Privacy Policy

Data Controller

The entity responsible for the processing of personal data in connection with this website (the "data controller" for the purposes of applicable privacy and data protection laws) is:

KXN Ventures Trust
trading as Doctor Pathways Australia
43 Fowler St, Camperdown NSW 2050, Australia

Contact email:
[email protected]

Where the General Data Protection Regulation (GDPR) applies, the entity identified above acts as the data controller within the meaning of Article 4(7) GDPR.

Information We Collect

We may collect personal information such as your name, email address, phone number, organisation details, and the contents of your enquiry. We may also collect technical and usage information such as IP address, browser type, device information, pages visited, and time of access.

Categories of Data Processed

When you use this Site, we may process the following categories of personal data:

• Technical data (e.g. IP address, browser type and version, device information, time of access);
• Usage data (e.g. pages visited, actions taken on the Site);
• Contact data that you provide (e.g. name, email address, phone number, message content);
• Any other data you voluntarily provide to us.

Documents You Upload to the Portal

If you create an account and use the document checklist, we collect and store the documents you choose to upload. These are credentials issued to you and verifiable by whoever issued them: your primary medical degree certificate, medical registration and certificates of good standing, examination results, English language test results, your curriculum vitae, evidence of recent practice, and professional indemnity insurance.

Documents we do not accept

We do not accept passports or other photo identification, and we do not accept police checks or criminal history records from any country. These are the most sensitive documents in the whole process — under the Privacy Act 1988 (Cth) a passport is a government-related identifier and criminal history is sensitive information — and nothing we do requires us to hold a copy of either. AHPRA obtains and assesses your criminal history itself through its own provider; AHPRA and the Department of Home Affairs ask you for your passport directly; an employer verifies your right to work through VEVO. So we do not ask for them, the portal offers no way to upload them, and our system refuses them if they are sent anyway.

Two facts from your passport are genuinely useful to you, so we ask for those instead of the document: your name exactly as it is printed — a spelling or transliteration difference between your passport and your qualifications is a common cause of AHPRA delay — and your passport expiry date, so we can warn you if it falls below the validity most visa subclasses require. For a police check we record only the date you tell us you obtained one. We do not ask for or store your passport number, your date of birth, or your place of birth.

The documents you do upload

Uploading is optional. You can use the pathway information and checklists without uploading anything. If you choose not to upload documents we simply cannot review them or prepare work that depends on them.

Who can see them. Your uploaded documents are visible to you and to our administrators, and each administrator access is recorded in an audit log. If you are being introduced to a specific medical practice and you have agreed to that introduction, documents relevant to that placement may also be visible to that practice. We do not sell your documents, and we do not disclose them to any other party except where required by law.

You can ask us to delete an uploaded document, or your account and everything in it, at any time — see Your Rights below, or write to [email protected].

Purposes of Processing

We process personal data primarily to:

• Provide, operate and maintain the Site;
• Respond to enquiries and communicate with you;
• Improve and develop our services and user experience;
• Ensure the security and integrity of the Site;
• Comply with legal obligations and defend legal claims.

Contact Form

When you use the contact form, we process the data you provide (such as name, email address, and message content) to respond to your enquiry. This processing is necessary to take steps at your request prior to entering into any agreement and is in our legitimate interest to communicate with users.

Google Forms

This Site uses embedded Google Forms for applications and enquiries. When you submit a Google Form, your data (including any personal information you provide) is transmitted to and processed by Google LLC under Google's Privacy Policy. We access the submitted data through our Google account to respond to your enquiry or process your application.

By submitting a Google Form, you acknowledge that your data will be processed by Google as a separate data controller in addition to us.

Cookies and Similar Technologies

We use cookies and similar technologies to operate this Site. The following table describes the cookies we use:

You can manage or disable cookies through your browser settings. Disabling cookies may affect Site functionality.

Cookie Consent

Where required by applicable law (including the GDPR and ePrivacy Directive for visitors in the EU/EEA), we request your consent before setting non-essential cookies. A cookie notice will be displayed when you first visit the Site, allowing you to accept or decline non-essential cookies. You can change your preferences at any time through your browser settings.

Analytics

We use the following analytics services to understand how visitors use this Site:

• PostHog – Product analytics platform that collects usage data including pages viewed, features used, session duration, approximate location (derived from IP address), and device/browser information. PostHog may set cookies to identify returning visitors. For more information, see PostHog's Privacy Policy.
• Vercel Analytics – Web analytics provided by our hosting platform that collects page views and performance metrics. For more information, see Vercel's Privacy Policy.

You can limit analytics data collection using browser privacy settings, ad blockers, or by enabling "Do Not Track" in your browser.

Session Recording

To understand how this site and the portal are actually used — and to improve that experience — we record how pages are used during your visit: which pages you open, what you click, and how you move between them. The same recording is what lets us see what happened when something goes wrong, so a fault can be diagnosed and fixed rather than guessed at.

What you type is not recorded. Text entered into form fields is masked before anything leaves your browser, so the answers you give us and anything you type into a message are not captured in these recordings.

Recordings are processed on our behalf by PostHog (see Analytics above). They are used only to improve the product and support the people using it — never to build a profile of you, never to make a decision about you, and never shared with a practice or any other third party.

If your browser sends a Do Not Track signal we do not record your session at all. You can also ask us to stop recording yours, or to delete recordings already held, by writing to [email protected].

Legal Basis under Australian Privacy Law

Where Australian privacy law applies, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We collect, use and disclose personal information for purposes that a reasonable person would expect in connection with operating this Site and providing our services, or where required or authorised by law, or where you have given your consent.

Legal Basis under the GDPR

Where the General Data Protection Regulation (GDPR) applies, we process personal data on the following legal bases:

• Art. 6(1)(a) GDPR — Consent
• Art. 6(1)(b) GDPR — Performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR — Legal obligation
• Art. 6(1)(f) GDPR — Legitimate interests (e.g. operating and securing the Site, responding to enquiries)

Recipients and Categories of Recipients

We may share personal data with:

• Service providers who support the operation, hosting, security, analytics or other functions of the Site;
• Professional advisers (e.g. lawyers, accountants) where necessary;
• Authorities or third parties where required by law or to protect our rights.

International Data Transfers

Personal information collected through this Site may be transferred to, processed, or stored in countries outside of Australia and/or the European Economic Area (EEA), including in the United States. In particular:

• Vercel (hosting) — data may be processed on servers located in the United States;
• PostHog (analytics) — data may be processed in the United States or the European Union, depending on configuration;
• Google (forms) — data submitted through embedded Google Forms is processed by Google under its own privacy policy and may be stored in the United States or other jurisdictions.

Where Australian privacy law applies, we take reasonable steps to ensure overseas recipients handle personal information in accordance with the Australian Privacy Principles (APP 8). Where the GDPR applies, transfers to countries outside the EEA are made on the basis of appropriate safeguards under Chapter V GDPR (such as standard contractual clauses or adequacy decisions) or applicable derogations.

Storage Period

We retain personal data for the following periods:

• Contact form enquiries: 2 years from submission, unless ongoing correspondence
• Analytics data: 12 months (aggregated/anonymised data may be retained longer)
• Server logs: 90 days
• Account data: Duration of account plus 2 years

Data may be retained longer where required by law or to defend legal claims. After the applicable retention period, data will be deleted or anonymised.

Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, having regard to the state of the art, implementation costs and the nature of the data.

How We Protect Uploaded Documents

In addition to the measures described above, documents uploaded to the portal are:

• stored in a private storage bucket that is not publicly readable — there is no public link to any document, and files are served only through short-lived, access-checked links;
• held in a database hosted in Australia (AWS Asia Pacific, Sydney), encrypted in transit and at rest;
• restricted at the database level so that they are reachable only by your own signed-in account, by our administrators, and by a practice you have agreed to be introduced to;
• protected by an optional authenticator-app second factor (TOTP) on your account, which we recommend enabling if you upload identity documents.

No system is perfectly secure. If an eligible data breach affects your personal information, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). Where the UK GDPR applies to you, we will also notify the Information Commissioner’s Office within 72 hours of becoming aware, as Article 33 requires.

Your Rights under Australian Privacy Law

Where Australian privacy law applies, you may request access to, or correction of, personal information we hold about you, subject to certain exceptions under the Privacy Act. If you have a concern or complaint about how we handle your personal information, you may contact us using the details provided below.

Your Rights under the GDPR

Where the GDPR applies, you have the following rights in relation to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise any of these rights, please contact us using the details provided below.

EU Supervisory Authority

Where the GDPR applies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work, or the place of the alleged infringement.

Children's Privacy

This Site is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

Health Information

This Site is not intended for the submission of patient or health information. Please do not submit sensitive health data or other special category information via the Site or contact forms. If such information is submitted, we may delete it where reasonably practicable.

Complaints

If you have a concern or complaint about how we handle personal information, please contact us using the details below and provide sufficient information for us to assess your complaint.

We will acknowledge your complaint and aim to respond within a reasonable timeframe. If you are not satisfied with our response, and Australian privacy law applies, you may be able to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Changes to this Privacy Policy

We may update this Privacy Policy from time to time by publishing an updated version on this Site. The updated policy will apply from the date it is published. Your continued use of the Site after changes are published constitutes acceptance of the updated Privacy Policy to the extent permitted by law.

Contact

If you have any questions or concerns about this Privacy Policy or our handling of personal data, please contact us at:

[email protected]

Last updated: 2026-01-25