Med Mend logo with header background for healthcare app.
Second Opinions, Without Borders

Med Mend Data Policy.

Last updated: 2 September 2026

Med Mend Pty Ltd (“Med Mend”, “we”, “us”, “our”) is committed to protecting your privacy and handling your personal and health information responsibly. This Data Policy explains what information we collect, how we use it, where it is stored, and the rights you have over it.

This Data Policy should be read alongside our full Privacy Policy, available at medmend.app/privacy, which sets out our obligations under the Australian Privacy Principles (APPs) in full. Where this Data Policy and the Privacy Policy address the same subject, the Privacy Policy is the authoritative statement of our obligations; this Data Policy is a companion summary and does not limit or override it.

We may collect the following categories of information:

  • Identity and contact information — name, date of birth, email address, phone number, country of residence.
  • Health information — medical history, diagnostic reports, imaging, pathology results, specialist letters, and any other clinical information you submit as part of your case.
  • Payment information — processed securely by our third-party payment provider; Med Mend does not store full card details.
  • Technical information — device, browser, and usage data collected automatically when you use our platform, including through cookies and similar technologies (see Section 13).

We use your information to:

  • Facilitate the second opinion service you have requested, including providing your case to the specialist you have selected, or to the next available specialist in the relevant field where you have not selected one;
  • Communicate with you about your case, your account, and platform updates;
  • Process payments for services purchased;
  • Maintain the security, integrity, and proper functioning of the platform;
  • Support internal quality improvement, using de-identified (anonymised) information as described in Section 3;
  • Meet our legal, regulatory, and record-keeping obligations.

 

Med Mend does not use your health information for advertising or marketing purposes, and does not sell your personal information to third parties.

Assignment of your case to a specialist is not determined by an automated decision-making system. Where you select your own specialist, your case is provided directly to them. Where you do not select a specialist, your case is provided to the next available specialist in the relevant field.

We may use de-identified (anonymised) information — meaning information that has had identifying details removed so it can no longer reasonably be linked back to you — for internal quality improvement, service development, and analytics purposes.

Your identified health information (i.e. information that identifies you) is used only for the purpose of delivering your individual second opinion service. Consistent with our Privacy Policy, we will not use your health information for research purposes without your separate, express consent.

By submitting your information and using Med Mend’s services, you consent to the collection, use, and disclosure of your information as described in this Data Policy and our Privacy Policy. Where we are required to obtain your explicit consent — for example, before your health information is shared with a specialist for your case — we will seek that consent at the relevant point in the platform.

You may withdraw your consent at any time by contacting us at privacy@medmend.app, noting that withdrawing consent may affect our ability to provide services to you, including any case already in progress.

We share information only as necessary to deliver the service, including with:

  • The independent specialist you have selected, or who has been assigned to your case, solely for the purpose of providing your second opinion;
  • Service providers who support our platform’s operation (including secure hosting and payment processing), under contractual obligations to protect your information;
  • Regulators or authorities, where required by law.

 

We do not share your health information with your existing treating doctors, insurers, or employers unless you specifically direct us to do so.

Personal and health information is stored on servers located in Australia.

Med Mend connects patients with specialist doctors located around the world. Where your case is assigned to a specialist located outside Australia, your health information will be transferred to or accessed from that overseas location. This is an inherent feature of the second opinion service, and you consent to such transfer when you submit a case for specialist review. In practice, this occurs by way of remote access through the secure platform — specialists do not download, export, or independently store case data, and your information is not otherwise transferred to a system outside Med Mend’s control.

Before disclosing your health information to an overseas recipient, Med Mend takes reasonable steps to ensure that the receiving party is subject to a standard of privacy protection substantially similar to the APPs, or that the transfer is otherwise permitted under APP 8. These steps include contractual obligations in the Specialist Platform Participation Agreement requiring overseas specialists to handle health information consistently with Australian privacy standards, verification of the specialist’s current professional registration, and encrypted transmission and access controls for all case materials.

A current list of countries to which information may be transferred, depending on the specialist matched to your case, is available on request by contacting privacy@medmend.app. Full detail on cross-border disclosure, including your acknowledgement under APP 8.1, is set out in our Privacy Policy.

We apply administrative, technical, and physical safeguards designed to protect your information against unauthorised access, disclosure, alteration, or loss, including encryption of data in transit and at rest, and restricted access controls limited to personnel and specialists directly involved in your case. Full detail on our security framework is set out in our Privacy Policy.

In the event of a data breach involving your personal or health information that is likely to result in serious harm, we will take steps to notify affected individuals and the Office of the Australian Information Commissioner (OAIC), consistent with our obligations under the Notifiable Data Breaches scheme. Our full breach response process is set out in our Privacy Policy.

We retain your information for as long as necessary to provide the service, meet our legal and regulatory record-keeping obligations, and resolve any disputes. Consistent with our Privacy Policy, we retain case records for a minimum of seven (7) years from the date of the second opinion report for adult patients, and for a minimum of seven (7) years after a minor patient reaches the age of 18 (i.e. until they turn 25), in accordance with applicable Australian record-keeping standards. Independent specialists retain ongoing access to case records they have been involved in, within the platform, both before and after the consultation is completed — this data remains platform-owned and is not exported or held independently by the specialist.

You may request deletion of your account and associated information at any time, subject to our ability to retain certain records where required by law.

The platform is not available to persons under 18 acting independently. Consultations on behalf of a minor may only be submitted by a parent or legal guardian (an Authorised Representative), who provides consent on the minor’s behalf. An Authorised Representative holds the same rights to access and correct the minor’s information as the minor would if they were an adult, exercisable until the minor turns 18, at which point privacy rights and access transfer exclusively to that person.

Where a person lacks decision-making capacity, their information may be collected, used and disclosed with the consent of their Authorised Representative — a person who holds legal authority to make healthcare decisions on that person’s behalf, such as an enduring guardian, an attorney under an enduring power of attorney, a person responsible, or a person appointed under a guardianship order. The Authorised Representative holds the same access and correction rights as the individual would if they had capacity, exercisable while the incapacity subsists. Med Mend may request evidence of an Authorised Representative’s authority at any time.

Subject to applicable law, you (or, where applicable, your Authorised Representative
under Sections 10 or 11) have the right to:

  • Access the personal and health information we hold about you;
  • Request correction of inaccurate or incomplete information;
  • Request further information about how your information has been used or disclosed;
  • Withdraw consent or request deletion of your information, as described in Sections 4 and 9;
  • Lodge a complaint about how we have handled your information.

 

To exercise any of these rights, contact us using the details in Section 15. Full detail on access, correction, and complaint timeframes is set out in our Privacy Pol

We use cookies and similar technologies to operate our platform, keep you signed in, and understand how our platform is used. You can control or disable cookies through your browser settings; doing so may affect how parts of the platform function. We do not use cookies to serve third-party advertising.

Our platform or communications may contain links to third-party websites. We are not responsible for the privacy practices or content of third-party sites, and encourage you to review their own privacy policies.

If you believe we have mishandled your information, you may lodge a complaint with our Privacy Officer at privacy@medmend.app. If you are not satisfied with our response, you may raise the matter with the Office of the Australian Information Commissioner (OAIC).

We may update this Data Policy from time to time. Material changes will be notified on this page with an updated “last updated” date.