Privacy Policy

Last updated: June 2026 · DRAFT v0.1 · awaiting Kane review

1. About this Policy

Longevity Medical (“we“, “us“, “our“) is the medical-consumables and injection-supplies trading division of Longevity Health Group Pty Ltd (ABN 43 695 139 194; ACN 695 139 194), a proprietary company registered in Victoria on 10 February 2026. Our registered office and principal place of business is Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004. We operate the online store at longevitymedical.au.

This Policy explains:

  • what personal information we collect when you visit the site, place an order, or contact us;
  • how we use, store, and share that information;
  • your rights and how to contact us with questions or complaints.

We handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs“). Because Longevity Medical is part of a corporate group that includes a health services provider (Longevity Healthcare), we apply the Privacy Act in full regardless of the small-business exemption.

2. The information we collect

2.1 When you visit our website

  • IP address, browser type, device, approximate location;
  • pages viewed and referring site;
  • cookies and similar identifiers (see Section 8).

2.2 When you create an account or place an order

  • full name;
  • email address and phone number;
  • billing and shipping address;
  • order history and product preferences;
  • payment information (card details are processed by our payment provider and are not stored by us in plaintext);
  • account password (stored in hashed form);
  • communications you send us (e.g. enquiry messages, support tickets).

2.3 When you register as a clinical or professional buyer (if applicable)

[CONFIRM: only include this section if B2B verification is in scope]
  • business or practice name and ABN;
  • AHPRA registration number, profession, and verification evidence;
  • contact details of the practitioner or purchasing officer;
  • delivery address(es) of the practice.

2.4 What we do not collect

We do not collect health information about you. Longevity Medical sells supplies; we do not provide clinical care or hold clinical records. If you require a consultation or prescription, you would deal with our affiliated telehealth clinic Longevity Healthcare, which holds its own separate privacy policy.

3. How we collect your information

We collect your information:

  • directly from you, when you create an account, place an order, fill in a form, or contact us;
  • automatically through your use of the website (cookies, analytics);
  • from third-party verification sources (e.g. AHPRA’s public register) where you have asked us to verify your professional credentials;
  • from our payment, shipping, and fraud-prevention providers (e.g. delivery status, payment authorisation).

4. Why we collect your information

a. to process and fulfil your orders;
b. to take and reconcile payment;
c. to arrange shipping and delivery;
d. to respond to enquiries and provide customer support;
e. to send you order-related communications (order confirmation, dispatch, tracking, refunds);
f. to verify your professional credentials where applicable;
g. with your separate consent, to send you direct marketing (Section 5);
h. to detect and prevent fraud, chargebacks, and misuse of the site;
i. to comply with Australian law, including tax (ATO), consumer law (ACL), and regulator notifications;
j. for internal record-keeping, audit, and improvement of the site and service.

5. Direct marketing

With your separate consent, we may send you product news, promotions, restocks, and similar marketing communications by email. You can opt out at any time by clicking the unsubscribe link in any marketing email or by emailing us.

We do not use product names of Schedule 4 substances in marketing communications (this is prohibited by the Therapeutic Goods Advertising Code). Marketing describes categories and use-cases, not scheduled molecules.

6. How we use and disclose your information

6.1 People inside our business

Your information is accessed by authorised staff of Longevity Medical, and by personnel of Longevity Health Group Pty Ltd providing shared services (e.g. finance, IT, customer support). Access is on a need-to-know basis.

6.2 Service providers

We share information with the following categories of provider, each contractually bound to handle your information consistent with this Policy and Australian privacy law:

  • website host and platform: WordPress / WooCommerce on [CONFIRM: hosting provider — e.g. SiteGround, WP Engine, Cloudways];
  • payments: [CONFIRM: Stripe / PayPal / Tyro] — we receive transaction confirmation only; full card details are held by the provider;
  • shipping carriers: [CONFIRM: Australia Post / Sendle / StarTrack];
  • email and document storage: [CONFIRM: Google Workspace / Microsoft 365];
  • email marketing: [CONFIRM: Mailchimp / Klaviyo / Campaign Monitor — if used];
  • analytics: [CONFIRM: Google Analytics / Plausible / Fathom];
  • accounting and tax: [CONFIRM: Xero / MYOB / accountant].

6.3 Other disclosures

We disclose your information outside the above only where:

a. you consent;
b. it is reasonably necessary to fulfil your order or provide the service you have requested;
c. we are required or authorised by law (e.g. response to a court order, notification of a serious cyber-security incident under the Notifiable Data Breaches scheme).

6.4 Disclosures we do not make

We do not sell your information. We do not disclose your information to data brokers or to advertisers for their own purposes.

6.5 Overseas disclosure

Some of our providers store data outside Australia. We assess each cross-border disclosure under APP 8. The current list of countries to which your data may be transferred is available on request from our Privacy Officer.

7. How we store and protect your information

Your information is held in:

  • our WooCommerce database (encrypted in transit, access-controlled);
  • our email and document storage system (encrypted at rest and in transit);
  • our payment provider’s environment (we do not hold plaintext card numbers).

Controls include:

  • TLS encryption on every connection to the site;
  • multi-factor authentication on all administrator accounts;
  • individual log-ins for every authorised staff member — no shared accounts;
  • regular software, theme, and plugin updates;
  • daily database backups [CONFIRM: confirm with host];
  • restricted physical access to any premises holding records.

No system can guarantee absolute security. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (“OAIC”) in accordance with the Notifiable Data Breaches Scheme.

8. Cookies and analytics

Our site uses cookies to:

  • keep you logged in and remember items in your cart;
  • remember your preferences (e.g. shipping address);
  • measure site traffic and improve the user experience;
  • (with your consent) measure the effectiveness of marketing campaigns.

You can disable cookies in your browser settings. Disabling cookies may degrade functionality (e.g. cart will not persist between visits).

9. How long we keep your information

Information type Retention period
Account profile While account is active, plus 12 months after last activity
Order and invoice records 7 years (per Australian Tax Office requirements)
Payment records 7 years
Marketing consent and opt-out records 7 years after opt-out
Customer support correspondence 3 years
Website analytics (aggregated, non-identifying) indefinite
CCTV at our premises (if any) [CONFIRM]

After the retention period we securely delete or de-identify your information.

10. Your rights

10.1 Access (APP 12)

You have the right to request a copy of the personal information we hold about you. Contact our Privacy Officer (Section 13). We will respond within 30 days. We may charge a reasonable cost-based fee for retrieval and will tell you before incurring it.

10.2 Correction (APP 13)

You can ask us to correct any information about you that is inaccurate, out of date, incomplete, or misleading. There is no fee for correction.

10.3 Withdrawal of consent

You can withdraw consent for marketing or for any other non-essential use at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

10.4 Deletion / closing your account

You can ask us to delete your account. We will delete what we are legally able to delete. Order and tax records will be retained for the 7-year period required by the ATO.

10.5 Anonymity (APP 2)

You can browse our site without identifying yourself. Identification is required to place an order and arrange delivery.

11. Children

This site is intended for adults purchasing medical consumables for professional or personal use under appropriate medical guidance. We do not knowingly collect information from people under 18. If you believe we hold information about a person under 18, contact us and we will delete it.

12. Changes to this Policy

We review this Policy at least once every 12 months and may update it at any time to reflect changes in our practices or the law. The current version is always available on this page. Material changes will be highlighted on our website and, where appropriate, communicated to account holders by email.

Version Date Summary Approver
0.1 [TO COMPLETE] Initial draft replacing legacy text from prior trading entity Director, LHG Pty Ltd

13. Contact us / Privacy Officer

If you have a question about this Policy, want to access or correct your information, or wish to make a complaint:

Privacy Officer
Longevity Medical
Email: privacy@longevitymedical.au (or info@longevitymedical.au until the privacy address is live)
Post: Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004
Phone: [CONFIRM]

We aim to acknowledge privacy correspondence within 5 business days and respond substantively within 30 days.

14. Complaints

Step 1 — to us. Contact our Privacy Officer above. We will investigate and respond in writing within 30 days.

Step 2 — to the regulator. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/privacy/privacy-complaints.

End of Policy.