Privacy Policy

CPAP Victoria Privacy Notice

Effective date: 11 September 2026

CPAP Victoria Pty Ltd (ABN 50 792 757 850) ("CPAP Victoria", "we", "our" or "us") is the entity responsible for this Privacy Notice. This Privacy Notice explains how CPAP Victoria handles personal information we receive about you and the privacy practices that govern how we collect, use, disclose, store and otherwise process that information.

It applies when you interact or transact with us, including in person, at our clinics, via telephone or email, through our social media channels, or on our websites, whenever we refer to or link to this Privacy Notice.

Your relationship with us may also be governed by other privacy notices where you use ResMed or third-party products, platforms or services. We may update this Privacy Notice from time to time.

Content:

1. What personal information we collect about you and how we collect it

2. How do we use your personal information?

3. How do we protect your personal information?

4. Who do we share your personal information with?

5. Where is your personal information currently hosted and processed?

6. On what basis do we use your personal information?

7. How long will we retain your personal information?

8. What are your personal information rights?

9. Personal information from children

10. Links to other sites

11. Contact us

1. What personal information we collect about you and how we collect it

In most cases, we collect personal information about you directly from you, but in some circumstances we may receive personal information about you from third parties.

WEBSITE VISITORS

When you visit our websites, we may collect:

  • your IP address;
  • your browser type, browser activity and related information;
  • information about the computer or device you are using, including operating system information; and
  • information you enter or otherwise share with us.

Through technologies used on our websites, we and our service providers may also collect information through cookies, pixels and similar technologies. CPAP Victoria currently uses tools such as Google Analytics, Google Ads, Meta/Facebook Pixel and Shopify Analytics for website analytics and advertising. These tools are not intended to receive your health, sleep study or CPAP therapy information.

END USERS OF OUR PRODUCTS AND SERVICES

Depending on how you interact with us, we may collect:

  • your title, first name and last name;
  • your date of birth, gender and contact details;
  • your address, email address and telephone number;
  • payment and transaction information;
  • Medicare or health insurance information where relevant;
  • information about your healthcare professionals, including treating doctors, sleep specialists and other healthcare providers;
  • information about your authorised representative or guardian;
  • information about the products you use, including sleep therapy devices, masks and accessories;
  • sleep, health, prescription, sleep study and health-related lifestyle information;
  • therapy and device information, including device usage and therapy information available through therapy-management platforms; and
  • any other information you provide to us.

In most cases, there will be additional information provided when we collect your personal information, such as information on a form, at a clinic or through a digital notice. We may collect information about you when:

  • you purchase or enquire about a product or service;
  • you make an appointment or visit one of our clinics;
  • you contact us by phone, email, website or social media;
  • we receive information or prescriptions from your healthcare professional;
  • you ask us to provide therapy setup, therapy support or remote therapy support;
  • you consent to us accessing therapy or device information through ResMed AirView or another manufacturer therapy-management platform;
  • you make a Medicare claim or ask us to assist with a Medicare-related service;
  • you participate in promotional offers, surveys or provide feedback; or
  • a healthcare provider, device manufacturer, service provider or authorised representative provides information to us where permitted by law.

HEALTHCARE PROVIDERS

Depending on how you interact with us, we may collect your name, contact and practice details, professional qualifications or registration information, payment information, information about products and services you use, and other information you provide to us. We may collect this information when you interact with CPAP Victoria, refer or support a patient, purchase products, attend training, or otherwise engage with us.

2. How do we use your personal information?

Depending on how you interact with us, we may use your personal information:

  • to respond to your requests and maintain our relationship with you;
  • to provide products and services, including product supply, sleep testing, therapy setup, technical support and ongoing therapy support;
  • where you have provided the required consent, to access relevant therapy and device information through ResMed AirView or another manufacturer therapy-management platform to provide remote therapy support;
  • to communicate with your healthcare provider where appropriate, including to support treatment, referrals or therapy management;
  • to process purchases, payments, deliveries, warranties, returns and other transactions;
  • to process relevant Medicare claims, including through the Services Australia PRODA platform;
  • to communicate with you about our products, services, programs and other information, including marketing where permitted by law;
  • to conduct statistical analysis, surveys, research and service improvement activities;
  • to prevent fraud, maintain security, troubleshoot and provide technical support;
  • to conduct financial, operational, privacy, risk and compliance activities; and
  • to fulfil our legal, regulatory and risk-management obligations, including establishing, exercising or defending legal claims.

3. How do we protect your personal information?

We employ security and privacy controls designed to protect your personal information and comply with applicable privacy laws. However, no method of transmission or storage can guarantee absolute security.

If we confirm that personal information has been subject to a data breach, we will respond in accordance with applicable data breach notification laws, including the Notifiable Data Breaches scheme where applicable.

We also make reasonable efforts to ensure that the personal information we collect is limited to what is reasonably necessary for the purposes described in this Privacy Notice.

4. Who do we share your personal information with?

We do not sell or rent your personal information. We only disclose personal information in accordance with this Privacy Notice and as permitted or required by applicable law.

We may disclose personal information:

  • within the ResMed group where necessary to provide products, services, technology, technical support or other services to CPAP Victoria;
  • to your GP, sleep specialist, sleep laboratory or other healthcare provider involved in your care or therapy, where appropriate;
  • to device manufacturers, suppliers and service providers where necessary to provide products, therapy-management services, technical support or other services related to your care or use of our products and services;
  • to third-party service providers that provide services to us, including data hosting, website and e-commerce services, payment processing, customer management, billing, marketing, analytics, delivery, logistics and professional services;
  • to government agencies or authorities where required or authorised by law, including where necessary to process Medicare claims;
  • if some or all of CPAP Victoria’s business or assets are transferred to another entity; or
  • where otherwise required or authorised by law.

We may share your personal information in limited circumstances, in a controlled and secure manner, with third-party data processors and service providers that we engage to provide aspects of our services on our behalf. These data processors and service providers are contractually required to keep your personal information confidential and to use your personal information for the sole purpose of performing the services we have engaged them to provide. They may not use your personal information for any other purpose.

5. Where is your personal information currently hosted and processed?

To provide our products and services, personal information may need to be accessed from or transferred to locations outside Australia. Depending on the product or service used, these locations may include Australia, New Zealand, Japan, Singapore, the European Union and the United States of America, as well as other countries in which our service providers or product manufacturers operate.

For CPAP Victoria, this may include overseas processing or access associated with website and e-commerce services, payment services, device manufacturers and therapy-management platforms. For example, CPAP Victoria uses Shopify and Stripe for relevant e-commerce and payment functions, and may use platforms or services associated with Fisher & Paykel, Philips, Löwenstein Medical and BMC.

If personal information is accessed from or transferred outside Australia, we take reasonable steps appropriate to the circumstances to ensure applicable Australian privacy requirements are addressed. This may include contractual protections, privacy due diligence, and appropriate technical and organisational safeguards.

6. On what basis do we use your personal information?

We use your personal information on the following bases:

  • to perform a contract, such as providing you with the products and services you purchased;
  • for the establishment, exercise or defence of legal claims or proceedings;
  • to comply with legal and regulatory obligations;
  • for legitimate business purposes; and
  • with your consent.

7. How long will we retain your personal information?

We will retain your personal information for:

  • as long as we are required to do so under laws regarding medical data and financial record retention;
  • the limitation period for taking legal action;
  • good practice; and
  • our business purposes.

8. What are your personal information rights?

Applicable privacy laws provide certain rights for individuals.

You are entitled to request details of the personal information we hold about you and how we process it. You may also have the right, in accordance with applicable privacy law, to:

  • have it rectified or deleted;
  • restrict our processing of your personal information;
  • stop unauthorised transfers of your personal information to a third party; and
  • have personal information relating to you transferred to another organisation, in some circumstances.

If you object to the processing of your personal information, or if you have provided your consent to processing and later choose to withdraw it, we will respect that choice in accordance with our legal obligations.

Your objection, or withdrawal of any previously given consent, could mean that we are unable to perform the actions necessary to achieve the purposes described in this Privacy Notice. You also may not be able to make use of certain services and products offered by us.

Please note that even after you have withdrawn your consent, we may be able to continue to process your personal information to the extent required or otherwise permitted by law, including in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations.

We must ensure that your personal information is accurate and up to date. Please advise us of any changes to your personal information using the contact details in section 11.

Your rights are not absolute and we will assess them when you make a request.

If you wish to make a complaint about a breach of your privacy, you can contact us using the details in section 11. You may also have the right to lodge a complaint in relation to our processing of your personal information with the Office of the Australian Information Commissioner (OAIC).

9. Personal information from children

We do not knowingly collect personal information from children. Our websites and services are not intended for, or directed to, children. If you are under 13 years of age or otherwise considered a minor under applicable law, please do not use or access our websites or services at any time or in any manner.

If a parent or legal guardian becomes aware that their child has provided us with personal information without appropriate consent, please contact us using the details in section 11.

If we confirm that a user is a minor and has provided us with personal information, we will delete such personal information from our databases.

10. Links to other sites

For your convenience, our websites and communications may include links to third-party websites or features whose privacy practices may differ from ours. This Privacy Notice does not govern those third-party sites or services. We encourage you to review their privacy notices before providing personal information.

11. Contact us

If you have questions or concerns about this Privacy Notice, would like to exercise your privacy rights, or wish to make a privacy complaint, please contact:

Privacy Contact
CPAP Victoria Pty Ltd
375 Bay Street
Port Melbourne VIC 3207
Telephone: 03 9646 7008
Email: info@cpapvictoria.com.au

You may use this email address to request access to or correction of your personal information, ask a privacy question, withdraw consent where applicable, or make a privacy complaint.

Internal drafting note (remove before publication): This draft follows the structure and core wording approach of the ResMed Asia Pacific Privacy Notice, with CPAP Victoria-specific variations retained for its legal entity, clinic/customer interactions, therapy-management platforms, Medicare/PRODA, device manufacturers, local contact details and cross-border processing.