Privacy policy
Privacy Policy
Australian Pure Health Pty Ltd (ABN 12 602 097 503), trading as Mr Vitamins ("we", "us", "our"), operates www.mrvitamins.com.au (the "Site") and our retail stores in Sydney.
Effective date: 18 August 2026
Last reviewed: 18 August 2026
Next scheduled review: August 2027
Version: 2.0
We sell natural health products and give health and wellbeing advice. That means some of what you tell us is health information, which Australian law treats as sensitive information and holds to a higher standard than an ordinary retail purchase. We have written this policy to that higher standard, and in plain English, so you can see exactly what we do with your information before you decide to share it.
This policy explains how we collect, use, hold, disclose and protect your personal information, and how you can access, correct or complain about it. It applies to our website, our stores, our email and SMS programs, our customer service channels and our loyalty program.
The short version
- We do not sell your personal information. Not to data brokers, not to anyone.
- We do not share your health information with advertising platforms. We do not build audiences on Google, Meta or any other ad platform based on a health condition you have told us about.
- Health information is only collected with your consent, and only where it is needed to give you useful advice or supply a product safely.
- You can opt out of marketing at any time, in one click, and it does not affect your ability to shop with us.
- You can ask us what we hold about you, ask us to correct it, or ask us to delete it. We respond within 30 days.
- If we get it wrong, you can escalate to the Office of the Australian Information Commissioner. Details are at the end of this policy.
The rest of this policy is the detail behind those six points.
The law that applies to us
We are an Australian company bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Our privacy regulator is the Office of the Australian Information Commissioner (OAIC).
Because we handle health information, we are also subject to the additional protections the Privacy Act places on sensitive information, and to the Health Records and Information Privacy Act 2002 (NSW) in respect of health records created in our New South Wales stores.
Our marketing is governed by the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). Our advertising of therapeutic goods is governed by the Therapeutic Goods Advertising Code, which affects what we are permitted to say to you, including in personalised communications.
What we collect
Identity and contact information
What: name, email address, phone number, delivery and billing addresses, date of birth (where you give it for age-restricted products or birthday rewards), and your account login details.
Why: to create and maintain your account, take and deliver your order, verify your identity when you contact us, and communicate with you about your purchase.
How we get it: directly from you.
Order and payment information
What: what you bought, when, at what price, order and delivery history, returns and refunds, and payment details.
Why: to fulfil our contract with you, process payment, arrange delivery or click-and-collect, issue invoices and tax receipts, handle returns and warranty claims, screen orders for fraud, and meet our record-keeping obligations under Australian tax law.
How we get it: directly from you and from our payment providers.
A note on card details: we do not see or store your full credit or debit card number. Card data is captured and processed directly by our PCI DSS compliant payment providers. We receive only a token, the last four digits and the card type.
Health and wellbeing information (sensitive information)
What: health goals, symptoms, dietary requirements, allergies, current medications or supplements, pregnancy or breastfeeding status, and any other health detail you choose to tell one of our practitioners or our customer service team.
Why: so our qualified team can give you safe, relevant advice, check for interactions between a product and your medication, and answer your questions properly. This is the core of what we do and we cannot do it well without it.
How we get it: only from you, and only with your consent. You are never required to give it. If you would rather not, we will still serve you, we will simply give you general information rather than advice tailored to your situation.
See the dedicated section below for exactly how we handle it.
Inferred product and category interests
What: the product categories you browse and buy from, and the segments we place you in for merchandising and marketing purposes (for example "sports nutrition buyer" or "sleep and stress category").
Why: to recommend relevant products, decide what to stock, and send you communications you are more likely to find useful rather than a generic email to everyone.
How we get it: generated by us from your purchase and browsing history.
The limit we place on this: we do not treat a purchase as a diagnosis. We do not create, use or disclose marketing segments that assert or imply that you have a specific medical condition, and we do not upload health-based segments to advertising platforms. You can opt out of personalised marketing at any time.
Device and website usage information
What: IP address, browser type and version, device type, operating system, time zone, referring website, search terms used on our Site, pages and products viewed, and how you interact with the Site.
Why: to load the Site correctly, keep it secure, measure and improve how it performs, and (where you have consented) to measure and target advertising.
How we get it: automatically, through cookies, log files, pixels, tags and similar technologies. See the Cookies section.
Customer service and communications
What: the contents of your emails, chat messages, social media messages and phone calls with us, including any recordings or transcripts, and our notes about your enquiry.
Why: to answer your question, resolve complaints, train our team and improve our service.
How we get it: directly from you when you contact us.
In-store information
What: purchase records linked to your loyalty account, consultation notes where you have had a practitioner consultation, and CCTV footage in our stores.
Why: to operate the loyalty program, provide continuity of advice, and for the safety and security of our customers and our team. CCTV is used only for safety and loss prevention and is not linked to your customer account.
Practitioner and wholesale accounts
What: if you apply for a practitioner or wholesale account, we collect your professional registration or association membership details, qualifications, clinic details and ABN.
Why: to verify your professional status and give you access to practitioner-only products and pricing, as required by our supplier agreements and the applicable regulatory framework.
What we do not collect
We do not collect government identifiers such as Medicare numbers, tax file numbers or driver licence numbers, other than where required for an age-restricted purchase or a wholesale account. We do not buy marketing lists or personal information from data brokers. We do not collect biometric information.
Health information: how we handle it
Health information is sensitive information under the Privacy Act and attracts stronger protections than other personal information. We apply the following rules to it.
Consent first. We collect health information only with your consent, and only for the purpose you gave it to us for: giving you safe, relevant advice. Consent can be express (you complete a consultation form) or clearly implied (you tell our naturopath what medication you are on so they can check for an interaction). You can withdraw consent at any time.
Purpose limitation. We use your health information to advise you, to check product suitability and interactions, to follow up on a consultation, and to keep an accurate record of the advice given. We do not use it for anything else without asking you first.
What we will never do with it. We do not sell it. We do not disclose it to advertising or social media platforms. We do not use it to build advertising audiences or lookalike audiences. We do not disclose it to insurers, employers, credit providers or data brokers. We do not use it to set prices.
Who can see it. Access to consultation records is restricted to the practitioners and team members who need it to serve you, on a need-to-know basis. Our team are bound by confidentiality obligations in their employment terms, and our practitioners are additionally bound by the codes of conduct of their professional associations.
How long we keep it. We retain consultation records for seven years from your last consultation, consistent with health record-keeping practice in Australia. If you were under 18 at the time, we retain the record until you turn 25. You can ask us to delete it sooner and we will unless we are legally required to keep it.
Our advice is not a substitute for medical care. Information you receive from us is general and product-related. It does not replace advice from your doctor or another registered health practitioner, and we encourage you to discuss any supplement with them, particularly if you are pregnant, breastfeeding, taking prescription medication or managing a diagnosed condition.
How we use your personal information
We use your personal information to:
- supply the products and services you have asked for, including taking payment, arranging delivery or click-and-collect, and handling returns;
- run your account and loyalty membership, including points, rewards and wishlists;
- give you health and product advice you have asked for;
- answer your questions and resolve complaints;
- send you transactional messages such as order confirmations, dispatch notifications and receipts (these are not marketing and you cannot unsubscribe from them while you have an active order);
- send you marketing communications where you have consented or would reasonably expect them, with an unsubscribe link in every message;
- personalise what you see on our Site and in our communications;
- detect, investigate and prevent fraud, misuse of our Site and security incidents;
- understand how our Site and stores perform, and improve them;
- meet our legal obligations, including under Australian consumer law, tax law and the therapeutic goods framework, and to respond to lawful requests from regulators, courts and law enforcement.
Marketing, and how to stop it
If you have bought from us, subscribed, or joined our loyalty program, we may send you email and SMS marketing about products, offers, health education content and events. Every message contains a clear way to opt out.
- Email: click "unsubscribe" at the bottom of any marketing email, or update your preferences in your account.
- SMS: reply STOP to any marketing SMS.
- Everything at once: email onlinesupport@mrvitamins.com.au and ask us to remove you from all marketing.
We action opt-outs within five business days, and in any case within the five working days required by the Spam Act. Opting out of marketing does not stop transactional messages about an order you have placed, and it does not affect your ability to shop with us or use your loyalty points.
We do not sell or rent your contact details to third parties for their own marketing.
Cookies and tracking technologies
A cookie is a small file placed on your device when you visit our Site. We use cookies that are necessary for the Site to function, plus cookies for analytics, personalisation and advertising.
Cookies necessary for the store to function
| Name | Function |
|---|---|
| _ab | Used in connection with access to admin. |
| _secure_session_id | Used in connection with navigation through the storefront. |
| cart | Used in connection with the shopping cart. |
| cart_sig | Used in connection with checkout. |
| cart_ts | Used in connection with checkout. |
| checkout_token | Used in connection with checkout. |
| secret | Used in connection with checkout. |
| secure_customer_sig | Used in connection with customer login. |
| storefront_digest | Used in connection with customer login. |
| _shopify_u | Used to facilitate updating customer account information. |
Reporting and analytics
| Name | Function |
|---|---|
| _tracking_consent | Records your tracking preferences. |
| _landing_page | Tracks landing pages. |
| _orig_referrer | Tracks landing pages. |
| _s | Shopify analytics. |
| _shopify_fs | Shopify analytics. |
| _shopify_s | Shopify analytics. |
| _shopify_sa_p | Shopify analytics relating to marketing and referrals. |
| _shopify_sa_t | Shopify analytics relating to marketing and referrals. |
| _shopify_y | Shopify analytics. |
| _y | Shopify analytics. |
| _ga, _gid, _gat | Google Analytics: distinguishes users and limits request rates. |
| _gcl_au | Google Ads conversion measurement. |
| _fbp | Meta advertising and conversion measurement. |
| __kla_id | Klaviyo: identifies a subscriber for email and SMS personalisation. |
Session cookies last until you close your browser. Persistent cookies last until they expire or you delete them; most of ours expire between 30 minutes and two years from the date they are set.
You can control cookies through your browser settings, usually under "Tools", "Settings" or "Preferences". Guidance is available at www.allaboutcookies.org. Blocking cookies may stop parts of our Site working properly, including your cart and checkout.
Advertising and analytics partners
We use analytics and advertising services to understand how our Site is used and to show you relevant advertising on other websites and social platforms. This involves sharing limited information about your Site activity and purchases with those platforms, usually via cookies and pixels.
- Google (Analytics, Ads, Merchant Centre): Google privacy policy. Opt out of Google Analytics with the browser add-on, or manage ad personalisation at My Ad Center.
- Meta (Facebook and Instagram): Meta privacy policy. Manage your settings in Ad Preferences.
- Klaviyo (email and SMS marketing, on-site personalisation): Klaviyo privacy notice.
As noted above, we do not share health information with any of these platforms.
You can opt out of interest-based advertising more broadly through the Digital Advertising Alliance's opt-out portal or the Network Advertising Initiative's opt-out tool. Opting out means you see less relevant advertising, not less advertising.
Who we share your information with
We share personal information with service providers who help us run our business. They are permitted to use it only to provide their service to us, and are bound by contract to protect it.
- Shopify — our ecommerce platform and store systems. Shopify privacy policy.
- Payment providers — Shopify Payments, PayPal, and our buy-now-pay-later providers. They handle your card and payment data directly under PCI DSS.
- Klaviyo — email and SMS marketing delivery.
- Google and Meta — analytics and advertising, as described above.
- Yotpo — product reviews and ratings. If you submit a review, your first name and review content are published publicly.
- Our loyalty and wishlist providers — to operate points, rewards and saved product lists.
- Warehousing, third-party logistics and delivery partners — including Australia Post and our courier partners, to pick, pack and deliver your order. They receive only what is needed to deliver: your name, address, contact details and parcel contents.
- Customer service and communications platforms — to manage and respond to your enquiries.
- Professional advisers — accountants, auditors, insurers and lawyers, where necessary and under confidentiality obligations.
We also disclose personal information where we are required or permitted by law: to comply with a subpoena, warrant, or lawful request from a regulator, court or law enforcement agency; to establish or defend a legal claim; or to prevent a serious threat to someone's life, health or safety.
If our business or part of it is sold, merged or restructured, customer information may transfer to the acquirer as part of that transaction. We would notify you and the acquirer would be bound by this policy or a materially equivalent one.
Sending information overseas
Some of our service providers store or process personal information outside Australia. Based on our current providers, this includes the United States, Canada, Ireland and Singapore.
Before disclosing personal information to an overseas recipient we take reasonable steps, as required by APP 8, to ensure the recipient handles it consistently with the Australian Privacy Principles. This is generally done through contractual data protection terms with each provider.
Health information collected in consultation records is held in Australia and is not routinely disclosed overseas.
Automated decision-making
We are transparent about where computers, rather than people, make or substantially inform decisions about you.
We do not make fully automated decisions that have a legal effect on you or that significantly affect your rights or interests. A person is involved in any decision that materially affects you, such as refusing a refund or closing an account.
We do use automation in the following ways, none of which we consider to have a significant effect on you:
- Fraud and risk screening. Shopify applies automated fraud analysis to orders, including temporary denylisting of IP addresses associated with repeated failed transactions (hours) and of cards associated with those addresses (days). A person reviews any order flagged as high risk before it is cancelled.
- Marketing segmentation and product recommendations. We use purchase and browsing history to decide which emails you receive and which products are surfaced to you. This affects what you are shown, not what you are charged or whether we serve you.
- Inventory, delivery and address validation. Automated checks on addresses and stock availability.
From 10 December 2026, amendments to APP 1 will require Australian organisations to disclose additional detail about automated decision-making in their privacy policies. We have written this section in anticipation of that requirement and will update it as our practices or the guidance change.
How we keep your information secure
We take the following steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure:
- our Site is served over TLS encryption and our checkout runs on Shopify's PCI DSS Level 1 certified infrastructure;
- we do not store full payment card numbers;
- access to customer data is restricted by role, with individual accounts and multi-factor authentication on our core systems;
- access to health consultation records is further restricted to the team members who need it;
- our team receive privacy and data handling guidance as part of onboarding;
- we review the security and privacy practices of new service providers before we connect them to customer data;
- we destroy or de-identify personal information when we no longer need it and are not required to keep it.
No system is perfectly secure, and we cannot guarantee the security of information transmitted over the internet. Please use a strong, unique password for your account and tell us immediately if you think it has been compromised.
If there is a data breach
We are covered by the Notifiable Data Breaches scheme. If we suffer a data breach that is likely to result in serious harm to you, we will:
- contain and assess it promptly;
- notify you and the Office of the Australian Information Commissioner as soon as practicable, and in any case within the timeframes required by the Privacy Act;
- tell you plainly what happened, what information was involved, and what you should do about it.
How long we keep your information
| Information | Retention period |
|---|---|
| Order, payment and tax records | 7 years from the transaction, as required by Australian tax law |
| Account and loyalty records | While your account is active, then 3 years, unless you ask us to delete it sooner |
| Health consultation records | 7 years from your last consultation (until age 25 if you were under 18) |
| Marketing contact details | Until you unsubscribe, then held on a suppression list so we do not contact you again |
| Customer service correspondence | 2 years from resolution |
| Website analytics and cookie data | Up to 26 months |
| CCTV footage | 30 days, unless retained for an active incident |
Where we are legally required to keep information, we will keep it for that period even if you ask us to delete it, and we will tell you why.
Your rights
Under the Australian Privacy Principles you have the right to:
- Access the personal information we hold about you (APP 12);
- Correct it if it is inaccurate, out of date, incomplete or misleading (APP 13);
- Ask us to delete it, subject to our legal record-keeping obligations;
- Withdraw consent, including consent to hold your health information;
- Opt out of direct marketing at any time (APP 7);
- Deal with us anonymously or under a pseudonym where it is lawful and practicable to do so, for example when making a general enquiry (APP 2);
- Complain if you think we have mishandled your information.
To exercise any of these, email onlinesupport@mrvitamins.com.au with "Privacy request" in the subject line, or write to us at the address below. We may need to verify your identity before we act, particularly for access requests. We respond within 30 days and we do not charge for access or correction requests.
If you need this policy or your information in an alternative format for accessibility reasons, tell us and we will provide it.
Children and young people
Our Site is not directed at children. We do not knowingly collect personal information from anyone under 16 without the involvement of a parent or guardian, and some of the products we sell are not suitable for children.
If you are a parent or guardian and believe your child has given us personal information, contact us and we will delete it.
Where a young person under 18 receives advice from one of our practitioners, we handle their information with the additional care described in the health information section above.
Visitors from outside Australia
Our Site is directed at customers in Australia. If you access it from elsewhere, your information will be processed in Australia and in the countries listed in the overseas disclosure section, which may have different privacy laws.
European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies to our processing, our lawful bases are: performance of our contract with you (orders and delivery); your consent (marketing, cookies, health information); our legitimate interests (fraud prevention, improving our services, where not overridden by your rights); and compliance with our legal obligations. You have rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your local supervisory authority.
California. Where the CCPA/CPRA applies, you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of any sale or sharing. We do not sell personal information as defined by the CCPA. You may use an authorised agent to make a request; contact us at the address below.
To exercise any of these rights, use the same contact details as everyone else. We do not run a separate process by region.
Do Not Track and Global Privacy Control
There is still no consistent industry standard for responding to "Do Not Track" browser signals, and we do not currently alter our data collection when we receive one. Where our cookie consent tool detects a Global Privacy Control signal, it treats it as an opt-out of advertising and analytics cookies.
Changes to this policy
We review this policy at least annually and update it when our practices, our service providers or the law change. The effective date and version number at the top tell you which version you are reading. Material changes will be notified on the Site, and by email where we hold your address and the change affects you.
Change log
- v2.0, 18 August 2026 — Rewritten under the Privacy Act 1988 and the Australian Privacy Principles. Added dedicated health information handling, named service providers, retention schedule, automated decision-making disclosure, data breach commitments and OAIC escalation path.
- v1.0 — Previous policy.
Contact us
If you have a question about this policy, want to exercise a right, or want to make a complaint:
Email: onlinesupport@mrvitamins.com.au
Phone: [phone number]
Post: Privacy Officer, Australian Pure Health Pty Ltd, Suite 1, Level 12, North Tower, 1-5 Railway Street, Chatswood NSW 2067, Australia
Complaints
Tell us what happened and what you would like us to do. We will acknowledge your complaint within 5 business days and give you a substantive response within 30 days. If we need longer, we will tell you why and agree a new timeframe with you.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
- Online: oaic.gov.au/privacy/privacy-complaints
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
For complaints about health records created in New South Wales, you may also contact the NSW Information and Privacy Commission on 1800 472 679 or the NSW Health Care Complaints Commission on 1800 043 159.