Privacy Policy

1. About this Privacy Policy

Blistr Pty Ltd (ABN 16 688 317 642), trading as Sicknotes (“Sicknotes”, “we”, “us” or “our”), is committed to protecting your privacy.

This Privacy Policy explains how we collect, use, disclose, store and otherwise handle personal information when you use the Sicknotes website and certificate assessment service.

In this Privacy Policy:

• “you” and “your” mean the individual to whom personal information relates;
• “Certificate” means an Absence from Work Certificate issued following a pharmacist assessment through the Service; and
• “Service” means the Sicknotes website and the certificate assessment service provided through it.

This Privacy Policy is made with reference to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information we collect

We collect personal information that is reasonably necessary to provide and administer the Service.

Depending on the nature of your request, this may include:

• Your name;
• Date of birth;
• Email address;
• Mobile telephone number;
• Residential address;
• Information about your employment and leave request;
• Information about your symptoms, illness, injury or other reason for seeking an absence from work;
• The date your symptoms commenced and information about their progression;
• Information provided during your consultation with a pharmacist;
• Information relating to the outcome of the pharmacist’s assessment; and
• Information you provide when contacting us for support or making an enquiry or complaint.

Health information is sensitive information under the Privacy Act. We only collect health information that is reasonably necessary for the purposes described in this Privacy Policy.

3. Information about another person

If you request a Certificate relating to carer’s leave, we may collect information about the person for whom you are providing care, including their name and, where relevant, their date of birth and relationship to you.

By providing personal information about another person, you confirm that you are authorised to provide that information to us for the purposes of the Service.

You should only provide information about another person that is reasonably necessary for the Service.

4. Information collected during a pharmacist consultation

The online questionnaire is used to collect information required to facilitate your request and prepare for the pharmacist consultation.

The pharmacist conducting your consultation may collect additional information from you during the consultation where the pharmacist considers it reasonably necessary to assess your request.

The pharmacist may record their professional assessment, including the outcome of the consultation and information reasonably necessary to support that assessment.

Sicknotes maintains the Service record. The pharmacist may also retain information or records as required by applicable professional or legal obligations.

5. How we use personal information

We may use personal information to:

• Receive and assess your request;
• Arrange and conduct your pharmacist consultation;
• Enable the pharmacist to assess whether a Certificate is appropriate;
• Issue and deliver a Certificate where the pharmacist determines that one should be issued;
• Process payments and refunds;
• Communicate with you about your request;
• Provide customer support;
• Maintain appropriate business and professional records;
• Verify identity and prevent fraud, misuse or unauthorised use of the Service;
• Maintain the security and functionality of the Service;
• Investigate and respond to complaints, disputes and enquiries;
• Comply with legal, regulatory and professional obligations; and
• Protect the rights, property and safety of Sicknotes, its customers and others.

We may also use appropriately aggregated or de-identified information for purposes such as service improvement, operational analysis and reporting, provided the information is no longer reasonably capable of identifying an individual.

6. Information we do not use for advertising

Sicknotes does not sell personal information.

We do not use your health information for behavioural advertising or advertising profiling.

We do not currently use personal or health information to train or develop artificial intelligence models.

If our practices change in a way that materially affects how personal information is handled, we will update this Privacy Policy as appropriate.

7. Disclosure to service providers

We use third-party service providers to operate the Service. Depending on the service involved, these providers may process personal information for purposes including:

• Cloud hosting, application infrastructure and database services;
• Payment processing;
• Email and communications delivery;
• Address verification;
• Website security, network protection and technical infrastructure;
• Fraud prevention and security; and
• Other technology services reasonably necessary to operate the Service.

We only disclose information to service providers to the extent reasonably necessary for the relevant service.

For example, our payment processor receives information required to process your payment and does not receive your health information for the purpose of assessing your request.

Our email and communications providers may receive your contact details and the content necessary to deliver communications to you. A Certificate delivered by email may contain limited information relevant to the Certificate, but Sicknotes does not use email providers to conduct the clinical assessment.

8. Overseas processing

Some service providers used by Sicknotes may be located outside Australia or may process personal information outside Australia.

As a result, personal information, including sensitive information, may be processed in countries including the United States and other countries in which our service providers or their subprocessors operate.

Sicknotes takes reasonable steps appropriate to the circumstances to protect personal information provided to overseas recipients, including by assessing relevant service providers and their privacy and security arrangements and, where appropriate, entering into contractual arrangements addressing the handling of personal information.

Where required, Sicknotes complies with the requirements of APP 8 concerning overseas disclosure of personal information. Under APP 8, an Australian organisation may remain accountable for certain acts or practices of an overseas recipient.

9. Storage and security

Customer information is stored using cloud infrastructure, including a production database hosted in Australia.

Personal information may also be processed temporarily or otherwise accessed through application, security, communications and other infrastructure located outside Australia.

Sicknotes takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These measures may include access controls, authentication, encryption, secure transmission and other technical and organisational safeguards appropriate to the nature of the information.

No method of transmission or electronic storage is completely secure. Accordingly, while we take reasonable steps to protect your information, we cannot guarantee absolute security.

10. Data breaches

Sicknotes maintains processes for identifying, assessing and responding to suspected data breaches.

Where an eligible data breach occurs, Sicknotes will comply with its obligations under the Notifiable Data Breaches scheme in the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

11. Your consultation

Your consultation with the pharmacist is conducted by telephone or another method offered by Sicknotes.

The consultation is not recorded by Sicknotes and is not processed by a third-party video, transcription or call-recording service. No artificial intelligence tool is used during or after the consultation.

The pharmacist may make professional records of information discussed during the consultation where required or considered necessary for the pharmacist’s professional obligations.

12. Cookies and similar technologies

Sicknotes does not currently use cookies for behavioural advertising.

The Service may use necessary cookies, session technologies, local browser storage and similar technologies required to operate the website, maintain security, authenticate authorised users or preserve progress through a request.

Sicknotes may introduce additional analytics, security or performance technologies in the future. Where those technologies involve personal information, their use will be managed consistently with applicable privacy requirements and this Privacy Policy will be updated where appropriate.

13. Retention

Sicknotes retains personal information for as long as reasonably necessary for the purposes for which it was collected, including to:

• Provide the Service;
• Maintain appropriate business and professional records;
• Comply with legal and regulatory obligations;
• Resolve complaints and disputes;
• Prevent fraud and misuse; and
• Protect our legal rights.

Different categories of information may be retained for different periods depending on their nature and the legal or professional obligations applying to them.

When personal information is no longer required, Sicknotes will take reasonable steps to destroy or de-identify it, unless retention is otherwise required or permitted by law.

14. Access and correction

You may request access to personal information Sicknotes holds about you.

You may also request correction of personal information that is inaccurate, incomplete, out of date or misleading.

We may need to verify your identity before responding to an access or correction request.

Sicknotes will deal with requests in accordance with the Privacy Act and applicable privacy requirements.

15. Privacy complaints

If you have concerns about how Sicknotes has handled your personal information, you should contact us first so that we have an opportunity to investigate and respond.

Privacy enquiries and complaints can be made through the Contact & Support page.

We will investigate complaints and respond within a reasonable period and in accordance with applicable privacy requirements.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Service, technology, legal obligations or information-handling practices.

The version published on the Service is the version applicable at the relevant time.

17. Contact

Questions concerning this Privacy Policy or the handling of personal information should be directed to Sicknotes through the Contact & Support page.