Privacy policy

Questions about your information? Contact us. For certifications and regulatory status see Evidence and compliance.

This Privacy Policy sets out how EVEDA Pty Ltd ABN 17 658 197 418 ACN 658 197 418 ("EVEDA", "we", "our", or "us") protects the privacy of your personal information. This Policy is subject to the General Data Protection Regulation 2016/679 ("GDPR") if you are based in the European Union or UK during your interactions with us ("EU Individual").

1. Scope

This Privacy Policy applies to the collection, holding, use and disclosure of personal and sensitive information provided about individuals to EVEDA through the use of the website, https://www.eveda.com.au ("the website"), other applications related to EVEDA, and any services offered or provided by EVEDA ("services"). In this Privacy Policy, we also explain how you can contact us if you have a query about any personal or sensitive information that we may be holding about you. If you are an EU Individual, please refer to sections 20, 21 and 22, which deal with matters specific to EU Individuals.

2. Acknowledgement

By continuing to use the website and/or services or when you purchase services from EVEDA, you acknowledge that you have had the opportunity to read this Privacy Policy. You also acknowledge and consent to EVEDA collecting, holding, and disclosing personal information supplied by you and retaining and/or using your personal information subject to the terms of this Privacy Policy, the website, any terms and conditions that apply to any services that we provide to you, and any other applicable contracts or laws. If you provide us with personal and/or sensitive information of a third party individual, you will be responsible for bringing the existence of this Privacy Policy to their attention and obtaining their consent for their personal or sensitive information to be provided to EVEDA for the purposes indicated in this Privacy Policy or as otherwise indicated at the time of collection.

3. Purpose

The purpose of this Privacy Policy is to clearly communicate the personal and sensitive information handling practices of EVEDA, enhance the transparency of EVEDA's information collection processes, and give individuals a better understanding of the sort of personal information that EVEDA collects, and the way EVEDA handles and stores that information.

4. Personal information

"Personal information" has the same meaning as defined by section 6 of the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in material form or not. Personal information we may collect includes your name, address, date of birth, contact telephone number(s), email address, organisational affiliation, employment details, billing and payment information, and any other information necessary for the delivery of our services.

5. Sensitive information

"Sensitive information" has the same meaning as defined by section 6 of the Privacy Act, and may include details or an opinion about your health information. We will only collect your sensitive information with your consent and where information is reasonably necessary for one or more of our services. We will only use and disclose your sensitive information for the primary purpose for which it was collected or a purpose that is directly related to this primary purpose and is reasonably expected. You consent to the use and disclosure on this basis. If for example we have collected information about any medical conditions you are suffering, then you consent to us disclosing this information to our service providers if they reasonably have a need to know such information in order to safely supply services for your benefit. We will not otherwise collect, use or disclose sensitive information about you unless required to do so by law.

6. How we collect information

EVEDA collects personal and sensitive information through a variety of channels, including when you:

• Undergo a health screening using any of our devices or systems
• Register for or use any of our digital health platforms or mobile applications
• Participate in an employer, corporate, government, or community health program facilitated by EVEDA
• Attend a health screening event
• Correspond with EVEDA in person, by telephone, email, mail, or through our website
• Submit an enquiry or request information
• Enter into a service agreement or contract with EVEDA
• Provide information through social media or third-party channels

We may also receive personal information from third parties, including your employer (in the context of a workplace health program), your healthcare provider, government agencies, or partner organisations, where you have consented to such sharing or where required by law. If you do not consent to the collection of your information, we may not be able to provide our services to you.

7. Cookies

We use Google Analytics to understand how our website is used, such as which pages are visited and for how long. This data is aggregated and does not identify you. Internet Protocol addresses are not stored in our analytics reports. You can opt out using Google's browser opt out tool.

Cookies are small blocks of data created by a web server while a user is browsing a website and placed on the user's computer or other device by the user's web browser. Cookies are placed on the device used to access a website, and more than one cookie may be placed on a user's device during a session. To ensure we are meeting the needs and requirements of our website users, and to continue to develop our online services, we may collect aggregated information through the use of cookies. We may use cookies to collect data about your visit and to allow you to navigate from page to page without having to reload each time. You may control, refuse and/or delete cookies by using the appropriate setting on your browser as you wish, however, if you do so you may be unable to access portions of our website.

8. Use of personal information

Personal and health information collected by EVEDA will be used for the purpose for which it was provided, for directly related purposes, for purposes you have consented to, or as otherwise permitted by law. This includes, but is not limited to:

• Delivering health screening services
• Generating your personal health reports and records
• Facilitating clinical consultations with healthcare providers
• Managing your health record within our digital platforms
• Enabling communication between you and your nominated healthcare providers
• Administering employer, government, or community health programs
• Improving the quality and safety of our services
• Complying with regulatory, legal, and reporting obligations
• Communicating with you about our services

9. De-identified and aggregated data

EVEDA may use de-identified, aggregated data for population health analytics, research, service improvement, and reporting purposes. De-identified data has been processed to remove any information that could reasonably be used to identify an individual. Aggregation thresholds are applied to prevent re-identification. Organisations that commission health programs through EVEDA receive only de-identified, population-level insights through DaX, including cohort risk stratification, demographic trends, and program dashboards. Individual patient records are never accessible through our analytics services. Your identity is not exposed through any population-level reporting.

10. Direct marketing

We may contact you using the contact details which you provide to us to provide you with direct marketing communications about our services (in accordance with the permitted limits of the law). You may opt out of receiving direct marketing communications from us at any time by contacting us using the details set out below or by functionality within such communications.

11. Disclosure

We may disclose personal and/or sensitive information to:

• Our directors, officers, employees, and related entities
• Contracted healthcare practitioners, clinical staff, and medical consultants engaged in delivering our services
• Your nominated healthcare provider, with your consent
• Organisations that commission health programs (only de-identified, aggregated data)
• Contracted service providers who assist in delivering our services, including cloud hosting providers, technology partners, and maintenance providers
• Payment processors and financial service providers
• Government, regulatory, and law enforcement agencies where required or authorised by law
• Our professional advisors, including accountants, auditors, and lawyers

In all cases, we prohibit third parties from using your personal information except for the specific purpose for which we provide it.

12. Data ownership

EVEDA believes that individuals should own and control their health data. Where health data is generated through our screening services, that data belongs to the individual. You control who can access your records through our digital platforms. Organisations that commission health programs cannot access individual records. The sharing of your health information with healthcare providers requires your explicit consent.

13. Overseas disclosure

We may disclose personal and/or sensitive information to overseas recipients in order to provide services. Generally, we will only disclose your personal information to these overseas recipients in connection with our services such as facilitation or fulfilment of your service engagement and/or to enable the performance of administrative and technical services by them on our behalf.

14. Storage, security, and technical measures

EVEDA takes the security of your personal and health information seriously. We implement technical and organisational measures to protect the information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include, but are not limited to:

• Encrypted data transmission and storage
• Role-based access controls and audit trails
• ISO 27001 certified information security management
• Staff training on privacy and data handling obligations
• Physical security controls at all facilities
• Incident response and disaster recovery procedures

Our systems are designed and maintained in line with the Australian Privacy Principles and our ISO 27001 certified information security management system.

15. Access and correction

You may request access to your personal and health information at any time by contacting us using the details below. Where we provide digital health platforms, you may also access your records directly through those platforms. If you believe that any information we hold about you is inaccurate, out of date, or incomplete, you may request a correction.

16. Automated decision-making

EVEDA may use automated processes to generate health risk scores, clinical alerts, and population health insights based on information we collect. These processes are designed to support, not replace, clinical decision-making by qualified healthcare professionals. Where automated processing is used in a way that could reasonably be expected to significantly affect your rights or interests, we will disclose this in accordance with applicable law, including the Privacy and Other Legislation Amendment Act 2024 (Cth). You may contact us to request information about the logic involved in any automated decision that affects you.

17. Children and young people

Where our services involve the collection of personal or health information from children or young people under the age of 18, we will obtain consent from a parent or legal guardian before collecting such information. We take additional care to protect the privacy of minors and ensure that information is collected, used, and disclosed only as necessary to deliver the relevant health services.

18. Links to external websites

Our website and platforms may contain links to external websites. EVEDA is not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any external site you visit.

19. Changes to this Privacy Policy

This is our current Privacy Policy. Please note that we reserve the right to amend, modify, remove, or vary this Privacy Policy at any time and without notice. You should check this page regularly to take notice of any changes we may have made to this Policy. To obtain a current version of our privacy policy, please contact EVEDA via the contact details below.

20. GDPR compliance

If you are a resident of the European Union (or following Brexit, you are a resident of the UK and the UK has laws equivalent to the GDPR in effect), you have certain rights and protections under the GDPR regarding the processing of your personal data. This section sets out the additional information that we are required to provide to you under the GDPR. Where the GDPR applies, the meaning of "personal information" has the same meaning as "personal data" and the meaning of "sensitive information" will apply as information concerning the processing of special categories of personal information ("sensitive data") under the GDPR. For the purposes of the GDPR we will either be the "data processor" or "data controller" for any personal information you provide to us in connection with our relationship. We rely on lawful means of processing your personal data, including where it is necessary to fulfil a contract with you, where you have given us valid consent to use your personal data, and where it is to further our legitimate interests.

21. Your rights as an EU or UK resident

Under certain circumstances or if you are a resident of the European Union or UK, you have various rights under the GDPR in relation to your personal information, including the right to: be informed; access information; rectification; object/withdraw consent; restriction of processing; erasure or to be forgotten; data portability; and not be subject to automated processing. To exercise any of these rights please contact EVEDA via the contact details set out below.

22. Withdrawing your consent

You can withdraw your consent to our collection or processing of your personal data. You can do so by contacting us or by opting out of email newsletter communications by following the instructions in those emails or by clicking unsubscribe. If you withdraw your consent to the use of your personal data, you may not have access to our services, and we might not be able to provide you with our services. In some circumstances, where we have a legal basis to do so, we may continue to process your information after you have withdrawn consent. For example, if it is necessary to comply with an independent legal obligation or if it is necessary to do so to protect our legitimate interest in keeping our services secure.

23. Contact

If you have any questions or concerns about how we handle your personal or sensitive information, or if you wish to access or amend personal and/or sensitive information we hold about you, please make a request in writing. All correspondence should be directed to:

You can also use our contact page.

If you decide to contact us for any of the reasons above, we request that you provide us with sufficient details regarding your reason for getting in touch with us. We note that, if necessary, we will ask you to provide us with a copy of your ID, passport or other valid identity document.

24. Complaints

If you have any enquiries about this Privacy Policy or wish to make a complaint about a matter relating to privacy, please contact us using the details set out above. We will investigate and consider any complaint received by us, and a response will be provided to the complainant as soon as practicable.