Privacy Policy
1: Who We Are and What This Policy Covers
Website Privacy Policy. Last updated: 4th November 2026
Melbourne Digital Therapeutics Pty Ltd (ABN 47 664 944 405), trading as Melbourne DTx ("we", "us", "our"), operates www.melbournedtx.com (the "Website"). Our registered address is PO BOX 4203, Fitzroy, Melbourne Australia 3065.
We respect your privacy and are committed to protecting your personal information. This policy explains what we collect through the Website, why, who we share it with, where it may be sent, how long we keep it, and the rights you have under the laws that apply to you, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), the EU and UK General Data Protection Regulation (GDPR), the Privacy Act 2020 (New Zealand), and US federal and state privacy laws.
This policy covers visitors to the Website, including clinicians, healthcare organisations, researchers, patient groups, industry partners, and people who contact us or subscribe to our updates.
In this policy, personal information means information about an identified or reasonably identifiable individual.
2: Information We Collect
The Website is intended for adults and is not designed to collect health information. Please do not send us your own or another person's health information through the Website or by email.
If you give us information about another person, you confirm you are entitled to do so. If you decline to give us information we ask for, we may not be able to respond to your enquiry.
| Category | Examples | How we collect it |
|---|---|---|
| Newsletter details | Email address | You enter it in the sign-up form in the Website footer |
| Enquiry details | Name, email, organisation, role, the content of your message | You email us at [info@melbournedtx.com] [or submit a contact form] |
| Device and usage data | IP address, browser type, device type, pages viewed, referring page, approximate location, date and time | Collected automatically through our website host and analytics tool |
| Cookie identifiers | Random identifiers that recognise your browser | Cookies and similar technologies (section 5) |
3: How We Use Your Information and Our Legal Bases
Marketing emails. We send newsletters only to people who have subscribed or otherwise consented, and each message includes a working unsubscribe link, in line with the Spam Act 2003 (Cth) and, for US recipients, the CAN-SPAM Act. We will process unsubscribe requests within the time the law allows. You may withdraw consent at any time without affecting past processing.
What we do not do. We do not sell your personal information. We do not permit third-party advertisers on the Website.
| Purpose | Information | Legal Basis (EU/UK) |
|---|---|---|
| Respond to enquiries and discuss partnerships | Enquiry details | Legitimate interests (Art. 6(1)(f)); steps at your request before a contract (Art. 6(1)(b)) |
| Send newsletters and updates about our products | Newsletter details | Consent (Art. 6(1)(a)); you can unsubscribe at any time |
| Operate, secure and maintain the Website, and understand how it is used | Device, usage and cookie data | Legitimate interests; consent for non-essential cookies |
| Comply with law, regulatory requests and audits, and establish or defend legal claims | As needed | Legal obligation; legitimate interests |
4: Who We Share Information With, and Overseas Transfers
We do not disclose your personal information except as described here.
Service providers. We use providers for website hosting and analytics (Squarespace), email delivery and newsletter management (MailJet), and IT support. They may use your information only to provide services to us and must protect it under written agreements.
Business transfers. If we are involved in a sale, merger, restructure or financing, your information may be transferred to the new owner, who must honour this policy.
Legal and safety. We may disclose information where required or authorised by law, to respond to a lawful request, or to prevent a serious threat to life, health or safety.
Aggregated or de-identified data. We may use data that no longer identifies you for analysis and reporting.
Overseas transfers. Our website host and other providers are located in Australia. Your information may therefore be stored or accessed outside the country where you live. For Australian users, we take reasonable steps under APP 8 to ensure overseas recipients handle your information consistently with the APPs, and we remain accountable for it. For EU and UK users, we transfer data outside the EEA or UK only where there is an adequacy decision, or under Standard Contractual Clauses (and the UK Addendum or IDTA) [and, for US providers certified to it, the EU-US Data Privacy Framework]. You can ask us for a copy of the safeguards we rely on.
5: Cookies and Similar Technologies
The Website uses cookies and similar technologies. A cookie is a small file placed on your device. We use:
Strictly necessary cookies, which keep the Website secure and working (including those set by Squarespace). These do not need consent.
Analytics cookies, which tell us how visitors use the Website. [Google Console]
If you are in the EU or UK, we set non-essential cookies only after you opt in through a cookie banner, and you can withdraw consent at any time through the cookie settings link in the Website footer. For visitors elsewhere, you can block cookies in your browser settings, though parts of the Website may not work properly. We respond to the Global Privacy Control signal where the law requires it.
6: Retention, Security and Breach Notification
Retention. We keep personal information only as long as needed for the purposes in section 3 or as the law requires. Our current periods are: [enquiries: 24 months]; [newsletter details: until you unsubscribe, then [12] months on a suppression list so we honour your choice]; [analytics data: [14] months]. When information is no longer needed, we destroy it or de-identify it.
Security. We use technical and organisational safeguards appropriate to the information we hold, including access limited to staff who need it, strong passwords and multi-factor authentication for administrative accounts, and encrypted connections (HTTPS). No system is completely secure.
Data breaches. If a breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. For EU and UK data, we will notify the relevant supervisory authority within 72 hours where required, and notify you where the breach is likely to result in a high risk to you. We will also meet breach-notification duties under US federal and state law.
7: Your Rights and Choices
Your rights depend on where you live. We extend the core rights below to all visitors where we reasonably can. To use any of them, email privacy@melbournedtx.com (see section 8). We may ask you to verify your identity first, and we will respond within the time the law requires (generally within 30 days; one month under GDPR; 45 days under most US state laws).
Non-discrimination. We will not treat you less favourably for exercising your rights.
Australian users: statutory privacy tort. Australian law now allows individuals to sue for serious invasions of privacy. You may also complain to us or the OAIC.
California and other US state residents. In the past 12 months we have collected the categories listed in section 2 and disclosed them for business purposes to the recipients in section 4. We do not sell or share personal information for cross-context behavioural advertising.
EU and UK users. Melbourne Digital Therapeutics Pty Ltd is the controller. You may lodge a complaint with the supervisory authority in your country of residence, workplace or the place of the alleged infringement.
| Right | Australia (APPs) | EU/UK (GDPR) | US | New Zealand |
|---|---|---|---|---|
| Access your information | Yes (APP 12) | Yes (Art. 15) | Yes, where state law applies | Yes (IPP 6) |
| Correct it | Yes (APP 13) | Yes (Art. 16) | Yes, where state law applies | Yes (IPP 7) |
| Delete it | No general right; we delete or de-identify when no longer needed (APP 11.2) | Yes, in the cases in Art. 17 | Yes, subject to exceptions, where state law applies | Not a general right |
| Receive a portable copy | Not a general right | Yes, for consent or contract-based processing (Art. 20) | Yes, where state law applies | Not a general right |
| Object or restrict processing | Not a general right | Yes (Arts. 18, 21) | Opt out of sale, sharing and targeted advertising where state law applies | Not a general right |
| Withdraw consent or unsubscribe | Yes | Yes (Art. 7(3)) | Yes | Yes |
| Complain to a regulator | OAIC | Your local supervisory authority | State attorney general or FTC | Office of the Privacy Commissioner |
8: Children, Complains, Contact and Changes
Children. The Website is intended for adults aged 18 or over and is not designed to attract children. We do not knowingly collect personal information from anyone under 18 through the Website. If we learn we hold such information, we will delete it as soon as practicable and in accordance with applicable law.
Complaints. Please contact us first so we can try to resolve your concern. We will acknowledge your complaint within [5] business days and aim to respond within [30] days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (oaic.gov.au), your local EU/UK supervisory authority, the Office of the Privacy Commissioner (New Zealand), or, in the US, your state attorney general or the Federal Trade Commission.
Contact us. Privacy Officer, Melbourne Digital Therapeutics Pty Ltd, PO BOX 4203, Fitzroy Melbourne, Australia 3065. Email: privacy@melbournedtx.com
Changes to this policy. We may update this policy. We will post the new version with its date on this page and, if the changes are material, take reasonable steps to notify you. We use your information as described in the policy in effect when we collected it, unless you consent otherwise