Last updated: 05/02/2026

1. Introduction

DocPouch is committed to protecting your privacy and handling personal information in an open and transparent way.

This Privacy Policy explains how we collect, use, store, and disclose personal information when you access or use the DocPouch website and ordering platform (the Platform), including when you create an account, submit a PBS Prescriber Bag order request, upload documents, or place a Private Stock order.

This Policy also explains how you can:

• access and correct the personal information we hold about you; and
• make a complaint about our handling of your personal information.

Important note: DocPouch is a workflow and submission platform. Medicines are supplied by licensed partner pharmacy/pharmacies (each a Supplying Pharmacy). We share information with the Supplying Pharmacy to verify eligibility, review order documentation, dispense (where applicable), dispatch, and maintain an audit trail.

2. Who we are

DocPouch (Platform operator):
DocPouch (“DocPouch”, “we”, “us”, “our”).

Doc Pouch Pty Ltd.
ACN: 695 916 306
ABN: 28 695 916 306

Supplying Pharmacy (current partner):
Priceline Pharmacy Sunshine Marketplace
Shop MM002 Sunshine Marketplace, 80 Harvester Rd, Sunshine VIC 3020
Phone: (03) 9364 7133
(“Supplying Pharmacy”)

DocPouch may partner with additional licensed pharmacies in the future. Where this occurs, we will update the Platform and/or this Policy to reflect the relevant supplier arrangements.

Partner pharmacy handling: Where DocPouch transmits your information to a Supplying Pharmacy, that pharmacy will handle your information in accordance with its own legal obligations as a pharmacy and its own privacy practices. DocPouch and the Supplying Pharmacy each take reasonable steps to protect personal information and restrict access to authorised staff and agents.

3. Scope

This Policy applies to:

• prescribers (e.g., medical practitioners and authorised nurse practitioners) who use the Platform;
• practice managers and authorised clinic staff who order on behalf of prescribers;
  and
• clinic accounts managing multiple prescribers.

This Policy does not apply to third-party websites linked from our Platform. Those third parties have their own privacy policies.

4. Laws and standards

We handle personal information in accordance with the:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); and
• other laws that may apply to pharmacies and PBS supply arrangements (including record-keeping and compliance obligations).

5. What personal information we collect

The information we collect depends on how you use the Platform and what services you access.

5.1 Identity and contact information

• Full name
• Email address
• Phone number(s)
• Clinic/practice name
• Clinic/practice address (shipping + verification)

5.2 Professional credentials and eligibility information

• AHPRA registration number
• PBS prescriber number (where applicable)
• Role type (prescriber / practice manager / clinic staff)
• Verification status (e.g., pending/verified)
• Supporting evidence requested for verification (if needed)

5.3 Order and workflow information

• Items requested and quantities (PBS)
• Order notes and communications
• Order status history (pending review, on hold, processing, dispatched, completed)
• Dispatch details and tracking numbers
• Proof of delivery metadata (where provided by a courier)

5.4 Uploaded documents

• Uploaded copies of Prescriber Bag Supply Order Forms
  (e.g., PDF/JPG/PNG)
• Other documents you provide to support verification or order processing

5.5 Payments (Private Stock only)

If Private Stock ordering is enabled:

• Payment status and transaction identifiers
• Amounts paid, refund, chargeback/dispute status
• We generally do not store full card details; payments are processed by third-party payment processors (e.g., Stripe, Apple Pay).

5.6 Technical and usage information

• Device and browser type
• IP address and approximate location derived from IP
• Log data (date/time of access, pages visited, actions taken)
• Cookies and analytics data (see section 12)

6. What we generally do not collect

DocPouch is not a telehealth provider and does not provide clinical care. We generally do not collect:

• Patient medical records
• Diagnoses, treatment notes, or health histories
• Medicare details or Individual Healthcare Identifiers (IHI)

If the Platform evolves to include additional functions that require collection of health information, we will update this Policy and
implement additional safeguards.

7. How we collect personal information

We collect personal information when you:

• Create an account or update your profile;
• Submit an order request;
• Upload documents;
• Communicate with us or the Supplying Pharmacy through the Platform;
• Place a Private Stock order and complete payment;
• Use the Platform (via cookies, logs, and analytics tools).

We may also collect information from:

• Public registers (e.g., AHPRA register) to verify credentials;
• Your authorised clinic/practice representatives (where a practice manager creates a clinic account);
• Our service providers (e.g., payment processors, couriers, hosting providers) to enable the Platform.

8. Why we collect, use, and disclose personal information

We collect, use, and disclose personal information to:

8.1 Provide and operate the Platform

• Create and manage user and clinic accounts
• Authenticate access and manage permissions
• Provide a streamlined order workflow and record order history
• Provide support and respond to enquiries

8.2 Verify eligibility and prevent misuse

• Verify prescriber identity and AHPRA registration
• Verify clinic/practice details
• Detect and prevent fraud or misuse (including chargeback patterns for Private Stock)

8.3 Facilitate order review, dispensing, and dispatch

• Transmit order details and supporting documents to the Supplying Pharmacy
• Allow the Supplying Pharmacy to review, approve/hold/decline orders
• Generate dispatch updates and tracking information where available
• Maintain an audit trail aligned with PBS and pharmacy requirements

8.4 Process payments for Private Stock (if enabled)

• Process online payments through payment providers
• Issue receipts, refunds (where applicable), and handle payment disputes

8.5 Compliance and legal obligations

• Comply with PBS-related supplier obligations (where applicable)
• Comply with record-keeping, audit, or regulatory requests
• Respond to legal claims, subpoenas, or law enforcement requests (where required or authorised)

8.6 Improve and secure the Platform

• Diagnose technical issues
• Monitor performance and uptime
• Improve usability and workflow design
• Maintain security and access logs

9. Who we disclose personal information to

We disclose personal information only where reasonably necessary.

9.1 Supplying Pharmacy/pharmacies

We share your information with the Supplying Pharmacy to:

• Verify credentials and eligibility
• Review orders and documentation
• Dispense and supply medicines (where approved)
• Dispatch orders and provide tracking
• Maintain audit-ready records

9.2 Service providers (IT and operations)

We may disclose information to trusted providers that help us operate the Platform, such as:

• Cloud hosting and storage providers
• Email/SMS communication providers
• Identity/verification tools
• Customer support tools
• Analytics providers
• Software developers and system administrators (including contractors)

Access is restricted to authorised personnel and governed by confidentiality and data protection obligations.

9.3 Payment processors (Private Stock only)

We may disclose information to payment processors (e.g. Stripe, Apple Pay) to process transactions and manage disputes.

9.4 Courier and delivery partners

We may share delivery information (name, clinic address, phone, dispatch details) with couriers for delivery and tracking.

9.5 Regulators and government bodies

We may disclose personal information to regulators or government entities where required or authorised by law, including in relation to PBS compliance and pharmacy regulation.

9.6 Professional advisers

We may disclose information to accountants, auditors, insurers, or lawyers where reasonably necessary for compliance, audit, or legal advice.

9.7 Authorised representatives

Where you authorise a practice manager or clinic representative, we may share information with them through your Clinic Account permissions.

10. Overseas disclosures

Some of our technology providers may store or process data outside Australia (for example, cloud infrastructure or support tooling). Where this occurs, we take reasonable steps to ensure overseas recipients handle your personal information in a manner consistent with the APPs.

If you want details of likely hosting locations for your configuration, contact us using the details in section 16 and we will provide
what we can.

11. How we store and secure your information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or
disclosure. Safeguards may include:

• Role-based access controls (least privilege)
• Encryption in transit (TLS) and encryption at rest where supported
• Audit logs and monitoring
• Secure document storage for uploaded forms
• MFA for admin/pharmacy users (where enabled)
• Contractual confidentiality obligations for staff and contractors

No method of transmission or storage is completely secure. You should also protect your login credentials and notify us of
suspected unauthorised access.

12. Cookies and analytics

We may use cookies and analytics tools to understand usage and improve the Platform, including:

• Pages visited and time spent
• Feature usage
• Device/browser type
• Referral source

You can control cookies through your browser settings. Some cookies may be necessary for the Platform to function (e.g.,
session/authentication).

13. Data retention

We retain personal information only for as long as necessary for the purposes described in this Policy, and to meet legal,
regulatory, PBS, and pharmacy record-keeping requirements.

As a general guide:

• Account and order records may be retained to support audit trails and compliance
• Uploaded form copies may be retained as part of the order record
• Technical logs may be retained for security and performance purposes

When information is no longer required, we take reasonable steps to delete it or de-identify it.

14. Access and correction

You may request access to the personal information we hold about you and request corrections if it is inaccurate, out of date,
incomplete, irrelevant, or misleading.

We may need to verify your identity before granting access. We aim to respond within a reasonable timeframe (generally within 30
days).

In some circumstances, we may refuse access where permitted by law. If we refuse, we will provide reasons in writing.

15. Making a privacy complaint

If you believe we have mishandled your personal information, you can complain to us using the contact details below. We will
acknowledge your complaint and work with you to resolve it.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

16. Contact us

Supplying Pharmacy (order/supply enquiries):

Priceline Pharmacy Sunshine Marketplace
Shop MM002 Sunshine Marketplace, 80 Harvester Rd, Sunshine VIC 3020
Phone: (03) 9364 7133
Email: admin@docpouch.com

17. Updates to this Policy

We may update this Privacy Policy from time to time. The latest version will be published on the Platform with an updated “Last updated” date.