PRIVACY POLICY

Fern NRT
Last updated: 27 August 2026

1. ABOUT THIS PRIVACY POLICY

Fern NRT is operated by Fern Dispensary Pty Ltd 41 691 147 494 (“Fern NRT”, “we”, “us” or “our”).

Fern NRT respects your privacy and is committed to protecting the personal information and health information entrusted to us.

This Privacy Policy explains how we collect, hold, use and disclose personal information when you:

• visit or use fernnrt.com.au (the “Website”);
• create a customer or patient account;
• complete an online assessment or medical questionnaire;
• upload or provide a prescription;
• purchase or request products or services;
• communicate with our team;
• interact with a doctor, pharmacist or other healthcare professional through services facilitated by Fern NRT; or
• otherwise interact with Fern NRT.

We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and other applicable Commonwealth, State and Territory privacy and health-information laws.

The Fern NRT online store is powered by Shopify. We also use other technology and service providers to operate our services.

2. PERSONAL INFORMATION WE COLLECT

The information we collect depends on how you interact with Fern NRT.

Personal and contact information

We may collect:

• your full name;
• date of birth and age;
• residential, billing and delivery address;
• email address;
• telephone number;
• account and login information;
• identity and age-verification information;
• Medicare or other healthcare-related information where relevant;
• prescription information;
• order and transaction history;
• communications with Fern NRT; and
• other information you choose to provide.

Health and sensitive information

Where required to provide or facilitate healthcare services, we may collect sensitive information, including health information such as:

• smoking and nicotine-use history;
• medical history;
• current and previous treatments;
• current medications;
• allergies and adverse reactions;
• medical conditions;
• information contained in prescriptions;
• responses provided in medical questionnaires or assessments;
• information supplied to or by a doctor, pharmacist or other healthcare professional; and
• other health information reasonably necessary to assess suitability for, provide, dispense or facilitate healthcare services or therapeutic products.

Health information is sensitive information under Australian privacy law and is handled accordingly.

Transaction and shopping information

When you use our online store, we may collect information about:

• products you view;
• products added to your cart;
• orders you place;
• purchases;
• cancellations;
• refunds;
• delivery information;
• payment status; and
• previous transactions.

Payment information

Payment information may be collected and processed through third-party payment providers.

Depending on the payment method used, this may include payment-card information, transaction information, payment confirmation and related billing details.

Fern NRT does not necessarily receive or retain your complete payment-card details where these are processed directly by a payment provider.

Website and device information

When you use our Website, certain information may be collected automatically, including:

• IP address;
• browser type and version;
• device type;
• operating system;
• network information;
• pages viewed;
• date and time of access;
• referring website;
• interactions with our Website;
• cookies and similar technologies; and
• other Website usage and analytics information.

3. HOW WE COLLECT INFORMATION

We generally collect personal information directly from you.

This may occur when you:

• create an account;
• complete an online questionnaire or assessment;
• upload or provide a prescription;
• place an order;
• make an enquiry;
• contact Fern NRT;
• communicate with a healthcare professional;
• subscribe to communications;
• interact with our Website; or
• otherwise provide information to us.

We may also collect information automatically when you use our Website through cookies and similar technologies.

Where appropriate and permitted by law, we may receive information from third parties including:

• Australian-registered doctors and other healthcare professionals;
• pharmacists and pharmacies;
• clinics or healthcare providers;
• Shopify;
• healthcare and patient-management platforms;
• payment providers;
• identity-verification providers;
• delivery and logistics providers; and
• technology providers involved in delivering our services.

Where health information is collected from another healthcare provider, this will generally occur with your consent, where reasonably necessary to provide a health service, or where otherwise permitted or required by law.

4. HOW WE USE YOUR INFORMATION

We collect, hold and use personal information where reasonably necessary to operate Fern NRT and provide or facilitate our products and services.

This may include using information to:

• create and manage your account;
• verify your identity and age;
• assess eligibility to access particular services;
• facilitate medical assessments or consultations;
• enable an Australian-registered healthcare professional to review information you submit;
• verify prescriptions;
• facilitate dispensing and supply of products;
• process payments;
• process and fulfil orders;
• arrange delivery or collection;
• provide order and account notifications;
• communicate with you regarding your account, assessment, prescription or order;
• provide customer support;
• respond to enquiries, complaints and requests;
• maintain appropriate health, dispensing and business records;
• comply with legal, regulatory, pharmacy and healthcare obligations;
• prevent and investigate suspected fraud, misuse or unlawful activity;
• maintain the security of our Website and systems;
• improve our Website, services and customer experience; and
• analyse Website performance and usage.

We will not use health information for an unrelated purpose unless you have provided the necessary consent or the use is otherwise permitted or required by law.

5. HEALTH INFORMATION AND HEALTHCARE PROFESSIONALS

Information you provide through a medical questionnaire, assessment or prescription pathway may be made available to an appropriate Australian-registered healthcare professional where necessary to provide the service you request.

This may include doctors, pharmacists or other healthcare professionals involved in:

• reviewing your medical information;
• assessing your circumstances;
• providing medical advice;
• determining whether treatment is clinically appropriate;
• issuing or verifying a prescription;
• dispensing medication; or
• providing other healthcare services.

Independent healthcare professionals may have their own professional, legal and privacy obligations regarding the information they collect and the clinical records they maintain.

Fern NRT only seeks to provide healthcare professionals with information reasonably necessary for the healthcare service being provided or facilitated.

6. HOW WE DISCLOSE PERSONAL INFORMATION

We do not sell your personal or health information.

We may disclose personal information where reasonably necessary to provide or facilitate our services or where authorised or required by law.

Recipients may include:

• Australian-registered doctors and other healthcare professionals involved in your care;
• pharmacists and pharmacies involved in verifying, dispensing or supplying products;
• healthcare clinics or service providers;
• Shopify;
• our employees and authorised contractors;
• healthcare and patient-management technology providers;
• website, IT and data-hosting providers;
• payment processors;
• identity-verification providers;
• delivery, courier and logistics providers;
• professional advisers including lawyers, accountants, auditors and insurers;
• government agencies, regulators, courts or law-enforcement bodies where authorised or required by law; and
• other parties where you have expressly authorised or directed us to disclose information.

We take reasonable steps to limit disclosures to information necessary for the relevant purpose.

Information may also be disclosed where permitted by law in a medical emergency or where necessary to lessen or prevent a serious threat to life, health or safety.

7. SHOPIFY

The Fern NRT online store is powered by Shopify, which provides ecommerce technology that enables us to operate the Website and online store.

Shopify collects and processes certain personal information relating to your access to and use of the online store in order to provide its services.

Information you submit through Shopify-powered parts of the Website may be transmitted to and processed by Shopify and its service providers.

Shopify may also process information relating to your interactions with the Fern NRT store in accordance with Shopify's own privacy practices.

For further information about Shopify's handling of personal information, you can review the Shopify Consumer Privacy Policy and Shopify's privacy information available through Shopify.

8. STORAGE, SECURITY AND OVERSEAS PROCESSING

Fern NRT takes reasonable steps to protect personal information and health information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.

We use reputable technology and service providers and may store information electronically through healthcare, pharmacy, ecommerce, cloud-based and business systems.

Access to personal and health information is restricted to people who reasonably require access to perform their duties or provide services.

Although we take reasonable precautions, no electronic or internet-based system can be guaranteed to be completely secure.

Fern NRT operates in Australia and seeks to use Australian-based infrastructure for sensitive healthcare information where reasonably practicable.

However, some service providers used to operate our Website and services, including Shopify and their service providers, may process or store certain personal information outside Australia.

Where personal information is disclosed to an overseas recipient, we will handle the disclosure in accordance with applicable Australian privacy requirements and take reasonable steps where required to ensure that the information is appropriately protected.

9. RETENTION OF INFORMATION

We retain personal and health information for as long as reasonably necessary to:

• provide our products and services;
• maintain your account;
• maintain appropriate healthcare, pharmacy or dispensing records;
• comply with legal and regulatory requirements;
• resolve complaints or disputes;
• prevent fraud; and
• meet legitimate business and record-keeping requirements.

Retention periods may differ depending on the type of information and the legal requirements applying to it.

Where information is no longer required and we are not legally required to retain it, we take reasonable steps to securely destroy or de-identify it.

10. ACCESS AND CORRECTION

You may request access to personal information we hold about you.

You may also ask us to correct personal information that you believe is inaccurate, incomplete, out-of-date, irrelevant or misleading.

Requests may be made using the contact details at the end of this Privacy Policy.

We may need to verify your identity before providing access to or correcting information.

In some circumstances, Australian law may permit or require us to refuse access to certain information. Where permitted, we will explain the reason for refusing a request.

11. ANONYMITY AND PSEUDONYMS

Where practicable, you may interact with Fern NRT anonymously or using a pseudonym.

However, identification may be required where required by law or where it is impracticable to provide a particular product or service without knowing your identity.

For example, identification may be required for:

• medical assessments;
• prescription verification;
• dispensing;
• supply of regulated therapeutic products;
• age verification;
• payment processing; and
• delivery.

12. MARKETING COMMUNICATIONS

Where you have consented, or where otherwise permitted by law, Fern NRT may send you communications about our services, educational information, business updates or other relevant content.

You can opt out of marketing emails at any time by selecting the Unsubscribe link contained in the communication or by contacting us.

Opting out of marketing does not prevent us from sending necessary service communications relating to your:

• account;
• assessment;
• prescription;
• healthcare service;
• transaction;
• order; or
• delivery.

We will not use sensitive health information for direct marketing unless the required consent has been obtained and the use is permitted by law.

13. COOKIES AND ANALYTICS

Our Website uses cookies and similar technologies to operate the Website, remember preferences, maintain security, understand Website usage and improve our services.

Cookies and similar technologies may collect information about your:

• browser;
• device;
• IP address;
• pages visited;
• Website interactions; and
• shopping activity.

Some cookies and similar technologies are provided by third-party services used for ecommerce functionality, analytics, security, payments or other operational purposes.

You may be able to restrict or disable cookies through your browser settings. However, doing so may affect the operation of parts of the Website.

14. THIRD-PARTY WEBSITES AND SERVICES

Our Website may contain links to websites or services operated by third parties.

Fern NRT does not control the privacy practices of third-party websites or services.

Their collection and handling of personal information is governed by their own privacy policies and terms.

We encourage you to review the privacy policies of third-party services before providing personal information to them.

15. SECURITY AND DATA BREACHES

Fern NRT takes reasonable administrative, technical and organisational measures appropriate to the nature of the information we hold.

If we become aware of a suspected data breach involving personal information, we will investigate and respond in accordance with applicable privacy laws.

Where an eligible data breach is likely to result in serious harm and the Notifiable Data Breaches scheme applies, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where required by law.

16. CHILDREN AND AGE-RESTRICTED SERVICES

Fern NRT's products and services are not intended to be accessed by children where the relevant product or service is legally restricted to adults.

We may require age verification before providing access to certain products or services.

If we become aware that personal information has been provided by a person who is not legally eligible to access a particular service, we may take reasonable steps to restrict access and handle the information in accordance with applicable law.

17. PRIVACY COMPLAINTS

If you have a concern or complaint about how Fern NRT has handled your personal information or health information, please contact us using the details below.

Please provide sufficient information for us to understand and investigate your concern.

We will investigate privacy complaints and aim to respond within a reasonable period.

If you are not satisfied with our response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our services, systems, business practices, technology or legal and regulatory obligations.

The current version will be published on the Fern NRT Website and will state the date on which it was last updated.

Where required by law, we will provide appropriate notice of material changes.

19. CONTACT US

If you have questions, requests or complaints concerning this Privacy Policy or the way Fern NRT handles personal information, please contact:

Fern NRT
Operated by: Fern Dispensary Pty Ltd
ABN: 41 691 147 494

Email: hello@ferndispensary.com.au
Phone: +61 468 280 437
Address: 2/168 Brisbane Road, Booval QLD 4304, Australia
Website: fernnrt.com.au

Last updated: 27 August 2026