Privacy Policy

Bloody Good Tests Pty Ltd (ABN 62 667 990 963 / ACN 667 990 963), trading as Eirly Health ("Eirly", "we", "us", "our").

In this policy, Diagnostic Services includes pathology, diagnostic imaging (radiology), at-home test kits, and other diagnostic and health services supplied by providers and vendors through the Eirly Marketplace (Diagnostic Providers).

1. Who this policy covers

This policy applies to personal information we collect through:

• bloodygood.com.au, bloodygoodtests.com.au and eirly.health;
• the Eirly Marketplace;
• our customer portal (my.eirly.health / my.bloodygoodtests.com.au);
• our practitioner portal (app.eirly.health / app.bloodygoodtests.com.au);
• our mobile applications and digital health tools;
• telephone, email and chat support; and
• collection centres and at-home sample kits.

We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), and by health records legislation in the states and territories where we operate — including the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Health Records (Privacy and Access) Act 1997 (ACT).

2. What "personal information" and "sensitive information" mean

Personal information is information or an opinion about you where you are identified or reasonably identifiable, whether or not accurate or recorded. For us this includes your name, contact details and date of birth; Medicare and payment details; the Diagnostic Services you request; your Results; and any notes or interpretations a practitioner records about you.

Sensitive information attracts stronger protection, and we generally need your consent to collect it. For us it includes health information (your Results, the tests or scans you request, your symptoms and medical history), genetic information, and other information collected to provide your Diagnostic Service (such as name, date of birth and sex at birth) that becomes health information because it is collected to provide a health service.

3. Dealing with us

We need your correct contact details to follow up on your Results and for clinical purposes. We do not require identification beyond what is needed to provide the Diagnostic Service, unless a provider requires it.

4. Who "owns" your information

Australian privacy law does not treat personal information as property. Your Results are yours to use and share. We are responsible for the information we hold, and hold it to provide our services and because health records legislation requires us to. The record is distinct from the information: you can access and copy it, but you cannot require us to destroy a health record on request, because the law requires us to keep it for the periods in section 22. Diagnostic Providers and practitioners hold their own copies under their own obligations. We do not sell your information.

5. What we collect

• Identity and contact — name, date of birth, sex at birth, email, phone, and delivery address for at-home kits. We collect only what is needed to provide your chosen Diagnostic Service.
• Diagnostic information — the Diagnostic Services you order and the Results (pathology reports, imaging reports and other diagnostic results) we receive.
• Payment and transaction — billing details, purchase history, invoices and refunds. Card details are processed by our payment provider and not stored by us.
• Your ordering practitioner — where a practitioner orders for you.
• Account — login credentials, settings, preferences, and account activity.
• Medicare details — where your test is billed to Medicare, your Medicare number.
• Online activity — IP address, device/browser identifiers, approximate location, pages viewed and cart activity, via cookies, tags and pixels.
• Practitioner details — for practitioners: identity, contact, registration/practice details, and portal activity.

6. How we collect it

Directly from you; generated by us or our Diagnostic Providers (Results, reports, genetic and molecular data); from a practitioner ordering for you; from someone acting for you (a parent, guardian, carer or authorised person); and automatically via cookies, tags, pixels and analytics.

7. Why we collect and use it

• Providing your Diagnostic Services — processing your order, arranging collection or imaging, referring to a Diagnostic Provider, producing and checking Results, delivering and presenting them (including trends), and arranging recollection where needed.
• Clinical governance and safety — review by an appropriately qualified practitioner, flagging Results needing urgent attention, quality assurance, audit, accreditation, and investigating incidents and complaints.
• Running our business — payment, billing, refunds, debt recovery, account management, support, records, tax, improving our services and developing new ones, and staff training.
• Communicating with you — service messages (which you cannot opt out of), including communications about your own Results and suggested follow-up testing, and marketing where permitted.

8. Consent

For health and other sensitive information, we ask at the point of collection and tell you what we are collecting and why at that moment. Creating an account is not blanket consent to collect health information. You may withdraw consent via our Privacy Officer at any time; withdrawal may limit the services we can provide, and does not affect information we must retain by law or disclosures already made.

Information collected automatically as you browse — cookies, tags and analytics — works differently, and section 8A explains it.

8A. Cookies, tags and analytics

When you browse our websites we and our providers set cookies and similar technologies. We use them to keep you signed in and keep the site secure (these are necessary for the site to work), to remember your preferences, and to measure how the site is used so we can improve it.

Analytics tell us things like which pages are visited and how people move through the site. They are not used to build a health profile of you, and we do not use your Results, your test selections or your questionnaire answers for advertising. Where our consumer store uses advertising or measurement tags supplied by a third party, those tags may receive information about the pages you visit and the items in your cart; section 18 explains the limits we apply to marketing.

You can block or delete cookies in your browser settings. Blocking necessary cookies will stop parts of the platform working, including signing in.

9. Who we share your information with

Diagnostic Providers and Marketplace vendors. We share your identity and health information with the Diagnostic Provider or vendor engaged to perform your Diagnostic Service — including pathology laboratories, diagnostic imaging (radiology) providers, at-home test-kit providers, and other vendors on the Eirly Marketplace. These are independent organisations, accredited where required, each with their own privacy obligations and retention requirements. Our network grows over time; the current, complete list of the providers and vendors we work with is available on request at support@eirly.health.

Service providers. Under contract and only as needed: hosting and cloud storage; payment processing; support and communications platforms; email and SMS delivery; analytics and advertising measurement; professional advisers (lawyers, accountants, auditors, insurers); and debt recovery.

Your healthcare providers. Where you order through, or a practitioner orders for you, or you ask us to share, we disclose your details and Results to that practitioner.

My Health Record. Whether a Result is uploaded depends on the provider performing your test and the law that applies to it. Contact us to confirm the position for a particular test.

Where the law requires it. Without your consent where required or authorised by law — subpoena, court or tribunal order, warrant, or a lawful request from a regulator or law-enforcement body — and where reporting is mandated.

Who sees your Results. You, and the practitioner or organisation that ordered for you or through which you ordered. Within our team, staff who prepare and upload Results, and a doctor engaged by us where a Result is flagged clinically urgent; access is limited to those who need it, under confidentiality obligations. And anyone you ask us to share with.

If our business changes hands. In a merger, acquisition, restructure, capital raising or sale, we may disclose to advisers and a prospective purchaser, limited to what is reasonably necessary, under confidentiality, using aggregated or de-identified information where practicable; your information remains subject to this policy or substantially equivalent terms.

10. De-identified information, and limits

We may create and use de-identified information for health and disease research, service improvement and public health, requiring recipients to agree in writing not to re-identify, not to pass on, and to keep it secure; genetic and genomic data are excluded from de-identified datasets. What we don't do: we do not sell your personal or health information (including de-identified), and we do not use your Results to decide your access to our services.

11. Notifiable conditions and public health reporting

Some Results must be reported to government health authorities by law (this applies to all pathology testing in Australia, however ordered). Where a test identifies a notifiable condition — such as some sexual health and infectious disease tests — the laboratory must report it, and a public health unit may contact you directly. This cannot be opted out of.

12. Samples, imaging, genetic testing and specialty providers

• Samples. We never receive, hold or handle your physical sample. It is collected and analysed by the Diagnostic Provider, which determines how it is retained and handled under its own obligations.
• Imaging. For diagnostic imaging there is no physical specimen; the imaging provider captures and holds the images and produces the report, under its own obligations, and we receive the report.
• Genetic information. For genetic, genomic or microbiome testing we receive only the report, never raw sequencing data. Genetic information is sensitive information and receives the highest protection under this policy.
• Specialty providers. Some specialty tests are performed by providers outside Australia (see section 17). Ask us which provider will perform a particular test before you order.

13. Where a practitioner orders for you

We hold your information in our own right and are responsible for it under the Privacy Act, whether you came to us directly or through a practitioner. The practitioner separately holds their own records under their own obligations; neither holds it for the other. We provide the Diagnostic Services and tools; we do not supervise the practitioner's advice. You can ask us to stop sharing with them at any time (we cannot undo a disclosure already made). If the practitioner stops using the platform we remove their access; we retain your records for the legally required periods and you keep direct access to them.

14. Our API for organisations

We offer an API that lets an organisation we have a written agreement with order Diagnostic Services and retrieve Results from its own systems. It is for businesses, not individuals, and requires a written agreement and credentials we issue. When an organisation orders for you it sends us what we need to arrange it, having collected that from you under its own obligations; we rely on it having your consent. It can retrieve only the order status and Results for tests it ordered, plus our general reference information. We log API activity (organisation, endpoint, time, outcome, content) encrypted, to investigate errors, detect misuse and meet audit obligations. We can suspend or revoke access; we do not supervise how it uses information once disclosed and cannot delete records it holds.

15. Connecting an AI assistant to your account

You may choose to connect an external AI assistant (such as Claude, or another tool supporting the Model Context Protocol) to your account, to ask questions about your own Results. It is optional, off unless you turn it on, and can be disconnected at any time. You approve the connection through a secure sign-in on our page; the assistant never receives your password. On your instruction it can see your profile, Results, biomarker history and pending tests, retrieve your documents, look up reference information, record health information you give it, and assemble a panel for you to order — only for you. Your information goes to the AI provider and is then handled under its policy, not ours (retention, overseas processing, and training are its decisions; most process overseas). This is different from the AI we use ourselves (section 16). We log that a request was made and the outcome, not your conversation. Revoke at any time; information already sent must be deleted by the provider under its policy.

16. Artificial intelligence and privacy

We use software, including AI, to help process the reports we receive, generate plain-language educational explanations, respond to general enquiries, and operate and improve the platform. Educational explanations are reviewed and approved by a registered medical practitioner before publication, and everyone who orders a given test sees the same approved explanation. Your individual Results are not reviewed by a practitioner unless flagged clinically urgent. All AI content is educational only, not a diagnosis. Our AI processing is carried out for us by contracted cloud providers in Australia; your information is not sent to public or consumer AI services, and neither we nor those providers use your identifiable information to train AI models. We may use de-identified information to improve the accuracy of our own systems, including our document-reading and result-processing tools (section 10). Two exceptions: an external AI assistant you connect yourself (section 15); and our support chat, which is provided through Intercom and may use Intercom's own AI assistant to answer general enquiries. If you choose not to use the chat, nothing is sent to it. If you do, your messages are handled by Intercom under its terms, including overseas (section 17).

Separately from the AI we use to process reports, some of our ordinary service providers use information for their own machine-learning purposes under their own terms — our payment processor, for example, uses transaction data to train fraud-detection models. Where a provider offers the option, we exclude your information from being used to train its models (section 17).

17. Where your information is stored and sent

Our infrastructure. Hosted on Amazon Web Services in Australia. Results, reports and biomarker data from standard tests are stored and processed in Australia, by Australian providers (accredited where required) and on our Australian-hosted infrastructure. Any AI processing we carry out also takes place in Australia (section 16).

Overseas service providers. We use third-party providers located outside Australia, including in the United States, Japan and Canada, for payment processing, customer support and communications, email and message delivery, and system monitoring and analytics. Information handled by them is generally account, contact, billing and support information, though monitoring and support records may incidentally include health-related information you raise with us.

Specialty and overseas testing. Some specialty tests (including DNA, genetic and nutrigenomic panels and certain functional panels) are performed by reference laboratories outside Australia; your sample and the resulting data go there for analysis. Ask us which provider will perform a particular test before you order.

AI assistants you connect yourself — information is sent to that provider and usually processed overseas, under its policy (section 15).

Our safeguards. Where we disclose to an overseas recipient we take reasonable steps to ensure it is handled consistently with the APPs: contractual use restrictions, retention limits, and security and confidentiality obligations. Where a provider offers the option, we exclude your information from being used to train its models.

18. Marketing

Only where you have consented, or where you have an existing relationship and the marketing is what you would reasonably expect; we comply with the Privacy Act and the Spam Act 2003 (Cth). Marketing is based on your contact details, account status and purchase history, not on your Results, questionnaire responses or genetic information. Communications about your own Results within your account, including practitioner-recommended follow-up and suggested follow-up testing, are service communications, not marketing. Every marketing message has a working unsubscribe; we action opt-outs within 5 business days; service communications continue regardless.

19. Government identifiers

We collect your Medicare number only when a Medicare-rebatable test is ordered for you by your practitioner, and use it only for the rebate. We do not collect it for commercial (non-rebatable) tests, and do not use or disclose it for any other purpose.

20. How we protect your information

Technical — encryption in transit and at rest, multi-factor authentication for systems holding health information, role-based need-to-know access, monitoring and logging, and regular security review and vulnerability testing. Organisational — confidentiality obligations and privacy training for all staff and contractors, access limits, vendor security assessments, and data processing agreements with providers holding our data. Physical — controlled premises access and secure handling and destruction of physical records. Retention and destruction — governed by our Data Retention and Destruction Policy, which sets the retention schedule in section 22, applies recognised destruction standards (crypto-erasure or certified secure overwrite for digital records, cross-cut shredding for paper, confirmed purge from vendor backups), records every destruction event in a destruction log, and suspends destruction under a legal hold. It is reviewed at least annually.

21. If something goes wrong — data breaches

We are covered by the Notifiable Data Breaches scheme. If we become aware of unauthorised access to, disclosure of, or loss of your personal information, we will: act immediately to contain it; promptly assess whether it is likely to result in serious harm; where that threshold is met, notify the Office of the Australian Information Commissioner as soon as practicable and notify the individuals at risk; notify you in any other case where the law requires it or where we consider you would want to know; and review and fix the cause. We keep incident and breach records for seven years.

22. How long we keep your information

We keep information as long as needed and as long as the law requires; where more than one obligation applies we keep it for the longest period.

We may keep information longer under a legal hold. When we no longer need it and are not required to keep it, we destroy it securely or permanently de-identify it.

23. Closing your account, and deleting your information

You can ask us to delete your personal information and we will where we are legally able. Closing your account stops login, Results access, and marketing/service use, but does not delete health records we must retain (section 22) — those are held in secure archive and then securely destroyed. Records held by Diagnostic Providers are theirs. Contact our Privacy Officer; we verify your identity, act within 30 days, and where we cannot delete everything we tell you what remains and why, and offer de-identification.

24. Accessing and correcting your information

You can ask for a copy of what we hold; we verify your identity and respond within 30 days, and can refuse only in limited Privacy Act circumstances (with reasons in writing). You can access your Results any time through your account. If information is inaccurate, out of date, incomplete or misleading, tell us and we will take reasonable steps to correct it; we cannot alter a Result (it records what the provider measured) but can arrange retesting or attach a statement of the correction you sought.

25. Complaints

Contact our Privacy Officer with what happened and when; we acknowledge within 5 business days and respond in writing within 30 days. If you are not satisfied you can escalate to our senior management or to the Office of the Australian Information Commissioner (1300 363 992, enquiries@oaic.gov.au, GPO Box 5218 Sydney NSW 2001), or a state/territory health or privacy commissioner.

26. Children and young people

Our services are for people aged 18 and over; a person under 18 cannot order or hold an account in their own name, and we do not offer lab-collection testing for under-18s unless we have approved a specific arrangement in writing. A parent, carer or guardian may order at-home kits for a child in their care, consenting on the child's behalf; the arrangement ends at 18. We keep a minor's records until age 25, or 7 years from last service, whichever is longer.

26A. Automated decision-making

We do not use automated processes, including AI, to make a decision that significantly affects your rights or interests. Software decides operational things — how a report is laid out, which explanation is shown with a result, whether a result is flagged for a practitioner to look at, and whether a payment or an order is held for review — and a person remains responsible for any decision about your care, your access to a service, or your money. Where a result is flagged as clinically urgent, an appropriately qualified practitioner reviews it; the flag itself does not decide anything. If you want to know whether a decision about you involved automated processing, ask our Privacy Officer.

27. Related documents

This policy is read with our Terms of Service (eirly.health/terms-of-service). Business and API customers are also covered by our Master Services Agreement and, where applicable, a Data Processing Agreement.

28. Changes and contact

We review this policy at least annually and sooner if the law or our practices change; the current version and effective date appear at the top. We take reasonable steps to notify you of material changes in advance, and seek your consent where the law requires it.

Privacy Officer, Bloody Good Tests Pty Ltd trading as Eirly Health — support@eirly.health — 16 Nexus Way, Southport QLD 4215.