OrthoADVANCE Privacy Policy

Operator: EHI Design Pty Ltd (ABN 87 695 941 729; ACN 695 941 729), trading as OrthoADVANCE — www.orthoadvance.com.au
Effective date: 18 September 2026 · Version: 1.0

This Privacy Policy explains how EHI Design Pty Ltd manages personal information in connection with the OrthoADVANCE website, applications (including the general wellness version of OrthoADVANCE and the clinical decision support software version of OrthoADVANCE), digital programs, products and related services (collectively, OrthoADVANCE, or the Platform).

EHI Design Pty Ltd (we, us or our) operates OrthoADVANCE. We are committed to handling personal information openly and responsibly in accordance with the Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs), the following state and territory health records legislation, and other applicable laws:

• the Health Records (Privacy and Access) Act 1997 (ACT) and its ‘Privacy Principles’ in the Australian Capital Territory; and
• the Health Records and Information Privacy Act 2002 (NSW) and its ‘Health Privacy Principles’ in New South Wales; and
• the Health Records Act 2001 (Vic) and its ‘Health Privacy Principles’ in Victoria

The above state and territory Health Privacy Principles and Privacy Principles are referred to in this Privacy Policy as the ‘HPPs’.

This Privacy Policy applies to our collection and handling of personal information.

‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.

Personal information includes ‘sensitive information’, which is a particular type of personal information. Sensitive information includes identifying health information about you, such as details of your health and medical history, and health services you have sought or received. Sensitive information also includes information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, and sexual orientation or practices.

By using OrthoADVANCE or providing personal information or other information to us, you acknowledge the practices described in this Privacy Policy. Where the law requires consent—particularly for the collection, use or disclosure of sensitive information—we will seek that consent separately.

In addition to this Privacy Policy, we may also provide shorter collection notices (including details of what is being collected and for what purpose, and who it may be disclosed to) at or before the time we collect particular information, such as when you create an account, connect with a care team, participate in a program, make a purchase or consent to tracking technologies.

At a glance

1. Scope of this Privacy Policy

This Privacy Policy applies to personal information we handle through the OrthoADVANCE website and applications, digital prehabilitation and rehabilitation programs, education and support services, online purchases, communications, surveys, events and interactions with patients, authorised healthcare providers, hospitals and other participating organisations, care-team members, suppliers, contractors and job applicants.

A particular service, study or feature may have an additional privacy notice. If an additional notice is inconsistent with this Privacy Policy, the more specific notice will apply to that activity to the extent of the inconsistency.

2. Personal information we collect

Account, identity and contact information

We may collect your name, date of birth, postal address, email address, telephone number, account identifiers, login and authentication information, communication preferences and information needed to verify your identity , professional role, organisation, or authority to act for another person.

Health and other sensitive information

When you use the Platform as a patient or program participant, we may collect health information that is reasonably necessary to provide the Platform services. This may include relevant medical and surgical history, condition and procedure information, treating hospital and care-team details, appointments, medications or risk information you choose to enter, care pathway, exercise programs, completion and adherence information, pain and symptom responses, mobility and functional measures, recovery goals, patient-reported outcomes, survey or questionnaire answers, messages and documents or images that you upload.

We collect your health information and any other sensitive information with your consent, including when you create an account, participate in a digital program, complete assessments or questionnaires, connect with your care team. We may also collect your health information where collection is otherwise authorised or required by law.

Where relevant and appropriate, we may also collect information about language, accessibility, cultural background or other needs so that content and services can be provided appropriately. To the extent this information is sensitive information, we will only collect that information with your consent or where otherwise authorised or required by law.

Service, transaction and communication information

We may collect records of products or services requested or purchased, subscription and billing information, delivery details, support requests, correspondence, feedback, survey responses and participation in promotions or events. Payment card information is generally collected and processed directly by our payment service provider; we do not intend to store complete card details on OrthoADVANCE systems.

Technical and usage information

When you access our website or app, we may collect technical and usage information through cookies, software development kits, pixels, analytics tools, logs and similar technologies. This information may include internet protocol address, approximate location derived from that address, device and browser type, operating system, app version, login activity, pages or screens viewed, referral source, session information, cookie choices, diagnostic information, crash reports and security logs.

Clinician, supplier and employment information

For clinicians and other professional users, we may collect workplace, role, contact details, professional registration, credentials and information needed to configure access. For suppliers, contractors, workers and applicants, we may collect business details, qualifications, employment history, references, licences, right-to-work information and background checks where lawful and relevant.

3. How we collect information

Directly from you. This includes information entered when you register, complete forms or assessments, use a program, purchase a product, contact support, communicate through the Platform or participate in a survey or event.

From people you authorise. We may receive information from your surgeon, physiotherapist, general practitioner, hospital, other care-team member, parent, guardian or authorised representative where you have authorised the sharing or the law otherwise permits it. Where those people or organisations interact with the Platform, we may also collect their personal information directly from them or from their organisation, including their name, role, workplace contact details, professional details and information about their use of the Platform.

Through your use of the Platform. We collect technical and usage information through our website, app, cookies, software development kits, pixels, analytics tools, logs and similar technologies.

From service providers and public sources. We may receive payment confirmations, delivery updates, identity or security information, professional registration information and business contact details from providers or publicly available registers.

You may choose not to provide personal information and may manage non-essential cookies, pixels and similar technologies through available consent settings and browser or device controls. However, if required information is not provided, or if essential technologies are not permitted, we may be unable to create or maintain your account, tailor your program, connect you with your care team, process an order or provide a particular service.

When we collect personal information, we will take reasonable steps, at or before the time of collection or as soon as practicable afterwards, to notify you of relevant matters, including our identity and contact details, why we collect the information, whether collection is required by law, the consequences if information is not provided, how we use and disclose the information, likely overseas disclosures where practicable, and how you may access or correct your information or make a complaint.

4. Why we collect, hold, use and disclose information

Providing and administering OrthoADVANCE

We use information to create and secure accounts; verify and administer professional user and organisation access; provide education, digital programs and services; tailor content to information and goals supplied by you; record progress; support communication and connected care; process orders and payments; deliver products; provide support; and maintain business, clinical-support and administrative records.

Program tailoring and automated processing

OrthoADVANCE may use rules-based or automated processing to organise information, tailor educational or exercise content, calculate progress measures, present reminders, or flag responses that may warrant review. These functions are intended to support the user and, where applicable, the care team. They do not replace professional clinical judgement and should not be relied upon as an emergency or diagnostic service.

Communication, safety and security

We use information to respond to questions, send service and account notices, provide reminders requested through the service, authenticate users, monitor performance, detect misuse or fraud, investigate incidents, maintain backups and protect users, our systems and our legal rights.

Improvement, analytics and research and development

We may analyse how OrthoADVANCE is used to test, maintain, evaluate and improve our services, content, accessibility, safety, algorithms and business operations. Wherever reasonably practicable, we use aggregated or de-identified information for analytics and research and development.

If a proposed research activity requires identifiable health information beyond the purposes for which it was collected, we will obtain any consent and ethics or other approval required by law. We will not attempt to re-identify information that has been properly de-identified, except where necessary to test whether de-identification is effective or as permitted by law.

Legal and business purposes

We may use or disclose information to comply with legal and regulatory obligations, respond to lawful requests and court processes, establish or defend legal claims, maintain required records, manage insurance and professional advice, and support a proposed or completed corporate transaction subject to appropriate confidentiality and legal safeguards.

Marketing

With any consent required by law, we may send information about OrthoADVANCE products, services, educational events or offers. You may opt out at any time using the unsubscribe function or by contacting us. Service, security and transactional messages are not marketing and may continue while you have an account or active transaction. We do not use identifiable health information for third-party targeted advertising.

5. When we disclose personal information

Your authorised care team

If you choose to connect with a surgeon, physiotherapist, general practitioner, hospital or other care-team member through OrthoADVANCE, we may make relevant information available to that person or organisation in accordance with your instructions, consent and the service configuration. We may also make limited information about care-team members available to you or to other authorised users where reasonably necessary to identify the care team, manage access, support communication or administer the relevant care pathway. Care-team members may separately be responsible for information they receive and keep in their own clinical systems.

You may ask us to change or end future sharing. Ending sharing does not ordinarily remove information already lawfully received or incorporated into a healthcare provider’s records.

Service providers

We may disclose information to providers that help us operate OrthoADVANCE, including cloud hosting and data storage, cybersecurity, identity and authentication, app development and maintenance, communications, customer support, payment processing, order fulfilment, professional advice, analytics and records management. We seek to limit access to what the provider reasonably needs and require appropriate privacy, security and confidentiality protections.

Other permitted recipients

We may disclose information to professional advisers, insurers, auditors, regulators, courts, tribunals, law-enforcement agencies, emergency services, a purchaser or adviser involved in a genuine corporate transaction, another person you authorise, or any other recipient where disclosure is required or authorised by law. Where reasonably possible, we will tell you before making a disclosure that is not reasonably expected.

We do not sell or rent personal information or patient lists.

6. Storage and overseas disclosures

We store primary OrthoADVANCE account information, user profile information and health information using systems hosted in Australia. However, we may disclose or make available limited technical and usage information to third party service providers that help us operate, secure, analyse and improve the Platform. This may include providers of analytics, measurement, advertising and similar technologies used to measure visits to and interactions with our website, understand the effectiveness of our online advertising, improve our services and, where enabled, support remarketing or more relevant advertising. These third party providers may include Google LLC and Meta Platforms, Inc., which are located in the United States, as well as their related bodies corporate or service locations in other countries in which they operate. We take reasonable steps to limit the information disclosed to what is necessary for the relevant service and to configure those technologies to minimise the personal information collected, used and disclosed.

If we disclose personal information overseas, we will comply with the APPs and HPPs when making such disclosures, and we will only make the disclosure where:

• we have taken reasonable steps to ensure that the overseas recipient of your personal information does not breach the APPs or HPPs; or
• the overseas recipient is subject to a law, binding scheme or binding contract that provides substantially similar protection to the APPs and HPPs which you can access and enforce; or
• the disclosure is otherwise required or authorised by law.

The reasonable steps we take to ensure that the overseas recipient of your personal information does not breach the APPs or HPPs include due diligence, limiting the information disclosed, contractual privacy and security requirements, configuration controls and access controls.

7. Cookies, pixels and similar technologies

Our website and app may use cookies, local storage, software development kits, pixels, analytics tools, logs and similar technologies.

These technologies may collect technical and usage information such as device identifiers, IP address, browser and device information, pages viewed, links selected, session activity, referral source, approximate location, cookie choices, and whether an email or message has been opened or interacted with.

Some technologies are essential, for example, for security, login, and service delivery functions. Others may be used, where enabled or consented to, to measure visits to and interactions with our website, understand the effectiveness of our online advertising, improve our services and support remarketing or more relevant advertising.

We may use third party service providers for these purposes, including providers of analytics, measurement, advertising and similar technologies. These providers may include Google LLC and Meta Platforms, Inc., which are located in the United States, and their related bodies corporate or service locations in other countries in which they operate. In those circumstances, the relevant provider may receive limited technical and usage information generated through its technologies.

We take reasonable steps to limit the information disclosed or made available to third party providers to what is necessary for the relevant service, and to configure those technologies to minimise the personal information collected, used and disclosed. Wherever reasonably practicable, we use aggregated or de-identified information for analytics, performance measurement, product improvement and research and development.

We do not use tracking pixels or similar technologies to disclose identifiable health information to Google, Meta or other third party platforms for targeted advertising. We also do not permit third party marketing technologies to be placed on pages or screens that are intended to collect or display sensitive health information, unless we have assessed the privacy risks, implemented appropriate controls and obtained any consent required by law.

Where we use analytics, measurement or similar third party technologies provided by platforms such as Google or Meta, those third party technologies are intended to operate only where you interact with those platforms or their services, or where you have enabled or consented to the relevant technologies.

You can manage cookies, pixels and similar technologies through available consent settings and your browser or device controls. We will seek your consent for non-essential tracking where required by law, including where the technology involves collection or disclosure of health information or other sensitive information. Blocking essential technologies may prevent login or affect Platform functionality.

8. Automated decision making and use of artificial intelligence

We do not make decisions which could reasonably be expected to significantly affect the rights or interests of individuals by means of automated decision making or the use of artificial intelligence (AI).

We will inform you through this Privacy Policy if in future we use any computer programs or AI systems that use personal information to make automated decisions that could reasonably be expected to significantly affect the rights or interests of an individual. This will include information about the kinds of personal information used in, and types of decisions made by, such computer programs or AI systems that use personal information to make such decisions.

9. Protecting personal information

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Depending on the system and risk, these measures may include encryption in transit and at rest, access controls, multi-factor authentication, logging and monitoring, secure development practices, backups, staff and contractor confidentiality obligations, security review and incident-response procedures.

No internet-connected service can guarantee absolute security. You should protect your password and device, avoid sharing login credentials and tell us promptly if you suspect unauthorised access to your account.

Data breaches

We maintain processes for assessing and responding to suspected data breaches. Where the ‘Notifiable Data Breach’ scheme under the Privacy Act 1988 (Cth) applies and a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

10. Retention, account closure and deletion

We retain personal information only for as long as it is reasonably needed for the purposes described in this Privacy Policy or to meet legal, regulatory, clinical-record, taxation, corporate, insurance, dispute-resolution or security requirements. Retention periods vary according to the type of information and the service involved. For example, for health information, the HPPs require a minimum retention period of 7 years for adults, or until you turn 25 if you were under 18 when the relevant heath information was collected.

When information is no longer required for any lawful purpose, we take reasonable steps to destroy it securely or de-identify it. Information may remain temporarily in secure backups until those backups are overwritten in the ordinary course. Aggregated or properly de-identified information may be retained for analytics, safety and research and development.

You may request closure of your OrthoADVANCE account by contacting us. Account closure stops ordinary use of the account but does not necessarily require deletion of information that we or a connected healthcare provider must retain by law or reasonably need for one of the purposes above. We will explain any material information we cannot delete.

11. Your privacy rights and choices

Access

You may request access to personal information we hold about you. We will verify your identity and respond within a reasonable period. We do not charge for making an access request, although we may charge a reasonable cost for providing access where permitted by law and advised in advance. If access is refused or limited, we will provide reasons where required and explain available complaint options.

Correction

You may ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. If we do not make the requested correction, we will explain why where required and you may ask us to associate a statement with the information.

Consent and sharing choices

Where we rely on consent, you may withdraw it for future handling by contacting us or using available account controls. Withdrawal does not affect handling that occurred before withdrawal and may mean that a feature or service can no longer be provided.

Anonymity and pseudonymity

You may interact with us anonymously or using a pseudonym where it is lawful and practicable, such as making a general enquiry. We usually need accurate identity and contact information to create a secure patient account, connect a care team, personalise a health-related program, process an order or respond to an access or correction request.

Marketing preferences

You may opt out of marketing at any time using an unsubscribe link or by contacting admin@orthoadvance.com.au. We will action the request as soon as practicable.

12. Children and authorised representatives

OrthoADVANCE is not directed to children unless a particular service expressly states otherwise. If a person under 18 uses a service, we may require consent or involvement from a parent, guardian or authorised healthcare provider, taking account of the person’s capacity and applicable law.

If you provide information or exercise rights for another person, we may ask for evidence of your identity and authority. We will act in the individual’s interests and respect their capacity and privacy rights.

13. Privacy enquiries, requests and complaints

Please contact our Privacy Officer if you have a question, wish to exercise a privacy right or believe we have mishandled your personal information.

How we handle a complaint

Step 1 — Tell us what happened. Please include your name and contact details, the nature of the concern, relevant dates and any supporting information. Tell us if you need assistance to make the complaint.

Step 2 — We investigate. We will acknowledge the complaint, verify identity where necessary, investigate fairly and keep you informed. We aim to provide a written response within 30 days; complex matters may take longer, in which case we will explain the delay.

Step 3 — Escalation. If you are not satisfied, you may ask for an internal review. You may also complain to the OAIC.

Office of the Australian Information Commissioner: 1300 363 992 | www.oaic.gov.au/privacy/privacy-complaints

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to OrthoADVANCE, our information-handling practices or legal requirements. The current version will be published on our website with its effective date. If a change is material, we will provide additional notice where reasonably practicable, such as through the app, website or email.

We encourage you to review this Privacy Policy periodically. Continued use after an update does not replace any consent that the law requires us to obtain.