Your information, accounted for
The plain-language version of our privacy practices. What we collect, where it’s stored, who can access it, how long we keep it, anchored to specific Australian laws and named data systems. For more detail, see the Privacy Policy.
Clinical data
What we collect to deliver care
Australian Privacy Principle 3 requires us to only collect personal information that is reasonably necessary for the service. The examples below explain common categories. The information needed depends on the service and your circumstances.
Name, date of birth, Medicare or IHI number, contact details
Record and AIRUsed to identify you and match the clinical and AIR records where applicable. The pharmacist explains which details are needed; a Medicare card is not available or required for every person or program.
Stored at: Pharmacy clinical system + AIR (Services Australia)
Pre-vaccination screening answers
Pharmacy recordUsed to assess suitability and document the pre-vaccination discussion.
Stored at: Pharmacy clinical record
Vaccine administered + batch + site + date
Record and AIRRecorded in the clinical record and reported to AIR in line with the applicable requirements. An entry may not appear immediately.
Stored at: AIR (Services Australia) + pharmacy clinical system
Post-vaccination observation notes
Pharmacy recordDocuments observation and any concerns noted. At least 15 minutes is generally recommended; the clinician may advise longer.
Stored at: Pharmacy clinical system; relevant information may be reported to SAEFVIC through SAFEVAC
Sensitive health history you choose to share
Pharmacy recordCollected where necessary for clinical care or another lawful purpose, such as required record keeping. Ask the pharmacist why a detail is needed.
Stored at: Pharmacy clinical record; shared only with a lawful basis, such as care, consent or a legal requirement
Analytical data
What we collect to improve the site
Optional analytics start only after you choose Accept all. A random identifier distinguishes browsers; this is not fully anonymous data. We do not send health answers or form text. Choose Manage cookies in the footer to withdraw consent. We also respect Do Not Track and Global Privacy Control.
Website analytics with a random browser identifier
Optional analyticsPostHog groups general page visits and actions from the same browser. Consenting browsers may see different booking-button wording for a comparison of general interactions; this does not confirm appointment bookings. We exclude health answers, form text, detailed clinical page addresses and URL queries. We do not record screens or link analytics to your booking or clinical record.
Stored at: PostHog (United States), only after you choose Accept all
Page performance (Vercel Speed Insights)
Optional analyticsMeasures loading, responsiveness and layout stability using general page groups. Queries, fragments and detailed clinical routes are excluded.
Stored at: Vercel (United States), only after you choose Accept all
Connection information for website hosting
Website deliveryThe hosting provider receives your IP address and request information to deliver and secure the website. This is separate from optional analytics.
Stored at: Vercel hosting systems
Retention
How long we keep it
Clinical record retention and website data retention follow different rules. Contact the pharmacy if you need details about a record or a request to remove information.
| Data | Period | Legal basis |
|---|---|---|
| Adult clinical records (vaccination + screening) | Generally at least 7 years from the last health service | Health Records Act 2001 (Vic), Schedule 1, HPP 4.2. Other requirements may require longer retention. |
| Paediatric clinical records (under-18 at time of care) | Generally until at least age 25 | Health Records Act 2001 (Vic), Schedule 1, HPP 4.2. The applicable period depends on when the information was collected and other requirements. |
| AIR record | Managed by Services Australia | AIR retention and access follow Services Australia requirements. |
| PostHog website analytics | Contact us for current retention details | Retention depends on the configured project settings. Withdrawal stops future capture; it does not automatically erase earlier events. |
| Vercel hosting and performance data | Contact us for current retention details | Retention depends on the hosting service and account settings. |
| External booking records | See booking-provider policies | The Priceline booking portal is powered by Healthengine. Review the notices presented when you book. |
Your rights
What you can do with your data
Under the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic) you have specific, enforceable rights. Here’s how to use each one.
Access your record
Contact the pharmacy to request access. Identity checks, legal exceptions and permitted access fees may apply. We explain the process and any charge. You can also obtain an AIR immunisation history statement through the available Services Australia channels.
Correct your record
Tell the pharmacy which information you believe is inaccurate, incomplete or out of date. Correction requests are assessed under applicable privacy law. For an incorrect vaccination entry, contact the administering provider; Services Australia can also help with AIR access.
Get a copy to take elsewhere
You can ask for information to be shared with another provider. The pharmacy checks your identity and authority, the requested scope and a suitable transfer method. Ask about any permitted charge before proceeding.
Opt out of analytics
Choose Manage cookies in the footer, then Essential only. This stops future optional analytics and performance capture. It does not delete information already received by a provider. Contact us about access or deletion requests.
If we don’t resolve a privacy complaint to your satisfaction, you can escalate to the Office of the Australian Information Commissioner (OAIC) for federal privacy matters, or to the Health Complaints Commissioner (Vic) for Victorian health-information matters.
Processors
Services involved in handling information
These are the main services used by the website and care pathway. Provider policies explain their own processing and subprocessors. Ask the pharmacy about the clinical systems used for your care.
| Processor | Purpose | Country |
|---|---|---|
Services Australia (AIR) Their privacy policy | National immunisation register , required by law | Australia |
Pharmacy clinical record systems | Clinical care and documentation | Ask the pharmacy for system and hosting details |
Priceline booking portal / Healthengine Their privacy policy | External online appointment booking | See provider privacy policy |
PostHog Their privacy policy | Optional analytics using a random browser identifier | United States |
Vercel Their privacy policy | Website hosting and optional performance measurement | United States |
Web3Forms Their privacy policy | Delivers contact form messages | See provider privacy policy |
hCaptcha Their privacy policy | Checks contact form submissions for automated abuse | See provider privacy policy |
Google Translate (when you use the translate button) Their privacy policy | Opens an external Google translation service for the page you choose. Google receives the page address and connection information. | United States |
TIS National (when interpreting is arranged) Their privacy policy | Interpreter support; funding eligibility is checked | Australia |
Unsplash image delivery Their privacy policy | Delivers some stock photographs and receives connection information when they load | See provider privacy policy |
Google Maps (when you choose to load a map) Their privacy policy | Displays the pharmacy location after your request | See provider privacy policy |
Understand how your information is handled
For the formal version with the Privacy Act sections cited, see the Privacy Policy. For the safety side of this picture, see the Quality and safety framework.