may also use your personal information for related secondary purposes that you would reasonably expect, including:

Improving the quality, safety, security and functionality of the Services.
Quality assurance, clinical governance and internal audit.
De-identified research and analytics conducted in accordance with applicable law and ethical standards.
Sending you a reminder if you start an order but do not complete it, unless you have opted out (see clause 10).
Detecting, investigating and preventing fraud, misuse of the Services, and breaches of our Terms of Service.
Complying with our legal, regulatory and professional obligations.

6. Who we disclose your information to

We disclose your personal information only where it is necessary for the purposes described in this Privacy Policy or otherwise permitted or required by law. We may disclose your information to:

6.1 Independent healthcare providers

Independent GPs who review your questionnaire, conduct telehealth consultations, issue prescriptions or referrals, and otherwise provide clinical care through the platform.

6.2 Pathology laboratories

Accredited third-party pathology laboratories that receive and test your samples and return results to the treating GP and (where appropriate) to you.

6.3 Our online store and email platforms

Our online store runs on Shopify, and we use Klaviyo to send emails about your order. When you place an order, we share the following with these providers:

Your name, email address, phone number and delivery address.
The test or kit you order, and the status of your order and payment.
How you interact with our website and emails, such as the products you view and whether you open our emails.

Shopify uses this information to process your order and payment. Klaviyo uses it to send you order updates and reminders, such as a reminder to complete your health questionnaire, or a reminder if you leave an order unfinished (see clause 10).

The name of the test you order may indicate something about your health. By placing an order, you consent to us sharing this information with Shopify and Klaviyo for these purposes.

Your health questionnaire answers, clinical notes and test results are never shared with Shopify or Klaviyo. They are held separately in our practice management system.

Shopify and Klaviyo may store information on servers outside Australia, including in the United States and Canada (see clause 7).

6.4 Delivery partners

We use Australia Post to deliver test kits. We give Australia Post your name, delivery address, email address and phone number so it can deliver your kit and send you tracking updates. Nothing on the outside of the parcel shows the test you ordered or any health information.

6.5 Service providers and contractors

Trusted service providers who help us operate the Services, including cloud hosting, software platforms, customer support tools, payment processors, courier and logistics partners, communications providers, analytics and security providers. These providers are only permitted to use your information for the purposes for which we engage them and are required to handle it in accordance with this Privacy Policy and applicable law.

6.6 Government and regulators

Where required or authorised by law, we may disclose your information to government agencies, regulators, professional bodies and law enforcement. This includes, for example, Services Australia (to verify your Medicare details), the Therapeutic Goods Administration, AHPRA, the Office of the Australian Information Commissioner, and state or territory public health authorities (including for notifiable disease reporting, which is mandatory for certain STIs).

6.7 Professional advisers and business transactions

We may disclose your information to our professional advisers (such as lawyers, accountants and auditors), and in connection with a sale, merger, restructure, financing or transfer of all or part of our business, subject to appropriate confidentiality protections.

6.8 With your consent

We may disclose your information to other recipients with your consent, or in a manner that you direct (for example, providing a copy of your results to your regular treating doctor at your request).

6.9 Meta (Facebook and Instagram)

We use the Meta Pixel to measure and improve our ads. Meta is told when someone visits our website, views a test, adds to cart, starts checkout or makes a purchase, and collects technical information such as your IP address and browser. We never share which test you viewed or ordered, your contact details or any health information with Meta. You can block Meta cookies through your browser settings.

7. Cross-border disclosure of information (APP 8)

Our patient records, including your health questionnaire answers, clinical notes and test results, are held in Australia by our practice management system.

Some of our other service providers store or process information overseas, including Shopify (our online store), Klaviyo (email), Google (email, file storage, website analytics and advertising) and Meta (advertising measurement). This means your contact details, order details and website activity may be held in the United States, Canada and other countries where these providers operate.

We only use providers whose terms require them to protect personal information to a standard similar to the Australian Privacy Principles.

8. How we hold and protect your information

8.1 Security measures

We take the security of your personal information seriously and have implemented reasonable physical, technical and administrative safeguards designed to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:

Encryption of data in transit (TLS) and at rest where appropriate.
Role-based access controls and authentication for staff and contractors.
Network security controls, monitoring and logging.
Secure cloud infrastructure provided by reputable hosting partners.
Confidentiality and privacy obligations imposed on our personnel and contractors.
Periodic review of our security practices and policies.

8.2 No absolute guarantee

No method of transmission over the internet or method of electronic storage is completely secure. While we use commercially reasonable measures to protect your personal information, we cannot guarantee its absolute security.

8.3 Eligible data breaches

If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will assess and respond to the breach in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

9. Cookies and similar technologies

Our website is built on Shopify and uses cookies and similar technologies to operate, secure and improve the Services. Cookies are small text files placed on your device when you visit a website.

The categories of cookies used on our website include:

Strictly necessary cookies — required for core functionality such as shopping cart, checkout, login sessions, and security (for example, Shopify's _shopify_essential, cart, and secure_customer_sig cookies). These cannot be disabled.
Analytics and performance cookies — help us understand how visitors use our website so we can improve it (Shopify Analytics and Google Analytics).
Marketing cookies — placed by our marketing platforms (Klaviyo, Google Ads and Meta) to send you order reminders and measure how our ads perform.
Preference cookies — remember your choices such as language and region.

Where required by law, we will ask for your consent before placing non-essential cookies. You can block or delete cookies at any time through your browser settings. Disabling certain cookies may affect the functionality of the Services.

For a full list of cookies set by the Shopify platform, please see the Shopify Cookie Policy.

10. Direct marketing and communications

We will send you communications that are necessary to provide the Services, including order confirmations, dispatch notifications, reminders to complete your health questionnaire or return your sample, test result notifications, appointment reminders and account-related messages. You cannot opt out of these communications while you have an active account.

If you start an order but don't complete it, we may send you an email reminder. We do not currently send newsletters or promotional emails. If we do in future, we will only do so where permitted by law, including the Spam Act 2003 (Cth), the Therapeutic Goods Act 1989 (Cth) and the advertising requirements of the Health Practitioner Regulation National Law. We do not, and will not, send marketing communications about specific prescription-only medicines.

You can opt out of order reminders and any other non-essential communications at any time by using the unsubscribe link in any electronic message we send you or by contacting us at hello@testsmart.com.au.

11. How long we keep your information

We are required by law to keep health records for minimum periods set by Australian state and territory legislation. This means we generally retain clinical records for at least 7 years from the date we last provided you with a service. These requirements come from legislation including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic).

Other personal information that is not a clinical record is kept only for as long as we need it for the purposes described in this Privacy Policy, plus any additional period required by law.

When information is no longer required and we are not required by law to retain it, we take reasonable steps to securely destroy it or to permanently de-identify it.

12. Your rights — access, correction and complaints

12.1 Access to your information

You have a right to request access to the personal information we hold about you. We will respond to your request within a reasonable time and, where appropriate, give you access in the manner you request. In some circumstances we may decline to provide access (for example, where required or authorised by law, where access would pose a serious threat to life or health, or where the request is frivolous or vexatious). If we decline a request, we will tell you why in writing.

12.2 Correction of your information

You have a right to request correction of personal information we hold about you if it is inaccurate, out of date, incomplete, irrelevant or misleading. If we agree the information needs to be corrected we will do so without delay. If we disagree, we will tell you why, and you may request that we attach a statement to the record noting your view.

12.3 How to make a request

To request access to or correction of your information, contact us at hello@testsmart.com.au. We may need to verify your identity before responding.

12.4 Complaints

If you have a concern about how we have handled your personal information, please contact us first at hello@testsmart.com.au and we will do our best to resolve the matter. We aim to acknowledge complaints within 5 business days and to provide a substantive response within 30 days.

If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001

Depending on the nature of your concern, you may also be able to complain to a state or territory privacy commissioner or health complaints body.

13. Children

The Services are not intended for, and we do not knowingly collect personal information from, anyone under 18 years of age. If you become aware that a person under 18 has provided personal information to us, please contact us and we will take reasonable steps to delete that information.

14. Compliance with regulatory frameworks

TestSmart's communications about therapeutic goods and health services comply with the Therapeutic Goods Advertising Code, the Health Practitioner Regulation National Law, and AHPRA's Guidelines for advertising a regulated health service.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or the law. We will publish the updated Privacy Policy on our website and update the "Last updated" date above. Your continued use of the Services after changes take effect constitutes acceptance of the updated Privacy Policy.

16. Contact us

If you have questions or concerns about this Privacy Policy, or how we handle your personal information, please contact us:

TestSmart Pty Ltd

Email: hello@testsmart.com.au

Website: testsmart.com.au

ACN: 692 728 840

Registered office: 3 Howard Rd, Padstow NSW 2211