Scriptwell

Privacy Policy

Last updated 9 November 2026

This policy explains how TerryWhite Chemmart Armstrong Creek (“we”, “us”) collects, uses, stores and shares your personal and health information when you use the Scriptwell patient portal. We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Health Records Act 2001 (Vic).

1. What we collect

• Your name, date of birth, phone number, and (where given) email and Medicare number.
• Your delivery address.
• Your prescriptions issued through TerryWhite Chemmart Armstrong Creek, including drug name, strength, dose form, repeats remaining, and expiry.
• Your orders, substitution decisions, payments, and dispatch tracking.
• Times you accessed the portal (for audit and security).

2. Why we collect it

Solely so we can dispense your medication safely and accurately, take payment, ship your order, and meet our regulatory obligations as a pharmacy (including dispensing records, Schedule 8 reporting, and tax records).

3. Who we share it with

We share the minimum data needed with the following service providers to operate Scriptwell. None of them sell your data, and each is contractually required to protect it.

• Supabase (database and infrastructure) — hosted in Sydney, Australia.
• Vercel (web hosting) — global edge network; servers process requests close to you.
• NAB (payments), through its payment gateway provider Cybersource — you enter your card details into their secure payment window, so we never see or store them.
• Stripe (legacy payment fallback) — used only for rollback and older payment workflows; Stripe receives the order amount and the card details you enter into its checkout.
• MessageMedia (SMS) — receives your mobile number and the content of messages we send you.
• ClickSend (legacy SMS fallback) — receives your mobile number and message content only if the fallback is deliberately selected.
• Resend (operational email) — hosted in the United States; pharmacy alerts are deliberately privacy-minimised and direct staff back to the authenticated admin console.
• Minfos (our pharmacy dispensing system) — your prescription record lives here regardless of whether you use Scriptwell.
• StarTrack / Australia Post (delivery) — receives your name, mobile number and delivery address when the pharmacy creates your shipment.
• Your prescribing doctor, where clinical consultation is needed (e.g. substitution decisions, urgent issues).
• Australian government agencies where the law requires (e.g. Schedule 8 reporting via SafeScript Victoria, Department of Health, AHPRA).

Cross-border note (APP 8): Cybersource, Stripe and Resend may process some of your data outside Australia, including in the United States. They are bound by contractual safeguards including Standard Contractual Clauses. By using Scriptwell, you consent to this transfer. If you would prefer not to, you can order in-person at our pharmacy instead.

Public website analytics

We use Google Analytics on selected public information pages to count visits and understand which pages are useful. Google may receive technical information such as your IP address, browser and device information, and uses analytics cookies to distinguish visits. This information may be processed outside Australia. Advertising personalisation and Google signals are disabled.

Our Google Analytics integration does not run on prescription intake, login, registration, patient portal, payment, checkout or admin pages. We do not send form contents, patient identifiers, prescription details, URL query strings or referring URLs to Google Analytics. Browser Do Not Track and Global Privacy Control preferences disable this integration.

4. How long we keep it

• Dispensing records (including Schedule 8): a minimum of 2 years per the Victorian Drugs, Poisons and Controlled Substances Regulations.
• General health records: 7 years from your last service, or until age 25 for minors, per the Health Records Act 2001 (Vic).
• Payment records: 5 years per ATO requirements.
• SMS / email logs: 12 months for operational audit.
• Inactive account magic-link tokens: rotated or invalidated after 14 days of non-use.

5. How we protect it

• Database encrypted at rest, hosted in Sydney.
• All web traffic over HTTPS with HSTS.
• Row-level security policies on every database table.
• Magic-link access requires both the link and your date of birth.
• Account is locked after 5 failed date-of-birth attempts and the pharmacy is alerted.
• Two-factor authentication on back-office provider accounts (including NAB/Cybersource, Stripe, Supabase, GitHub, Vercel, MessageMedia, ClickSend, Resend, shipping, registrar and primary email).
• Audit logs capture every meaningful event (order placed, paid, dispatched, etc.).

6. Your rights

You have the right to:

• Access a copy of the personal information we hold about you (APP 12).
• Correct information that is inaccurate or out of date (APP 13).
• Request deletion of your account and associated data, subject to our regulatory record-keeping obligations above.
• Withdraw consent at any time (this will end your use of Scriptwell but does not affect dispensing records we are legally required to retain).
• Complain if you believe we have mishandled your information. Please contact us first; if unresolved, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

To exercise any of these rights, email armstrongcreek@twcmgroup.com. We will respond within 30 days.

7. Data breaches

We are subject to the Notifiable Data Breach scheme. If a breach likely to result in serious harm to you occurs, we will notify you and the Office of the Australian Information Commissioner within 30 days of becoming aware of it.

8. Children

Scriptwell is not intended for use by individuals under 18. Prescriptions for minors are managed by their guardian in person at the pharmacy.

9. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. We will notify you by SMS or email if changes materially affect your rights.

10. Contact

TerryWhite Chemmart Armstrong Creek
Armstrong Creek, Victoria, Australia
Email: armstrongcreek@twcmgroup.com

This policy is provided in good faith and reflects our current practices. It is not a substitute for legal advice. We will have this policy reviewed by a privacy lawyer prior to general public launch.