Scriptwell

Privacy Policy

Last updated 2 May 2026

This policy explains how TerryWhite Chemmart Armstrong Creek (“we”, “us”) collects, uses, stores and shares your personal and health information when you use the Scriptwell patient portal. We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Health Records Act 2001 (Vic).

1. What we collect

• Your name, date of birth, phone number, and (where given) email and Medicare number.
• Your delivery address.
• Your prescriptions issued through TerryWhite Chemmart Armstrong Creek, including drug name, strength, dose form, repeats remaining, and expiry.
• Your orders, substitution decisions, payments, and dispatch tracking.
• Times you accessed the portal (for audit and security).

2. Why we collect it

Solely so we can dispense your medication safely and accurately, take payment, ship your order, and meet our regulatory obligations as a pharmacy (including dispensing records, Schedule 8 reporting, and tax records).

3. Who we share it with

We share the minimum data needed with the following service providers to operate Scriptwell. None of them sell your data, and each is contractually required to protect it.

• Supabase (database and infrastructure) — hosted in Sydney, Australia.
• Vercel (web hosting) — global edge network; servers process requests close to you.
• Stripe (payments) — hosted in the United States; Stripe handles your card details directly so we never see them.
• ClickSend (SMS) — hosted in Australia.
• Resend (operational email) — hosted in the United States; only your name, phone, and order summary are included in emails to our pharmacy inbox so we know to fulfil your order.
• Minfos (our pharmacy dispensing system) — your prescription record lives here regardless of whether you use Scriptwell.
• Your prescribing doctor, where clinical consultation is needed (e.g. substitution decisions, urgent issues).
• Australian government agencies where the law requires (e.g. Schedule 8 reporting via SafeScript Victoria, Department of Health, AHPRA).

Cross-border note (APP 8): Stripe and Resend process some of your data in the United States. They are bound by contractual safeguards including Standard Contractual Clauses. By using Scriptwell, you consent to this transfer. If you would prefer not to, you can order in-person at our pharmacy instead.

4. How long we keep it

• Dispensing records (including Schedule 8): a minimum of 2 years per the Victorian Drugs, Poisons and Controlled Substances Regulations.
• General health records: 7 years from your last service, or until age 25 for minors, per the Health Records Act 2001 (Vic).
• Payment records: 5 years per ATO requirements.
• SMS / email logs: 12 months for operational audit.
• Inactive account magic-link tokens: rotated or invalidated after 14 days of non-use.

5. How we protect it

• Database encrypted at rest, hosted in Sydney.
• All web traffic over HTTPS with HSTS.
• Row-level security policies on every database table.
• Magic-link access requires both the link and your date of birth.
• Account is locked after 5 failed date-of-birth attempts and the pharmacy is alerted.
• Two-factor authentication on every back-office account (Stripe, Supabase, GitHub, Vercel, ClickSend, Resend, registrar, primary email).
• Audit logs capture every meaningful event (order placed, paid, dispatched, etc.).

6. Your rights

You have the right to:

• Access a copy of the personal information we hold about you (APP 12).
• Correct information that is inaccurate or out of date (APP 13).
• Request deletion of your account and associated data, subject to our regulatory record-keeping obligations above.
• Withdraw consent at any time (this will end your use of Scriptwell but does not affect dispensing records we are legally required to retain).
• Complain if you believe we have mishandled your information. Please contact us first; if unresolved, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

To exercise any of these rights, email armstrongcreek@twcmgroup.com. We will respond within 30 days.

7. Data breaches

We are subject to the Notifiable Data Breach scheme. If a breach likely to result in serious harm to you occurs, we will notify you and the Office of the Australian Information Commissioner within 30 days of becoming aware of it.

8. Children

Scriptwell is not intended for use by individuals under 18. Prescriptions for minors are managed by their guardian in person at the pharmacy.

9. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. We will notify you by SMS or email if changes materially affect your rights.

10. Contact

TerryWhite Chemmart Armstrong Creek
Armstrong Creek, Victoria, Australia
Email: armstrongcreek@twcmgroup.com

This policy is provided in good faith and reflects our current practices. It is not a substitute for legal advice. We will have this policy reviewed by a privacy lawyer prior to general public launch.