Privacy Policy

This Privacy Policy describes how Integra Medical Group Pty Ltd ACN 668 298 459 and its related bodies corporate ("we", "us" and "our") collect, use, and disclose information about you, and what choices you have with respect to that information.

It applies to your use of our software (Software), websites (Websites), and related services.

The first section explains which privacy terms apply to you depending on what type of user you are.

If you do not agree with this Privacy Policy, do not access or use the Software, Websites, or related services.

1. What type of user am I and which privacy terms apply to me?

2. Privacy terms for Subscribers.

3. Privacy terms for Patients.

4. Privacy terms for Site Visitors.

5. Privacy terms for all users.

6. Your other privacy rights.

7. Questions or complaints.

8. Contact us.

Depending on the products used, there are different types of users and individuals whose personal information we collect.

Subscribers are users who use the Software as part of a subscription plan. Subscribers may include clinicians, health care clinics, hospitals or other institutions or businesses (Clinics), as well as private individuals using non-clinic-facing software.

For Subscribers who are employees or staff members of a Clinic, the Software features and functionality available to them are determined by the specific terms agreed between us and the Clinic under the relevant clinic agreement.

The Clinic controls its instance of the Software and is the data controller of information collected through the Software about Subscribers. We act as data processor for that information.

Patients are Clinic clients. If a Patient uses non-clinic-facing Software, they may also be treated as a Subscriber for the purposes of this Privacy Policy.

Site Visitors are users of the Websites. Site Visitors may simply browse the Websites, or may be Subscribers or Patients seeking information about us or our products. We are the data controller for information collected through the Websites about Site Visitors.

This section applies only to Subscribers.

If you are a Subscriber who is an employee or staff member of a Clinic, the clinic agreement governs the collection and processing of information collected from you through the Clinic's Software environment, including associated messages, attachments, files, tasks, conversations and other submitted content (Workplace Content).

If there is a conflict between this Privacy Policy and the clinic agreement for Workplace Content, the clinic agreement governs.

Because the Clinic controls the workplace used by Subscribers, questions about workplace settings and privacy practices should be directed to the Clinic whose workplace you use.

If you are a Subscriber located in the European Union, the Clinic is the data controller for Workplace Content under the GDPR and we process that information on behalf of the Clinic.

Please contact your workplace owner or administrator to exercise applicable data subject rights, including rights to access, delete, rectify, transfer or object under the GDPR.

We require Subscribers to provide information needed to provide access to the Software. Other information may be collected automatically as the Software is used.

Workplace Content is collected, used and shared in accordance with the Clinic's instructions, the applicable clinic agreement, and applicable law. The Clinic determines its own internal policies for storage, access, modification, deletion, sharing and retention of Workplace Content.

To set up an account, you or the Clinic may provide basic information including name, address, telephone number, email address and password. You may also provide optional profile information such as a photograph or demographic data.

Individual Subscribers may also provide information described in the Privacy Terms for Patients section of this Privacy Policy.

If you submit payment information in connection with Software use, a third-party payment processor may collect and store payment information on our behalf.

As you use the Software, we collect information about how you use and interact with it.

Device information may include device type, operating system, mobile network information, mobile phone number, MAC address and other unique device identifiers.

Log files may include web request information, IP address, browser type and settings, referring and exit pages, URLs, click counts, date and time stamps, language preferences, cookie data and similar information.

Location information may include approximate geographic location inferred from an IP address.

Workplace use metadata may include high-level non-content information about how you work in your workplace.

Other information may include information you provide through support forms, sales forms, user research, beta testing, support requests, technical assistance and other communications with us.

We may view and use Workplace Content only as necessary to maintain, provide and improve the Software; prevent or address technical or security issues; resolve support requests; investigate alleged violations of applicable terms; comply with lawful requests; or as otherwise permitted by the clinic agreement or written permission from the Clinic.

We may use account information, Service Usage Information and other Subscriber information to maintain, provide, improve and protect the Software; respond to information requests; resolve support issues; comply with lawful requests; analyse usage; understand user interests and needs; and communicate important service notices and updates.

Where permitted by law, we may communicate promotions, offers and news about us. You can opt out of these communications.

We may also use information for cross-device account management, including where service providers help recognise the same user across multiple browsers or devices to save preferences and analyse usage.

Information about Patients may be entered into clinic-facing Software by a Clinic or transferred from individual-facing Software with the individual's consent.

Patient information may include name, gender, date of birth, address, email address, telephone number, emergency contact information, health conditions, diagnosis details relevant to botulinum toxin treatment, referring physician, concurrent medication and treatment effect.

We may use Patient information to maintain, provide and improve the Software; conduct analysis, research and reporting; respond to Patient requests; prevent or address technical or security issues; resolve support requests; investigate alleged violations of terms; comply with lawful requests; understand user interests and needs; customise the Software; and protect users in emergencies.

This section applies only to Site Visitors and to use of the Websites, not to use of the Software.

If you submit a request or question through the Websites, we may collect contact information including name, email address, phone number, postal address, communication records, the issue raised and how it was resolved.

As you browse the Websites, we and our service providers may collect usage information through cookies and similar tools. This may include web request information, IP address, browser type and settings, referring and exit pages, URLs, click activity, domain names, landing pages, pages viewed, mobile carrier, mobile device identifiers, device information, and date and time stamps.

We may also collect approximate location information inferred from the device used to access the Websites or Software.

We and our service providers use internet server logs, cookies, tags, SDKs, tracking pixels and similar technologies to collect Websites Usage Information.

Cookies may help recognise your computer and login session, store preferences and settings, understand which pages you visit, improve your experience, measure content and advertising, perform analytics, and assist with security and administration.

Tracking pixels may help measure ad impressions, clicks, email open rates, Website popularity and advertising performance, and may access user cookies.

You can change browser settings to notify you when a cookie is set or updated, or to block cookies. Browser help settings provide more information.

We use Site Visitor information to maintain, provide and improve the Websites and Software; respond to information requests; send promotional communications where permitted; prevent or address technical or security issues; investigate alleged violations of terms; understand Site Visitor interests and needs; and analyse Website and Software use.

We may use third-party web analytics services on the Websites to collect and analyse usage information through cookies and similar tools, perform auditing, research and reporting, and provide features.

The Websites may integrate third-party advertising technologies that allow relevant content and advertising to be delivered on our Websites and on other websites you visit.

Third parties whose products or services are accessible or advertised through the Websites may place cookies or tracking technologies on your device. We do not control those third-party technologies.

We may provide Site Visitor information, such as email addresses, to service providers who match that information in de-identified form to cookies, mobile advertising identifiers and other proprietary IDs to provide more relevant advertising.

Do Not Track is a privacy preference available in some browsers. We do not currently recognise or respond to browser-initiated Do Not Track signals.

Where necessary, permitted by law, or with your consent, we may supplement information we receive from you with information from third-party sources.

Our Websites and Software are not targeted towards, nor intended for general use by, anyone under 18 years of age. You may only use the Websites and Software if you are at least 18 years of age and can form legally binding contracts under applicable law.

For services that may be used by children under 16 years of age, such as a migraine tracking mobile app, we comply with applicable legislation relating to minors and ask the user to register with a first name and unique identifier only.

To the extent we collect personal information of minors under 16 years of age, we do not and will not sell that information without affirmative authorisation.

Our legal basis for collecting and using personal information depends on the personal information concerned and the context in which we collect it.

Legal bases may include performance of a contract, legitimate interests, legal compliance, and consent.

We may share information with related bodies corporate, affiliated businesses, service providers, professional advisers and other third parties who perform services on our behalf.

If ownership of all or substantially all of our business changes, information may be transferred to the new owner so the Software and Websites can continue to operate, subject to this Privacy Policy until modified by the acquiring party and subject to applicable law.

We may disclose information as required by law or legal process, at the request of governmental authorities conducting an investigation, to enforce our rights or policies, to protect safety and security, for a purpose disclosed elsewhere in this Privacy Policy, or with your consent or direction.

Personal information may be transferred to, stored in, or processed in Australia and other countries around the world.

Where third-party service providers operate those servers or environments, we take reasonable steps to work with providers subject to laws, binding schemes or contracts that uphold fair information handling principles substantially similar to the original jurisdiction, or another valid exception.

We also require relevant providers to protect personal information in accordance with applicable privacy legislation and to destroy or de-identify personal information once it is no longer needed.

By agreeing to this Privacy Policy, you expressly consent to your personal information being transferred, stored and processed in this way to the extent permitted by law.

We retain information for the period necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law, or where the clinic agreement requires or permits specific retention or deletion periods.

We may aggregate or de-identify information collected through the Software or Websites so it can no longer be linked to you or your device. We may use and share aggregate or de-identified information for any purpose, including research and analytics.

We take technical and organisational measures to protect information against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure and unauthorised access.

No method of internet transmission or electronic or physical storage is absolutely secure, so we cannot ensure or warrant absolute security.

If you receive email from us, we may use analytics tools such as clear GIFs to capture data such as email opens and link clicks, which helps us measure communications and campaigns.

You may instruct us not to use your contact information for email, postal mail or phone marketing about products, services, promotions and events by contacting us. Commercial emails may also include opt-out instructions.

Even if you opt out, we may still use and share information as permitted by this Privacy Policy or required by law, including operational and service-related emails.

You may access, review, update, correct or delete certain online account information, or close your account, by logging in to your account where that functionality is available.

If you cannot access or correct information through your account, contact privacy@bntxinteract.com with details of the request and proof of identity.

We take reasonable steps to verify identity before responding to requests. Verification steps vary depending on the sensitivity of the information and whether you have an account with us.

We may retain cached or archived copies for a period required by law and may retain de-identified information indefinitely. It may not always be possible to completely remove all information from databases or backup media.

Subject to applicable law, we may charge a reasonable fee to cover the cost of verifying an application and locating, retrieving, reviewing and copying requested material.

We endeavour to respond to written requests within 30 business days after receiving a request.

We may amend this Privacy Policy at any time to reflect changes in law, collection and use practices, Software or Website features, or technology.

The revised Privacy Policy will be made accessible through the Software and Websites. If we make a material change, we will comply with applicable legal requirements for notice or consent.

Depending on your country or state of residency, you may have legal rights with respect to personal information, including rights of access, rectification, restriction, portability, objection or opt out, withdrawal of consent, erasure or deletion, non-discrimination, not being subject to automated decision-making, and lodging a complaint.

Some rights may be facilitated through the Websites or Software.

Individuals located in the European Union may also have rights under the GDPR, including confirmation, portability, objection and restriction of processing rights.

California law gives California residents certain rights to request information about how categories of personal information may be shared with third parties for direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

If you have questions about this Privacy Policy, processing of your data, or concerns or complaints about the administration of this Privacy Policy, contact privacy@bntxinteract.com with a summary and any relevant documentation.

We will investigate complaints and endeavour to respond within 30 business days. We will take immediate steps to redress proven privacy concerns or breaches.

If you are an Australian resident and do not receive a response after 30 days, or are not satisfied with the response, you may contact the Office of the Australian Information Commissioner to make a complaint or access information about privacy rights.

Integra Medical Group Pty Ltd.

Suite 12.01, Level 12, 54 Miller St, North Sydney NSW 2060.

Email: privacy@bntxinteract.com.