Privacy Policy

1. Who we are

Pharmacy HQ is a software-as-a-service (SaaS) product providing staff operations dashboards for Australian pharmacies. It is operated by Pharmacy HQ Pty Ltd (ACN 698 203 164 · ABN 86 698 203 164), an Australian company with registered office at C/- Perrier Ryan Business Advisors, Level 1, 30 Lisburn Street, East Brisbane QLD 4169.

In this policy, "Pharmacy HQ", "we", "us" and "our" refer to Pharmacy HQ Pty Ltd. "You" refers to the pharmacy owner, manager, or staff member using our service.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What information we collect

Account information

When you create a Pharmacy HQ account, we collect:

• Your pharmacy name and email address
• A hashed password (we never store plain-text passwords)
• Your selected subscription plan and billing details (processed by Stripe, we store only a Stripe Customer ID, not card numbers)

Operational data you enter

All data entered by you or your staff into the application is stored under your pharmacy's account and includes:

• Staff records, names, roles, emoji avatars (no government IDs, no contact details unless you enter them)
• Task and diary entries, operational notes, task completions, timestamps
• Special orders and delivery records, patient names and item descriptions (as entered by your staff)
• Staff leave records, dates and leave types
• Front-of-store logs, incident notes, stocktake records, expiry dates
• Webster patient profiles, patient names, DOB, address, phone, Medicare/DVA/NDIS numbers, pack type + frequency, fee type, prescribing doctor, packing notes; plus, when supplied for PPA claim eligibility: concession status (pensioner / health-care-card-holder / general), Aboriginal and/or Torres Strait Islander identification (used for IDAA claim eligibility, entered with patient consent at enrolment), living setting (e.g. home / RACF / supported accommodation, used for staged supply program eligibility)
• Staged Supply records, A2 enrolment agreement (patient + prescriber + meds + service terms), per-visit dispensing log (A3/A4), comms log (A5), photographs of wet-signed acknowledgement slips
• Care Transfer records, patient name, DOB, Medicare/DVA/NDIS, scripts-per-month estimate, welcoming staff member
• Vaccination claim records, patient name, DOB, Medicare/DVA, vaccine batch/lot, dose number, vaccinator AHPRA registration
• PPA claim drafts, monthly DAA + Staged Supply claim line items aggregated from your patient records
• Sick-call records, staff name, shift, reason (optional), expected days off, photo of sick certificate (when uploaded)
• Staff Workforce records, rosters, time-clock punches, timesheets, annual leave balances
• File uploads, photographs (e.g. proof-of-delivery photos, Webster pack pre-check photos, photographs of wet-signed Staged Supply slips, sick certificate uploads, policy library document uploads) are stored in Firebase Storage. Each file is bound by Firebase Storage Security Rules so only members of the uploading pharmacy can access it.

Information from services your pharmacy connects

• Clever Logger fridge temperatures. If your pharmacy connects its Clever Logger account, with your pharmacy's permission Pharmacy HQ reads the temperature readings of the fridges your pharmacy chooses, about once an hour, through a read-only viewer login your pharmacy adds for us. We only read; we never change anything in Clever Logger. The readings are stored in your pharmacy's fridge records. The access key is kept in Google Cloud Secret Manager in Sydney. Your pharmacy can end the connection at any time by removing our viewer login in Clever Logger.

Technical data collected automatically

When you use our application, we or our infrastructure providers may automatically collect:

• Your IP address and approximate location (city-level)
• Browser type and version, operating system
• Pages visited within the application and timestamps
• Error logs and crash reports (to help us fix bugs)

3. How we use your information

We use the information we collect for the following purposes:

• Providing and improving the service, running your operations dashboard, syncing data across devices, and fixing bugs
• Account management, creating and managing your account, verifying your identity, and enforcing subscription limits
• Billing, processing subscription payments and sending invoices
• Communications, sending you service emails (welcome, payment failure alerts, and important product updates). We do not send marketing emails without your consent.
• Analytics, understanding how the application is used in aggregate so we can improve it. We do not create individual behavioural profiles for advertising.
• Legal compliance, meeting our obligations under Australian law

We will never sell your data to third parties, use it to serve you advertisements, or share it with anyone who is not listed in Section 4 of this policy.

4. Who we share information with

We share data only with the following trusted third-party providers, and only to the extent necessary to provide the service:

Authoritative sub-processor list: for the current authoritative list of every data sub-processor + their role + jurisdiction, see pharmacyhq.com.au/sub-processors. That page is updated whenever a sub-processor is added, removed, or changes role, it is the single source of truth and takes precedence over any listing in this document.

All of these providers are bound by their terms with us to handle your data only to provide their service. Some of them process data outside Australia, as the Country column shows. Section 5 sets out where your data is stored and what is processed overseas.

We may also disclose your information if required to do so by Australian law (for example, in response to a court order or regulatory request).

4a. AI features and Anthropic

Pharmacy HQ has the AI features listed below. All of them except PreCheck use Anthropic's Claude model through Anthropic's own service in the United States. The list says what each feature sends. Each AI feature carries a small "AI" label in the app.

Not everything below is switched on yet. PreCheck, AI Scribe and AI reading of emailed scripts are still in testing and are not enabled for live pharmacies. Each is switched on only after that testing completes, and this section applies to each from the moment it is enabled. When they are enabled, PreCheck and AI Scribe stay off for each pharmacy until its Owner turns them on in Pharmacy settings → AI features, because they handle pack photos and consultation notes. The other AI features are on unless the Owner turns AI off for the pharmacy.

• Help Chat, answers "how do I do X in the app?" questions using Pharmacy HQ's own help articles. It sends your question and the help articles that match it.
• Policy Chat, answers questions from the policy documents your pharmacy has uploaded to its policy library. It sends your question and the full text of up to five of your policy documents that match it.
• Workflow Chat, can read your live pharmacy data (patients, deliveries, orders, roster) through a controlled set of read-only tools, and answers questions like "What's Mrs Smith's Webster status?". Two of these tools are only for the pharmacy's Owner and Administrators: the incident register, and the sick-call list. The sick-call list gives each recent sick call's staff name, shift date and times, when it was reported, whether a certificate is on file and how many people were notified. It never includes the reason, it cannot be narrowed to one person, and it leaves out cancelled sick calls. Whatever a tool returns is sent to Anthropic with the question, as described below.
• AI Scribe, turns the pharmacist's MedsCheck consultation notes into a draft Action Plan and adherence answers, which the pharmacist checks before saving. It sends the notes exactly as they were typed or dictated (up to 10,000 characters), the patient's first name and the type of MedsCheck. It does not add the patient's surname or date of birth, but anything written in the notes is sent as written.
• Incident auto-tagging, suggests which QSPP clauses a new incident report relates to. When a report is saved, it sends the incident type, its severity and the first 500 characters of "What happened". If that text names a patient or a staff member, the name is sent. It can also be turned off on its own in the pharmacy's QSPP readiness settings.
• QSPP writing tools, draft an attestation narrative, a guide to the QSPP transition and practice audit questions. They send the pharmacy's name, the accreditation cycle, the date of the last attestation, which QSPP clauses the Owner has marked as covered outside Pharmacy HQ, and the number of entries on the ownership board. They send no patient or staff details and no incident numbers.
• Invoice reading, reads the lines of a supplier invoice that you upload. It sends the invoice image or PDF as uploaded.
• Reading emailed scripts, reads the patient, prescriber, clinic and medicines from a prescription emailed to your pharmacy's script inbox. It sends the email subject, the first 1,500 characters of the email and the first 4,000 characters of text from any attached PDF, which usually include the patient's name and date of birth.
• PreCheck, assistive image analysis of Webster pack photos, returning a pill-count vs the expected count. See Section 4b below for the dedicated PreCheck data-handling notes.

What is sent to Anthropic

For every feature above except PreCheck, what is sent goes to Anthropic's API in the United States. For the Help, Policy and Workflow chats, that is the text of your question and the information the assistant needs to answer it, which may include patient names, prescription details or other pharmacy records. PreCheck does not use Anthropic's US API: see Section 4b.

Dictation

The MedsCheck consultation notes have a Dictate button. Dictation uses the speech recognition built into your web browser; it is not one of Pharmacy HQ's AI features and it does not use Anthropic. In Google Chrome, the browser sends your voice to Google to turn it into text, under Google's own terms for Chrome. Other browsers may use their own maker's speech service in the same way. Pharmacy HQ receives only the text, never the audio. The pharmacy AI switch does not turn dictation off. If you do not want your voice to leave the computer, type the notes instead.

What Anthropic does with it

Under Anthropic's commercial terms in effect at the date of this policy, requests and responses are not used for model training and are not retained beyond the time required to deliver the response (subject to Anthropic's standard logging for abuse prevention).

What we log on our side

We log metadata only, timestamp, surface (help / policy / workflow / pre-check), tokens consumed, latency. We do not log the prompt or the response text on our side. This is a deliberate PHI-hygiene choice; the trade-off is we can't audit the content of historical AI queries.

How to opt out

The pharmacy owner can disable AI features for the entire pharmacy in Pharmacy settings → AI features. Once disabled, no Anthropic API calls occur from your pharmacy's account: every AI surface, the Help, Policy and Workflow chats, the MedsCheck AI scribe, invoice reading, incident auto-tagging, the QSPP writing tools, and PreCheck, refuses instead of calling out. The switch is enforced on our servers, not in the browser, so it holds regardless of which device or app version a staff member is using. Only the owner can change it; a manager cannot. Prescriptions emailed to your script inbox continue to arrive while AI is off, they are simply filed without the patient and prescriber details being read out of them. PreCheck is additionally opt-in per patient (Section 4b): patient consent and this pharmacy-level switch must both allow it.

4b. PreCheck, Webster pack AI verification

PreCheck is an assistive workflow tool that captures an end-of-pack photograph of a Webster (dose administration aid) pack and runs AI image analysis to count the pills it can see in each cell and show the pharmacist where a count differs from the expected count. It is intended to help the pharmacist check a packed pack; it does not decide whether a pack is correct. The pharmacist reviews every result and is solely responsible for verifying the pack before it leaves the pharmacy.

Patient consent (per patient, opt-in)

PreCheck is gated on per-patient consent. The pharmacist obtains the patient's documented consent at Webster enrolment and records it on the patient's Webster profile inside Pharmacy HQ (a structured field: granted, at, by, with a withdrawal field if consent is later revoked). PreCheck capture refuses to upload a photo for a patient whose consent is not granted. Consent is patient-level (not pharmacy-level) and is withdrawable at any time via Pharmacy Settings or by request to the pharmacy.

What is sent, and what is NOT sent

What we send to the AI provider: the cropped image of the pack grid only (the rectangle inside the violet outline shown on the camera preview), plus the expected pill count for each slot and, depending on the AI model used, the name of each expected medicine. The image is cropped client-side using a fixed bounding rectangle before it is uploaded to our servers; everything outside the violet outline is discarded before the image data exists.

What we do NOT send: the patient's name, date of birth, Medicare number, AHPRA number, or any other personal identifier. There is no patient ID, no store ID, and no timestamp in the AI payload that could correlate the image with a patient. We additionally run a server-side OCR redaction check on the cropped image (Google Cloud Vision textDetection) before any AI call; if the OCR detects identifier-shaped text (patient name, DOB pattern, Medicare pattern, or AHPRA pattern) we BLOCK the AI call and prompt the pharmacy staff member to reframe and re-capture.

Where the AI runs

PreCheck sends the cropped pack photo to two services, one after the other.

• The text check. Google Cloud Vision reads any printed text in the photo, so that we can stop the photo if it shows a patient's name, a date of birth or a number such as a Medicare number. Google does not offer this service in Australia, so this step may process the photo outside Australia. We keep only the result of the check (passed, or the kind of identifier found), never the text it read.
• The pill count. Only if the text check passes, the photo and the expected counts go to an AI model hosted in Australia, so this step does not leave Australia. The model and its provider are still being chosen in testing; the first option is Google Cloud Vertex AI in the australia-southeast1 (Sydney) region, the same Sydney Google Cloud project where the rest of your pharmacy data is stored. We will name the model and provider in this section before PreCheck is enabled for any live pharmacy.

We do not send either step the patient's name, date of birth, Medicare number, or any patient or pharmacy ID as data. If the text check reads the patient's name, date of birth or a Medicare number in the photo, it stops the photo before the pill count.

Retention

On Vertex AI, request logging is turned off for the PreCheck call (header: X-Vertex-AI-Logging-Off: true). Before PreCheck is enabled for any live pharmacy, this section will say whether the chosen model's provider keeps or trains on the photo.

Pharmacy HQ retains the cropped photograph in your pharmacy's storage bucket alongside the AI result for the audit trail. Photographs are deleted in line with our standard retention schedule (Section 6) or earlier on request.

Audit trail and pharmacy attestation

Every PreCheck capture records a structured privacy field, consent state at capture time, crop bounds applied, OCR preflight result, AI provider, AI region, and retention policy. Pharmacy owners can generate a Privacy Audit Pack (PDF) from the PreCheck tab covering the last 30 days of activity, suitable for OAIC, AHPRA, or insurer enquiries.

How to opt out

Individual patients can withdraw consent at any time by asking their pharmacy to un-tick the PreCheck consent on their Webster profile; subsequent captures for that patient are blocked. PreCheck is off for each pharmacy until its Owner turns it on in Pharmacy settings → AI features, and the Owner can turn it off again there at any time. Turning off AI features for the whole pharmacy also stops PreCheck.

Privacy Impact Assessment

We keep a Privacy Impact Assessment for PreCheck, covering personal information flows, the risk register, mitigations, and the Australian Privacy Principles compliance map. It is updated before PreCheck is enabled for live pharmacies. A pharmacy can ask for a copy at privacy@pharmacyhq.com.au.

5. Data storage and security

Your pharmacy's data, including patient and staff records, is stored in Google Cloud Firestore in the australia-southeast1 (Sydney) region, and our cloud functions run in the same region. File uploads are stored in Firebase Storage in Sydney. Backups of the database are kept in Sydney: daily and weekly backups are kept for 14 weeks, and the database can also be restored to any point in the last 7 days. Mentions of staff (who was mentioned, the sender's name, a short title and up to 400 characters of the message, post, note or task they were made in; a mention on a special order or Webster patient includes the patient's name) are stored in Cloud Firestore in Sydney.

Data still held in the USA. Some of your data is still written to the Firebase Realtime Database, which is hosted in the United States. It covers:

• which pharmacies each user belongs to, and their role there;
• requests to start using Pharmacy HQ (the applicant's email address, pharmacy name, ABN, role, suburb and notes), and requests to link two pharmacies (the email address entered);
• the locum network and the marketplaces between pharmacies: locum profiles, applications, invitations, certificates, reviews and payments, which can include a locum's name, AHPRA number, phone number and email address, and the stock and knowledge listings pharmacies share;
• a log of each email we send (the recipient's address and the subject), a record of which monthly claim reminder emails and pre-shift reminder texts were sent (the Owner's email address, or the staff member), and a count of password reset requests for each email address;
• the automated fridge temperature and dead-stock emails your pharmacy receives: a log of each one (the sender and recipient addresses and up to 800 characters of the report), the wholesaler reports attached to dead-stock emails, your pharmacy's address for these emails, and the names of your fridge logger sites;
• claim records: the outcome of each MedsCheck and vaccination claim to PPA (its status, claim number and any error message from PPA), the status of monthly DAA, IDAA and Staged Supply claims, status updates from PPA, and who marked a claim as submitted (their email address);
• the link from a vaccination record to the patient's record (a record number, not the patient's details);
• the text read from policy documents uploaded to your policy library, and the email address of the person who uploaded each one;
• bulletin posts sent to a group of pharmacies (up to 4,000 characters);
• delivery addresses looked up for route planning, with their map location, kept so the same address is not looked up again; these are usually patients' home addresses;
• a record of each new staff member added in the setup wizard (their name), and of changes to protected pharmacy settings (the values before and after);
• compounding referrals between pharmacies (the patient's name and phone number and what is needed), a feature still in testing, and the care transfer record each referral creates.

Older copies may also remain there until they are moved or deleted. These include copies, written before 28 September 2026, of merged patient records, which can include a patient's name, date of birth, address and phone number, and of patient requests sent by text reply (the phone number, name and message). They also include copies, written before 19 October 2026, of mentions of staff (who was mentioned, the sender's name, a short title and up to 400 characters of the message, post, note or task they were made in; a mention on a special order or Webster patient includes the patient's name) and a record of who sent each one, and prescription emails that reached your pharmacy's script inbox up to 18 October 2026 (the sender, the subject, the text of the email and of any attached PDF, and the details read from it), which are deleted automatically 30 days after they arrived. We are moving the remaining data to Australia.

Processed outside Australia. Besides the data above, these services process data outside Australia: sign-in accounts (Firebase Authentication, a Google global service); push notifications to staff devices (Firebase Cloud Messaging, a Google global service); emails sent through Resend (United States, with emails sent from Japan (Tokyo), Section 4); the AI features that use Anthropic in the United States (Section 4a); the PreCheck text check by Google Cloud Vision (Section 4b); text messages sent through Twilio in the United States, and the OpenAI scam check used by Mobile Message (Section 4); and the other providers in Section 4 whose country is not Australia.

All data is protected by:

• Encryption in transit, all connections use TLS 1.2 or higher
• Encryption at rest, Firebase encrypts data at rest by default
• Authentication-gated access, Firebase security rules ensure each pharmacy can only access their own data. No cross-pharmacy data leakage is possible by design.
• Admin access control, only whitelisted Pharmacy HQ administrators can access the management dashboard, protected by Firebase custom claims

Edge security and inbound mail processing. DNS for pharmacyhq.com.au is hosted on Cloudflare; inbound automated emails (e.g. fridge temperature logs from Clever Logger) are routed through Cloudflare Email Routing and processed by a Cloudflare Worker before being forwarded to our Cloud Functions for ingestion. Cloudflare may temporarily process the email contents in transit; we do not retain Cloudflare's processing logs beyond what their standard logging provides.

While we take reasonable technical measures to protect your data, no internet transmission or electronic storage method is 100% secure. If you become aware of any security vulnerability, please contact us immediately at security@pharmacyhq.com.au.

6. How long we keep your data

• Active account data, retained for as long as your account remains active
• Diary entries and one-off tasks, retained for at least 24 months from their date (for a task, its due date or the date it was completed, if later), then permanently deleted. A pharmacy may choose to keep them longer. Recurring task schedules are kept while the account is active.
• Cancelled accounts, operational data is retained for 90 days after cancellation, giving you time to export records. After 90 days, it is permanently deleted.
• Billing records, retained for 7 years to comply with Australian taxation and accounting obligations
• Historic cash reconciliation records, the cash reconciliation feature has been withdrawn and no new records can be created. Records entered before it was withdrawn are retained for 7 years from entry under the same taxation obligations, then permanently deleted. They are no longer readable in the application; request a copy or earlier deletion at the address below.
• Email logs, retained per Resend's standard retention (30 days for successful deliveries; 90 days for bounces and complaints), then deleted
• Anonymous/aggregate analytics, retained indefinitely (contains no personally identifiable information)

You can request earlier deletion of your data at any time by contacting privacy@pharmacyhq.com.au. Billing records may be retained longer if required by law.

7. Your privacy rights (Australian Privacy Act)

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights:

Right to access your data

You can request a copy of the personal information we hold about you. We will provide this within 30 days of your request. Your operational data is accessible directly through the application at any time.

Right to correction

If any information we hold about you is inaccurate or out of date, you can correct it yourself within the application or ask us to correct it.

Right to deletion

You can request that we delete your account and associated data. Some data may be retained where required by law (e.g. financial records).

Right to complain

If you believe we have handled your personal information in breach of the Privacy Act, you can lodge a complaint with us at privacy@pharmacyhq.com.au. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

To exercise any of these rights, email privacy@pharmacyhq.com.au. We will respond within 30 days and may need to verify your identity before acting on your request.

8. Cookies, browser storage and tracking

Pharmacy HQ is a single-page web application. We use the following minimal cookies and browser storage:

• Firebase Authentication session cookies, strictly necessary to keep you signed in. These expire when you sign out or after 30 days of inactivity.
• Local preferences, browser local storage may be used to remember UI preferences (for example, the selected tab). Apart from the pharmacy computer setting described below, this data never leaves your device.
• Offline copy of pharmacy data. So that a pharmacy can keep working when its internet connection drops, Pharmacy HQ can keep a copy of the pharmacy data the signed-in person can see, and any changes not yet sent, in the browser's own storage on that computer. This is browser storage, not a cookie. It can include patient and staff records.

  The copy is kept on:

  • a computer the Owner or an Administrator has marked as a pharmacy computer;
  • a computer that has been used with the pharmacy's store login (the shared sign-in for the pharmacy's own computers); and
  • a computer where nobody has yet signed in to Pharmacy HQ.

  On any other computer, once someone signs in there with their own login, Pharmacy HQ runs without the copy from then on. The copy from that first session is cleared when the person signs out. If the browser is closed without signing out, the copy stays on that computer until the next sign-out there.

  Before you sign out, Pharmacy HQ warns you if any of your changes have not yet reached our servers and would be lost.

  The offline copy is protected by the computer's own security (who can use it, and whether its disk is encrypted) as well as by Pharmacy HQ. Pharmacies should mark only computers that stay in the pharmacy as pharmacy computers, and staff should sign out of their own login on any computer the pharmacy does not control.

• Pharmacy computer setting. Pharmacy HQ keeps two small settings on each computer: whether it has been marked as a pharmacy computer, and whether the store login has been used on it. When a computer is marked or unmarked, we record who did it, when, and the browser type in the pharmacy's audit history.

We do not use advertising cookies, third-party tracking pixels, or social media widgets. The landing page (pharmacyhq.com.au) does not use Google Analytics or any equivalent analytics service that tracks individuals across sites.

9. Pharmacy and health-adjacent data

Pharmacy HQ is primarily a workflow and operations dashboard. We are not a clinical management system, regulated health records platform, or dispensing software. However, several features that you (the pharmacy) can optionally enable do require us to store patient-adjacent operational data.

What we may store, when your pharmacy uses the relevant feature:

• Patient identifiers (Medicare, DVA, NDIS, date of birth, address, phone), captured in the Webster patient record, the Care Transfer modal, and the Staged Supply enrolment, so the pharmacy can match patients to PPA claim submissions and operational workflows.
• Dispensing-event records under Staged Supply, when your pharmacy operates a Staged Supply Service (a PSA-defined program for patients managing risk of medication misuse), each per-visit dispensing event is recorded against the patient (drug, scheduled vs actual doses, balance, photographs of wet-signed acknowledgement slips).
• Vaccination claim records, for MedsCheck, NIPVIP, CVCP claims: patient name, DOB, Medicare/DVA, vaccine batch/lot, vaccinator AHPRA number.
• Delivery and Webster pack metadata, patient name, address, pack frequency, delivery notes, packing instructions.

What we still do not store:

• Full clinical medication histories (the dispensing system at your pharmacy remains the system of record).
• Diagnosis or clinical decision documentation.
• My Health Record content (we may write to MHR in future when you connect that integration, but we do not store its contents in our database).

All patient-adjacent data is gated by Firebase Security Rules so that one pharmacy cannot read another pharmacy's records. Per-feature sensitivity controls (e.g. the Staged Supply path is admin-SDK-write-only, every write goes through an authenticated Cloud Function with an audit log) give an extra layer for the most sensitive paths.

Pharmacy owners remain responsible for ensuring their use of the application complies with applicable pharmacy board and privacy regulations. We provide the platform; you remain the data controller for patient information under the Privacy Act.

If you have specific compliance questions for your pharmacy, we recommend seeking independent legal advice or contacting the Pharmacy Guild of Australia.

9a. Our mobile apps

We publish two iOS and Android apps. They are separate apps for separate audiences, and they collect different things. Everything in the rest of this policy applies to both; this section covers what is specific to a phone.

PHQ Team, the staff app

PHQ Team is for people who work at a pharmacy that uses Pharmacy HQ. You sign in with an account your pharmacy gives you; you cannot create one yourself. In addition to the account and operational data described in section 2, the app may collect:

• Location, only at the moment you clock in or out. It is used once, to check you are at the pharmacy, and the result is stored against that clock event. The app does not track your location in the background or between shifts.
• Photographs you take as delivery proof, taken deliberately by you, attached to the delivery, and visible to your pharmacy.
• Documents you choose to attach to a leave request, for example a medical certificate. These are visible only to your pharmacy’s owner and manager, and are kept as part of the pharmacy’s employment records for as long as record-keeping law requires.
• A push notification token for your device, so we can notify you about shifts and messages.
• Basic device information (model, operating system version) for support and crash diagnosis.

Pharmacy HQ, the patient app

The patient app is for customers of a pharmacy that uses Pharmacy HQ. Alongside your account details it may hold your prescription and medication information, your Individual Healthcare Identifier, the pharmacy you are linked to, a record of the device you signed in on, and a push notification token.

Payments for physical goods are handled by Stripe. We never see or store your full card number.

Face ID, Touch ID and your PIN

Both apps can lock behind a biometric check or a PIN. Biometric data never leaves your device and is never sent to us, the device tells the app only whether the check passed.

Notifications do not contain health information

Notification text is deliberately written so that nothing sensitive appears on a lock screen. A notification will tell you that something is ready or that you have a message; it will not name a medicine or a health condition.

Permissions we ask for

Every one of these is optional. You can refuse or later withdraw any of them in your device settings, and the app keeps working with that feature turned off.

Deleting your account from the apps

You can delete your account from inside either app, without contacting us.

In both apps, open Settings (the gear at the top of the screen) and choose “Delete my account”. In PHQ Team, this removes your sign-in, your membership of every pharmacy you belong to in the app, the link between your sign-in and your staff card, and your notification tokens. It does not delete your pharmacy’s employee records of you (rosters, hours, leave and pay), which Australian workplace law requires the pharmacy to keep for seven years; those belong to the pharmacy, not to your app account. A pharmacy owner’s sign-in is the pharmacy’s own account, so it is closed from the web app rather than from a phone: under Settings in the sidebar, cancel the subscription in Manage plan, then choose Leave a pharmacy. Once the owner is the pharmacy’s only member, leaving deletes the pharmacy.

In the patient app, it removes your sign-in, the link between your account and the pharmacy’s record of you, your stored consent, the record of your device, and your notification tokens. After it completes, no login can reach that record.

It does not delete your pharmacy’s own records of your prescriptions or your conversations with them. Those are the pharmacy’s health and business records, and Australian law requires the pharmacy to keep them for a set period. That is the pharmacy’s data, not your app account’s, and section 6 explains how long it is kept.

What the apps do not do

• They contain no advertising and no advertising identifiers.
• They contain no third-party analytics or tracking software.
• We do not sell your data, and we do not share it with data brokers.
• We do not track you across other companies’ apps or websites.

10. Children's privacy

Pharmacy HQ is a professional business tool intended for use by adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at privacy@pharmacyhq.com.au and we will promptly delete the account.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all registered account holders at least 14 days before the change takes effect

Continued use of Pharmacy HQ after the effective date of any changes constitutes your acceptance of the updated policy.

12. Contact us

For any privacy-related questions, requests, or complaints:

• Privacy requests and complaints: privacy@pharmacyhq.com.au
• Security reports: security@pharmacyhq.com.au
• General support: support@pharmacyhq.com.au
• Website: www.pharmacyhq.com.au

We aim to respond to all privacy enquiries within 5 business days.

Office of the Australian Information Commissioner (OAIC)
If you are not satisfied with our response to a privacy complaint, you may contact the OAIC:
Website: www.oaic.gov.au  ·  Phone: 1300 363 992  ·  GPO Box 5218, Sydney NSW 2001