1. Who we are
Pharmacy Run is a pharmacist service powered by House of Pharmacy. Approved House of Pharmacy stores, pharmacies, fulfilment locations and delivery providers may perform parts of an order.
This Policy explains how we manage personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles and, where applicable, health-records and pharmacy laws including the Health Records and Information Privacy Act 2002 (NSW).
2. The information we handle
Identity, account and contact information
This may include name, date of birth, username, email, phone, address, authentication records, authorised representative details, consent and communication preferences.
Order, payment and customer-service information
This may include items viewed or ordered, basket, price, discount, payment status and token, invoice, refund, return, correspondence, complaint, review and support records. Pharmacy Run does not need to store complete payment-card details where a secure payment provider processes them.
Delivery information
This may include address, postcode, delivery window, instructions, access details, carrier, status, geolocation associated with a delivery event, recipient, signature, identity-check result, photograph or other proof of delivery and failed-delivery information.
Health and pharmacy information
This is sensitive information and may include patient identity, prescriptions, eScript tokens, medicine and dispensing information, repeats, allergies or sensitivities, questionnaire answers, medical or health context relevant to supply, consultation and pharmacist notes, concession status, prescriber details, and professional decisions or communications.
Government-related identifiers
We may collect and use Medicare, concession or other government-related identifiers where lawful and reasonably necessary for pharmacy, benefit, identity or record-matching functions. We do not use these as a general account identifier.
Device, usage and security information
This may include IP address, device and browser details, login, session, cookie consent, security alerts, referring page, website interactions, approximate location and diagnostics. We restrict tracking on health-sensitive journeys as described below.
Business and other information
If you contact us as a supplier, partner, applicant or professional contact, we may collect your role, organisation, work contact details, application or enquiry information.
3. How we collect information
We collect information directly when you browse, enter an address, create an account, complete a patient form, submit a prescription or eScript, order, pay, receive delivery, contact us, subscribe, respond to a survey or review a product.
We may also receive information from:
- an authorised parent, guardian, carer or representative;
- prescribers, electronic prescription exchanges and patient or script systems;
- House of Pharmacy entities, supplying pharmacies and pharmacy systems;
- payment, identity, fraud and security providers;
- delivery, logistics and proof-of-delivery providers;
- public or regulatory sources where lawful; and
- another party you direct or authorise.
If you provide information about another person, you must be authorised and must make them aware of the relevant notice where practicable.
4. Why we collect, use and disclose information
We handle personal information to:
- check whether a service, product or delivery option is available;
- create, administer, secure and support accounts;
- validate and retrieve prescriptions and eScripts;
- assess, dispense and supply medicines and provide pharmacist services;
- verify identity, age, authority, patient and concession status;
- process orders, payments, cancellations, refunds, returns and disputes;
- allocate, prepare, track and deliver orders, including failed-delivery resolution;
- provide support, investigate issues and communicate with you;
- manage product safety, recalls, adverse events and professional obligations;
- detect and prevent fraud, misuse, unauthorised access and security incidents;
- operate, test, audit, analyse and improve the service;
- maintain records and comply with legal, regulatory, tax, pharmacy and professional requirements;
- manage suppliers, insurers, advisers, claims and corporate transactions; and
- send service or marketing communications in accordance with your choices and applicable law.
We may use de-identified or aggregated information for planning, operations, research and analysis where individuals are not reasonably identifiable.
5. Health information and pharmacist confidentiality
Health information is collected only where it is lawful, reasonably necessary and relevant to the pharmacy service. We use and disclose it primarily to provide that service, or for a directly related purpose you would reasonably expect, a permitted health or safety purpose, a legal obligation, or with consent.
Prescription submission does not guarantee supply. Pharmacists may access the information needed to review the request, communicate with the patient or authorised representative, record their decision and meet professional duties.
We do not sell health information. We do not use prescription, eScript, medication, patient-questionnaire, consultation or pharmacist-note information for targeted advertising, lookalike audiences or marketing profiling.
6. When we disclose information
We disclose only information reasonably needed for the authorised function to:
- House of Pharmacy entities and approved supplying or fulfilment pharmacies;
- pharmacists, pharmacy staff, prescribers and other authorised health professionals;
- prescription exchange, patient, pharmacy-management and medication-record providers;
- delivery, courier, logistics, warehousing and proof-of-delivery providers;
- payment, banking, identity, fraud and security providers;
- hosting, software, support, communications, document, analytics and professional-service providers;
- insurers, auditors, lawyers, accountants and corporate advisers;
- regulators, courts, government agencies, law enforcement or emergency services where authorised or required; and
- another party with consent or at your direction.
7. Cookies, analytics and advertising
Our Cookies Statement explains our cookie categories and choices. Strictly necessary technologies support account, security, basket, checkout, consent and payments. Optional technologies may support functionality, analytics and marketing with the required choice or consent.
We apply stricter controls to health-sensitive journeys. Advertising and behavioural pixels must not operate on prescription, eScript, medicine questionnaire, patient or pharmacist pages. Analytics must not capture eScript tokens, form contents, medication or health details, payment-card information, patient identifiers or sensitive content in URLs, events, recordings or logs.
8. Direct marketing and service messages
We may send marketing where we have consent or another lawful basis. Messages identify the sender and provide a functional unsubscribe method. We keep evidence of consent and action unsubscribe requests as required.
Buying from Pharmacy Run does not by itself mean you consent to every form of marketing. Marketing choices are optional and should be separate from checkout and patient consent.
Unsubscribing from marketing does not stop necessary messages about an order, pharmacist request, security, product safety, recall, delivery, legal notice or account administration.
9. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. These may include encryption in transit and at rest, Australian-hosted patient data stores where specified, role-based and store-level access, multi-factor authentication, audit logging, secure APIs, monitoring, backup, vendor controls, staff training and incident response.
No method is risk-free. You should use a unique password, protect eScript tokens and devices, sign out of shared devices and contact us if you suspect unauthorised access.
10. Retention and deletion
We retain information only for as long as reasonably needed for the purpose, pharmacy and health-record obligations, tax and accounting, legal claims, safety, audit, fraud prevention and other lawful requirements. Different records have different minimum periods.
When information is no longer required, we take reasonable steps to destroy or de-identify it, subject to backups, legal holds and mandatory pharmacy or health-record retention. The approved production retention schedule will govern account closure, support, delivery, marketing, patient and prescription records.
11. Access and correction
You may request access to personal information we hold and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact info@houseofpharmacy.com.au.
We will respond within the period required by applicable law and explain any permitted refusal. Some information may need to be accessed or corrected through the supplying pharmacy, prescriber, electronic prescription system or other record holder; we will direct or assist you where appropriate.
12. Data breaches
We maintain a response process to contain, assess and remediate suspected breaches. Where an eligible data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, unless an exception applies.
13. Privacy complaints
Send a complaint to the Privacy Officer at postal address 3 Coal St, Silverwater 2128, email info@houseofpharmacy.com.au or by phone 1800 875 225. Include your contact details, what happened, the outcome you seek and relevant dates. Do not email passwords, payment-card details or eScript tokens.
We will acknowledge the complaint and investigate it fairly. Our target response is within 2 business days, subject to complexity and legal timeframes. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner. Health-privacy complaints may also be eligible for the NSW Privacy Commissioner or another applicable health complaints body.
14. Changes to this Policy
We may update this Policy as services, law, technology or providers change. The current version will be published with its effective and last-updated dates. We will provide additional notice or seek consent where required for a material change.
15. Contact us
Privacy Officer, Pharmacy Run
House of Pharmacy Retail Services Pty Ltd ABN 58 682 591 546,
Postal address: 3 Coal St, Silverwater 2128,
Email: info@houseofpharmacy.com.au
Phone: 1800 875 225.