Privacy Policy

Last updated: 4 April 2026

1. About This Policy

This Privacy Policy explains how NUYU Clinic Pty Ltd (ABN 35 692 027 937), trading as NUYU Health Technologies ("we", "us", "our"), collects, holds, uses, and discloses personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all products and services operated by NUYU Health Technologies, including CompoundConnect, AestheticOS, PeptiClinic, and the NUYU Health Technologies website.

2. What Personal Information We Collect

The types of personal information we may collect depend on how you interact with us:

Website visitors

Email address (if you subscribe to updates or contact us)
Browser type, IP address, and usage data collected via cookies and analytics

Clinic practitioners and staff (SaaS users)

Name, email address, phone number
Professional registration details (AHPRA number, HPI-I, prescriber number)
Practice address and ABN
Payment and billing information

Patients (via clinic platforms)

Name, date of birth, contact details
Health information including medical history, conditions, allergies, and medications
Medicare number and Individual Healthcare Identifier (IHI)
Consultation records and clinical notes
Prescription and pathology information

Sensitive information: We collect health information and other sensitive information only with consent and where it is reasonably necessary for the provision of healthcare services through our platforms. This is handled in accordance with APP 3.3 and APP 3.4.

3. How We Collect Personal Information

We collect personal information:

Directly from you (via forms, account registration, or correspondence)
From clinic practitioners who use our platforms to manage patient care
From third-party services (e.g. Stripe for payments, Zoom for telehealth)
Automatically via cookies, analytics tools, and server logs when you visit our websites

4. Why We Collect Personal Information

We collect and use personal information for the following purposes:

To provide, maintain, and improve our software products and services
To enable clinic practitioners to deliver healthcare services to their patients
To process payments and manage billing
To communicate with you about your account, services, or enquiries
To comply with legal obligations, including healthcare regulations and the Therapeutic Goods Act 1989
To send marketing communications (only with your consent, which you may withdraw at any time)

5. Disclosure of Personal Information

We may disclose personal information to:

Service providers: cloud hosting (DigitalOcean, AWS — Australian regions), payment processing (Stripe), email delivery (Resend), telehealth (Zoom), and analytics providers
Pharmacy partners: where a clinic uses our prescription dispatch features, relevant prescription and patient details are shared with the dispensing pharmacy
Regulatory bodies: where required by law (e.g. TGA adverse event reporting, Medicare compliance)
Professional advisers: legal, accounting, or insurance advisers as necessary

We do not sell personal information. We do not disclose personal information to overseas recipients except where our cloud infrastructure providers may process data in data centres outside Australia, in which case we take reasonable steps to ensure compliance with the APPs (APP 8).

6. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure (APP 11). Our measures include:

Encryption in transit (TLS/HTTPS) and at rest
Access controls and role-based permissions
Regular security assessments
Secure password storage (bcrypt hashing)
Audit logging of data access
Daily encrypted database backups with 30-day retention

7. Data Retention

We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law. Healthcare records are retained in accordance with applicable state and territory health records legislation. When personal information is no longer needed, we take reasonable steps to destroy or de-identify it.

8. Your Rights

Under the APPs, you have the right to:

Access the personal information we hold about you (APP 12)
Request correction of inaccurate, incomplete, or out-of-date information (APP 13)
Withdraw consent for marketing communications at any time
Complain if you believe we have breached the APPs

To exercise any of these rights, contact us using the details below.

9. Cookies and Analytics

Our websites use cookies and analytics tools (such as Google Analytics) to understand how visitors use our sites and to improve the user experience. You can control cookies through your browser settings. We may also use marketing pixels (Google Ads, Meta) with your consent for advertising measurement purposes.

10. Notifiable Data Breaches

In the event of an eligible data breach, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988, including notifying the OAIC and affected individuals as required.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website with the date of last update.

12. Contact Us

If you have questions about this Privacy Policy, wish to access or correct your personal information, or wish to make a complaint, please contact us:

NUYU Clinic Pty Ltd (trading as NUYU Health Technologies)
ABN 35 692 027 937
Level 8, 805/220 Collins St, Melbourne VIC 3000
Email: [email protected]

If you are not satisfied with our response to your complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by phone on 1300 363 992.