Group Privacy Policy
Introduction
Last updated: 20 January 2026
Welcome to Montu Group Pty Ltd ABN 35 634 198 360 and its wholly owned subsidiaries Alternaleaf Australia Pty Ltd, uMeds Australia Pty Ltd, Saged Australia Pty Ltd and Leafio Australia Pty Ltd, as well as its businesses including Montu Medical (Montu, we, us, our). Montu is committed to earning and maintaining your trust by carefully and respectfully managing your personal information.
This Privacy Policy provides important information about how we collect, use, hold, and disclose your personal information. It also outlines how you can:
- access and correct the personal information we hold about you
- make a complaint about our handling of your personal information.
Scope of this Privacy Policy
This Privacy Policy applies to the Montu Group of companies and businesses in Australia, including:
- Montu Group Pty Ltd
- Alternaleaf Australia Pty Ltd
- uMeds Australia Pty Ltd
- Leafio Australia Pty Ltd
- Saged Australia Pty Ltd
- Montu Medical
We will update this Privacy Policy if our information handling practices change.
Key sections of this Privacy Policy
- Laws which require or authorise us to collect your personal information
- Types of personal information we collect
- Who we may collect your personal information from
- How we collect your personal information
- Why we collect your personal information
- Why we use and disclose your personal information
- Who we may disclose your personal information to, and why
- How we hold and secure your personal information
- Your privacy choices
- Contact information
Privacy Policy in full
Laws which require or authorise us to collect your personal information
Some laws require or authorise us to collect, use and disclose personal information. These include:
- Privacy Act 1988 (Cth)
- My Health Records Act 2012 (Cth)
- Privacy laws in some States and Territories
- Health privacy laws in some States and Territories
- Healthcare Identifiers Act 2010 (Cth)
- Migration Act 1958 (Cth)*
- Tax Administration Act 1953 (Cth)
- Superannuation Guarantee (Administration) Act 1992 (Cth)*
*Note: For job candidates only
Types of personal information we collect
The personal information we collect depends on the services we offer you and the circumstances of your interactions with us. The table below lists examples of the types of personal information we collect.
Types of Personal Information
Examples of what personal information this may include
Identity information and contact details
- Full and preferred name
- Date of birth
- Mailing and residential address
- Phone number
- Next of kin
- Emergency contact
Demographic information
- Age
- Gender
- Relationship status and family circumstances
- Whether you have dependents (including children)
- Carer status
Health information (sensitive information)
Includes:
- Symptoms and diagnoses
- Health history, including family health history
- Diagnostic assessment results (physical and psychological)
- Diagnostic imaging reports
- Information in health summaries, discharge summaries, specialist letters and reports
- Information in pathology reports
- Drug and alcohol test results
- Information in correspondence with other healthcare practitioners involved in your care
- Medical therapies, for example, medications, supplements, and information about allied health service engagement such physiotherapy or counselling
- Information from prescriptions, including those issued by non-Alternaleaf health practitioners
- Disability information
- Pregnancy status
- Social and lifestyle factors related to health, for example, diet, exercise, smoking, and recreational activities
- Your status as a patient, including whether you have been discharged and the reason for being discharged
Other sensitive information
Information may include:
- Racial or ethnic origin, or cultural background, such as Aboriginal or Torres Strait Islander status
- Sexual orientation
- Criminal record or supervision requirements. For example, if you are incarcerated or have a Community Corrections Officer assigned to manage your matter
Support information
- Family violence
- Financial distress
- Legal matters, such as, insurance claims, or court matters
Financial information
- Bank account details
- Bankruptcy check*
- Chargeback requests
- Credit/debit card details
*Note: For job candidates only
Australian Government related identifiers
- Australian Health Practitioner Regulation Agency (AHPRA) Registration Number
- Copy of Australian Birth Certificate
- Copy of Australian Citizenship Certificate
- Copy of Australian Passport
- Department of Veterans' Affairs (DVA) number, also known as your Veteran File Number (VFN)
- Driver’s Licence details
- Individual Healthcare Identifier (IHI)
- Medicare Card details
- Pensioner/Healthcare Concession Card details
Employment information
- If you are an Alternaleaf patient, your employment information may be captured in health consultations, including employment status, role, workplace injuries, and any other information you may provide us
- For healthcare practitioners, we may collect the details of the health organisation you work at, including name, address and provider number
- For job applicants, we collect any information you provide to us in the course of recruitment activities, including details of insurance required for your position
Photographs, video or audio recordings and transcripts
Audio or video recordings, photographs, and screenshots you may send us.
Interaction and behavioural information
- Call quality
- Facial expression
- How you communicate from video and audio recordings and transcripts
- Mouse movements
- Voice tone
- Words used
Also see Website and App tracking.
Website and app tracking
- Browser type
- Details of sites visited before visiting our website
- Details of visits to our website or use of our apps and the browsers used
- Device location
- Documents viewed and downloaded
- Links clicked
- Operating system
- Pages visited and the time spent on these pages
- Preferences
- Referring URL
- Search terms
- Server address/IP address
Personal information we create from data analytics activities
- Purchase behaviours (what you are purchasing)
- Order volume (how much you are purchasing)
- Consultation frequency
- Fraud check information. For example, volume of chargebacks
Who we may collect your personal information from
We may collect personal information from:
- You directly, as a patient, customer, job applicant, witness, service provider, or member of the public
- Your family members, carers, nominated emergency contact, next of kin, and those whom you have provided authority for us to collect your personal information from
- Your references, if you are a job applicant
- Our other service providers, such as pharmacies and delivery partners
- Medical professionals and health services, including your community general practitioner or specialist, pharmacy and allied health services
- Australian Government organisations and agencies, and their platforms, such as;
- Australian Digital Health Agency (ADHA), and My Health Record (MHR)
- Australian Financial Security Authority (AFSA)
- Australian Health Practitioner Regulation Agency (AHPRA)
- Department of Home Affairs and their Visa Entitlement Verification Online (VEVO) system
- Federal and State Law Enforcement
- State Fair Trading Departments
- State Healthcare Complaint Commissions
- State Health Departments and their Real Time Prescription Monitoring (RPTM) systems
- State Public Guardian
How we collect your personal information
We collect your personal information in various ways, including:
- When you contact us, or we contact you, via our call centres, chatbot, email, public forums, social media pages or in telehealth consultations
- When you interact with any of our platforms, including to make a booking for your consultation, attend a consultation, or when you use the Alternaleaf or uMeds portal, or or any of our websites
- When you participate in customer satisfaction, marketing, user experience, and clinical research surveys and interviews
- When you interact with our social media pages through your views, comments, likes, and direct messages, or leave us a review on platforms such as Google
- When you submit an application for a job position with us, and participate in recorded interviews
- When you intentionally share your personal experience directly to the public or on public platforms through written submissions, interviews, podcasts, or industry events
- From Linkedin or other similar platforms if we are interested in your job profile
- Using APIs provided by online social media and public forums, such as Reddit
- From surveillance cameras at our premises
- Website analytics tools, cookies, and other tracking technologies
Why we collect your personal information
We endeavour to limit the collection of your personal information to what is reasonably necessary for our business activities and functions. The table below lists the primary purposes for which we collect your personal information and some examples.
To provide healthcare products and services
- Assessing your eligibility for a service, or to participate in any of our programs including the Alternaleaf Concession Program
- Scheduling consultations with Alternaleaf healthcare practitioners
- Contacting you with appointment confirmations, reminders, rescheduling notifications, and in relation to missed consultations
- Conducting audio-visual consultations through our online platform to provide personalised healthcare tailored to individual needs, including issuing you a prescription if appropriate
- Creating a patient file to store your health information
- Corresponding with your GP, specialists, and other treating healthcare providers as necessary to coordinate your medical treatment
- Receiving clinical records, including referrals and health summaries from your GP, specialists, and other treating healthcare providers to ensure continuity and safety of your care
- Providing you with supporting documentation in relation to your treatment, such as a treatment plan, or letters from your prescriber outlining your care
- Conducting wellbeing calls or outreach as necessary to assess the health and safety of individuals
- Contacting emergency services to report serious concerns for the immediate safety or welfare of any person
- Issuing you with an optional digital Alternaleaf Patient Card
To invite you to participate in research studies
Montu conducts research to improve healthcare, and contributes to public health policy discussions.
We may inform you of, and invite you to participate in research studies.
To facilitate the supply of medication
- Receiving prescriptions issued by external health practitioners
- Check whether the medication on your prescription is in stock
- Recommending a pharmacy where your medicine can be dispensed from based on your location
- Providing your script to a preferred pharmacy for dispensing
- Processing your medication orders
- Facilitating the delivery medicine to you, including providing tracking details for your order
To enable our products and services
- Verifying your identity
- Creating and maintaining accurate records of the services we provide
- Summarising and recording notes about your interactions with us
- Processing payments for services, issue refunds, issue invoices, and provide you with receipts and electronic confirmation of payments for services
- Communicating information to provide services to you by phone, email, SMS, and the Alternaleaf patient and uMeds customer portals. For example, communicating updates on the availability of our services.
- Displaying relevant notifications in our Alternaleaf patient and UMeds customer portals.
- Responding to your queries, addressing your comments, complaints and feedback. For example, responding to your queries relating to costs, missed consultations, medication administration, or order status
- Providing product information and education
- Troubleshooting technology issues to help you access our service platforms, including our Alternaleaf patient and uMeds customer portals. For example, assessing your connection to our our platform, and assisting when there are issues during your video consultation
To evaluate and improve the quality of our services
- Evaluating patient/customer experience on our platform and service delivery
- Evaluating treatment outcomes to improve the healthcare services provided to you
- Reviewing recordings and transcripts to evaluate the quality of service provided to you, and to improve training for our practitioners and staff to improve their provision of services to you
To manage dispute resolution and complaints
- Accessing and reviewing personal information subject to the matter to complete our investigation and provide you with a response
- Responding to information requests from regulators or Government authorities in relation to the complaint
- Conducting reviews and generating reports about our complaint management performance
To monitor and investigate fraud, criminal activity, or any other incidents
We monitor and investigate matters where we suspect there is fraudulent or criminal activity. For example:
- We collect information from individuals that allege their payment details have been used to make purchases without their knowledge.
- We may review your interactions with us including purchase history and chargeback requests you have made.
- When you provide a document from another practitioner we may to contact them to verify the validity of the document and the information
To comply with legal and regulatory obligations
To satisfy our reporting, auditing, and record retention obligations
To obtain legal advice or engage in litigation
We may seek legal advice to manage, establish, or defend legal claims
To obtain information about an incident or injury involving staff
In the event you are a witness to an incident or injury involving a person employed by us, your contact information and statement of the incident may be collected for workplace health and safety reporting purposes
To conduct recruitment activities
- Responding to job application or employment opportunity queries
- Identifying and assessing the suitability of applicants for a position
- Contacting applicants to provide progress updates on an application
- Contacting past applicants about new employment opportunities
To assess potential supplier relationships
- Verifying the identity, professional qualifications, credentials, and legal standing of personnel or representatives
- Evaluating and assess suitability before entering into a commercial agreement, contract, or partnership
- Managing the administrative, financial, and legal aspects of any potential or actual contractual relationship with your organisation
Business administration
- Billing and financial auditing
- Conducting internal audits
- Staff training
Why we use and disclose your personal information
While we may use and disclose your personal information for the primary purposes set out in the table above, we may also use personal information for the following secondary purposes.
Providing access to our staff onshore working remotely, or our offshore service provider in the Philippines
We may seek support from offshore partners to support our business activities including:
- Answering and directing your queries
- Assisting you with booking an appointment
- Checking your order status
- Accounts receivable
Preparing medical reports for third parties
If you are an Alternaleaf patient, we may prepare medical reports for third parties, with your explicit consent. For example, a medical report may be requested when you have matters with insurance companies, motor accident authorities, workers’ compensation, and solicitors for other personal matters.
Responding to regulatory inquiries or consultations
We may disclose personal information as part of patient stories when we respond to Government inquiries or consultations.
Conducting research
We conduct research to help evaluate and improve patient outcomes and treatment strategies, and enable future research and trend analysis.
Low risk research conducted by Montu is overseen by the Montu Research Governance Committee, and adheres to the National Health and Medical Research Code for the Responsible Conduct of Research. In the event we conduct high risk research, it will always be referred to an external nationally registered Human Research Ethics Committee (HREC).
We may use your contact details to invite you to participate in research projects from time to time. Consent is specific to each project, and will be obtained prior to enrollment. All projects are approved via the ethical pathways above prior to any invitation.
The OAIC guidance: Research for further information outlines the permitted use of personal information under the Privacy Act for research purposes.
Quality assurance
To check our products and services meet regulatory and internal policy requirements. For example, checking that your identity was verified before disclosing personal information to you.
Direct marketing
We engage in direct marketing using personal information. We may perform data matching exercises of personal information we hold with marketing and advertising service providers deliver marketing across specific online or digital channels, such as social media and other digital platforms such as Google.
Marketing
We may publish reviews you leave on platforms, pages or websites managed by us, such as Google, on our websites.
Obtaining legal advice or engaging in litigation
We may seek legal advice to manage, establish, or defend legal claims
Product development and improving the performance of our services
To guide the development and enhancement of products, services, and features. Examples may include:
- Analysing the performance of our systems, websites, patient/customer portals
- Analysing interactions with features on our websites and portals to enhance functionality and performance
- Personalising individuals’ experiences
- Automating routine tasks
- Analysing behaviour to better understand needs
- Reviewing and updating algorithms or machine learning models. For example, machine learning algorithms help recommend the closest pharmacy to you or check that the medication on your prescription is in stock.
- Sending you a reward for providing feedback as part of piloting services.
Who we may disclose your personal information to, and why
Who we disclose your personal information to will depend on our relationship with you and the purposes for which we collected your personal information. In some circumstances, the entities we share information with may also share your personal information with other entities they do business with. The table below describes who we may share your personal information with and why.
Within the Montu Group of companies
We may share your personal information within the Montu group or related companies for the purposes outlined in this policy.
A person or entity authorised by you
You may authorise us to disclose personal information we hold about you to an individual or entity as deemed necessary by you. For example, your legal representative.
Your treating healthcare providers
We may disclose your personal information to your treating healthcare providers to ensure continuity and safety of your care. For example, your community GP, specialist practitioner, or treating doctor at a hospital.
Pharmacies
We share your personal information with pharmacies in our trusted network, and as appointed by you, to dispense your prescribed medicine
Parcel delivery services
We share your personal information with parcel delivery services to facilitate the delivery of your order to your nominated address and provide you with parcel tracking information
Federal or state regulatory authorities, law enforcement, and other government entities
We may disclose personal information where we are required or authorised by or under Australian law to do so. For example when we respond to a subpoena, Notice to produce information, or court order, to comply with a regulatory requirement, or to report fraudulent activity.
Government entities could include:
- Australian Digital Health Agency (ADHA)
- Australian Health Practitioner Regulation Agency (AHPRA)
- Australian Legislative Inquiry Bodies
- Federal and State Law Enforcement agencies
- Therapeutic Goods Administration (TGA)
- State Child Protection Services
- State Corrective Services
- State Health Departments
- State Public Guardian
Dispute resolution organisations
We may be required to produce personal information to complaint resolution entities, such as:
- State Fair Trading authorities
- NSW Health Care Complaints Commission (HCCC)
- Information and Privacy Commission NSW
- Office of the Australian Information Commissioner (OAIC)
- Office of the Victorian Information Commissioner (OVIC)
- Victorian Health Complaints Commissioner (HCC)
Public policy organisations
We may share personal information in patient stories with industry associations or patient advocacy groups.
Emergency services
We may call emergency services when we interact with a person and consider disclosure necessary to ensure the safety of an individual or other members of the public.
Social media services, language models, browsers
We use social media services. Comments on public posts, direct messages sent to us, or interactions on our website(s) or portals may be disclosed to social media companies. Any public information may be collected by organisations with language learning models. Your personal information can also be collected by browsers, including AI-powered browsers if you use these when interacting with us.
Social media services have their own privacy policies that you can access below.
Australian Digital Health Agency (My Health Record)
When an Alternaleaf clinician accesses your My Health Record (MHR) in the course of providing clinical care, details of when and what pages the clinician accessed will be recorded automatically by the MHR system.
Technology and IT infrastructure providers
To enable us to provide our services
- Cloud computing service providers
- Consultation scheduling service platform to book consultations with Alternaleaf healthcare practitioners
- Customer communication service platforms
- Order management platforms, for example, Shopify
- Recruitment platform to manage our talent recruitment activities
- Reward and survey service providers
- Your selected wallet provider for your digital Alternaleaf Patient Card
Information we disclose to overseas recipients
We may use, store and disclose your personal information to our Montu Group entities and other related parties, and contracted service providers for services such as software development, communication networks, and data storage located outside Australia.
These locations include:
- Belgium
- Canada
- France
- Germany
- Luxembourg
- New Zealand
- Philippines
- Poland
- Republic of Ireland
- United Kingdom
- United States of America
We will take all reasonable steps to ensure this information is handled in compliance with the APPs.
Where personal information has been disclosed overseas or stored in Australia by a third party with headquarters overseas, there is a possibility the recipient may be required to disclose personal information under a foreign law. When this occurs, such disclosure is not a breach of the Privacy Act. View the OAIC guidance: Overseas acts or practices required by a foreign law (8.64-8.68) for further information.
How we hold and secure your personal information
Holding your information
We hold your personal information in systems which may be on premises or in cloud-based servers, in data warehouses, in data lakes, on devices, and in hard copy files.
Once we determine that your personal information is no longer needed for any legal record keeping purpose, we take reasonable steps to securely delete or permanently deidentify the information.
Type of information: Health Information
Retention period: 7 years from the date of last entry in your record, unless legally required to be held for longer.
Type of information: Recordings and transcripts of telehealth consultations (Audio and Video calls)
Retention period:
- Recordings: 14 days from the date of the consultation
- Transcript: 7 years from the date of your last consultation, unless legally required to be held for longer.
We store the transcript in split and de-identified form for seven years after you have been discharged, and for as long as you are a patient of ours. Split form means a new record is created every time you or our clinician speak and means your transcript is not readily available in its full form.
Securing your information
We take reasonable steps to protect your personal information from misuse, loss, interference and unauthorised access, modification, or disclosure. We may use a combination of organisational and technical safeguards, which may include where appropriate:
- Deleting personal information when it is no longer required. For example, we delete (some) call recordings once no longer required.
- Store data in de-identified form where appropriate. For example, transcripts may be split and de-identified so that even if someone does access it, it is not reasonably identifiable
- Store data in a perturbed form. For example, if you call our whistleblower hotline, your voice will be perturbed so that you are not easily identifiable
- Restricting and monitoring access to personal information we hold
- Having stand-by systems and information backups in place to deal with major business interruptions
- Data loss prevention tools
- Maintaining information security products such as system firewalls, and encryption tools.
- Implementing risk management processes to maintain policies, standards and procedures that govern and control the protection of your personal information
- Reviewing of our information management systems and practices
- Assessing third-party security measures
- Providing staff training
- Putting in place legal contracts with third parties and related Montu entities.
Your privacy choices
How to request access or correction to your personal information
You can request access to and correction of the personal information we hold about you. You can make this request by using the contact details provided below. We will aim to respond to your request within 30 days. In most cases, there is no charge for this service.
We may refuse your request in some circumstances, in which case we will provide a written statement of the reasons for refusal.
You will be required to show that you are authorised to make a request, including if you are acting on behalf of someone else or otherwise have legal authority to request this information.
How to make a privacy complaint
If you think we have not handled your personal information correctly or in accordance with the law, you can lodge a complaint with us, or the Office of the Australian Information Commissioner (OAIC) using the contact information provided below.
We recommend you contact us first so we can try and resolve your complaint effectively and efficiently as generally, the OAIC will refer you back to us if you have not already complained directly to us.
How to control who can access your My Health Record (MHR)
Information on how to manage access to your MHR is available using the following link: Privacy and access - My Health Record
How to manage cookies and ads
We use Google Analytics as a website analytics tool to collect data about how you interact with our websites. Google Analytics collects information using cookies. View the Google Analytics Privacy Policy.
You can manage your cookie preferences through your web browser settings. Here are instructions for the main browsers:
We use various advertising platforms for our online advertising. The following links provide information on how to control the ads you see and the information that can be used to personalise them:
- Google Ads: Google Marketing Platform opt-out page
- Facebook Ads (Meta): Ad Preferences | Facebook Help Center
- Instagram Ads (Meta): Manage Instagram ads
- Linkedin Ads: Linkedin Controls
- Twitter (X) Ads: X account personalisation
- TikTok Ads: Privacy Center - Ads and Your Data | TikTok
How to unsubscribe from marketing
You can opt-out of receiving advertising communications from us via the “unsubscribe” function in any SMS or email marketing communications to you, or by contacting us using the contact information provided below.
Contact information
Contact us
Expected behaviour standards when engaging with Alternaleaf and uMeds
We are committed to providing a safe environment for our patients, customers, staff, and suppliers we work with to provide services to you. Abusive or threatening language or behaviour on our platforms will not be tolerated. The expected standards of behaviour are outlined in the Terms and Conditions on each website.
If, following a formal warning, conduct outside the expected behaviour standards persists, we reserve the right to restrict access to realtime channels, like phone calls. You can contact us via our chat bot (where available) and by email.
View the Alternaleaf Terms & Conditions and uMeds Terms & Conditions
Alternaleaf
Operated by Alternaleaf Australia Pty Ltd
How to contact the Patient Support Team:
- Complete our online form: Submit a request – Alternaleaf.
- Message us: Use the chat icon located on the bottom right corner of the Alternaleaf Help Centre to start a direct messaging conversation with our support team. Alternatively, you can log in to your Alternaleaf Patient Portal to use our messaging service. Messaging services are available Monday to Friday, from 8am to 9pm.
- Call us: 1800 864 878 (Available Monday to Friday from 9am to 9pm)
uMEDs
Operated by uMeds Australia Pty Ltd
How to contact the Customer Support Team:
- Complete our online form: Submit a request – uMeds.
- Messaging us: Use the chat icon located at the bottom right hand corner of the uMeds Help Centre to start a direct messaging conversation with our support team. Alternatively, you can log in to your Patient Portal to use our messaging service. Messaging services are available Monday to Friday, from 8am to 9pm.
- Call us: 1800 956 286 (Available Monday to Friday from 9am to 9pm)
Leafio
Operated by Montu Group Pty Ltd
- Complete this form: Contact Us – Leafio
- Call us: 03 7003 8214 (Available Monday to Friday, 9am - 5pm AEST)
SAGED
Operated by Montu Group Pty Ltd
How to contact Saged Customer Support:
- Complete this online form: Contact – SAGED
Montu Medical
Operated by Montu Group Pty Ltd
How to contact Customer Support:
- Login to Montu Medical at the top of our website
Montu
Operated by Montu Group Pty Ltd
Montu Careers: careers@montu.com.au
Contact details for external resolution bodies
Health Care Complaints Commission New South Wales, Australia
Complaints can be made on the Health Care Complaints Commission Portal.
Health Complaints Commissioner Victoria, Australia
Complaints can be made by phone or by completing an online form. Contact details can be found on the Make A Complaint website.
Human Rights Commission Australian Capital Territory, Australia
Complaints to the Human Rights Commission can be made by completing an online form on the Health Service - HRC website.
Office of the Australian Information Commissioner (OAIC)
Complaints must be made in writing and cannot be made over the phone. Refer to the Lodge a privacy complaint with us web page to access the relevant digital and hard copy complaints forms.
You must attempt resolution with us before making a complaint to the OAIC.
Sending us legal documents and correspondence
We accept service of legal notices or correspondence via our electronic contact channels for each business. We ask that you notify us by email if you intend to send documents to our registered address. Acknowledgement and processing periods will be typically longer for documents received through conventional mail. The registered address for Montu Group and its wholly owned subsidiaries and businesses is Level 18/1 Nicholson St, East Melbourne VIC 3002.
Quick links