Privacy
How we handle your information when a nurse visits you at home.
Collection notice
Version 2026-07-30-draft · in force from 02/08/2026
Express Pathology collects your name, date of birth, contact details, address and pathology referral so a registered nurse can attend your home and collect a sample. This is health information, which is sensitive information under the Privacy Act 1988 (Cth).
We collect it from you or from the healthcare provider who booked on your behalf. We use it only to arrange, deliver and follow up that visit.
We disclose it to: the nurse attending your visit; the pathology provider processing your sample; and our service providers for SMS and email delivery, hosting and error monitoring. Some of those providers are located overseas (primarily the United States) - we take reasonable steps to ensure they handle your information consistently with the Australian Privacy Principles, and we never send a diagnosis or test name through them. Your records are stored in Australia (Sydney).
You can ask us for access to your information, ask us to correct it, or ask us to delete it. You can also complain about how we handled it. Contact the booking provider you used, or Express Pathology directly. If you are not satisfied you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Who else handles your information
These are the service providers we rely on. Providers marked overseas hold or transmit information outside Australia; we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, and we never send a diagnosis or test name through them.
| Provider | Purpose | What they receive | Where |
|---|---|---|---|
| Supabase (AWS ap-southeast-2) | Primary database and storage | All booking and customer data, including health information | Sydney, Australia |
| Resend | Email delivery | Email address and message body | United Statesoverseas |
| Sentry (optional) | Error monitoring | Error messages and scrubbed context; PII keys are redacted before send | Configurable — must be set to an AU/EU projectoverseas |
| Twilio | SMS delivery to nurses and patients | Mobile number and message body (appointment time, suburb, reference) | United Statesoverseas |
| Vercel | Application hosting, logs | Request metadata; application logs (PII scrubbed before emission) | Sydney region for compute; logs may transit the USoverseas |
Your choices
- Access and correction. You can ask for a copy of what we hold about you, or ask us to correct it.
- Deletion.You can ask us to delete your details. We keep a de-identified record of the visit itself (time, suburb, outcome) because it is part of the nurse's work history and our service records — but nothing in it identifies you.
- Complaints. Contact the booking provider you used, or Express Pathology. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.