Privacy Policy

YOOLI (AUSTRALIA) PTY LTD (ABN 66 671 832 778) (Yooli, we, us, our) operates a digital health marketplace platform that connects patients with independent clinics, practitioners, and other healthcare providers (Providers). This Privacy Policy explains how we collect, hold, use, and disclose personal information (including health information) and how you can contact us about privacy.

This Privacy Policy applies to your use of:

• the Yooli website(s);
• the Yooli app(s) and platform (including patient and provider portals);
• any services, features, communications, bookings, payments, and support channels we make available (together, the Platform).

This Privacy Policy is drafted to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you do not agree, do not use the Platform.

Last updated: 05 January 2026

1.  Key concepts and roles

Yooli is a platform provider

Unless we expressly state otherwise in writing, Yooli is not a healthcare provider and does not provide clinical services.

1.2  Providers are independent

Providers on the Platform are independent third parties and are responsible for:

• clinical decision-making, treatment, and patient care;
• accuracy and completeness of information they enter into the Platform;
• their own professional, regulatory, privacy, and record-keeping obligations; and
• obtaining any consents they require from you for their

1.3  Patient records and visibility are essential to the Platform

The Platform is designed to function as a unified patient record and care coordination system to support safe and efficient healthcare delivery. As a condition of using the Platform, you acknowledge and authorise that:

• Providers you engage (and their authorised staff) will access, create, and update your records on the Platform as reasonably required for care delivery, prescribing, aftercare, and clinical governance; and
• you cannot opt out of necessary Provider access and still receive services through the

You may choose not to use Yooli, or you may withdraw from the Platform (see Section 12). If you withdraw access for a Provider prior to an appointment, this may result in cancellation and may prevent further services through that Provider via Yooli.

2.  The information we collect

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

We may collect the following categories (not all categories apply to every user):

2.1  Identity and account information

• name, date of birth/age, gender, profile photo (optional), and government-issued identification (where required for verification);
• usernames, passwords (stored in encrypted form), authentication tokens, and security settings (including multi-factor authentication).

2.2  Contact information

phone number, email address, residential address, emergency contact details (where required for care or safety).

2.3  Health and care information (health information and other sensitive information)

• medical history and relevant health details you provide;
• consultation notes, assessment outcomes, diagnoses, prescriptions, treatment plans, aftercare notes, adverse event reporting, and clinical images where uploaded;
• appointment details, symptom checkers, forms, and questionnaires;
• communications with Providers through the Platform (including messages and attachments).

2.4  Medicare, private health, NDIS and eligibility information (where applicable)

Medicare details, private health insurer details, claim-related identifiers, NDIS-related identifiers, and eligibility information required to facilitate billing or claims where offered through the Platform.

2.5  Provider credentials (for Providers)

qualifications, registrations, training and competency evidence, professional indemnity insurance evidence, CPD evidence, ABN, practice details, and banking details for payouts.

2.6  Payments and transactions

• transaction history, invoices, refunds, chargebacks, and payment

2.7  Technical, device, and usage data

• IP address, device identifiers, browser type, operating system, app version, log files, crash reports;
• location data (approximate or precise depending on settings and permissions);
• usage patterns (page views, session data, feature engagement), and referral/marketing source

2.8  Marketing and communications

subscription preferences, communication choices, campaign interactions, and responses to

3.  How we collect information

We collect information:

• directly from you when you register, use the Platform, complete forms, book services, message Providers, upload content, or contact support;
• from Providers when they provide care through the Platform and create or update records;
• from third-party service providers supporting identity verification, fraud prevention, payment processing, analytics, and communications;
• from publicly available sources where needed for verification, professional checks (for Providers), or to protect the Platform and users.

4.  Why we collect, hold, use, and disclose information

We collect, hold, use, and disclose information to the extent reasonably necessary to operate the Platform, provide services you request, and run our business. This includes:

4.1  Platform operation and service delivery

• create and manage accounts and access permissions;
• facilitate bookings, scheduling, reminders, and appointment workflows;
• enable Providers to deliver services and make informed clinical decisions;
• enable prescribing, aftercare, and clinical governance workflows;
• operate the unified patient record features and audit

4.2  Marketplace administration and commercial operations

• payments processing, billing, invoicing, refunds, disputes, chargebacks, collections;
• Provider onboarding, verification, credentialing, and compliance monitoring;
• quality assurance, incident management, and patient safety processes;
• preventing fraud, misuse, or unauthorised

4.3  Customer support and communications

• respond to enquiries and support requests;
• send service communications (booking confirmations, security alerts, policy updates).

4.4  Security and risk management

• protect the Platform and users, including investigating suspicious activity, enforcing our Terms, and maintaining audit logs.

4.5  Analytics, product improvement, and business development

• analytics, reporting, trend analysis, service optimisation, and feature development;
• testing, troubleshooting, and performance

4.6  Marketing, promotion, and growth

• promote Yooli and services available on the Platform;
• offer or recommend relevant services, offers, and new features across verticals (including cosmetic services and weight management offerings);
• personalise and measure marketing

4.7  Legal and regulatory obligations

• comply with applicable laws, lawful requests, court orders, and regulatory requirements;
• establish, exercise, or defend legal

5.  Health information and other sensitive information

Health information is treated as sensitive information under the Privacy Act and requires higher protection. We collect, use, and disclose health information:

• with your consent (express or implied, depending on context and as permitted by law);
• for the primary purpose of providing and enabling healthcare services through the Platform; and
• for directly related secondary purposes you would reasonably expect (for example, clinical governance, aftercare, safety follow-up, and incident management), as permitted by law.

Important: By using the Platform to engage Providers, you authorise relevant access and sharing of your health information with those Providers and their authorised staff for care delivery and Platform operation (Section 1.3).

6.  Who we disclose information to

We may disclose personal information (including health information where permitted) to:

6.1  Providers and their authorised personnel

• clinics, practitioners, and authorised staff involved in your care, booking management, and clinical

6.2  Service providers that support the Platform

• hosting and secure data storage providers (Australia-based);
• identity verification, fraud prevention, security monitoring, and authentication providers;
• communications providers (email, SMS, push notifications, call systems);
• analytics providers, customer support tools, and error monitoring tools;
• payment processors and financial institutions (for transactions and payouts).

6.3  Business and professional advisers

• legal advisers, accountants, auditors, insurers, and

6.4  Corporate transactions and restructuring

• if we merge, restructure, or sell part or all of our business or assets, we may disclose information to advisers and counterparties to assess and complete the transaction, subject to confidentiality and legal

6.5  Legal and safety disclosures

• courts, tribunals, regulators, law enforcement, and other bodies where required or authorised by law;
• emergency services or relevant third parties where we reasonably believe there is a serious threat to life, health, or safety and it is impracticable to obtain consent.

7.  No sale of identifiable health information as a product

We do not sell identifiable health information as a standalone commodity. However:

• we may use and share de-identified and aggregated data (Section 10); and
• we may share information with service providers and partners to operate, improve, and market the Platform, subject to law and any required consents.

8.  Data quality and Provider responsibility for clinical records

Providers are responsible for the clinical content they enter. You acknowledge that:

• Providers may create and update records based on clinical judgement and the information available at the time;
• Yooli does not warrant the accuracy of Provider-entered clinical notes; and
• if you believe records are inaccurate, you can request correction (Section 4). Providers may also have legal obligations affecting how and when records can be amended.

9.  Marketing and communications

• Service communications (no opt-out)

We may send operational messages necessary for Platform delivery and security (for example, appointment reminders, verification codes, and policy updates). You cannot opt out of these while maintaining an active account.

9.2  Direct marketing using non-sensitive information (opt-out available)

We may use and disclose non-sensitive personal information (for example, contact data, usage data, and transaction history) for direct marketing and growth activities to the extent permitted by law. You can opt out at any time (Section 12.2).

9.3  Marketing involving health information (consent-based where required)

Where marketing uses health information (or inferences drawn from health information) in a manner requiring consent, we will seek your consent via the Platform or other lawful mechanism. You may withdraw that consent at any time, subject to Section 12.3 (withdrawal is prospective and may affect access to certain features or offers).

9.4  Personalisation and targeting

We may personalise marketing and Platform experiences using your Platform interactions, booking history, and service preferences. We may also use cookies and similar technologies for retargeting and measurement (Section 14).

9.5  Partner and Provider marketing

Providers may market their services to you subject to their own obligations and your preferences. Where permitted by law, Yooli may facilitate Provider marketing through Platform tools (for example, sending appointment-related offers, aftercare reminders, or service availability messages).

10.  De-identified and aggregated data (broad licence)

We may create, use, store, commercialise, and disclose de-identified, anonymised, and aggregated data derived from Platform use and records for:

• analytics and reporting;
• product development and improvement;
• service optimisation and benchmarking;
• training and testing of Platform features and models (including safety, fraud, and quality systems);
• research and commercial

We will take reasonable steps to de-identify information before use or disclosure in this manner. You acknowledge that de-identified and aggregated outputs may be used for commercial purposes and may be shared with partners, Providers, and service providers.

11.  Storage, security, and data breaches

• Where data is stored

We store Platform data on servers located in Australia.

11.2  Security measures

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Measures may include encryption, access controls, audit logging, monitoring, and security testing.

11.3  No absolute guarantee

No method of transmission or storage is completely secure. To the extent permitted by law, we do not guarantee that unauthorised access will never occur.

11.4  User responsibility

You are responsible for:

• keeping your login credentials confidential;
• maintaining the security of your devices, email account, and communications channels;
• promptly notifying us of suspected unauthorised

To the extent permitted by law, Yooli is not responsible for unauthorised access arising from your failure to safeguard credentials, devices, or communications (including phishing, shared passwords, or compromised email accounts).

11.5  Data breach response

If we become aware of a suspected or actual data breach, we will assess and respond in accordance with our legal obligations, including notifications where required.

12.  Your rights, choices, and controls

• Choice to provide information

You do not have to provide information, but if you do not, we may be unable to create an account, verify identity, facilitate services, enable Provider care, or process transactions.

12.2  Unsubscribing from marketing

You may opt out of marketing communications at any time by:

• using the unsubscribe link in messages (where provided); or
• contacting us (Section 16).

12.3  Withdrawing consent

Where we rely on consent for certain uses (including some uses of health information), you may withdraw consent prospectively. Withdrawal:

• does not affect processing already performed; and
• may limit or prevent access to Platform services that depend on that consent, including Provider-delivered services that require record access.

12.4  Access and correction

You may request access to personal information we hold about you, and request correction if it is inaccurate, out of date, incomplete, irrelevant, or misleading.

• We may need to verify your identity before
• We may refuse access or correction where permitted by law (for example, where it would pose a serious threat, involve lawful confidentiality, or impact others’ privacy).
• If we refuse, we will provide reasons and complaint

12.5  Deletion and account closure

You may request account closure. However, we may need to retain certain information:

• to comply with legal, regulatory, tax, insurance, and dispute resolution obligations;
• for safety, security, fraud prevention, and audit purposes; and
• because Providers may have independent legal record retention

Where deletion is not possible, we may de-identify information or restrict access where reasonable and lawful.

13.  Overseas disclosures

We aim to store data in Australia. Some service providers may have personnel or support operations outside Australia. Where an overseas disclosure occurs, we will take reasonable steps to ensure it is handled in accordance with the APPs, and we will only disclose overseas where permitted by law.

14.  Cookies, analytics, and tracking

We use cookies, SDKs, pixels, and similar technologies to:

• operate the Platform;
• remember preferences;
• understand usage and performance;
• measure advertising and marketing effectiveness; and
• support retargeting campaigns where

You can manage cookies through browser settings. Blocking cookies may affect Platform functionality.

15.  Third-party links and Provider services

The Platform may link to third-party sites or services. Providers may offer services under their own terms and privacy practices. We are not responsible for third-party privacy practices. You should review the relevant Provider policies.

16.  Complaints and contact Privacy point of contact Email: admin@yooli.co

Please include your name, contact details, and a description of your request or complaint. We will investigate and respond within a reasonable time.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

17.  Changes to this Privacy Policy

We may update this Privacy Policy at any time by publishing the updated version on our website or within the Platform. The updated version applies from the date of publication. Your continued use of the Platform indicates acknowledgement of the updated Privacy Policy.