Privacy Policy

Privacy Statement

Last Updated: 22 May 2019

This Privacy Statement describes how members of the Althea Group, consisting of Althea Group Holdings Limited (ACN 626 966 943), Althea Company Pty Ltd (ACN 618 177 192), Althea MMJ UK Ltd (Company No. 11125946) and MMJ Clinic Group Limited (Company No. 11906622) (“Althea”, “we” or “us“) collect, use, share, and store your personal information, and how you can exercise your privacy rights.

The relevant entity will depend on the nature of your relationship with us. If you are engaging with Althea MMJ UK Ltd (“Althea UK“), or are a visitor to, or user of our UK websites/micro-sites and/or Althea Concierge Platform for the UK, Althea MMJ UK Ltd is the controller of your personal data under the General Data Protection Regulation. If you are dealing with MMJ Clinic Group Limited or one of its websites/microsites, MMJ Clinic Group Limited is the controller of your personal data under the General Data Protection Regulation. If you are dealing with an Australian based member of Althea, Althea has obligations under the Australian Privacy Principles in the Privacy Act 1988 (Cth) (Privacy Act) personal information.

This Privacy Statement applies to personal information we collect about you through the use and operation of each of Althea’s websites,  accessed through the domain www.althea.life, http://concierge.althea.com.au, http://conerierge.althea.co.uk and through the use of any other website which references this Privacy Statement, including the MEDIC website  https://mymedic.org  (each a “Website”), information collected through your use of the Althea Concierge platform (“Platform”), and information we receive from you or third parties outside of the Website or Platform as provided for in this Privacy Statement.

If you are an employee of Althea MMJ UK Ltd please see our separate UK Employee Privacy Notice.

If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Privacy Statement.

Collection and Use

Broadly speaking, we collect personal information about you in the following ways:

Information that You Provide Voluntarily

Certain parts of our Website or Platform may ask you to provide personal information voluntarily: for example, we may ask you to provide your contact details in order to register an account with us, to subscribe to marketing communications from us, and/or to submit enquiries to us. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

Information that We Collect Automatically

When you visit our Website or Platform, we may collect certain information automatically from your device. Specifically, the information we collect automatically may include your internet protocol (IP) address, your login data, browser type and version, time zone setting and location and other technical information. We may also collect information about how your device has interacted with our Website and our Platform, including what was accessed and the links clicked.

Collecting this information enables us to better understand the visitors who come to our Website and the users of our Platform, where they come from, and what content is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website and Platform.

Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Online Tracking” below.

Information that We Obtain from Third Party Sources

Where possible, Althea will endeavour to collect information from the relevant individual. However, there may be cases where Althea receives information about individuals from third parties, including (but not limited to) your health care professional, dispensing pharmacies or third parties with whom we have a relationship. For example, in order to comply with regulations in Australia, before Althea is able to supply pharmacies with products to dispense, it receives Therapeutic Goods Administration (TGA) approval letters from the relevant pharmacy.

Information We Collect and Why

The personal information we may collect depends on our relationship with you. Althea collects personal information from a range of individuals in the context of our business activities including healthcare professionals, patients, and pharmacists, users of our Platform, visitors to our Websites and job applicants.  

The following table sets out the types of information we collect and why we use it.

 

Data type

Why do we use this information?

Legal basis for healthcare professionals engaging with Althea UK

Healthcare professionals

Contact information: such as your name, email and work address (clinic details)

To assist the healthcare professional in completing any required application forms, required by law/regulation

Performance of a contract, or our legitimate interests

To facilitate contact from an Althea medical science liaison or other Althea personnel where you request such a visit

Consent or our legitimate interests

To provide you with information about our products, educational platform and other services on your request

Consent or our legitimate interests

To participate in surveys provided by Althea for research purposes

Consent

Professional information: such as your professional registration number, health practitioner type, your qualification, speciality and clinic details

To verify your details with the relevant regulatory body

Legal obligation or our legitimate interests

To add your clinic details and your professional details to the “find a doctor” directory on our Website and/or our Platform

Consent

Data Type

Why do we use this information?

Legal basis for patients of Althea UK

Patients with a Profile on our Platform or Websites

Contact information: such as your name, email and location

To create your user profile on our Platform or Website

 Consent

To provide you with information and/or access to information relating to medicinal cannabis on your request

Consent

To contact you to participate in a survey

Consent

To assist you in locating relevant healthcare professionals near your location when you use the Platform

Consent

To sign up to our Websites or register to use our Platform

Consent

Survey information: any information you provide to us as part of your voluntary participation in a survey, which could include sensitive personal information

To carry out analysis on users of our Platform and Websites

Consent

Patients of healthcare professionals engaging with Althea

Contact information: such as name, email, address, registered healthcare professional

Information uploaded by your Healthcare Professional but not accessible to Althea

N/A

Prescription data: such as name, initials, address, date of birth, gender, weight and printed age for those under the age of 12 or over the age of 60

For identity verification purposes and to enable us to fulfil a product order relating to your prescription with a dispensing pharmacist, which you have requested.

Legal obligation and health or social care purposes – for the provision of treatment.

Medical information: such as your diagnosis/medical condition, indication and clinical justification for the use of the product (e.g. the seriousness of the condition, details of previous treatments including detail on use of therapeutic treatment)

 To carry out analytics and create aggregate statistics for research purposes.

 Our legitimate interests and for scientific research purposes.

 

Information uploaded by your Healthcare Professional including as part of regulatory requirements but not accessible to Althea.

N/A

Treatment information: such as product type, dosage, dose form, frequency of administration and expected duration of treatment, treating clinic.

To carry out analytics and create aggregate statistics for research purposes.

 Our legitimate interests and for scientific research purposes.

 

Information uploaded by your Healthcare Professional, including as part of regulatory requirements but not accessible to Althea

N/A

Pharmacists

Contact information: such as your name, email address and pharmacy contact details

To add your pharmacy details to the “find a pharmacy” directory on our Website and/or our Platform

Consent

To facilitate contact from an Althea medical science liaison or other Althea personnel where you request such a visit

Consent or our legitimate interests

To provide you with information about our products, educational platform and other services on your request

Legitimate interests or consent

To deliver orders to you and provide you with information relevant to ordering from Althea

Performance of a contract or our legitimate interests

Professional Information: such as your professional registration number

To verify your details with the relevant regulatory body

Legal obligation or our legitimate interests

Financial Information: such as information regarding your financial viability

To conduct credit enquiries relating to your dispensing pharmacy application

Legal obligation or our legitimate interests

 

 

 

Any visitors to the Website / Users of the Platform

Contact information: such as name, email, telephone number, address, content of free text

To respond to your queries and requests and/or to register you.

Our legitimate interests

Technical information: such as internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform

To understand how you interact with our Website and Platform, as well as our content to enable us to improve service and functionality

Our legitimate interests

Information you disclose to us: any information you disclose to us through your communications with us which may include sensitive personal information

To respond to you including your questions in relation to our products and services

Consent

Job Applicants

Identification data: such as your name, gender, photograph, date of birth, national identifiers

To identify you as the individual applying for a role with us

Performance of a contract

Contact information: such as home address, telephone number, email address

To contact you about your application to us and invite you to participate in any assessments and interviews with respect to the role you have applied for

Performance of a contract

Employment details: such as employment history, application for role, third party references

To assess your job application to us and your suitability for the role

Performance of a contract

Background information: such as academic/professional qualifications, education, CV, criminal records data (for vetting purposes, where permissible and in accordance with applicable law)

To assess your job application to us and your suitability for the role

Performance of a contract, processing for employment and for the assessment of your working capacity

 

Sensitive Information

Some of the information collected/received may include sensitive information. Sensitive information is a subset of personal information that is generally afforded a higher level of privacy protection. Sensitive information includes health and genetic information and information about racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preferences or practices, criminal record and some types of biometric information. Althea will only collect sensitive information where it is reasonably necessary for its functions or activities and with respect to Althea UK where Althea UK has a legal basis to do so under the EU General Data Protection Regulation and /or any applicable UK data protection laws as provided for in the table above.

Althea as a Processor

Althea provides a platform to facilitate and assist healthcare professionals to complete their regulatory obligations when prescribing medicinal cannabis. In order to do this healthcare professionals upload patient details to our Platform including contact information, medical information and treatment information. In this situation, Althea acts solely as a processor and we have “locked down” the Platform to ensure that your directly identifiable information is not linked to your medical and treatment information and is therefore not accessible to Althea. For this reason, if you wish to amend, update, delete or access any information which has been uploaded to the Platform by your Healthcare Professional you must contact them directly as the controller of your personal data and they will be able to assist with this.

Scientific Research and Statistical Reporting of Pseudonymised Data

As set out in the table above we may also use your information for scientific research and statistical reporting, however we have taken a number of measures to ensure that this information is pseuondymised and cannot directly identify an individual. Althea only has access to your medical and treatment information for this purpose only and cannot directly identify you from this information.

Marketing

Where Althea carries out any marketing, and such marketing requires additional consents or other requirements under applicable data protection laws, Althea will obtain such consents from you where appropriate.

Online Tracking and Your Choices

Like many websites, we analyse log file information and other data collected through cookies, web beacons, and other tracking technology, to collect information about your browsing behaviour when you visit our Website, including for example, your browser type, domains, page views, IP address, referring/exit pages, information about how you interact with our Website’s webpages and with third-party links, traffic and usage trends on the service, etc.

We use session cookies to keep you logged in while you use features of our Website; these disappear after you close your browser. We also use persistent cookies, which stay in your browser and allow us to recognise you when you return to the Website. We use this to remember your information, so you will not have to re-enter it, to better understand how you use our Website and products and services, to diagnose and fix technology problems, and otherwise enhance our Website, products, and services. In some of our email messages, we use a “click-through URL” linked to content on the Website. We track this click-through data to help us measure the effectiveness of our customer communications.

We may collect analytics data directly or through third party analytics tools (including Google Analytics) to assist us with analysing and improving our service, to help us measure traffic and usage trends for our products and services. These tools collect information sent by your browser or mobile device, including the pages you visit and other information that assists us in improving our products and services.

Most Internet browsers automatically accept cookies, but you may be able to change the settings of your browser to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. If you set your browser to reject cookies, parts of our Website may not work for you. Please note, depending on your type of device or browser, it may not be possible to delete or disable all tracking mechanisms on your device.

Your selection of the “Do Not Track” option provided by your browser may not have any effect on our collection of cookie information for analytic and internal purposes. The only way to completely “opt out” of the collection of any information through cookies or other tracking technology is to actively manage the settings on your browser or mobile device to delete and disable cookies and other tracking/recording tools. To learn more about cookies, clear GIFs/web beacons and related technologies, you may wish to visit allaboutcookies.org.

For more information on our cookies and tracking technologies please see our Cookie Notice.

Third-Party Sites and Features:

Our Website may contain links to other websites operated by third parties and may include social media features such as Facebook and Twitter buttons (such as “Like,” “Tweet” or “Pin”). These third-party sites may collect information about you if you click on a link and the social media sites may automatically record information about your browsing behaviour every time you visit a Website that has a social media button. Your interactions with these features are governed by the privacy policy of the company providing the feature, not by our privacy policy. We do not control what information these third parties collect. Please review your privacy settings on your social media sites and think carefully before clicking on links which may take you to a third-party website.

Data Sharing

We may disclose your personal information to the following categories of recipients:

  • to our group companies including Althea Group Holdings Pty Ltd and Althea Company Pty Ltd for the purposes for which we are entitled to process your personal information under this Privacy Statement;

  • to third party service providers who work for us in the provision of our services and with whom we have contractual relationship. Your data may also be processed by a third party if required to deliver a service you have requested. For example, to a dispensing pharmacy in order to fulfil an order, regulatory bodies and healthcare professionals;

  • to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation; (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;

  • to an actual or potential buyer (and its agents and advisors) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Statement;

  • to persons for whom we have your consent to disclose your personal information.

We will check any third party that we use to ensure that they can provide sufficient guarantees regarding the confidentiality and security of your Data.

We will have written contracts with them which provide assurances regarding the protections that they will give to your Data and their compliance with our data security standards and international transfer restrictions.

Security

Althea takes security seriously and cares about the integrity of your personal data. We use commercially reasonable physical, administrative, and technological methods to secure your data and protect it from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

In the event that any information under our control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with any applicable laws and regulations.

International Transfers

Data collected from interactions with Althea UK is stored securely within the UK.

Althea will not transfer data collected and stored within the EEA (including the UK) to any country outside of the EEA that is not recognised as ensuring an adequate level of protection, without compliance with the relevant legal or regulatory requirements. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EEA or the UK in accordance with European Union data protection law. In addition, where required, we have implemented similar appropriate safeguards with our third party service providers. Further details on our international transfer safeguards is available on request.

Data collected from interactions with Althea within Australia is stored securely in Australia. Althea may disclose information outside of Australia where it has a legal right to do so and to its group companies located overseas in the normal course of its business. Althea’s policy is to comply with the requirements of the Privacy Act that apply to cross border disclosure of personal information. 

Data Retention

In order to deliver our core functions and to ensure we meet our legal data protection and privacy obligations, we will retain your information for at least as long as your account is active, as needed to provide you services, as long as is needed to fulfil the purpose for which it was collected (and any other linked purpose) or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

When we have no ongoing legitimate business need to process your personal information (as described above), we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your Rights

You have the following data protection rights:

  • If you wish to access of your personal information, you can do so at any time by contacting us using the contact details provided under the “Contact Us” section below.

  • If you wish to correct or update your personal information you can do this by accessing the profile sections of our Website and/or Platform, or by using the contact details provided under the “Contact Us” section below.

  • In addition, where Althea UK is the data controller of your personal information you also have the following rights:

    • You can request deletion of your personal information by contacting us using the contact details provided under the “Contact Us” section below.

    • you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “Contact Us” section below.

    • You have the right to opt out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “Contact Us” section below.

    • Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

    • You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please see the UK Information Commissioner’s Office website at https://ico.org.uk/make-a-complaint/.

Please note that the availability of your data protection rights will depend on Althea’s role as a controller or processor, our legal basis for processing and whether or not any exemptions are available under applicable privacy or data protection law. As we have set out in this Privacy Statement, if you wish to exercise any of these rights in relation to personal information provided to us by your Healthcare Professional please contact them directly.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable privacy and data protection laws.

In order to comply with a request, we may ask you to identify yourself. In such a situation, we will only request information to the extent required to confirm your identity.

You also have the right not to identify yourself when dealing with us where it is lawful and practicable for us to allow it. However, in some cases, if you don’t provide us with your personal information when requested, we may not be able to respond to your request or provide you with the product or service that you are seeking.

Contact Us

If you have a complaint or query about how Althea has collected or handled your personal information, please contact the Althea privacy officer using the contact information below and provide details of the incident so that we can investigate it.

If you are making a complaint, we will treat your complaint confidentially, investigate your complaint and aim to ensure that we contact you and your complaint is resolved within a reasonable time (and in any event within the time required by applicable law).

Australia

Privacy Officer
privacy@althea.life

Althea Company Pty Ltd (ACN 618 177 192)  
Suite 2, Level 37, 360 Elizabeth Street, Melbourne VIC 3000 


If our response to your complaint does not address your concerns to your satisfaction, you may have a right to make a complaint to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint.

UK

Privacy Officer

ukprivacy@althea.life

Portland House, Bressenden Place

London, SW1E 5RS

The Information Commissioner’s Office (ICO) is our lead supervisory authority. Where you are concerned about the collection and use of your personal information by Althea UK, you have the right to make a complaint to the ICO  For more information, please see the UK Information Commissioner’s Office website at https://ico.org.uk/make-a-complaint/.

ICO Registration No.

Althea MMJ UK Limited – ZA51934

MMJ Clinic Group Limited – ZA519342

Please use the correct contact details for the Althea entity with whom you have a relationship.

Changes to this Privacy Statement

Please note that we may update this Privacy Statement from time to time in response to changing legal, technical or business developments. When we update our Privacy Statement, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Statement changes if and where this is required by applicable data protection laws.

You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Privacy Statement.