Privacy Policy

Last updated: August 2026

About this Privacy Policy

In this Privacy Policy, ‘us’, ‘we’, ‘our’ or ‘Refr’ means Refr Pty Ltd (ACN 677 383 407).

This Privacy Policy sets out our commitment to protecting the privacy of your Personal Information provided to us, or otherwise collected, used, stored, handled or disclosed by us when providing our online platform and website and other services we make available from time to time (together, the Services), or when otherwise interacting with you.

Refr provides technology and workflow services that support healthcare referral pathways. Refr is not a healthcare provider. We do not provide medical advice, clinical assessment, diagnosis, treatment or clinical triage, and we do not make clinical decisions.

We handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles and other privacy and health records laws that apply to us.

By using our Services, or in providing any Personal Information to us, you consent to our collection, use, storage, handling and disclosure of your Personal Information in accordance with this Privacy Policy and any other arrangements that apply between us.

We may update this Privacy Policy from time to time by publishing changes to it on our website. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy.

Where a change materially affects how we handle Personal Information, we will take reasonable steps to notify affected individuals in advance or at the time the change takes effect, where practicable and appropriate. We will seek any consent required by law for a new use or disclosure.

Definitions

In this Privacy Policy:

Account means an account registered on the platform through which a Clinician accesses the Services, or through which an Enterprise Customer authorises its Authorised Users to access the Services.

AI Feature means any artificial intelligence, machine learning or automated decision-support functionality that we make available as part of the Services.

Authorised User means a person, including a Clinician or administrator, whom an Enterprise Customer authorises to access and use the Services through its Account.

Clinician means an allied health professional who uses the platform to submit or manage Referral Requests, such as a physiotherapist, osteopath, chiropractor, exercise physiologist, podiatrist, dietitian or accredited exercise scientist.

Consultation means a medical consultation between a Patient and a Third Party Medical Provider that arises in connection with a Referral Request.

Enterprise Customer means a clinic, practice, company or other organisation that registers an organisation Account and authorises one or more Authorised Users to access the Services.

Imaging Provider means a radiology, diagnostic imaging or image-guided procedure provider that receives or acts on a Referral. An Imaging Provider is a type of Receiving Provider.

Patient means an individual in respect of whom a Referral Request is submitted.

Patient Portal means the interface through which a Patient accesses the Services we make available to Patients.

Personal Information has the meaning given in the Privacy Act and includes information or an opinion about an identified or reasonably identifiable individual. For example, this may include your name, age, gender, postcode and contact details. It may also include financial information, including your credit card information.

Receiving Provider means an Imaging Provider, specialist practice or other healthcare provider to which a Referral is directed or sent.

Referral means a referral, imaging request or other clinical document issued by a Third Party Medical Provider following their independent clinical assessment of a Patient.

Referral Request means a request submitted through the platform by a Clinician or Authorised User for a Third Party Medical Provider to assess a Patient and determine whether to issue a Referral.

Sensitive Information has the meaning given in the Privacy Act and includes information relating to your racial or ethnic origin, political opinions, religion, trade union or other professional associations or memberships, philosophical beliefs, sexual orientation or practices, criminal records, health information, or biometric information.

Services has the meaning given in section 1.

Third Party Medical Provider means an Australian-registered medical practitioner or specialist who assesses a Patient and conducts a Consultation in connection with a Referral Request.

A reference to “you” or “your” means any individual to whom this Privacy Policy applies, according to the context.

Personal Information we collect

The Personal Information we collect depends on how you interact with us and the Services. We only collect Personal Information that is reasonably necessary for our functions and activities, or as otherwise permitted, required or authorised by law.

Patient information submitted by a Clinician or Authorised User

Refr first receives a Patient’s Personal Information when a Clinician or Authorised User creates a Referral Request. The information submitted may include:

full name, email address, mobile number and address;
age and date of birth;
gender;
Medicare and other funding information that is relevant to the requested referral pathway; and
health and clinical information relevant to the Referral Request, including the reason for referral, injury details, clinical findings, and clinical notes.

Where a Clinician or Enterprise Customer connects a practice management system or another third-party system to the Services, we may import, export, synchronise or otherwise process Patient information required to operate the integration and provide the relevant Services. This may include Patient identity and contact information, appointment information, case notes, clinical information, Referral Request information and related records.

The information available through an integration depends on the connected system, the permissions granted and the configuration selected by the Clinician or Enterprise Customer.

Patient information provided through the Patient Portal

After a Referral Request is submitted, the Patient may access the Patient Portal and provide, confirm or correct information. This may include:

full name, email address, mobile number and address;
profile picture;
preferences and/or opinions;
general practitioner’s details;
information provided through Patient surveys;
information about the Patient’s interaction with the Referral Request, Referral and related Services; and
any other Personal Information that is reasonably required to provide the Services.

Patient information received from Third Party Medical Providers and Receiving Providers

We may receive Personal Information about a Patient from Third Party Medical Providers, Receiving Providers and other healthcare providers involved in the referral pathway, including:

Consultation information and requests for further information;
the outcome of a clinical assessment and whether a Referral is issued;
Referrals, imaging requests and other clinical documents;
reports, results, letters and other clinical correspondence; and
communications concerning the Referral Request, Referral or related healthcare services.

Third Party Medical Providers and Receiving Providers are independent healthcare providers and may also collect Personal Information directly from the Patient under their own privacy arrangements.

Payment and transaction information

Where Patient billing or clinic billing applies, we may collect or receive:

the name and contact details of the person or organisation responsible for payment;
the applicable fee, billing model, transaction date, payment status and transaction reference;
invoice, receipt, refund, chargeback and payment dispute information; and
limited payment method information provided by our payment processor, such as the card type and last four digits.

We use third-party payment processors to collect and process payment details. Unless we state otherwise, we do not directly collect or store full payment card or bank account details.

Information about Clinicians, Enterprise Customers and Authorised Users

If you are a Clinician, Enterprise Customer contact or Authorised User, we may collect:

full name, email address, mobile number and address;
practice, organisation, role and employment information;
professional qualifications, registration, accreditation, memberships and provider numbers;
information reasonably required to verify identity, professional status, authority or eligibility;
Account, authentication, security and access information; and
any other Personal Information that is reasonably required to provide the Services.

Information about Third Party Medical Providers and Receiving Providers

If you are a Third Party Medical Provider, Receiving Provider or a representative of one, we may collect:

identity and contact information;
practice, service entity, specialty and location information;
professional qualifications, registration and provider numbers;
information reasonably required to verify identity, professional status, authority or eligibility; and
any other Personal Information that is reasonably required to provide the Services.

Information collected automatically

When you access or use the Services, we may automatically collect technical and usage information for security, operational, support and performance purposes, including:

device, browser, operating system, network and Internet Protocol address information;
login, session, authentication and security information;
pages, features and functions accessed, dates and times of access, referral status events and other usage records;
additional Personal Information that you provide to us, directly or indirectly, through your use of our Services, associated applications, associated social media platforms, and/or accounts from which you permit us to collect information; and
any other Personal Information about your use of the Services requested by us and/or provided by you or a third party.

Sensitive Information

Some Personal Information we collect is Sensitive Information, including:

Patient health information; and
Clinician criminal history and working with children checks.

We collect Sensitive Information only where it is reasonably necessary for our functions or activities and with consent, or where otherwise permitted, required or authorised by law.

We use and disclose Sensitive Information only for the purpose for which it was collected, for directly related purposes you would reasonably expect, or as permitted, required or authorised by law.

Where we collect Medicare numbers or other government-related identifiers, we use and disclose them only as permitted by law.

How we collect Personal Information

Direct collection

We may collect Personal Information directly from you when you:

create or use an Account or the Patient Portal;
complete an intake form;
connect or use an integration or AI Feature;
communicate with us, request support, make a complaint or provide feedback;
subscribe to updates or marketing communications; or
otherwise interact with us or the Services.

Indirect collection

Refr first receives a Patient’s Personal Information when a Clinician or Authorised User creates a Referral Request. We may also collect Personal Information indirectly from:
a Clinician, Enterprise Customer or Authorised User who creates or manages the Referral Request;
connected practice management systems and other integrations authorised by a Clinician or Enterprise Customer;
Third Party Medical Providers and Receiving Providers involved in the Patient’s referral pathway; and
payment processors and other service providers.

Before first submitting a Patient’s Personal Information or health information, the Clinician must obtain the Patient’s informed consent and any other authority required by law. A Patient’s later use of the Patient Portal does not cure any failure by the Clinician to obtain that consent or authority.
Because we ordinarily collect Patient information indirectly, we take reasonable steps to notify the Patient after a Referral Request is submitted, including through the notification and Patient Portal.
By using the Patient Portal, the Patient authorises us, subject to applicable law and this Privacy Policy, to:
make any Referral available through the Patient Portal;
where applicable, transmit the Referral and relevant information to a Receiving Provider; and
receive reports, results, letters, appointment information and status updates from Receiving Providers and make them available to the Clinician as part of the Services.
We will seek any additional consent required for a use or disclosure that is outside the referral workflow or materially different from the practices described in this Privacy Policy.

Children and authorised representatives

Where a Patient is under 18 or cannot lawfully act for themselves, the Clinician must determine who may lawfully provide the required consent and authority. Depending on the circumstances and applicable law, this may be the Patient, a parent, a legal guardian or another authorised representative.
We rely on the Clinician to obtain and confirm the appropriate consent before submitting a Referral Request. We may request evidence of a representative’s identity or authority and may restrict access to, or processing of, a Referral Request while that authority is verified.

You may withdraw consent by contacting us. Withdrawal does not affect any handling of Personal Information that occurred lawfully before the withdrawal. It may prevent us from progressing a Referral Request or providing some or all of the Services.
We may continue to hold or handle information after consent is withdrawn where this is permitted or required by law, or reasonably necessary for legal, regulatory, audit, complaint, dispute, security or recordkeeping purposes. Information already disclosed to an independent healthcare provider remains subject to that provider’s own obligations and practices.

How we use Personal Information

We may collect, hold, use and disclose your Personal Information for the following purposes:
to enable you to access and use our Services;
to operate, protect, support, improve and optimise the Services and our business, including by conducting analytics, research and product development;
to verify identity, professional status, authority, eligibility and access rights;
to communicate with users and respond to enquiries, support requests, complaints, disputes, incidents, claims and regulatory matters;
to operate integrations and process payments, billing, refunds, disputes and debt recovery;
to prevent, detect and investigate fraud, misuse, errors, unauthorised access and security incidents;
to send service communications and, where permitted by law, marketing communications; and
to maintain records, conduct audits, comply with legal, regulatory, insurance and professional obligations, and manage our business, advisers, insurers and corporate transactions.
We may also use or disclose Personal Information for another purpose where you have consented, you would reasonably expect the use or disclosure and it is permitted by law, or the use or disclosure is otherwise permitted, required or authorised by law.

What happens if we cannot collect your Personal Information?

If we cannot collect the Personal Information we reasonably require, we may be unable to provide some or all of the Services, process or manage a Referral Request, provide Account or Patient Portal access, verify identity or authority, process payments, or respond to enquiries, complaints or support requests.
You may deal with us anonymously or using a pseudonym where it is lawful and practicable, such as when making a general enquiry. However, this will generally not be practicable where we need to identify you to provide the Services, process a Referral Request, verify your authority or comply with legal or professional obligations.

AI Features

We may make AI Features available as part of the Services. AI Features may support the referral workflow by extracting, categorising, routing, summarising or drafting information for review. For example, an AI Feature may use case notes imported from a connected practice management system or pasted into the platform to populate fields in a Referral Request.
If an AI Feature is used, we may collect and handle:
information submitted to the feature, including case notes and other Patient or clinical information;
information generated by the feature for review by the relevant user; and
technical, usage, performance, security and audit information associated with the feature.
A Clinician must only submit information that is reasonably necessary for the relevant workflow and must hold all consents and authorities required for Refr and its service providers to process that information.
AI Features are decision-support tools only. They do not provide medical advice, clinical assessment, diagnosis, clinical triage or recommendations, and they do not make clinical decisions. The relevant Clinician or Third Party Medical Provider remains responsible for independently reviewing and verifying any AI-generated output before relying on or acting on it.
We may use third-party service providers to support AI Features, including providers of cloud infrastructure, storage, monitoring, security and model access services. Where we disclose Personal Information to those providers, we do so only as reasonably necessary to provide, secure and support the relevant feature and in accordance with our arrangements and applicable law.
Where an AI Feature involves materially different information-handling practices, we may provide an additional collection notice or seek specific consent at or before the relevant collection, use or disclosure.
Where you use AI Features, we may store information you submit to those features, information generated by those features, and related technical metadata, where reasonably necessary to provide the features, maintain security, investigate incidents, and maintain the performance and reliability of AI Features. The way in which such information is stored may depend on how the relevant feature is configured and the third party services used to support it.

Service communications and direct marketing

We may send communications that are reasonably necessary to provide, administer, secure or support the Services. These may include Referral Request notifications, Patient Portal links, payment notices, appointment or status information, Account notices, service updates, support messages, safety notices and security alerts. You may not be able to opt out of communications required to provide an active Service.
We may send marketing communications to Clinicians, Authorised Users and Enterprise Customer contacts who have consented or where otherwise permitted by law. These communications may include information about Refr features, services, educational content, events and industry developments.
We do not send direct marketing communications to Patients or use Patient health information for targeted advertising. A Patient may still receive service communications relating to a Referral Request or another Service they have requested.
You may opt out of direct marketing at any time by using the unsubscribe facility in the communication, updating available communication preferences or contacting us. Opting out of marketing does not affect service communications.

Who we may disclose your Personal Information to

We will not sell Personal Information we collect about you to any third parties. However, we work with other companies that help us provide our systems and Services and we may provide Personal Information to these companies for the purpose of providing the Services to you.
Those service providers will only be provided with access to your Personal Information as is reasonably necessary for the purpose that we have engaged the service provider, and we will require that those third parties comply with our standards and all applicable laws.
We may disclose Personal Information, where reasonably necessary for the purposes described in this Privacy Policy, to:
Third Party Medical Providers, Receiving Providers and Imaging Providers involved in a Patient’s referral pathway;
the Clinician who submitted the Referral Request, and the relevant Enterprise Customer and Authorised Users, in each case only to the extent permitted by their access rights and reasonably necessary for a legitimate purpose connected with their role or use of the Services;
a parent, legal guardian, representative or other person authorised by the relevant individual or by law;
practice management systems and other integration providers connected to the Services;
payment processors, financial institutions, billing and debt recovery providers;
our service providers, contractors and professional advisers, including providers of cloud hosting, infrastructure, storage, communications, customer support, analytics, security and AI or model access services, and our auditors and insurers;
our employees and contractors who require access to perform their duties;
courts, tribunals, regulators, government bodies, law enforcement agencies and other persons where permitted, required or authorised by law; and
any other person to whom you direct or authorise us to disclose information.
Independent healthcare providers handle Personal Information under their own privacy arrangements and professional obligations. A Third Party Medical Provider or Receiving Provider may collect additional information directly from a Patient.

Overseas disclosure and access

Some of our service providers may be located outside Australia or may store or access Personal Information from overseas. This may include providers of cloud infrastructure, communications, customer support, analytics, security, payment and AI services.
Where we disclose Personal Information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with applicable Australian privacy requirements, unless an exception applies. We may also disclose Personal Information overseas where permitted, required or authorised by law.
The countries in which overseas recipients are likely to be located may vary according to the relevant provider and Service. We will identify those countries in this Privacy Policy or an additional collection notice where practicable.

Security and data breaches

We take reasonable steps to protect Personal Information from misuse, interference, loss and unauthorised access, modification or disclosure.
Where we provide Personal Information to a service provider in connection with services provided to us, we take reasonable steps within our control to prevent unauthorised access, use or disclosure
Our safeguards are designed having regard to the nature and sensitivity of the information, the risks presented by the relevant systems and activities, and current operational and technical practices.
For example, depending on the relevant system and use case, we may use measures such as:
encryption of data in transit using TLS 1.2 or higher;
encryption of data at rest on our Australian-hosted servers;
access controls and authentication measures to restrict access to Personal Information to authorised personnel only; and
regular security reviews and testing of our systems.
As part of our security protocols, we may occasionally ask for proof of identity before disclosing Personal Information to you.
While we take reasonable steps to safeguard Personal Information, no method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee the absolute security of your Personal Information.
If a data breach occurs, we will respond in accordance with our legal obligations. Where the breach is an eligible data breach under the Privacy Act, we will notify the Office of the Australian Information Commissioner and affected individuals as required by the Notifiable Data Breaches scheme.

Retention and deletion

Personal Information

We retain Personal Information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with our legal, regulatory and professional obligations, resolve disputes and enforce our agreements.
In determining the appropriate retention period, we consider the nature and sensitivity of the information, the purposes for which it is held, the risk of harm from unauthorised use or disclosure, and our legal, regulatory, tax, accounting and other obligations.

Health information

We retain health information only for as long as it is needed for the purpose for which it was collected, or another purpose for which it may lawfully be used or disclosed.
When health information is no longer needed for a lawful purpose and we are not required or authorised by law to retain it, we take reasonable steps to securely destroy or permanently de-identify it.

Deletion and de-identification

When Personal Information is no longer required, we take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain it. If immediate deletion is not reasonably practicable, including where information is held in backups, we securely restrict it from further active use until deletion or de-identification is possible.
You may request deletion or de-identification of your Personal Information by contacting us at contact@refr.com.au.
We will consider the request in accordance with applicable law. We may retain information where it remains necessary for a lawful purpose, including to complete or administer a Referral Request, comply with legal or regulatory obligations, investigate an incident, resolve a complaint, dispute or claim, maintain appropriate audit records or enforce our agreements.
A deletion request does not apply to information held independently by a Clinician, Third Party Medical Provider, Receiving Provider or other healthcare provider.

Access and correction

You may request access to, or correction of, Personal Information we hold about you at any time by contacting us at contact@refr.com.au. We may need to verify your identity or authority before acting on a request.
We will respond to an access request within the period required by applicable law. If you request correction of health information, we will notify you of our decision as soon as practicable and no later than 30 days (or, in the case of NSW, 45 days) after receiving the request.
We may refuse or limit access or correction where permitted or required by law. If we do, we will provide written reasons and explain any available complaint process, unless it would be unlawful or unreasonable to do so.
Where information is inaccurate, incomplete, out of date, irrelevant or misleading, we will take reasonable steps to correct it as required by law. Where a request concerns a clinical document, this may involve amending the information, adding corrected information or attaching a notation rather than deleting or overwriting the original record.
If we correct health information, we will, where required by law, take reasonable steps to notify any healthcare provider:
to whom we disclosed the information before it was corrected; and
who may reasonably be expected to rely on the information in the future.
Where a request concerns a clinical document or information created by an independent healthcare provider, we may consult with that provider before responding. We will not alter an independent provider’s clinical opinion or source record unless authorised and appropriate under applicable law. Consulting or referring a request to that provider does not affect our obligations in relation to information we hold.

Cookies and similar technologies

We may use cookies, web beacons and similar technologies on our website and platform to operate and secure the Services, maintain sessions, remember preferences, understand usage and improve performance.
Where information collected through these technologies is Personal Information, we handle it in accordance with this Privacy Policy.
The types of cookies we may use include:
essential cookies, which are necessary to operate the Services, authenticate users, maintain sessions and protect security;
functional cookies, which remember your preferences and settings to improve your user experience;
analytics cookies: which help us understand how the website and Services are used and improve their performance; and
marketing cookies, which may be used on our public website to measure advertising and deliver relevant marketing, where permitted by law and subject to any required consent.
We do not use marketing cookies or advertising technologies in the Patient Portal or on authenticated pages containing Referral Request, clinical or health information.
You may manage non-essential cookies through available cookie controls or your browser settings. Disabling certain cookies may affect the operation or functionality of the Services.

Website analytics and tracking

This part of our Privacy Policy covers our public website, www.refr.com.au. It was added in September 2026. It does not apply to the Clinician Portal or the Patient Portal, where we do not use these tools.

We use Google Analytics 4 to understand how visitors use our public website. It records the pages you view and how you interact with them, such as scrolling, clicks on links that leave our website, file downloads and plays of embedded videos, together with your device type, browser and approximate location (country and city), which Google derives from your IP address. Google Analytics 4 does not store IP addresses.
Before a page address is sent to Google Analytics, we remove everything from it except campaign tags (such as utm_source), and we record a referring website by its domain only. We do not send names, email addresses, health information or anything else you enter on our website, and we do not link website analytics to Accounts or the Patient Portal.
Google signals and ad personalisation are turned off, so this information is not used for advertising.
Google Analytics sets first-party cookies (_ga and _ga_ followed by an identifier) to tell one visitor from another. They expire after up to two years. Google keeps the analytics data for 14 months and may process and store it outside Australia.
For more about how Google handles this information, see How Google uses information from sites or apps that use our services.
Analytics runs only on www.refr.com.au, and not at all if your browser sends a Do Not Track signal.

Opting out of website analytics

You can block or delete cookies in your browser settings.
You can install Google’s Analytics opt-out browser add-on.
You can turn on Do Not Track in your browser. Our website then does not load analytics at all.

Opting out does not affect your use of our website.

Forms and other services on our website

Our contact, support and demo-booking forms are provided by HubSpot. Information you enter in them, such as your name, email address, phone number and message, is collected by HubSpot on our behalf and may be stored outside Australia. HubSpot may set its own cookies within these forms. Please do not include health or clinical information in these forms.
Our website loads fonts from Google Fonts. Google receives your IP address and browser details when the fonts load. Google Fonts does not set cookies.

De-identified and aggregated information

We may create and use aggregated or de-identified information for internal analytics, security, service quality and improvement of the Services.
We take reasonable steps to ensure that this information is no longer reasonably identifiable and do not attempt to re-identify it except as permitted or required by law.
We may disclose aggregated or de-identified information to our service providers and professional advisers where reasonably necessary for those purposes, subject to appropriate safeguards against re-identification
You may withdraw your consent to the use of your de-identified data for these purposes at any time by contacting us at contact@refr.com.au. Data already incorporated into aggregated datasets or published research may not be retrievable.

Links

The Services may contain links to third-party websites or services. Unless we state otherwise, we do not control those third parties and are not responsible for their privacy practices or content. You should review the privacy information provided by the relevant third party before providing Personal Information to it.

Privacy complaints

If you think we have breached the Privacy Act, or you wish to make a complaint about the way we have handled your Personal Information, you can contact us using the details below with full details of your complaint.
We will acknowledge and investigate your complaint and respond within a reasonable period. We may ask for further information or need to verify your identity or authority.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/.

Contact us

For questions about this Privacy Policy, or to request access, correction or deletion, withdraw consent or make a complaint, please contact us at:
Refr Pty Ltd (ACN 677 383 407)
Email: contact@refr.com.au
Website: https://refr.com.au/