Privacy Policy

This Privacy Policy explains how MEDEXHUB PTY. LTD. (ACN 603 739 902), referred to as “MedExHub”, “we”, “us” or “our”, manages personal information when you visit our websites, create an account, purchase a subscription, complete examination questions, participate in discussions or contact us.

We aim to manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to our activities.

This policy applies to the MedExHub website and associated services. A third-party website or service linked from MedExHub is governed by its own privacy policy.

The information we collect depends on the services and features you use. It may include:

Account and profile information

• your name, email address and account identifier;
• a securely stored password hash and authentication information;
• telephone number, date of birth, gender, country, city, postal address or profile image where you choose to provide them;
• your medical examination pathway, subscription and account preferences; and
• information used to confirm or recover your account.

Subscription and transaction information

• the products, examination resources and access periods you purchase;
• transaction identifiers, payment status, amount, discount, refund and invoice information;
• billing contact information; and
• communications concerning a payment, renewal or refund.

Study and performance information

• questions attempted, answers selected and whether answers were correct;
• scores, completion, timing, topic performance and progress;
• study-mode and examination-mode sessions;
• saved questions, flash cards, notes and revision preferences; and
• discussion posts, votes, comments and other content you submit.

Communications and technical information

• support requests, feedback, complaints and correspondence;
• IP address, browser, device type, operating system and approximate location derived from an IP address;
• login records, security events, access times, referring pages and pages viewed;
• cookie identifiers and analytics information; and
• information required to diagnose errors, prevent abuse and maintain the service.

MedExHub does not require identifiable patient health information for ordinary use of its examination-preparation services and does not intend to operate as an electronic medical record.

You must not include a patient’s name, date of birth, address, medical record number, images or other identifying details in a discussion, note, question, support message or uploaded material.Clinical examples should be fictional or appropriately de-identified.

We will only collect sensitive information where it is reasonably necessary for our functions and permitted by law, including where valid consent has been provided or another legal exception applies.If sensitive information is sent to us when it is not required, we may delete or de-identify it where lawful and practicable.

We may collect personal information:

• directly from you when you register, purchase access, update your profile, complete questions, post content or contact us;
• automatically when you use the website, through server logs, cookies and similar technologies;
• from a payment processor when it confirms a transaction, subscription, dispute or refund;
• from an organisation purchasing or administering access for you, where applicable; and
• from publicly available sources or service providers where lawful and reasonably necessary.

You may browse some public parts of the website without identifying yourself. Certain services cannot be provided anonymously because an account, payment or progress record is required.

We may use personal information to:

• create, authenticate, administer and secure your account;
• provide subscriptions, question banks, flash cards, examination sessions and other requested services;
• record progress and generate scores, comparisons and performance insights;
• process purchases, renewals, invoices, discounts and refunds;
• respond to enquiries, technical issues, complaints and support requests;
• send essential account, payment, security and service communications;
• personalise study sessions and improve the relevance and usability of the platform;
• analyse service performance, usage patterns and feature effectiveness;
• detect, investigate and prevent fraud, account misuse, scraping, unauthorised sharing and security threats;
• enforce our Terms and Conditions and protect our rights, users and systems;
• comply with legal, regulatory, accounting and taxation obligations; and
• carry out other purposes disclosed to you at the time of collection or with your consent.

We may use aggregated or de-identified information for analytics, educational research, product planning and reporting where the information is no longer reasonably identifiable as relating to you.

Online payments may be processed by PayPal or another payment provider identified at checkout. Payment providers collect and process payment credentials under their own terms and privacy policies.

MedExHub generally does not receive or store your complete payment card number. We may receive and retain limited transaction information, such as your payer name or email, transaction ID, amount, currency, payment status, refund status and subscription details, for account administration, fraud prevention, taxation and financial record-keeping.

We may use cookies, local storage, session identifiers, server logs and similar technologies to keep you signed in, remember preferences, maintain shopping and examination sessions, protect the website and understand how the service is used.

These technologies may be used for:

• essential functions, including authentication, security, navigation and session continuity;
• preferences, including display and study settings;
• performance and analytics, including page usage, errors and service improvement; and
• communications measurement, such as whether a service email was delivered or opened, where supported.

You may be able to block or delete cookies through your browser. Blocking essential cookies may prevent login, payment, question sessions or other parts of the website from functioning correctly.

We do not sell personal information. We may disclose information where reasonably necessary to:

• hosting, cloud infrastructure, database, backup and content-delivery providers;
• payment processors, banks and fraud-prevention providers;
• email, communications, analytics and customer-support providers;
• IT, cybersecurity, development and professional service providers;
• account administrators where an organisation has arranged your access;
• government authorities, regulators, courts or law-enforcement bodies where required or authorised by law;
• our insurers, accountants, auditors and legal advisers; and
• a purchaser, investor or successor in connection with a proposed or completed business restructure, merger or sale, subject to appropriate confidentiality and legal safeguards.

A discussion post, profile name or other content you deliberately publish in a shared feature may be visible to other authorised users. Do not publish information you wish to keep private.

Some technology, payment, email, analytics or support providers may store or process information outside Australia. The likely locations depend on the providers and infrastructure used at the relevant time.

Where an overseas disclosure occurs and Australian privacy law applies, we take reasonable steps appropriate to the circumstances to ensure the recipient handles personal information consistently with applicable Australian privacy requirements, unless an exception applies.

You may contact us for current information about the countries in which our principal service providers are likely to process personal information.

We use administrative, technical and physical safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Depending on the information and system involved, safeguards may include:

• access controls, account authentication and role-based permissions;
• password hashing, secure connections and protective system configuration;
• logging, monitoring, backups and vulnerability management;
• restricted administrative access and confidentiality obligations; and
• incident assessment and response procedures.

No internet transmission or storage system can be guaranteed to be completely secure. You are responsible for protecting your password, signing out of shared devices and notifying us promptly if you suspect unauthorised access to your account.

If a data breach is likely to result in serious harm and the Notifiable Data Breaches scheme applies, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to maintain legitimate business and security records, and to meet legal, taxation, accounting and dispute-resolution requirements.

Retention periods vary according to the information. Account and study information may be retained while your account remains active and for a reasonable period afterwards. Financial transaction records may be retained for the period required by applicable law. Security logs and backups may be retained for limited operational cycles.

When information is no longer required and no legal basis requires retention, we take reasonable steps to delete it or de-identify it. Deletion from active systems may not immediately remove information from encrypted backups, logs or records that must be retained by law.

You may update certain account information through your profile. You may also request access to, or correction of, personal information we hold about you by emailing enquiries@medexhub.com.

Please provide enough information for us to identify the relevant account and request. We may need to verify your identity before providing access or making a correction.

We will respond within a reasonable period. In limited circumstances permitted by law, we may refuse access or correction. Where required, we will explain the reason and available complaint options.

We may send operational communications needed to administer your account, such as registration, password, purchase, subscription, security, outage and policy notices. These are not marketing communications and may be necessary to provide the service.

Where permitted, we may also send information about MedExHub products, free trials, examination resources or offers. You can opt out of marketing messages using the unsubscribe link in the message or by contacting us. Opting out of marketing will not stop essential service communications.

If you believe we have mishandled your personal information, please send a written complaint describing what happened, the information involved and the outcome you are seeking.

We will acknowledge and investigate the complaint and aim to respond within a reasonable period, generally within 30 days where practicable.

If you are not satisfied with our response and the Privacy Act applies, you may be able to lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC generally expects you to complain to the organisation first.

We may update this Privacy Policy to reflect changes to our services, technologies, providers or legal obligations. The revised version will be published on this page with an updated “Last updated” date. Material changes may also be notified through the website, your account or email where appropriate.

Privacy contact

MEDEXHUB PTY. LTD.
ACN 603 739 902
4 Red Penda Court
Norman Gardens QLD 4701
Australia

Email:enquiries@medexhub.com