Privacy and Cookie Policy

This Privacy Policy applies to the collection, use, and disclosure of personal information by Biolume Health (ACN 677 751 530), a company registered under the laws of Australia and governed by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). Where applicable, this policy is also intended to meet Biolume Health's obligations under state-based health records legislation, including the Health Records and Information Privacy Act 2002 (NSW).

Biolume Health ("we," "us," "our") is responsible for managing personal information collected through its website biolume.health (the Website) and related services (the Services).

Health service providers are not eligible for the small business exemption under the Privacy Act regardless of annual turnover. Biolume Health is bound by the APPs on that basis.

Questions or concerns about this Privacy Policy or the handling of your personal information can be directed to our Privacy Officer at support@biolume.health.

Who we are and the nature of our Services

Biolume Health provides a self-service health literacy platform. Through the Website and member portal, individuals can:

Order a baseline pathology blood test, with results made available through the portal.
Upload their own existing pathology or blood test results from a lab of their choosing.
Receive AI-generated interpretation, explanation, and educational content based on those results, delivered through an AI tool within the member portal.
Access a personal health data store (the Health Wallet) and connect third-party health devices where offered.

This Website is intended for individuals aged 18 years and older. We do not knowingly collect personal information from children under 18. If we become aware that personal information from a minor has been provided, we will take reasonable steps to delete it.

Types of personal data we collect about you

Personal information means any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not, as defined under the Privacy Act.

We collect the following categories:

Identity information: full name, date of birth, gender, and contact details.
Health information: pathology and blood test results (whether ordered through Biolume or uploaded by you from another provider), historical health data you choose to share, and any other health-related information relevant to interpretation of your results. Health information is sensitive information under Australian Privacy Principle 3.3 and is subject to a higher standard of protection and consent, described further below.
Medical escalation data: where you order a pathology test through Biolume, information relating to review of urgent or critically flagged results by a medical professional, and any related recommendation. This category applies only to Biolume-ordered tests. See "Important information about how our Services work" below for the distinction between Biolume-ordered tests and self-uploaded results.
AI-generated content: outputs generated by our AI tool based on your health information, including plain-language explanations, educational content, and general observations. These outputs are not a medical diagnosis. Whether they involve any clinical review depends on how your results were obtained, described below.
Device and wearable data: where you choose to connect a third-party health device or app, data such as activity, sleep, or biometric information shared with us through that connection.
Technical data: IP address, device identifiers, browser type and version, operating system, time zone, and similar technical information.
Usage information: how you interact with the Website and portal, including page views and navigation patterns.
Account and billing information: information needed to manage your account and membership, including payment information processed through third-party payment providers.
Marketing and communication preferences: your preferences regarding marketing communications from us.

Aggregated and de-identified data

We may create aggregated or de-identified data from the categories above, including for research, service improvement, or content development. Aggregated or de-identified data does not identify you and is not treated as personal information.

Health information as sensitive information

Because health information is sensitive information under the APPs, we will only collect it with your consent, or where another exception under the Privacy Act applies. You provide this consent when you order a test through Biolume or choose to upload your own results for interpretation. You may withdraw consent at any time by contacting us, noting this will affect our ability to provide the Services to you.

How your personal data is collected

Directly from you

When you create an account or order a Biolume baseline blood test.
When you upload your own pathology or blood test results, obtained from a laboratory or provider of your choosing, for interpretation through our AI tool. When you do this, you confirm the results belong to you and that you have the right to upload and share them with us for this purpose.
When you connect a third-party health device or app to your account.
When you contact us directly, subscribe to communications, or otherwise interact with the Website.

From pathology laboratories

Where you order a test through Biolume, your results are transmitted securely from the relevant accredited pathology laboratory to us for processing and display in your portal.

From third-party service providers

We use third-party providers to help operate the Services, including hosting, payment processing (such as Stripe), analytics, and the AI tools that power result interpretation. These providers only process personal information on our instructions and for the purposes described in this policy.

From publicly available sources

In limited circumstances, and only to the extent permitted by law, we may obtain information from publicly available sources.

Important information about how our Services work

This section is intended to be read alongside our Website Disclaimer and Terms of Service, and applies regardless of anything elsewhere in this policy that could be read to suggest otherwise. The level of clinical review that applies to you depends on how your results were obtained.

If you order a pathology test through Biolume: your results are reviewed by the pathology laboratory in the usual way, and any result flagged by the laboratory as urgent or critical is escalated for review by a medical professional, who may contact you or provide a related recommendation. This escalation relates to laboratory-flagged critical values. It does not mean every aspect of your AI-generated interpretation has been reviewed by a clinician, only that urgent lab flags are checked.

If you upload your own existing pathology or blood test results: there is no clinical review and no escalation process. Interpretation is generated entirely by our AI tool, with no medical professional checking the results, the AI-generated content, or flagging anything as urgent on our behalf. It is your responsibility to review these results with your own general practitioner or other qualified health professional.

In both cases: AI-generated content is not a diagnosis. Outputs from our AI tool are general and educational in nature, generated from your personal health information, and are not a substitute for advice from a qualified medical professional. If future changes to our Services alter the scope of clinical review described here, we will update this policy accordingly.

About the AI Co-Pilot specifically: the AI Co-Pilot is a large language model. We have worked to ground its outputs in relevant data and to make it function as reliably as possible, but like any large language model it can produce incorrect, incomplete, or outdated information. We do not monitor individual outputs of the AI Co-Pilot as they are generated, and we do not endorse or vouch for the accuracy of any specific response it gives you. It is not a diagnostic tool, and any information it provides should be treated as general and educational only, not as personalised medical advice.

How we use your personal data

Legal bases for processing

Performance of a contract, including creating and managing your account and membership, processing test orders, delivering AI-generated interpretation of your results, and providing access to the portal and its features.
Legitimate interests, including improving the accuracy and usefulness of our AI-generated content, maintaining the security of the Services, detecting and preventing fraud, and internal research and product development, provided this does not override your rights.
Legal obligations, including compliance with Australian privacy and health information laws and responding to lawful requests from regulators or law enforcement.
Consent, including for collection of your health information, for marketing communications, and for connecting third-party devices to your account. You may withdraw consent at any time, noting this may affect our ability to provide certain Services.

Purposes for which we use your data

To create and manage your account and membership.
To process pathology test orders and generate AI-based interpretation of your results, whether from a Biolume-ordered test or a test you upload yourself.
To maintain your Health Wallet and, where connected, incorporate data from third-party devices.
To respond to support requests and communicate updates about the Services.
To improve the accuracy and usefulness of our AI-generated content, using de-identified data wherever possible.
To send you educational content and updates, subject to your preferences.
To comply with our legal and regulatory obligations.
To protect the security and integrity of the Services and the data we hold.

Disclosures of your personal data

We may disclose personal information to the following categories of third parties, only where reasonably necessary for the purposes described in this policy:

Service providers who support the Services, including hosting and infrastructure providers, the AI tools used to generate result interpretation, and third-party payment processors such as Stripe. These providers are contractually required to protect your information and to use it only for the purposes we specify.
Pathology laboratories, where necessary to process a Biolume-ordered test.
Medical professionals, where a Biolume-ordered test result is flagged by the laboratory as urgent or critical, for the purpose of reviewing and, where appropriate, contacting you about that result. This applies only to Biolume-ordered tests, not to results you upload yourself.
Professional advisors, including legal, accounting, and insurance advisors, where necessary for compliance or risk management.
Regulators and law enforcement, where required by law.
An acquiring entity, in the event of a business sale, merger, or restructure, subject to confidentiality obligations and continued compliance with this policy.
Third parties for marketing purposes, only with your explicit consent.

We do not sell your personal information. We do not share identifiable health information with any third party for their own independent use without your consent.

International transfers

Some of our service providers, including infrastructure and AI processing providers, may store or process personal information outside Australia. Where this occurs, we take reasonable steps required under Australian Privacy Principle 8 to ensure your information continues to receive an appropriate standard of protection, including through contractual safeguards, assessment of the recipient's data protection practices, and, where relevant, confirming the recipient is subject to a comparable privacy regime. By using the Services, you consent to the transfer, storage, and processing of your personal information outside Australia as described in this policy. Further detail about specific overseas transfers can be requested from our Privacy Officer.

Cookies and tracking technologies

We and our service providers use cookies, pixels, and similar technologies for analytics and, where you consent, marketing purposes. Some of these tools are provided by third parties, including advertising and analytics platforms.

Because our Services relate to health, we take particular care with data shared through these tools. We do not knowingly configure tracking tools to share identifiable health information, such as specific test results or diagnoses, with advertising platforms. Where practical, we limit the information shared through advertising and analytics tools to general website usage rather than health content. You can manage cookie preferences through your browser settings and, where available, through cookie preference controls on the Website.

The table below lists the cookies used on this website.

Cookie Name	Cookie Description
FORM_KEY	Stores randomly generated key used to prevent forged requests.
PHPSESSID	Your session ID on the server.
GUEST-VIEW	Allows guests to view and edit their orders.
PERSISTENT_SHOPPING_CART	A link to information about your cart and viewing history, if you have asked for this.
STF	Information on products you have emailed to friends.
STORE	The store view or language you have selected.
USER_ALLOWED_SAVE_COOKIE	Indicates whether a customer allowed to use cookies.
MAGE-CACHE-SESSID	Facilitates caching of content on the browser to make pages load faster.
MAGE-CACHE-STORAGE	Facilitates caching of content on the browser to make pages load faster.
MAGE-CACHE-STORAGE-SECTION-INVALIDATION	Facilitates caching of content on the browser to make pages load faster.
MAGE-CACHE-TIMEOUT	Facilitates caching of content on the browser to make pages load faster.
SECTION-DATA-IDS	Facilitates caching of content on the browser to make pages load faster.
PRIVATE_CONTENT_VERSION	Facilitates caching of content on the browser to make pages load faster.
X-MAGENTO-VARY	Facilitates caching of content on the server to make pages load faster.
MAGE-TRANSLATION-FILE-VERSION	Facilitates translation of content to other languages.
MAGE-TRANSLATION-STORAGE	Facilitates translation of content to other languages.
Analytics and advertising cookies	Used for website analytics and, where consented to, marketing purposes. See "Cookies and tracking technologies" above for how we handle health-related data in this context.

Data security

We maintain technical, administrative, and physical security measures designed to protect personal information from unauthorised access, alteration, disclosure, or loss, including encryption of health information and restricted, need-to-know access for staff and contractors. In the event of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

Data retention

We retain personal information only for as long as reasonably necessary for the purposes it was collected, including to meet legal, regulatory, and accounting obligations. Basic customer information, including contact and transaction data, is generally retained for up to three years after you cease being a member, for tax purposes. Health information, including pathology results and AI-generated interpretations, may be subject to longer retention periods under applicable health records legislation. Where we no longer need personal information for these purposes, we will securely delete, anonymise, or archive it as appropriate. You can ask us to delete your data at any time, subject to the exceptions described below.

Your legal rights

Subject to some exceptions, you have the right to:

Request access to the personal information we hold about you.
Request correction of inaccurate or incomplete personal information.
Request erasure of your personal information in certain circumstances.
Object to processing based on legitimate interests, including for direct marketing at any time.
Request a copy of your data in a structured, commonly used format, where it was provided by you and processed by automated means.
Withdraw consent at any time, where we rely on consent as our legal basis, noting this may affect our ability to provide the Services.
Request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at support@biolume.health. There is generally no fee, though we may charge a reasonable fee, or decline a request, if it is clearly unfounded, repetitive, or excessive. We may need to verify your identity before actioning a request. We aim to respond within one month, and will notify you if a request requires more time.

Children

This Website is intended for individuals aged 18 years and older. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a minor, we will take reasonable steps to delete it.

Contact details

Email: support@biolume.health
Postal address: 8 Montague Rd, Cremorne NSW

Complaints

If you have concerns about how we handle your personal information, please contact our Privacy Officer first so we can address them directly. If you remain unsatisfied, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: https://www.oaic.gov.au
Phone: 1300 363 992
Mailing address: GPO Box 5218, Sydney NSW 2001, Australia

Changes to this Privacy Policy

We review this policy regularly and will update it as our Services evolve. This version was last updated on [date]. Please check back periodically, and let us know if your personal information changes during your relationship with us.

Third party links and user-generated content

The Website may include links to third-party websites, plug-ins, or applications. We do not control these third parties and are not responsible for their privacy practices. We encourage you to review the privacy policy of any website you visit.

Where the Website includes user-generated content such as reviews, this reflects the opinions of individual users and not Biolume Health. We do not endorse or verify this content and are not liable for claims arising from it.

Biolume Health is not a diagnostic tool and does not replace your medical provider. AI-generated interpretations, including from the AI Co-Pilot, are not a medical diagnosis. The AI Co-Pilot is a large language model: its outputs are not monitored or endorsed by us as they are generated, and like any large language model it can be incorrect. Results you upload yourself are not reviewed by a clinician. For Biolume-ordered tests, only laboratory-flagged urgent or critical results are escalated for