Privacy Policy

Preview Health website and services

Last updated: October 2026

This Privacy Policy explains how Preview Health Pty Ltd (ACN 673 075 842) (Preview Health, we, us or our) collects, holds, uses and discloses your personal information when you visit our website at www.preview.health (Website), join our waitlist, communicate with us or use the Preview Services, which include our blood test, the clinical consultations and the Brain Health Preview report, in whatever phase we offer them, including the current beta pilot and any later launch.

Preview Health is an Australian health technology company based in Sydney, New South Wales. We are developing a blood test that measures biomarkers associated with brain health, and we provide the Preview Services both to deliver that test and to evaluate and develop it. Because we collect and hold health information, we are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) regardless of our size, and by the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) and the Health Privacy Principles in relation to health information we hold in New South Wales.

This Policy has four parts. Part A applies to everyone. Part B contains additional information for individuals in the European Union or European Economic Area, and Part C for California residents, in each case in relation to our Website and communications. The Preview Services are only available in Australia. Part D contains general provisions.

This Policy should be read with our Terms and Conditions, available at www.preview.health/terms-and-conditions. If you use the Preview Services, you give specific express consents to the collection and use of your health information through the Consent described in clause 5 of the Terms and Conditions, in addition to the information in this Policy.

By using the Website you acknowledge that you have read and understood this Policy. Where we rely on your consent to collect, use or disclose your personal information, we will ask for it separately and expressly.

Definitions

In this Privacy Policy:

• Personal information has the meaning given in the Privacy Act and means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not.

• Sensitive information has the meaning given in the Privacy Act and includes health information, genetic information, biometric information and information about racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal record.

• Health information is a kind of sensitive information and includes information or an opinion about your health, a health service provided to you, and information collected in connection with providing a health service, including the results of the analysis of your Sample and your Brain Health Preview.

• Preview Services means the services described in the Terms and Conditions through which we provide our blood test and the Brain Health Preview, including the onboarding questionnaire, clinical consultations, blood collection and laboratory analysis, in whatever phase we offer them (including any beta or pilot phase and after general launch).

• Service Data means the information and data collected or generated in connection with your use of the Preview Services, including your questionnaire responses, consultation information, laboratory data, results and Brain Health Preview.

• Sample means the blood sample collected from you for the Preview Services, including plasma or other fractions derived from it.

• Clinician means a medical practitioner registered with the Australian Health Practitioner Regulation Agency whom we engage to provide consultations as part of the Preview Services.

• Referring Practitioner means a medical practitioner or clinic through which you signed up for the Preview Services and who has agreed to deliver your Brain Health Preview to you.

• Research Partner means an organisation that provides the Preview Services to its own members or patients under its own consent process and its own agreement with us.

• Collection Provider means Healius Pathology Pty Ltd (ABN 84 007 190 043), which operates the Laverty Pathology collection centres we currently use, or another pathology collection provider we engage.

• Service means the Website, the Preview Services and the communications we provide in connection with them.

• Usage data means data collected automatically when you use the Website, such as your IP address, browser type, the pages you visit and the time spent on them.

• Cookies are small files placed on your device by a website to store information about your browsing activity.

• OAIC means the Office of the Australian Information Commissioner. IPC means the NSW Information and Privacy Commission.

Part A: Australian privacy law

This Part sets out how we comply with the Privacy Act, the APPs and the HRIP Act. It applies to everyone who uses the Service.

Open and transparent management of personal information (APP 1)

We manage personal information openly and transparently. This Policy describes:

• the kinds of personal information we collect and hold;

• how we collect and hold personal information;

• the purposes for which we collect, hold, use and disclose personal information;

• how we use software and automated processes in analysing Service Data;

• how you can access and correct your personal information;

• how you can complain about a breach of your privacy and how we will handle your complaint; and

• whether we disclose personal information to overseas recipients and, if so, where.

We maintain internal practices, procedures and systems to ensure that we comply with the APPs and the Health Privacy Principles, including staff training, access controls, a data breach response plan and a retention schedule.

The kinds of personal information we collect

Website visitors and waitlist members

If you visit the Website, join our waitlist or contact us, we may collect:

• your name and email address;

• any other information you choose to give us, for example through forms, waitlist sign-ups or correspondence; and

• usage data, as described under Cookies and tracking technologies below.

Participants in the Preview Services

If you use the Preview Services, we collect the following kinds of personal information. Most of it is health information.

• Identity and contact details: your name, date of birth, sex, email address, mobile number and, where needed to confirm your eligibility, your residential suburb or address.

• Eligibility and account information: your confirmation that you are 18 or over and resident in Australia, your acceptance of the Terms and Conditions and the consents you give, any promotional code you use, and your account credentials.

• Onboarding questionnaire responses: information about your health, medical history, medications and supplements, lifestyle, family history and any memory or cognitive concerns.

• Clinical consultation information: information you give a Clinician, the clinician’s notes and any recommendation they make.

• Sample and laboratory information: the fact that a Sample was collected, the date, time and place of collection, sample identifiers, and the analytical data generated by analysing your Sample, including biomarker measurements and related laboratory data.

• Results: your biomarker results, whether each result is within or outside the expected range we use, and your Brain Health Preview.

• Referral and partner information: if you joined through a Referring Practitioner, their details and the information they give us about your referral; if you joined through a Research Partner, the information the Research Partner provides to us with your consent.

• Payment and transaction information: the amount paid, the date, the type of payment method and a transaction reference. Your card details are collected directly by our payment processor. We do not hold your full card number.

• Communications: emails, SMS messages, calls and other communications with you, including appointment and scheduling information.

The Preview Services do not involve genetic testing. If that changes, we will update this Policy and seek your express consent before collecting genetic information.

How we collect personal information

We collect personal information:

• directly from you, when you use the Website, join the waitlist, sign up for the Preview Services, complete the onboarding questionnaire, take part in a consultation or contact us;

• from the Collection Provider, which confirms that your Sample has been collected and provides collection details and sample identifiers;

• from Clinicians, who record information from your consultations;

• from Referring Practitioners, if you signed up through one;

• from Research Partners, if you signed up through one and have consented under the Research Partner’s process to the information being shared with us;

• from your Sample, through the analytical data generated by analysing it;

• automatically, through cookies and similar technologies when you use the Website; and

• from our service providers, for example confirmation of a payment or the status of a message.

Where it is reasonable and practicable, we collect personal information directly from you. We do not collect personal information by unlawful or unfair means. If we receive personal information that we did not ask for and would not have been permitted to collect, we will destroy or de-identify it where it is lawful and reasonable to do so.

Notification of collection (APP 5)

At or before the time we collect your personal information, or as soon as practicable afterwards, we take reasonable steps to tell you:

• who we are: Preview Health Pty Ltd (ACN 673 075 842), Level 17, 123 Pitt Street, Sydney NSW 2000;

• how to contact us: by email at info@preview.health;

• why we are collecting it: for the purposes set out in this Policy;

• who we may disclose it to: the recipients described in this Policy;

• whether we disclose it overseas: as described under Cross-border disclosure below;

• what happens if you do not provide it: if you do not provide the personal information we ask for, we may not be able to provide the Service to you. In particular, we cannot provide the Preview Services to you without the health information and consents described in the Terms and Conditions;

• how you can access and correct it: as described under Access and correction below; and

• how you can complain: as described under Complaints below.

For participants in the Preview Services, this notification is given on the sign-up page or in the Consent Form, together with this Policy.

Purposes for which we collect, hold, use and disclose personal information

Delivering the Preview Services

We collect, hold, use and disclose Service Data to:

• confirm your eligibility and activate your place in the Preview Services;

• process your payment or promotional code;

• arrange and conduct your clinical consultations;

• arrange your blood draw with the Collection Provider and receive your Sample;

• analyse your Sample and produce your Brain Health Preview;

• deliver your Brain Health Preview to you through a Clinician or your Referring Practitioner;

• communicate with you about your use of the Preview Services, including appointments, next steps and results; and

• respond to your enquiries and manage any withdrawal from the Preview Services.

Research and development

The Preview Services are provided as part of our research and development of the test, including during any beta or pilot phase. With your express consent, we use your Sample, questionnaire responses, consultation information relevant to the test, laboratory data and results to:

• develop, validate and improve the test, including its biomarker panel, expected ranges, laboratory methods, software and models;

• evaluate how the test performs in practice and refine the participant experience;

• carry out internal quality control, which includes the review of identifiable results by authorised personnel;

• combine your Service Data with information from other participants for analysis;

• prepare de-identified or aggregated datasets, scientific publications and research outputs; and

• develop future Preview Health products and services.

Other purposes

We also collect, hold, use and disclose personal information to:

• operate the Website, the waitlist and your account;

• send you service communications, such as updates to our terms or security notices;

• send you marketing communications where you have consented (see Direct marketing below);

• analyse how the Service is used and improve it;

• detect, prevent and address security incidents, fraud and illegal activity;

• comply with our legal obligations, including health records retention requirements;

• manage complaints, disputes and legal claims;

• carry out a corporate transaction, as described below; and

• any other purpose to which you have consented.

Who we disclose personal information to

We disclose personal information, including health information, to the following recipients where it is necessary for the purposes described above:

• Clinicians, who conduct your consultations and deliver your results;

• Referring Practitioners, if you signed up through one, who deliver your Brain Health Preview and provide your care;

• Research Partners, if you signed up through one, to the extent described in the Research Partner’s consent process;

• the Collection Provider, Healius Pathology Pty Ltd (trading as Laverty Pathology), which collects, processes and stores your Sample and needs your identity details to do so;

• laboratory personnel working in the laboratory facilities we use, currently located at the University of Sydney, who receive coded Samples and data;

• service providers that help us operate the Service, including providers of cloud hosting and data storage, payment processing (Stripe), telehealth and scheduling platforms, email, SMS and customer relationship management platforms (including HubSpot), and IT support and security services;

• professional advisers, such as lawyers, accountants, auditors and insurers;

• regulators, law enforcement agencies and courts, where required or authorised by law; and

• our related bodies corporate, if any.

If we sell or transfer our business or assets, or merge with or are acquired by another entity, your personal information may be transferred as part of that transaction. We will tell you before your personal information becomes subject to a different privacy policy.

We do not sell personal information. We do not disclose your identifiable health information to third parties for their own research or marketing purposes without your further consent.

Access within Preview Health

Access to identifiable Service Data within Preview Health is restricted to authorised personnel on a need-to-know basis. This includes our clinical personnel and a small number of non-clinical staff who are responsible for laboratory operations, data management and quality control, and who need access to identifiable results to carry out those functions. All personnel are bound by confidentiality obligations, and access is logged.

Sensitive information and health information

Health information is sensitive information under the Privacy Act and is given a higher level of protection. We will only collect sensitive information, including health information, where:

• you have given your express consent to the collection; and

• the information is reasonably necessary for one or more of our functions or activities.

When we collect health information from you for the Preview Services, we:

• tell you, at the time of collection, what we are collecting and why;

• obtain your express consent through the sign-up page, the Consent Form or a Research Partner’s consent process;

• use and disclose it only for the purposes for which it was collected, for a purpose you have consented to, or where an exception under the Privacy Act or the HRIP Act applies;

• apply additional security measures to protect it, including coding of Samples and laboratory data; and

• do not use or disclose it for direct marketing.

Because we hold health information in New South Wales, the Health Privacy Principles in the HRIP Act also apply to how we collect, store, use, disclose and retain it, including the requirements described under Cross-border disclosure and Retention below.

Coding, de-identification and research use

We label Samples and laboratory data with a code rather than your name. The key that links the code to your identity is held securely within Preview Health and access to it is restricted to authorised personnel.

We may de-identify or aggregate Service Data at any time. Information is de-identified when it is no longer about an identifiable individual or an individual who is reasonably identifiable. Once information has been de-identified, it is no longer personal information and we may use, retain, disclose, publish and commercialise it for any lawful purpose, including sharing it with research collaborators and commercial partners and including it in scientific publications and future products. We will not attempt to re-identify de-identified data and we require anyone we share it with not to do so.

If you withdraw from the Preview Services, we will stop using your identifiable Service Data for research and development, except to the extent it has already been incorporated into analyses, datasets or models in a way that cannot reasonably be reversed. De-identified and aggregated data and research outputs derived from your participation before you withdrew may continue to be used.

Automated analysis and decision-making

Your biomarker results are produced by laboratory instruments and software that measure the biomarkers in your Sample and compare the measured levels with the expected ranges we use. The personal information used in this process is the analytical data from your Sample and, where relevant to an expected range, your sex and age. The output is reviewed by, and delivered to you through, a Clinician or your Referring Practitioner. We do not make any decision about you that could significantly affect your rights or interests solely by automated means.

Direct marketing (APP 7) and the Spam Act

We may use your name and contact details to send you marketing communications about our products, services and events where you have given your express consent, for example by joining our waitlist or opting in to receive updates, or where we are otherwise permitted to do so under the Privacy Act. We will not use your health information or the fact that you use the Preview Services for direct marketing unless you have expressly consented.

You may opt out of marketing communications at any time by:

• clicking the unsubscribe link in any marketing email we send;

• emailing us at info@preview.health; or

• updating your communication preferences in your account, where that function is available.

We will process your request as soon as practicable. After you opt out we may still send you communications about your use of the Preview Services and other service-related communications, such as updates to our terms or security notices.

We comply with the Spam Act 2003 (Cth). We only send commercial electronic messages with your consent, we identify ourselves and include our contact details in every message, and we include a functional unsubscribe facility in every message and honour unsubscribe requests promptly.

Cookies and tracking technologies

We use cookies and similar technologies, such as tags and scripts, to operate the Website, to understand how it is used and to improve it. The types of cookies we use are:

• Necessary cookies (session cookies, set by us), which are essential to operate the Website, to authenticate you and to prevent fraudulent use of accounts;

• Cookie notice cookies (persistent, set by us), which record whether you have accepted the use of cookies;

• Functionality cookies (persistent, set by us), which remember choices you make on the Website, such as your login details or language preference; and

• Analytics cookies (persistent, set by third parties), which collect information about traffic to the Website and how visitors use it. The information collected is usually linked to a pseudonymous identifier for your device, and may directly or indirectly identify you.

We do not place third-party advertising or analytics cookies, pixels or similar tracking technologies on the pages of the Website where you provide health information or access your results.

You can set your browser to refuse cookies or to tell you when a cookie is being sent. If you do, some parts of the Website may not work.

Cross-border disclosure of personal information (APP 8)

Your Sample is analysed in Australia. Your health information, laboratory data, results and Brain Health Preview are stored on cloud infrastructure located in Australia.

Some of our service providers store or process limited personal information outside Australia:

• United States: HubSpot, Inc. provides our customer relationship management and email platform. It stores the information you submit through forms on the Website, your contact details and our communications with you, and may process that information in the United States and in other countries where it or its service providers operate. HubSpot’s privacy policy is available at legal.hubspot.com/privacy-policy.

• United States: Stripe processes payments for us. Stripe collects your card details directly and receives your name, email address and the transaction amount and reference, which it may process in the United States and in other countries where it or its service providers operate. Stripe’s privacy policy is available at stripe.com/au/privacy.

Before we disclose personal information to an overseas recipient, we take reasonable steps, including contractual protections, to ensure that the recipient does not breach the APPs in relation to that information. We do not transfer health information outside New South Wales except where the HRIP Act permits it, including where the recipient is subject to privacy obligations that are substantially similar to the Health Privacy Principles or where you have consented. If we engage additional overseas providers in future, we will update this Policy.

Security of personal information (APP 11)

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include:

• encryption of data in transit (TLS) and at rest;

• coding of Samples and laboratory data, with the identity key held separately and access to it restricted;

• role-based access controls and logging of all access to identifiable Service Data;

• confidentiality obligations and privacy training for personnel and contractors;

• contractual security and privacy obligations on our service providers;

• use of reputable cloud providers with recognised security certifications; and

• a documented data breach response plan and regular review of our security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We take reasonable steps to destroy or permanently de-identify personal information when it is no longer needed for any purpose for which it may lawfully be used or disclosed, subject to the retention requirements described below.

Retention of personal information

We retain personal information for as long as it is needed for the purposes set out in this Policy or as required or permitted by law. In particular:

• Health records: we retain identifiable Service Data, including questionnaire responses, consultation information, results and your Brain Health Preview, for at least seven years from the date of the last entry in your record, consistent with health records retention requirements in New South Wales, and for longer where we are required to by law or need to in order to establish, exercise or defend legal claims.

• Samples: we retain Samples, or parts of them, while they are needed for the Preview Services and for the research purposes you have consented to, and then destroy them. If you withdraw and ask us to, we will destroy or de-identify any remaining Sample where it is practicable to do so.

• Waitlist and marketing information: we retain this until you unsubscribe or it is no longer needed.

• Usage data: we generally retain this for a shorter period, unless it is needed to strengthen security, improve the Service or comply with a legal requirement.

• De-identified data: we may retain de-identified and aggregated data and research outputs indefinitely.

When personal information is no longer needed, we take reasonable steps to destroy it or to permanently de-identify it.

Access to and correction of personal information (APP 12 and APP 13)

Access

You may ask for access to the personal information we hold about you by emailing info@preview.health. We will respond within a reasonable period, and in any event within 30 days, and will give you access in the way you request where it is reasonable and practicable to do so. Your results and Brain Health Preview are provided to you through a clinician; you may ask for a further copy at any time.

We may refuse access in the circumstances permitted by the Privacy Act and the HRIP Act, for example where giving access would pose a serious threat to the life, health or safety of any person, would have an unreasonable impact on the privacy of others, or relates to existing or anticipated legal proceedings. If we refuse access, we will give you written reasons and tell you how to complain.

Correction

You may ask us to correct personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant or misleading by emailing info@preview.health. We will respond within a reasonable period, and in any event within 30 days. If we correct information that we have previously disclosed to a third party, we will take reasonable steps to tell that third party, unless it is impracticable or unlawful to do so. If we refuse to correct information, we will give you written reasons and tell you how to complain, and you may ask us to attach a statement to the record noting that you consider it to be inaccurate.

Notifiable data breaches

We comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we have reasonable grounds to believe that an eligible data breach has occurred, being a breach that is likely to result in serious harm to any individual whose personal information is involved, we will as soon as practicable notify the OAIC and the affected individuals, and will include in the notification a description of the breach, the kinds of information involved and the steps we recommend individuals take in response. We maintain a data breach response plan and take prompt steps to contain and assess any suspected breach in accordance with OAIC guidance.

Complaints

Complaining to us

If you believe we have breached your privacy or mishandled your personal information, please contact us at info@preview.health with details of your complaint. We will acknowledge your complaint within five business days, investigate it and keep you informed, and respond within 30 days.

Complaining to a regulator

If you are not satisfied with our response, or you wish to complain directly, you may contact:

• the Office of the Australian Information Commissioner (Privacy Act): www.oaic.gov.au, telephone 1300 363 992, email enquiries@oaic.gov.au, or GPO Box 5218, Sydney NSW 2001;

• the NSW Information and Privacy Commission (HRIP Act): www.ipc.nsw.gov.au, telephone 1800 472 679, email ipcinfo@ipc.nsw.gov.au, or GPO Box 7011, Sydney NSW 2001; or

• for a complaint about a clinician, the NSW Health Care Complaints Commission: www.hccc.nsw.gov.au, telephone 1800 043 159.

Part B: Additional information for individuals in the EU and EEA (GDPR)

This Part applies in addition to Part A if you are located in the European Union or the European Economic Area and you use the Website or communicate with us. Where this Part is inconsistent with Part A, this Part prevails for those individuals. The Preview Services are only available to residents of Australia, and we do not collect health information from individuals in the EU or EEA.

Data controller

Preview Health Pty Ltd (ACN 673 075 842), Level 17, 123 Pitt Street, Sydney NSW 2000, Australia, is the controller of your personal data.

Legal bases for processing

We process personal data of individuals in the EU and EEA on the following legal bases:

• consent, where you have consented to processing for a specific purpose, such as receiving our newsletter;

• performance of a contract, where processing is necessary to perform an agreement with you or to take steps at your request before entering into one;

• legal obligation, where processing is necessary to comply with a legal obligation; and

• legitimate interests, where processing is necessary for our legitimate interests, such as operating and securing the Website, provided those interests are not overridden by your rights and interests.

We will only process special categories of personal data, including health data, with your explicit consent or where another condition in Article 9 of the GDPR applies.

International transfers

We are located in Australia, and personal data we collect from you will be transferred to and processed in Australia and in the countries where our service providers operate. Where required, we rely on appropriate safeguards for those transfers, such as standard contractual clauses.

Your rights

Subject to the conditions in the GDPR, you have the right to request access to your personal data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw consent at any time. To exercise these rights, contact us at info@preview.health. We will respond within one month. You also have the right to lodge a complaint with the data protection authority in your country.

Part C: Additional information for California residents (CCPA/CPRA)

This Part applies in addition to Part A if you are a resident of California and you use the Website or communicate with us. The Preview Services are only available to residents of Australia.

Categories of personal information collected

In the preceding 12 months we have collected the following categories of personal information from California residents who use the Website: identifiers (such as name, email address and IP address); personal information described in Cal. Civ. Code s 1798.80(e) (such as name and contact details); internet or other network activity (such as your interaction with the Website); and sensitive personal information limited to account login credentials, where you create an account. We do not collect the other categories listed in the CCPA from California residents.

Sale and sharing of personal information

We do not sell personal information and we do not share it for cross-context behavioural advertising. We use service providers, such as HubSpot and Stripe, to receive the information you submit through the Website, to manage our contact records, to send communications on our behalf and to process payments.

Your rights

If you are a California resident you have the right to know what personal information we have collected about you and how we use and disclose it, the right to request deletion, the right to request correction, the right to opt out of any sale or sharing, the right to limit the use of sensitive personal information and the right not to be discriminated against for exercising these rights. To exercise them, contact us at info@preview.health. We will respond to a verifiable request within 45 days.

Minors, Do Not Track and Shine the Light

We do not knowingly collect personal information from anyone under 18, and we do not sell the personal information of minors. The Website does not respond to Do Not Track signals; you can manage cookies through your browser settings. California residents with an established business relationship with us may request, once a year, information about any disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Part D: General provisions

Children

The Service is not directed at anyone under 18 years of age. The Preview Services are only available to people who are 18 or over. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe that your child has given us personal information, please contact us at info@preview.health and we will take steps to delete it.

Links to other websites

The Website may contain links to third-party websites that we do not operate. We recommend that you read the privacy policy of every website you visit. We have no control over, and accept no responsibility for, the content or privacy practices of third-party websites.

Changes to this Privacy Policy

We may update this Policy from time to time. We will publish the updated Policy on the Website and change the date at the top. If a change is significant, and in any case before we collect any new kind of sensitive information or begin a new overseas disclosure of health information, we will also tell current participants in the Preview Services by email or by a prominent notice on the Service before the change takes effect. Please review this Policy periodically.

Contact us

If you have a question about this Policy, wish to exercise any of your rights or wish to make a complaint, please contact us:

Preview Health Pty Ltd (ACN 673 075 842)

Level 17, 123 Pitt Street, Sydney NSW 2000

Email: info@preview.health

Website: www.preview.health