draft – needs legal review
Privacy policy
This policy explains how Cortex Health Solutions Pty Ltd, trading as Cortex Telehealth, handles personal information. It is a draft and must be reviewed by a lawyer before launch.
Draft – needs legal review
Last updated 11 October 2026. Written for the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Who we are
Cortex Health Solutions Pty Ltd (ABN 91 682 317 077) provides Cortex Telehealth. Contact: info@cortextelehealth.com.au. A phone number and street address are not published yet. TODO: add them once Brett confirms which details to use.
What this website collects
This website is a static site. It does not have an account system, a health intake form, or a place to upload results. If you only read the pages, we do not ask for your name or your health information.
Booking, payment and clinical notes happen in Halaxy, the practice's clinical system, not in this website. Information you type into the booking window is collected by the practice for the purpose of providing a health service, and it is stored in Halaxy. Halaxy's own privacy information is on halaxy.com.
Email to info@cortextelehealth.com.au is for general enquiries. Please don't send symptoms, images or test results by email. If you do, that message may contain health information. We will treat it as such, ask you to continue in a booked consult, and keep it only as long as we need to deal with it safely.
Health information
Health information is sensitive information under the Privacy Act. We collect it to assess, treat and follow up patients, to arrange pathology, prescriptions and referrals when they are clinically appropriate, and to meet record-keeping duties. The usual collection point is Halaxy, during booking or a consult, not this website.
Telehealth consults are provided through Halaxy's platform. Whether a consult is recorded is a matter for that platform and for consent at the time. This website does not record calls. TODO: confirm Halaxy's recording settings and describe them here once known.
Analytics and cookies
A Google Tag Manager container can be switched on from the site configuration. It is currently off. If it is turned on later, it may set cookies and send technical data such as pages viewed to Google. Booking and booking-confirmation pages are excluded. Event names must not include health conditions, symptoms or medicine names.
Tag Manager, if enabled, loads with consent signals set to denied until a consent tool updates them. This draft does not include a cookie banner. TODO: decide whether a banner is required before any analytics ID is added, and name the cookies actually in use.
Hosting is on Cloudflare. Cloudflare processes connection data such as IP address to deliver the site and to resist abuse. That processing can occur outside Australia.
Overseas disclosure
Halaxy, Cloudflare and, if analytics are enabled, Google may store or process information outside Australia. Before disclosing personal information overseas we take steps required by Australian Privacy Principle 8. The contracts and locations should be listed here after legal review. TODO: record Halaxy's hosting region and Cloudflare's relevant terms.
Why we use information, and who we share it with
- To provide telehealth care and to follow up safely.
- To take payment for consultations.
- With pathology laboratories, pharmacies and other clinicians, where that is needed for your care or you have agreed.
- With your GP, if you ask us to write to them or consent during a consult.
- Where the law requires it, including a mandatory notification or a valid request from a regulator.
We do not sell personal information.
Access and correction
You can ask for access to the personal information we hold about you, and ask for corrections. Clinical records are requested through the practice at info@cortextelehealth.com.au. We may need to confirm your identity. Access can be refused in the limited situations the Privacy Act allows, and we will explain why if we refuse.
Retention
Health records are kept for at least as long as the law in the relevant state or territory requires. TODO: a lawyer should set the exact retention schedule. This website itself does not hold a patient database.
Notifiable Data Breaches
If a data breach is likely to result in serious harm, we will assess it and, where the Notifiable Data Breaches scheme requires, notify the Office of the Australian Information Commissioner and the people affected.
Complaints about privacy
Write to info@cortextelehealth.com.au with "Privacy" in the subject. We will acknowledge and look into it. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
Concerns about clinical care have a separate path on the complaints page.