VELARA HEALTH
Privacy policy
Effective 5 November 2026
Who we are
Velara Health is operated by Elixton Pty Ltd (ABN 18 677 263 133). We provide telehealth care to Australian adults. This policy explains how we collect, use, store and share personal and health information. For privacy questions, contact support@velarahealth.com.au and ask for our privacy contact.
What we collect
We collect information needed to assess and care for you: your name, date of birth, contact details, current location when relevant to care, health history, symptoms, medications, allergies, relevant family and social history, consent and clinical notes. Where needed and lawful, we also collect Medicare details, your Individual Healthcare Identifier, test results, prescription information and payment or billing details. General website enquiries may include your name, email and message.
How we collect it
Usually you provide information through your booking, patient forms or consultation. With your consent, or where the law permits, we may obtain relevant information from your GP, other treating providers, pharmacies, pathology services or a representative. Once authorised access is established, this may include My Health Record and prescription monitoring systems. We collect only information relevant to the purpose.
Why we need it
We use information to confirm identity, assess suitability, provide and document care, prescribe where appropriate, arrange referrals and follow-up, manage bookings and payments, respond to enquiries and complaints, and meet legal obligations. You can make a general enquiry without identifying yourself where practicable. Clinical care usually requires identifying information; if essential information is missing, we may be unable to safely provide a service.
Who information may be shared with
Relevant information may be shared with practitioners involved in your care, pharmacies, laboratories, approved administrative staff and contractors, and service providers that support bookings, records, communications and payments. We seek consent for care correspondence where required. We may also disclose information where required or permitted by law, including to regulators, insurers or legal advisers when relevant, or to address a serious safety threat under applicable law. We do not sell your identifiable health information or use it for marketing without the required consent.
Prescribing approvals and safety checks
Where a prescription requires approval, notification or other regulatory checks, we may provide the necessary personal and health information to the Therapeutic Goods Administration (TGA) or the relevant state or territory authority. This may include your identifying details, condition and proposed treatment, as required for that process. We share only the information needed and permitted by law.
Clinical audits and quality checks
Authorised practitioners and, where necessary and lawful, designated administrative or compliance personnel may review relevant information to check clinical safety, documentation, service quality and compliance. Access is limited to the task, governed by role permissions and confidentiality obligations, and does not give staff general access to browse patient records. We use de-identified information where practical and seek consent where required.
Halaxy and our service providers
We use Halaxy for bookings, patient forms, clinical records, invoices and patient communications. Payment information is handled through the payment services used for your booking. Our business email uses Google Workspace. Providers have their own privacy policies, linked below. We remain responsible for our handling of your information and review services before using them for patient care.
AI assisted clinical notes
With your permission, your practitioner may use Heidi to assist with transcribing a consultation and preparing clinical notes. We explain the process and ask for consent before starting it. Your practitioner checks and finalises the notes and remains responsible for clinical decisions. You can decline AI-assisted documentation and still receive care. Ask your practitioner about the information processed, retention settings and any concerns before use. We do not promise a specific recording deletion period without confirming the configured settings.
Storage and overseas processing
Clinical records are held in approved systems with access limited to people who need them for their work. Halaxy states that its data is stored in Australia; some of its communications, infrastructure and payment suppliers are based in the United States. Google Workspace and other service providers may involve overseas processing or support. We assess these arrangements and take reasonable steps required by applicable privacy law. Contact us for details of the providers and countries relevant to your information.
Security and retention
We use access controls, individual accounts, multi-factor authentication where available and appropriate device and security measures. No online system can guarantee absolute security. Adult clinical records are retained for at least seven years after the last health service, and longer where another law or a claim requires it. We securely destroy or de-identify information when it is no longer required and lawful to do so. A request to delete an account does not override required clinical-record retention.
Access and correction
Email support@velarahealth.com.au to request access to, or correction of, your information. There is no charge to make an access or correction request, or for us to correct your information. A lawful fee may apply to providing copies or access to records; we explain any fee before proceeding. We verify identity securely and respond within a reasonable period, generally within 30 days. If access or a requested correction cannot be provided, we explain the reason and available complaint options, subject to lawful exceptions. Clinical records may preserve the original entry and include a correction or your statement rather than erase the history.
Messages and website use
Tell us if you have a preferred safe contact method. Email and SMS may be visible to someone with access to your device or account, so avoid including sensitive health details in general email enquiries. Our website does not currently add advertising trackers. Hosting, security and authentication services may process technical information such as IP address, device or browser information and access logs. External booking and service websites have their own cookies and privacy practices.
Concerns or complaints
Please contact support@velarahealth.com.au with a description of your concern and a safe way to reach you. We aim to acknowledge it within five business days and provide a response within 30 days, or explain any delay. You can also contact the Office of the Australian Information Commissioner or, for Victorian health privacy and service concerns, the Health Complaints Commissioner. This does not limit your right to approach a relevant authority.
Changes to this policy
We update this policy when our services or information handling changes. Material changes will be communicated where appropriate. The date above identifies the current version.
Halaxy privacy · Heidi privacy · Google privacy · OAIC · Health Complaints Commissioner