Effective date: 3 September 2026

1. About this policy

iTherapeutics is operated by ITHERAPEUTICS FOR PHARMACY PTY LTD (ACN 138 578 622), referred to in this policy as “iTherapeutics”, “we”, “us” or “our”.

We respect your privacy and are committed to protecting your personal information. This policy explains how we collect, use, store and disclose personal information when you use the iTherapeutics website, mobile application, learning management system and related services.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. Personal information we collect

Depending on how you use iTherapeutics, we may collect:

• your first and last name;
• your email address;
• your mobile telephone number;
• your date of birth;
• your profession and professional details;
• the pharmacy, store, workplace or organisation with which you are associated;
• your membership and account status;
• your account identifiers and login information;
• your training enrolments, progress, completion results and completion dates;
• information about certificates or continuing professional development activities;
• technical information about your device, operating system and application version;
• push-notification tokens and notification-delivery information;
• records of communications with us;
• email delivery and engagement information; and
• application, security and server log information.

We only collect information that is reasonably necessary to operate iTherapeutics and provide our services.

Please do not include sensitive health information in communications or other fields unless we specifically request it and explain why it is required.

3. How we collect personal information

We may collect personal information:

• directly from you when you register, update your account or contact us;
• when you use the iTherapeutics website, application or learning modules;
• from your pharmacy, store, employer, professional organisation or another organisation that arranges access for you;
• from the learning management system as you enrol in and complete training;
• through automated application and server logs; and
• from service providers that assist us with communications, hosting, support or notification delivery.

If you do not provide requested information, we may be unable to create or maintain your account, provide training, issue completion records or deliver other features of the service.

4. How we use personal information

We may use personal information to:

• create, authenticate and administer your account;
• provide access to learning modules and other iTherapeutics services;
• enrol you in training and record your progress and completion;
• issue certificates or other evidence of completed training;
• synchronise training records between our systems;
• associate your account with your pharmacy, store, workplace or professional group;
• provide service, account and training-related communications;
• send email campaigns where permitted;
• send push notifications when you have enabled them;
• provide technical support and respond to enquiries;
• maintain the security, reliability and performance of our systems;
• investigate faults, suspected misuse or security incidents;
• analyse participation and improve our learning content and services;
• meet our contractual and legal obligations; and
• exercise or defend legal rights.

We do not sell or rent members’ personal information.

5. Sponsored education modules

Some education modules may be supported or sponsored by a participating company.

When a member completes a supported module, we may provide the participating company with:

• the member’s name; and
• the pharmacy, store or workplace with which the member is associated.

The participating company does not receive the member’s email address or telephone number from us as part of this disclosure.

This information is provided for tracking participation and completion and for evaluating and improving learning activities. It is not provided to the participating company for marketing purposes.

Where applicable, the module or related information may identify the participating company before the member enrols or begins the module.

6. Push notifications

The iTherapeutics mobile application may ask for permission to send push notifications.

If you grant permission, we collect and store a push token that identifies the installation of the application on your device. We may also store associated technical information, such as the device platform, application version, notification status and delivery results.

We use this information to send relevant service and training notifications through Expo, Apple Push Notification service or Google Firebase Cloud Messaging.

Apple and Google control the operating-system permission that allows notifications on your device. Depending on your device, you may turn notifications off through the iTherapeutics account settings or your device’s system settings.

Turning off notifications does not delete your iTherapeutics account or affect your ability to access training. It only prevents or limits notifications being delivered to that device.

We do not intentionally include sensitive health information in push-notification content. Notifications may be visible on a locked screen depending on your device settings.

7. Disclosure to service providers and other parties

We may disclose personal information to trusted service providers where reasonably necessary to operate iTherapeutics. These providers may include:

• Australian hosting and infrastructure providers;
• learning management and training-system providers;
• email campaign and communications providers;
• Apple, Google, Firebase and Expo for push-notification delivery;
• technical support, security and professional service providers;
• participating companies in the limited circumstances described in Section 5; and
• regulators, law-enforcement bodies or other parties where disclosure is required or authorised by law.

Service providers may only use the information for the services they provide to us, subject to their contractual and legal obligations.

We do not sell or rent personal information to third parties.

8. Email communications and direct marketing

We use ActiveCampaign to manage email campaigns and member communications.

Only a member’s first name and email address are provided by iTherapeutics to ActiveCampaign. ActiveCampaign may also generate information about email activity, such as whether an email was delivered or opened, whether a link was selected and whether the member unsubscribed.

ActiveCampaign contact data for iTherapeutics is primarily hosted in Australia. ActiveCampaign and its service providers may nevertheless access or process limited information outside Australia when providing support, security, email delivery or related services.

Members may unsubscribe from marketing emails using the unsubscribe link included in those emails. Unsubscribing from marketing does not prevent us from sending essential account, service, security or training-related communications where appropriate.

Completion information provided to a participating company under Section 5 is not provided for marketing purposes.

9. Australian hosting and overseas processing

The principal iTherapeutics systems are hosted in Australia. This includes:

• the iTherapeutics API database;
• the learning management and training database;
• system backups; and
• application and server logs.

Some third-party services used by iTherapeutics may process or access limited information outside Australia. These services include:

• Apple Push Notification service;
• Google Firebase Cloud Messaging;
• Expo push-notification services; and
• ActiveCampaign and its support or infrastructure providers.

For push notifications, this information is generally limited to device identifiers, push tokens, platform information, message-delivery information and notification content.

For email communications, overseas processing may include a member’s first name and email address, together with email delivery and engagement information generated by ActiveCampaign.

Where practical, we select Australian hosting regions and take reasonable steps to ensure that third-party providers protect personal information consistently with applicable Australian privacy requirements.

10. Storage and security

We take reasonable technical and organisational measures to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.

These measures may include:

• access controls and authentication;
• encrypted network connections;
• controlled database and server access;
• system monitoring and logging;
• backups and recovery processes; and
• limiting staff and service-provider access according to operational requirements.

No electronic storage or transmission system is completely secure. If we become aware of a data breach, we will assess and respond to it in accordance with applicable legal requirements, including the Notifiable Data Breaches scheme where relevant.

Users are responsible for keeping their login details secure and should notify us promptly if they believe their account has been accessed without permission.

11. Retention and deletion

We retain personal information for as long as reasonably necessary to:

• provide and administer the iTherapeutics service;
• maintain training and completion records;
• meet contractual, legal, accounting and reporting obligations;
• resolve disputes;
• prevent fraud or misuse; and
• maintain system security and continuity.

Retention periods may vary depending on the type of information and the reason it was collected.

When information is no longer reasonably required, we take reasonable steps to delete it or make it anonymous, unless we are required or permitted by law to retain it.

Removing the mobile application from a device does not automatically delete the member’s iTherapeutics account or training records. Members may contact us to request account deletion. Some information may need to be retained where required by law or for legitimate record-keeping purposes.

12. Accessing and correcting personal information

You may request access to the personal information we hold about you or ask us to correct information that is inaccurate, incomplete or out of date.

Some account information may be updated directly through the iTherapeutics service. Other requests may be submitted using the contact details in Section 16.

We may need to verify your identity before providing access or making a correction. In limited circumstances, we may decline a request where permitted by law. If that occurs, we will generally explain the reason and the available complaint options.

13. Privacy enquiries and complaints

If you have a question or complaint about how we handle personal information, please contact us using the details in Section 16.

We aim to acknowledge a privacy complaint within five working days and generally provide a substantive response within 30 calendar days. If we require additional time because the matter is complex, we will notify you.

We will investigate complaints fairly and take reasonable steps to resolve any identified issue.

If you are dissatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) through www.oaic.gov.au.

14. Third-party websites and services

iTherapeutics may contain links to third-party websites or services. Those third parties are responsible for their own privacy practices.

We encourage you to review the privacy policy of a third-party service before providing personal information to it. This policy does not govern third-party services that are not controlled by iTherapeutics.

15. Changes to this policy

We may update this privacy policy from time to time to reflect changes to our services, technology, providers or legal obligations.

The current version will be made available through the iTherapeutics application or website. Where a change is significant, we may also notify members through the application, by email or by another reasonable method.

16. Contact us

For privacy enquiries, access or correction requests, complaints or account-deletion requests, contact:

Privacy Officer
ITHERAPEUTICS FOR PHARMACY PTY LTD
ACN 138 578 622
14A High Street
Inverloch VIC 3996
Australia

Email: privacy@itherapeutics.com.au
Telephone: +61 3 9855 2655
Australia: 1300 864 894