Who we are and what this covers
“Rxflow”, “we” and “us” mean the operator of the Rxflow platform (ABN 73 672 801 937). This policy covers this website and the Rxflow platform used by pharmacies, clinics and their patients.
Pharmacies and clinics that use Rxflow (our customers) decide what patient information they collect and how they use it. For patient records we act on their behalf, and their own privacy policy also applies. If you are a patient, your pharmacy or clinic is usually the best first contact for questions about your records.
Information we collect
Depending on how you use Rxflow, we may hold:
- Contact details: name, email, mobile number and address.
- Health information: prescriptions, repeats, medicines, consultation notes, appointment history and Medicare or Individual Healthcare Identifier (IHI) details, entered by your pharmacy, clinic or prescriber, or by you.
- Orders and payments: what you ordered, delivery or collection details, and payment status. Card details are handled by our payment provider and never stored by Rxflow.
- Messages: the reminders, emails and SMS sent to you, so there is a record of what went out.
- Account and usage data: sign-in details, device and browser information, and an audit log of actions taken in the platform.
- Business details: for pharmacy and clinic staff, your role, organisation and work contact details.
Health information is sensitive information under the Privacy Act. We only collect it with consent, or where it is required or authorised by law.
How we use it
- To run the platform for your pharmacy or clinic: bookings, consultations, prescriptions, orders and fulfilment.
- To send the reminders and messages your pharmacy or clinic has switched on, such as a repeat becoming available.
- To keep the platform secure, prevent misuse and keep an audit trail.
- To provide support, and to improve Rxflow using de-identified or aggregated data.
- To meet legal obligations, including record-keeping and real-time prescription monitoring where it applies.
We do not sell personal information, and we do not use health information for advertising.
Reminders, SMS and email
Your pharmacy or clinic decides which reminders and messages are sent. Service messages about your own prescriptions or orders are part of the care you have asked for. Any marketing message will include a simple way to opt out. To stop reminders, contact your pharmacy or clinic, or email us at privacy@rxflow.com.au.
Where it is stored and how it is protected
Rxflow is hosted in Australia (AWS Sydney region). We use encryption in transit and at rest, multi-factor authentication for staff accounts, role-based access, and audit logging of access to patient records.
Some service providers, such as SMS and email delivery, may process limited contact details outside Australia to deliver a message. Where that happens, we take reasonable steps under APP 8 to make sure the information is handled consistently with the APPs.
How long we keep it
We keep health records for as long as our customers need them to meet their legal and professional record-keeping obligations, and other information only as long as it is needed. When information is no longer required, we securely delete or de-identify it.
Accessing and correcting your information
You can ask to access or correct personal information we hold about you. For patient records, we will usually work with your pharmacy or clinic to respond. Email privacy@rxflow.com.au and we will reply within 30 days. We may need to confirm your identity first.
Data breaches
If a data breach is likely to cause serious harm, we will notify the affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and work with our customers to respond.
Questions and complaints
Contact our privacy officer at privacy@rxflow.com.au. We aim to resolve complaints within 30 days. If you are not satisfied, you can contact the OAIC at oaic.gov.au or on 1300 363 992.
We may update this policy from time to time. The latest version is always on this page.