Privacy Policy

This Privacy Policy explains how The Spore Clinic Pty Ltd (ACN 693 688 452) (Spore, we, us or our) collects, uses, discloses and protects your personal information when you access or use the Spore platform, including our website, applications and associated services (the Platform).

We use your information to provide and improve the Platform and to support the delivery of psychedelic-assisted therapy services and related clinical care. By accessing or using the Platform, you agree to the collection, use and disclosure of your information in accordance with this Privacy Policy.

Capitalised terms used in this Privacy Policy have the meaning given to them in our platform terms of use and related agreements (together, the Terms). Our Terms and this Privacy Policy together constitute your agreement with us. If there is any inconsistency, this Privacy Policy prevails with respect to privacy matters.

1. About this Privacy Policy

Your privacy and the confidentiality of your health information are extremely important to us. Because the Platform supports the delivery of clinical care, including psychedelic-assisted therapy, we handle a significant amount of sensitive information. We are committed to handling that information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act), the Australian Privacy Principles (the APPs), the My Health Records Act 2012 (Cth) (where applicable) and any State or Territory health records legislation that applies to us.

This Privacy Policy helps you understand what personal information we collect, how we use it, who we share it with, and the rights you have in relation to it. References in this Privacy Policy to “personal information” include “health information” and other “sensitive information” (as those terms are defined in the Privacy Act) unless we indicate otherwise.

If you have any questions or comments about this Privacy Policy, please contact us using the details in the How to contact us section below.

2. Who this Privacy Policy applies to

This Privacy Policy applies to anyone who interacts with the Platform, including:

• Patients who receive treatment or related support through the Platform;
• Practitioners, including therapists, psychiatrists, psychologists, medical practitioners, consultants and other clinical and allied health professionals who deliver services through the Platform;
• Dosing Room Providers and other service providers who deliver in-person treatment environments or related services in connection with the Platform;
• Referrers, including general practitioners and treating clinicians who refer patients to the Platform;
• Visitors to our websites and users of our online services generally; and
• Representatives of organisations or businesses that deal with us.

3. Information we collect

3.1 Information you provide to us

We collect personal information directly from you when you register for, access or use the Platform, or communicate with us. The categories of information we collect depend on how you use the Platform, and may include:

• Contact data, such as your first and last name, residential or business address, phone number, email address and emergency contact details;
• Registration and profile data, such as username, password, date of birth, gender, state or territory, display name, photograph and any other information you add to your account on the Platform (your Account);
• Practitioner professional data, such as registration details (for example, AHPRA number), qualifications, specialties, scope of practice, insurance information, references and other credentialing information;
• Identity verification data, such as government-issued identification documents, Medicare details and information required for background or healthcare verification checks;
• Health information, including diagnoses (including diagnoses that may be inferred from your use of the Platform, for example treatment-resistant depression inferred from eligibility for psilocybin-assisted therapy), treatment history, medication records, clinical notes, referral letters and any other information about your physical or mental health that you or your practitioner provide;
• Treatment data, such as information about sessions booked or attended, dosing information, therapy modality, clinical outcomes, patient-reported outcomes and other data recorded in connection with your treatment;
• Communications between you and us and between you and other users of the Platform, including messages, chat transcripts, emails, recordings of telehealth consultations (where consented to) and support requests;
• Transactional and payment data, such as information relating to subscriptions, bookings, invoices, order numbers, payment method and transaction history. Payment card information is processed by our third party payment providers, and we do not ourselves store full card numbers;
• Survey, feedback and research data that you provide when you participate in a survey, questionnaire or research activity;
• Marketing preferences, including your preferences for receiving our marketing communications; and
• Other information you choose to provide to us, including through our support channels.

3.2 Information we collect from third parties

We may collect personal information about you from third parties, including:

• From Practitioners and Referrers, such as when a practitioner invites you to join the Platform, refers you for treatment, or shares your referral letter, clinical notes, medication history or other health information with us so that we can provide the Platform to you;
• From other users of the Platform with whom you are connected, to the extent necessary to deliver the services you have requested (for example, scheduling information shared between you and your practitioner);
• From credentialing and verification providers, including background check, healthcare verification and identity verification services, where we need to confirm a practitioner’s qualifications, registration, insurance or fitness to practise;
• From public sources, such as professional registers (including the AHPRA register), government agencies and publicly available sources;
• From our service providers, such as information technology, analytics and marketing providers who assist us to operate or promote the Platform; and
• From related bodies corporate and affiliated entities, including Enosis Therapeutics Pty Ltd and other entities within our corporate group, where that information has been shared with us for a purpose consistent with this Privacy Policy.

Where a Practitioner or Referrer shares information about you with us before you have registered on the Platform, we expect the Practitioner or Referrer to have obtained your consent or to have another lawful basis for sharing that information with us. We ask Practitioners and Referrers to confirm that consent or lawful basis at the time of sharing. If you believe your information has been shared with us without an appropriate basis, please contact us immediately so we can address your concerns and, if appropriate, remove your information from the Platform.

3.3 Information we collect automatically

When you access or use the Platform, we, our service providers and our business partners may automatically collect information about you, your device and your interactions with the Platform. This includes:

• Device data, such as operating system type and version, device type and model, browser type and version, screen resolution, IP address, unique device identifiers, language settings and general location (such as city, state or geographic area);
• Usage and interaction data, such as the pages or screens you visit, the features you use, the links you click, the date and time of your access, the duration of your session and the actions you take on the Platform;
• Technical log and diagnostic data, such as error logs, crash reports, feature performance data and other system-level information we use to monitor and improve the Platform; and
• Location information, where you expressly permit us (or our applications) to access the general or precise location of your device.

3.4 Cookies and similar technologies

We and our service providers use cookies, pixels, tags, local storage and similar technologies to operate the Platform and to understand how it is used. These technologies may be used to:

• enable the technical operation of the Platform, for example to keep you signed in or remember your preferences;
• help us understand and analyse how the Platform is used so that we can improve it;
• monitor errors and performance issues; and
• measure the effectiveness of our communications with you.

You may be able to control cookies through your browser or device settings. Disabling cookies may affect the functionality of the Platform.

4. Sensitive information and consent

Much of the information we collect about patients through the Platform is “sensitive information” under the Privacy Act, because it relates to your physical or mental health. The Privacy Act requires us to obtain your express consent before collecting, using or disclosing sensitive information, unless an exception applies (for example, where collection is required or authorised by law, or is necessary to lessen or prevent a serious threat to life, health or safety).

When you register for the Platform, we will ask you to confirm that you have read this Privacy Policy and our Terms, and to expressly consent to the collection, use and disclosure of your health information and other sensitive information for the purposes described in this Privacy Policy. By providing that consent, you agree that we may:

• collect health information and other sensitive information from you, your Practitioner and your Referrer;
• use that information to deliver, administer and improve the Platform and the clinical services supported by it;
• share that information with your Practitioner, Referrer, Dosing Room Provider, your support person and other Platform users involved in your care, as described in this Privacy Policy; and
• disclose that information to our service providers and other third parties in accordance with this Privacy Policy.

You can withdraw your consent at any time by contacting us using the details below. Withdrawing your consent may mean that we can no longer provide some or all of the Platform to you. Withdrawing your consent does not affect the lawfulness of processing we have already carried out on the basis of that consent, and does not affect any information we are required to retain under the Privacy Act, professional standards or other applicable law.

5. How we use your personal information

We use your personal information for the following purposes, or for any other purpose we disclose to you at the time of collection:

5.1 Delivery of the Platform and clinical services

• To create and manage your Account and authenticate your access to the Platform;
• To facilitate consultations, assessments, referrals, therapy sessions, bookings, dosing sessions, clinical note-taking, prescribing (where relevant) and other clinical workflows supported by the Platform;
• To facilitate communication and collaboration between patients, Practitioners, Referrers, Dosing Room Providers, support persons, emergency contacts and other Platform users and our staff;
• To verify the identity, qualifications, registration and insurance status of Practitioners and other service providers;
• To process payments, manage subscriptions and account balances and issue invoices;
• To personalise your experience on the Platform and present content and features that are relevant to you; and
• To provide support and respond to your enquiries, requests and feedback.

5.2 Product improvement, research and development

We use your information to operate, maintain, test, troubleshoot and improve the Platform and the services we support. This includes conducting internal research and analytics, testing new features and clinical workflows, and evaluating clinical outcomes. This may include the use of artificial intelligence and machine learning tools to analyse Platform usage, clinical workflows and (where consented to and appropriate) de-identified health information. Any integration with other platforms is limited to what is necessary for the operation of the Platform and, where it involves personal information, is subject to the sharing rules in section 6. Any research outputs shared outside Spore are de-identified or aggregated only. Where we use your information for research, we will do so in accordance with applicable law and, where required, with your express consent.

We may create anonymised, aggregated or de-identified data from your personal information and from the information of other users. We do this by removing information that identifies you or anyone else. We may use and share this anonymised data for any lawful purpose, including to analyse and improve the Platform, to integrate with other platforms, to conduct or contribute to research, and to promote our business. We do not attempt to re-identify anonymised data, and we require third parties with whom we share anonymised data to do the same.

5.3 Communications and marketing

We may use your contact details to send you administrative communications about the Platform, including confirmations, reminders, security alerts and updates to our agreements. Where you have consented, or where permitted by law, we may also send you marketing communications about the Platform and related services. You can opt out of marketing communications at any time by following the unsubscribe link in those communications or contacting us directly.

5.4 Compliance, safety and protection of our rights

We may use your personal information to:

• comply with applicable laws, regulatory requirements, lawful requests and legal process, including subpoenas, court orders and requests from government authorities, health regulators and the Australian Health Practitioner Regulation Agency (AHPRA);
• meet our reporting and record-keeping obligations under health, pharmaceutical, mental health and professional standards legislation;
• protect our rights, property or safety, and the rights, property or safety of our staff, users and the public, including to respond to clinical risks and emergencies;
• enforce our Terms and other agreements with you;
• prevent, identify, investigate and deter fraudulent, harmful, unauthorised or unlawful activity; and
• establish, exercise or defend legal claims.

6. How we share your personal information

We share personal information with the parties described below, in accordance with this Privacy Policy, your consent (where required) and applicable law.

6.1 People involved in your care

We share personal information and health information with Practitioners, Referrers, Dosing Room Providers, our personnel and other clinical or support personnel engaged on the Platform, to the extent necessary for them to provide services on the Platform or otherwise support the care of Users. Access is restricted to the information that the relevant person needs to perform their role. We may also share the minimum necessary information with your nominated support persons, emergency contacts and other Platform users (for example, other Users involved in your care), where you have provided their details and consented for us to do so, and to the extent necessary for them to perform the role you have assigned them. This is intentionally narrower than the more extensive sharing with clinical practitioners described above.

6.2 Our service providers

We share personal information with third party service providers that help us operate the Platform and our business. As at the last updated date of this Privacy Policy, our service providers include:

• Amazon Web Services (AWS) - cloud hosting and infrastructure, provided from AWS in Australia;
• HubSpot - customer relationship management, email communications and marketing;
• Google - productivity tools, fonts, analytics and search services;
• Sentry - application error monitoring and diagnostic logging; and
• Enosis Therapeutics Pty Ltd, as a related entity which provides software and operational services in connection with the Platform.

We may also engage the following additional categories of service provider in the future, and will update this Privacy Policy where appropriate:

• product analytics providers (for example, Mixpanel or Amplitude);
• payment processing providers;
• video conferencing and telehealth providers;
• background check and identity verification providers; and
• healthcare credentialing and verification providers.

We require our service providers to handle personal information in accordance with the Privacy Act and our contractual requirements, and only use personal information for the purposes for which we have engaged them. Once we have disclosed personal information to a third party in accordance with this Privacy Policy, that third party is responsible for its own handling of that information under its own privacy policy and applicable law. To the extent permitted by law, we are not responsible for the independent acts or omissions of third parties who receive personal information from us in accordance with this Privacy Policy.

6.3 Related bodies corporate and affiliates

We may share personal information with our related bodies corporate, affiliates and other entities within our corporate group (including Enosis Therapeutics Pty Ltd) for purposes consistent with this Privacy Policy, including the operation and improvement of the Platform and the provision of shared services. We treat disclosures to related bodies corporate as disclosures to third parties for the purposes of this Privacy Policy.

6.4 Professional and legal advisors

We may share personal information with our professional advisors, including our lawyers, auditors, bankers and insurers, where reasonably necessary to obtain professional advice, conduct our business or defend our legal rights.

6.5 Authorities and other third parties

We may share personal information with:

• law enforcement agencies, regulators (including AHPRA and the Office of the Australian Information Commissioner) and government authorities, where we are required or authorised by law to do so, or where we consider in good faith that disclosure is necessary to prevent or investigate unlawful activity, protect health or safety or protect our legal rights;
• third parties involved in any actual or proposed sale, merger, acquisition, restructure, financing or other corporate transaction involving Spore or our business or assets, subject to appropriate confidentiality protections;
• any other third party where you have consented or directed us to share your information; and
• any other party as required or permitted by law.

7. Storage, data residency and international transfers

We are headquartered in Australia and we host the Platform on cloud infrastructure located in Australia. Our current primary hosting environment is AWS in Australia. As at the last updated date of this Privacy Policy, we do not transfer personal information overseas for the purpose of providing the Platform. Some of our service providers (for example, providers of analytics or marketing tools) may store limited operational data on servers outside Australia.

If in the future we need to disclose personal information to a recipient located outside Australia, we will take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information, including by putting appropriate contractual protections in place. We will update this Privacy Policy to reflect any material change to our data residency position. We may change our hosting providers or hosting locations from time to time. Where any such change results in a material change to our data residency position, we will notify you in accordance with the “Changes to this Privacy Policy” section below.

8. How we keep your information secure

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These steps include technical measures such as encryption in transit and at rest, access controls and role-based permissions, activity logging and monitoring, and secure backup; organisational measures such as staff training and confidentiality obligations; and operational measures such as incident response and vendor management.

While we take the security of your personal information seriously, no system is completely secure. By accepting this Privacy Policy, you acknowledge the inherent risks of transmitting information over the internet and using internet-based services. You should take appropriate steps to protect your own Account, including by choosing a strong password, keeping your credentials confidential and notifying us immediately if you suspect your Account has been compromised.

We will never ask you to provide your Account password or full payment card details through an unsolicited or unsecured communication. If you receive a request that you suspect is fraudulent, please do not respond and contact us using the details below.

9. How long we keep your information

We retain personal information for as long as it is necessary for the purposes set out in this Privacy Policy, and for any additional period required by law. In particular, where personal information forms part of a health record, we will generally retain that information for at least seven (7) years from the date of the last treatment or contact, and for longer where required by applicable law (for example, in the case of records relating to a minor, which are generally retained until the person turns 25).

If you ask us to delete your Account or your personal information, we will remove or de-identify your information on the Platform to the extent we are reasonably able to do so. We may retain a copy of your health information and other information where we are legally required to do so, or where retention is necessary to exercise or defend legal claims, resolve disputes or enforce our agreements.

10. Data breach notification

We maintain processes to detect, contain, investigate and respond to suspected data breaches. These processes cover all forms of unauthorised access to, or misuse of, personal information, including malicious cyber events such as ransomware. If we become aware of a data breach that is likely to result in serious harm to you, and we are required to do so under the Notifiable Data Breaches scheme in the Privacy Act or any other applicable law, we will notify the Office of the Australian Information Commissioner and the individuals at likely risk of serious harm as soon as practicable. If you believe your personal information may have been affected by a data breach or unauthorised access, please contact us at support@spore.clinic so that we can investigate.

11. Your rights

Subject to applicable law and any limits or conditions under the Privacy Act, you may at any time:

• request access to the personal information we hold about you;
• request correction of your personal information if you consider it to be inaccurate, out of date, incomplete, irrelevant or misleading;
• request that we delete personal information we hold about you, subject to our retention obligations;
• withdraw any consent you have previously given; and
• make a complaint about our handling of your personal information.

You are also responsible for the accuracy of the personal information you provide to us and share on the Platform, and for keeping your information up to date. Please let us know as soon as reasonably practicable if any of your personal information changes.

We will respond to your request within a reasonable period, and usually within 30 days. In some cases, we may be unable to give full effect to your request (for example, where doing so would be contrary to law or could affect the privacy of another person). If we cannot give effect to your request, we will let you know why and, where relevant, how you can escalate the matter. Withdrawing your consent operates prospectively only. It does not affect the lawfulness of any collection, use or disclosure of your personal information carried out before we received your withdrawal, and does not affect any information we are required to retain under applicable law (including health records legislation and our professional obligations).

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

12. Children and young people

The Platform is intended for use by adults aged 18 years or over. We do not knowingly collect personal information from anyone under the age of 18 without the consent of a parent or legal guardian, or otherwise as permitted by law in the context of clinical care. If you believe we have collected information from a child without an appropriate basis, please contact us so we can address the issue.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, our business practices or the law. If we make material changes, we will notify you by posting the updated Privacy Policy on the Platform, updating the “Last updated” date above, or through another appropriate method. Your continued use of the Platform after the updated Privacy Policy takes effect constitutes your acceptance of the updated Privacy Policy.

14. How to contact us

If you have any questions, concerns, complaints or requests about this Privacy Policy or our handling of your personal information, please contact us:

• Email: support@spore.clinic
• Post: The Spore Clinic Pty Ltd, Ground Floor, 2 Gwynne Street, Cremorne VIC 3121, Australia