Privacy Policy

1. About this policy

Gutceutics ("Gutceutics", "we", "us", "our") is an Australian gut intelligence service providing whole-genome shotgun (WGS) microbiome testing, reporting and associated wellness support.

Gutceutics is a subsidiary of JMX Medical Pty Ltd (ABN 95 678 672 565), Registered address to be confirmed, Australia. References in this policy to Gutceutics are references to that entity.

We handle some of the most personal information a person can share — health symptoms, a biological sample, and the genomic sequence of the microbial community living inside you. This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the control you have over it.

This policy applies to:

• our website at gutceutics.bio and any subdomain;
• the Gutceutics patient portal;
• the Gutceutics clinician portal;
• our test kits, laboratory analysis, reports and action-plan services; and
• any other interaction you have with us, including email, phone and social media.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and by the Health Records and Information Privacy Act 2002 (NSW) and equivalent State and Territory health privacy legislation where it applies to us.

If you do not agree with this policy, please do not use our website or order a test.

2. Summary — the short version

The detail matters, though. Please read the full policy.

3. What personal information we collect

3.1 Information you give us directly

Identity and contact information Name, date of birth, sex assigned at birth, email address, postal address, phone number.

Account information Patient or clinician portal username, password (stored hashed — we cannot see it), account preferences, communication settings.

Order and payment information Products ordered, order history, delivery address, kit barcode/accession number. Payment card details are entered directly with our third-party payment processor and are never received, seen or stored by Gutceutics. We receive only a transaction reference, the last four digits of the card and the payment status.

Health and symptom information Responses to our intake questionnaire — digestive symptoms, energy, sleep, mood, bowel habit, diet and dietary restrictions, medications and supplements, antibiotic history, relevant diagnoses, height and weight, pregnancy or breastfeeding status where relevant to test suitability.

Practitioner information (clinician portal users) Name, practice name and address, AHPRA registration number or equivalent professional registration, provider number, professional qualifications, practice contact details.

Correspondence Emails, support tickets, waitlist sign-ups, consultation notes shared with us, survey responses, feedback and reviews.

3.2 Information generated by testing

Biological sample The faecal sample you collect and post to our laboratory partner.

Sequence data Raw sequencing reads, quality-control metrics, assembled and annotated microbial genomes, taxonomic profiles (species and strain-level abundance across 140+ organisms), functional and metabolic pathway data.

Derived analytical outputs Diversity indices (e.g. Shannon), ratio metrics (e.g. Firmicutes/Bacteroidetes), deviation scores against our reference cohort, short-chain fatty acid potential, and our six microbiome risk-signal model scores (type 2 diabetes, inflammatory bowel disease, colorectal cancer, Crohn's disease, ulcerative colitis, fatty liver).

Reports and plans Your patient report, clinician report, nutritionist action plan, compounding recommendations and any retest trend data.

A note on human DNA. WGS of a faecal sample is designed to sequence microbial DNA, but a small proportion of reads may derive from human cells shed into the gut. Our pipeline computationally removes and discards human-derived reads as a standard step. We do not analyse, interpret or report on human genetic information, and we do not provide human genetic testing of any kind.

3.3 Information collected automatically

When you use our website or portal we may collect IP address, device and browser type, operating system, pages viewed, referring URL, time and duration of visits, and portal activity logs (logins, report views, downloads) for security and audit purposes.

We use cookies and similar technologies — see section 11.

3.4 Information from third parties

We may receive information about you from:

• your referring practitioner or clinic, where you have been referred for testing;
• our partner practitioners (nutritionists, compounding pharmacists, clinicians) where you have consented to information flowing back to us as part of your action plan;
• our laboratory partner, in the form of sequencing results and quality metrics; and
• service providers such as our payment processor and courier, in the form of transaction and delivery status.

3.5 Sensitive information

Health information, genetic information and biological samples are "sensitive information" under the Privacy Act and attract higher protection. Under APP 3.3 we collect sensitive information only where:

• you have given express consent — which you provide when you activate your kit and complete the consent step at registration; and
• the information is reasonably necessary for us to provide the service you have asked for.

You may withdraw consent at any time (see section 9), although we will not be able to continue providing the testing service without it.

4. Why we collect, hold and use your information

We use your personal information to:

1. Deliver the service — fulfil orders, dispatch and track kits, link your sample to your record via barcode, perform laboratory analysis, generate your reports, and make them available in your portal.
2. Interpret your results appropriately — questionnaire and medication data materially affect microbiome interpretation (for example, recent antibiotic use).
3. Coordinate your action team — share the results you have consented to share with our partner nutritionists, compounding pharmacists, nutrition partners and clinician network so they can prepare your action plan.
4. Provide clinical support to practitioners — operate the clinician portal and support co-managed patient care.
5. Manage your account — authentication, portal access, retest tracking and trend comparison.
6. Communicate with you — order updates, sample status, result notifications, service messages, and responses to your enquiries.
7. Handle payment — process orders, refunds and practitioner billing.
8. Maintain quality and safety — laboratory QC, pipeline validation, incident investigation, complaint handling, and follow-up where a result may warrant clinical attention.
9. Improve and secure the platform — analytics, troubleshooting, fraud prevention, security monitoring.
10. Improve our models and conduct research — only using de-identified data, and only if you have opted in (see section 7).
11. Marketing — send you updates about Gutceutics where you have opted in (see section 8).
12. Meet legal obligations — record-keeping, regulatory, tax and law-enforcement obligations.

We do not use your health, genetic or microbiome data for advertising, profiling for advertising purposes, or automated decision-making that produces a legal or similarly significant effect on you.

5. Who we disclose your information to

We disclose personal information only as described below, and only the minimum necessary in each case.

5.1 Laboratory partner

Our Australian sequencing laboratory receives your sample and the accession identifier required to process it. Wherever operationally possible the laboratory receives pseudonymised data — a barcode rather than your name.

5.2 Your action team

With your consent, we share your results and relevant questionnaire information with:

• Gut Brain Science — accredited biomedical nutritionists who review your results, conduct consultations and prepare your personalised action plan;
• Synergy Compounding Pharmacy — for the formulation and dispensing of bespoke probiotic and therapeutic compounds where you have purchased a plan that includes this;
• Chief Nutrition — for the preparation of your nutrition and protein protocol; and
• our integrated clinician network — where you have requested clinician involvement or where a result warrants referral and you have consented to that referral.

These organisations are independent providers. When they hold your information for their own purposes, they do so as separate entities under their own privacy policies and professional obligations. We encourage you to read their policies.

5.3 Your own GP or specialist

We will share your results directly with a nominated GP, specialist or other treating practitioner only at your request and with your consent.

5.4 Service providers

We use third parties to operate the business, under contracts requiring them to protect your information and use it only for the purpose we engage them for. These include:

• cloud hosting and database infrastructure providers;
• payment processing providers;
• postal and courier services (kit dispatch and sample return);
• email delivery and customer support platforms;
• website and product analytics providers;
• professional advisers (legal, accounting, insurance, audit).

5.5 Legal and safety disclosures

We may disclose personal information where required or authorised by law — including to courts, tribunals, regulators (such as the OAIC or the TGA), or law enforcement pursuant to a valid legal request — or where we reasonably believe disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual.

5.6 Business transfer

If Gutceutics is involved in a merger, acquisition, restructure or sale of assets, personal information may be transferred as part of that transaction. Any acquirer would be bound to handle it consistently with this policy, and we will notify affected individuals.

5.7 What we will never do

We will not:

• sell, rent, licence or trade your personal, health, genetic or microbiome data;
• disclose your information to insurers, employers, prospective employers, or credit or financial institutions without your express, specific, written consent for that disclosure;
• use your identifiable data for research without your opt-in consent; or
• disclose identifiable data to advertisers or data brokers.

6. Cross-border disclosure

Gutceutics is built to keep Australian data in Australia. Sample collection, sequencing and analysis are performed in Australia, and our primary data storage is in Australian data-centre regions.

Some of our service providers (for example, email delivery, analytics, or support tooling) may store or process limited information — typically contact and account information rather than health or sequence data — on servers located overseas, including in the United States and the European Union.

Where we disclose personal information overseas, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the APPs, including by way of contractual commitments and data-processing agreements.

If you use our website from outside Australia, be aware that our services are directed to Australian residents and that your information will be handled in Australia.

7. Research and model development

Gutceutics maintains reference cohorts and analytical models. Improving these depends on data — but it depends on it ethically.

• Research and model-development use is strictly opt-in. You will be asked a clear, separate question at registration. Declining does not affect your test, your report, your action plan or your pricing in any way.
• If you opt in, we use de-identified data only: your name, contact details, date of birth and other direct identifiers are stripped and replaced with a non-reversible code.
• We do not attempt to re-identify de-identified data, and we contractually prohibit our research collaborators from doing so.
• You can withdraw your research consent at any time. We will remove your data from future research use. We cannot retract data already incorporated into a published analysis or a trained model, and we will say so plainly rather than promise otherwise.
• Any research involving identifiable data, or intended for publication, is conducted under the National Statement on Ethical Conduct in Human Research with approval from a registered Human Research Ethics Committee.

8. Direct marketing

We will only send you marketing communications where you have opted in, or where you are an existing customer and would reasonably expect to receive them.

Every marketing email contains an unsubscribe link, and you can opt out at any time by using that link or emailing hello@gutceutics.bio. Opting out of marketing does not stop essential service communications — order confirmations, sample status, result notifications and account or security notices.

We do not use your health, symptom, genetic or microbiome data to target marketing to you.

9. Your rights and choices

9.1 Access

You may request a copy of the personal information we hold about you. Your reports and results are available directly in your patient portal. For raw sequence data or a full data export, email hello@gutceutics.bio.

We will respond within 30 days. Access is free; we may charge a reasonable cost-recovery fee for large or complex requests (for example, export of raw sequencing files), and we will tell you the amount before proceeding.

We may refuse access in the limited circumstances permitted under APP 12 — for example, where access would pose a serious threat to life or health, or unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and how to complain.

9.2 Correction

If information we hold is inaccurate, out of date, incomplete or misleading, tell us and we will correct it. Some information — such as raw laboratory results — cannot be altered as a matter of scientific record integrity, but we can annotate the record with your statement of correction.

9.3 Deletion

You may request deletion of your account and associated personal information. We will delete what we can, subject to:

• health and testing records we are required to retain by law (see section 12);
• de-identified data already used in research or model training, which cannot be retrieved; and
• records required for tax, financial or legal-defence purposes.

We will tell you specifically what has been deleted and what has been retained, and why.

9.4 Withdrawing consent

You may withdraw consent to research use, to sharing with a particular partner, or to marketing at any time, by emailing us. Withdrawing consent to the collection or use of health information necessary to deliver testing will mean we can no longer provide the service.

9.5 Anonymity and pseudonymity

Under APP 2 you may deal with us anonymously or by pseudonym for general enquiries. This is not practicable for testing — we must be able to link a sample to a person and return a result to the right individual.

10. How we protect your information

We hold personal information in secure cloud infrastructure with access controls, and we apply security measures proportionate to the sensitivity of the data. These include:

• encryption of data in transit (TLS) and at rest;
• role-based access control and the principle of least privilege — staff and partners access only what their role requires;
• multi-factor authentication on administrative and clinician portal accounts;
• separation of identifying information from sequence data wherever operationally possible, linked by internal identifier;
• audit logging of access to patient records;
• secure development practices, vulnerability management and regular review;
• confidentiality obligations in all staff, contractor and partner agreements;
• secure backup with defined recovery objectives.

No system is perfectly secure, and we will not claim otherwise. If you believe your account has been compromised, contact us immediately at hello@gutceutics.bio.

Data breach response

We maintain a data breach response plan. If a breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.

11. Cookies and analytics

Our website uses:

• Essential cookies — required for the site and portal to function, including session and authentication cookies. These cannot be disabled.
• Analytics cookies — to understand how the site is used and improve it.
• Preference cookies — to remember your settings.

We do not use advertising or cross-site tracking cookies on the patient or clinician portal.

You can control cookies through your browser settings. Blocking essential cookies will prevent the portal from working.

12. How long we keep your information

When information is no longer needed and we are not required to retain it, we destroy it or irreversibly de-identify it.

13. Children

Our services are intended for adults aged 18 and over. Testing for a person under 18 may be arranged only where a parent or legal guardian provides consent and manages the account.

We do not knowingly collect personal information from children through our website. If you believe a child has provided information to us, contact us and we will delete it.

14. Third-party links

Our website links to third-party sites, including our partners Synergy Compounding Pharmacy and Chief Nutrition. We are not responsible for their privacy practices. Read their privacy policies before providing information to them.

15. Overseas visitors and GDPR

Our services are offered to residents of Australia. If you are located in the European Economic Area or United Kingdom and interact with our website, you may have rights under the General Data Protection Regulation, including rights of access, rectification, erasure, restriction, portability and objection. Contact us at hello@gutceutics.bio to exercise those rights, and we will respond in accordance with applicable law.

16. Changes to this policy

We may update this policy from time to time. The current version is always available at gutceutics.bio, with the effective date at the top.

If we make a change that materially affects how we handle your health, genetic or microbiome data, we will notify you directly by email and, where the change requires it, seek fresh consent.

17. Contact us and complaints

Privacy Officer Gutceutics — a subsidiary of JMX Medical Pty Ltd ABN 95 678 672 565 Registered address to be confirmed Email: hello@gutceutics.bio

We will acknowledge a privacy complaint within 7 days and respond substantively within 30 days.

If you are not satisfied with our response, you may complain to:

Office of the Australian Information Commissioner (OAIC) GPO Box 5288, Sydney NSW 2001 Phone: 1300 363 992 Web: oaic.gov.au

NSW residents may alternatively complain to the NSW Information and Privacy Commission (ipc.nsw.gov.au, 1800 472 679) in relation to health information.

Gutceutics provides wellness and health optimisation testing. Our reports and risk signal scores are for general health awareness and lifestyle guidance only. They are not diagnostic tools, do not constitute medical advice, and are not a substitute for professional clinical evaluation. Always consult a qualified healthcare professional for medical decisions.