SCHEDULE 1 – USER AGREEMENT AND CONSENT 

Introduction 

This user agreement and consent (the “UAC”) sets out the rules governing: 

• the use of the website at www.vaxapp.com.au and subdomains or web based applications, any successor website, and the services available on that website or any successor website (the “Services”); and 
• the transmission, storage and processing of content by you, or by any person on your behalf, using the Services (“Content”). 

References in this UAC to “you” are to any customer for the Services and any individual user of the Services (and “your” should be construed accordingly); and references in this UAC to “us” are to VaxApp Pty Ltd (and “we” and “our” should be construed accordingly). 

By using the Services, you agree to the terms of this UAC. 

We will ask for your express agreement to the terms of this UAC before you upload or submit any Content or otherwise use the Services. 

You must be at least 14 years of age to use the Services (or deemed a mature minor by your health services provider, in line with applicable legislation); and by using the Services, you warrant and represent to us that you are at least 14 years of age. 

PART 1 – USE 

General usage rules 

You must not use the Services in any way that causes, or may cause, damage to the Services or impairment of the availability or accessibility of the Services. 

You must not use the Services: 

• in any way that is unlawful, illegal, fraudulent, deceptive or harmful; or 
• in connection with any unlawful, illegal, fraudulent, deceptive or harmful purpose or activity. 

You must ensure that all Content complies with the provisions of this UAC. 

Unlawful Content 

Content must not be illegal or unlawful, must not infringe any person’s legal rights, and must not be capable of giving rise to legal action against any person (in each case in any jurisdiction and under any applicable law). 

Content, and the use of Content by us in any manner licensed or otherwise authorised by you, must not: 

• be libelous or maliciously false; 
• be obscene or indecent;
• infringe any copyright, moral right, database right, trade markright, design right, right in passing off, or other intellectual property right; 
• infringe any right of confidence, right of privacy or right under data protection legislation;
• constitute negligent advice or contain any negligent statement;
• be in contempt of any court, or in breach of any court order;
• constitute a breach of any legislation; or
• constitute a breach of any contractual obligation owed to any person.

Factual accuracy 

Content must not be untrue, false, inaccurate or misleading. 

Statements of fact contained in Content and relating to persons (legal or natural) must be true; and statements of opinion contained in Content and relating to persons (legal or natural) must be reasonable, be honestly held and indicate the basis of the opinion. 

PART 2 – PRIVACY 

Background 

We collect, hold, use and disclose your personal information on behalf of your health services provider and in accordance with the agreement we have with them.

Consent 

You consent to us collecting, holding, using and disclosing your personal information in accordance with this policy.

Personal information is any information or an opinion about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true. 

What personal information do we collect and hold? 

We collect information about you and your interactions with us, for example, when you use any of our services or otherwise visit our website or web based application. The information we collect from you may include your identity and contact details, and your health and medical information including your immunisation history. 

We may collect information about how you access, use and interact with the website or web based application. This information may include: 

• the location from which you have come to the site and the pages you have visited; and
• technical data, which may include IP address, the types of devices you are using to access the website or web based application, device attributes, browser type, language and operating system. 

Cookies 

We use cookies. A cookie is a small text file that the website or web based application may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of our website or web based application for any of your future visits to the website or web based application. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the website or web based application. You may refuse to use cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of the website or web based application. 

Why do we collect, hold and use your personal information? 

We collect, hold and use your personal information so that we can support your health services provider to: 

• provide you with products and services, and manage their relationship with you;
• contact you, for example, to respond to your queries or complaints, or if they need to tell you something important;
• comply with their legal obligations and assist government and law enforcement agencies or regulators.

If you do not provide us with your personal information we will not be able to provide you with our services, communicate with you or respond to your enquiries. 

How do we collect your personal information? 

We will collect your personal information directly from you whenever you interact with us. 

We may collect information from third parties such as your health services provider. 

How do we store and hold personal information? 

We store most information about you in computer systems and databases operated by either us or our external service providers such as Amazon Web Services and Microsoft Azure. Some information about you is recorded in paper files that we store securely. 

We implement and maintain processes and security measures to protect personal information which we hold from misuse, interference or loss, and from unauthorised access, modification or disclosure. 

These processes and systems include: 

• the use of identity and access management technologies to control access to systems on which information is processed and stored;
• requiring all employees to comply with internal information security policies and keep information secure;
• requiring all employees to complete training about information security; and
• monitoring and regularly reviewing our practice against our own policies and against industry best practice.

We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected or for any secondary purpose permitted under the relevant laws. 

Who do we disclose your personal information to, and why? 

We hold your personal information on behalf of your health services provider and they have complete access to your personal information. 

Your health services provider reports all vaccines administered to the Australian Immunisation Register (AIR). You can access your records by contacting your health services provider or AIR. 

We may transfer or disclose your personal information to our related companies. 

We may disclose personal information to external service providers so that they may perform services for us or on our behalf. 

We may also disclose your personal information to others where: 

• we are required or authorised by law to do so;
• you may have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances; or 
• we are otherwise permitted to disclose the information under relevant laws.

If the ownership or control of all or part of our business changes, we may transfer your personal information to the new owner. 

Do we disclose your personal information to overseas recipients? 

We do not disclose your personal information to recipients which are located outside Australia. 

Do we use your personal information for marketing? 

We do not use your personal information for marketing. 

Your immunisation and health services provider may use your personal information to provide you with information about their products and/or services directly or through our Services. 

Access, control to and correction of your personal information  

You have certain choices available to you when it comes to your information. Below is a summary of those choices, how to exercise them and any limitations. 
 

Your Choices:  

Where applicable under local law, you may have certain rights with respect to your personal information. 
 

Depending on which jurisdiction you live in, you may have the right to request information about our processing of your information, to request a copy of your information, to request the deletion or restriction of your information, to request to correct or update your information and to request to opt out of certain profiling activities.  Below, we describe the tools and processes for making these requests.  You can exercise some of the choices by logging into the system and updating your profile. 
 

Your request and choices may be limited in certain cases: for example, if fulfilling your request would reveal information about another person, or if you ask to delete information which we are permitted by law or have compelling legitimate interests to keep.  If you have unresolved concerns, you may have the right to complain to a data protection authority in the country where you live, where you work or where you feel your rights were infringed.  
 

Access and update your information: Our portal gives you the ability to access and update certain information. For example, you can access your profile information from your account and update those details at any time.  
 

Deactivate your account:   If you no longer wish to use our service, your health provider may be able to deactivate your account. Otherwise, please contact security@vaxapp.com.au and we will action this on your behalf. Please be aware that deactivating your account does not delete your information; your information remains visible to providers based on your past participation. 

Delete your information: All request for deletion or deidentification of your information should be addressed to security@vaxapp.com.au. Please note, however, that we may need to retain certain information for record-keeping purposes, to complete transactions or to comply with our legal obligations, in all cases these records will be deidentified to ensure your personal identifiable data is no longer attached to the record. 

To contact VaxApp about any inquiries, complaints or disputes about this Privacy Policy please email security@vaxapp.com.au