This privacy notice explains how the Eucalyptus group of companies (“Eucalyptus”, “we”, “us”) collects, uses, shares and protects personal data when you use our websites, apps, and offerings, including our telehealth and healthcare-related services and communities.
Eucalyptus provides consumer services through brands such as Juniper, Pilot, Kin, and Software (and related websites/apps). Responsibility for your personal data within the Eucalyptus group may vary based on your location and the specific service you use.
Annex A contains regional requirements that modify or add to this notice for Australia, United Kingdom, EEA, Japan and Canada. Annex B lists the responsible entities (i.e. data controllers) and the services they manage (see Annex C for contact information).
This notice applies to a broad range of individuals, including our customers and users (including those who begin but do not complete our online questionnaires or onboarding processes), anyone who contacts us and/or anyone with an established business relationship with us.
It applies when you:
Some healthcare professionals or service providers you interact with through our services may operate as separate and independent controllers of your personal data. They will have their own privacy processes and practices when handling your personal data.
The personal data we collect depends on your relationship with us and the services you use. It can include:
We collect personal data from:
If we collect personal data about you from a third party, we may ask the third party (where appropriate) to inform you that we hold the information and how it will be used and disclosed.
We use personal data for various purposes, including those summarised below:
When required by law, we rely on appropriate lawful bases to process your information, such as:
If necessary, we may also rely on an appropriate additional condition to process sensitive or special category data. For example, to provide health or social care services, or where necessary for employment, social security or social protection law purposes.
We may share personal data with:
We and our service providers may store or process personal data in countries other than where you live. This includes access by our international operational support and service delivery staff in South Africa and Philippines.
Where applicable law requires additional safeguards, we use appropriate technical and organisational measures to provide an adequate level of protection to the processing of your personal data.
Further region-specific information is in Annex A.
Some calls, chats or consultations may be recorded or transcribed for purposes such as:
Where recording is optional and you do not want a recording to be kept, tell us (or the clinician) at the start of the call/consultation and we will handle this in line with the service and legal requirements.
If we request identity verification using a photo ID, you may be able to obscure non-essential details (for example, covering your licence number) unless we need the full image for a specific legal or safety reason.
We use cookies, SDKs, pixels and similar technologies (collectively “cookies”) to:
Online advertising may involve:
Where required by law, we will obtain consent before placing non-essential cookies and you can manage preferences using our cookie banners/settings or your device or browser.
We may use AI-enabled tools (including large language models) to support and improve our services, for example to:
These tools may process the content you provide (such as messages you send us). We use access controls and contractual measures intended to protect personal data, and we limit use to the purposes described in this notice and applicable law.
We may also use a limited amount of de-identified personal data to train internal AI tools so we can:
Where we use personal data for AI training and evaluation we:
AI features are designed to support services and are not a substitute for professional medical advice.
Where an AI feature is used in a way that may materially affect you, we include appropriate human oversight and routes to contact us.
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. This includes access controls, security monitoring and controls over suppliers.
If you suspect unauthorised activity on your account, contact us using the details in Annex C.
We keep personal data for as long as needed to:
Retention periods vary based on the type of data, the service you use and applicable legal requirements.
Where we no longer need personal data, we delete or de-identify it in accordance with applicable law and operational constraints.
Depending on where you live, you may have rights to:
We may need to verify your identity before processing a rights request. We may also refuse requests or apply exemptions where permitted by law, and we will explain why where required.
Region-specific rights and processes are set out in Annex A.
For privacy enquiries, complaints, or to exercise your rights, contact the privacy team using the details in Annex B.
For customer service queries (such as cancellations or subscription support), use the customer support contact for your brand and country (also listed in Annex B where available).
We may update this notice from time to time. If changes are material, we will take reasonable steps to notify you (for example via the website, app or email). We also encourage you to check periodically for the latest version.
This annex contains regional requirements that modify or add to the above notice.
Where there is any conflict between the above notice and these regional requirements, the regional requirements prevail.
In Australia, “personal data” in this notice corresponds to “personal information” under the Privacy Act 1988 (Cth). “Special category data” generally corresponds to “sensitive information” (including health information).
Where permitted, our direct marketing may include telephone calls to numbers you provide, generally between 9am and 8pm AEST on business days.
When we disclose personal data to overseas recipients, we take reasonable steps to ensure the recipient handles the personal data in a manner consistent with the Australian Privacy Principles (APP).
In exceptional cases, we may ask you to consent to an overseas disclosure where APP 8.1 does not apply. If you do, you acknowledge that the overseas recipient may not be bound by the APPs and you may not be able to seek redress under the Privacy Act.
We may ask you to verify your identity before providing access or making corrections.
We may recover reasonable costs of providing access.
If we refuse a correction request because we do not agree a change is required, we will explain why.
If you have concerns regarding our processing activities or are not satisfied with our response to your privacy requests/concerns, you can complain to the Office of the Australian Information Commissioner (OAIC):
Where healthcare services are provided through Juniper-branded platforms, the service is regulated by the Care Quality Commission (CQC) and our pharmacy service is registered with the General Pharmaceutical Council (GPhC).
We meet NHS Data Security and Protection Toolkit (DSPT) requirements (organisation code O6P4Y).
Where appropriate for your care, our clinicians and/or pharmacy professionals may access your NHS Summary Care Record (SCR) to support safe prescribing and clinical decision-making. Your SCR is a summary drawn from your GP record and typically includes your current medicines, allergies, previous adverse reactions, and may also include additional clinical information such as significant medical history, immunisations, care plan information, and communication needs.
Before we access your NHS SCR, we will normally ask for your permission to view it a) at the point of care or b) by asking for extended permission to view on an ongoing basis. If you are unable to give permission, an authorised clinician or pharmacy professional may access the record where it is in your best interests. Access is role-based, limited to those involved in your care, and is logged and auditable.
Your GP practice remains the data controller for your GP medical record. If you want to exercise your data protection rights in relation to your GP record, you should contact your GP practice. Your GP practice can also help with your NHS SCR preferences (including opting out).
We are the data controller for any SNOMED-coded information we create or add to our records following access to your NHS SCR. You can also ask us for a record of who has accessed your NHS SCR.
For more information about NHS SCR, please visit NHS Digital’s Information of Patients webpage.
When we transfer personal data outside the UK, we rely on UK adequacy regulations to freely transfer the personal data or other recognised safeguards to ensure a sufficient level of protection, including UK International Data Transfer Agreements (IDTA) or European Commission standard contractual clauses with the UK addendum.
We facilitate diagnostic and pathology services (such as blood testing) via third-party partners, including Randox Laboratories Ltd and Thriva Limited.
These services necessitate the collection and processing of your personal data, including Special Category Data (health history, biological samples, and test results), for analysis, interpretation, and clinical decision-making.
Biological samples may be provided in-clinic or using at-home testing kits.
For the data shared in connection with these services, we and the testing provider act as separate and independent data controllers, and the testing provider will handle your information according to their own privacy notices (linked below)
Randox: https://www.randox.com/privacy-and-cookies
Thriva: https://thriva.co/privacy-policy
We normally respond to rights requests within 30 days (subject to permitted extensions).
If you have concerns regarding our processing activities or are not satisfied with our response to your privacy requests/concerns, you can complain to the Information Commissioner’s Office (ICO) - https://ico.org.uk/
When we transfer personal data outside the EEA, we rely on the European Commission’s adequacy decisions to freely transfer the personal data or other recognised safeguards to ensure a sufficient level of protection, including standard contractual clauses.
We normally respond to rights requests within 30 days (subject to permitted extensions).
If you have concerns regarding our processing activities or are not satisfied with our response to your privacy requests/concerns, you can complain to your local supervisory authority:
https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html
https://www.autoriteitpersoonsgegevens.nl
By acknowledging this notice and using our services, you consent to our acquisition and use of your special care-required personal information (health data) as described in the Eucalyptus Privacy Notice and this regional annex.
Where our Japanese services are provided, we handle personal data in accordance with Japan’s Act on the Protection of Personal Information (APPI).
We do not provide personal data to third parties without your prior consent unless an APPI exception applies (e.g. required by law; necessary to protect life, body or property; public health; cooperation with authorities; or other permitted cases).
Where necessary to provide services, we may also share personal data with affiliated medical institutions, and you consent to this sharing by acknowledging this notice and using our services.
We may jointly use personal data as follows:
By acknowledging this notice and using our services, you consent to receiving marketing or promotional information by email, SMS, etc (you can opt out at any time).
We may receive information about advertisements you clicked (such as click date and where the advertisement was shown) from third-party tools and compare it with order information to measure effectiveness.
While we manage the platform and your account, the healthcare practitioners you consult with are separate and independent data controllers responsible for your medical record and clinical care. They process your personal health information in accordance with their own professional and legal obligations.
Where Canadian privacy laws apply, you can request access to and correction of your personal data.
We normally respond to rights requests within 30 days (subject to permitted extensions).
If you have concerns regarding our processing activities or are not satisfied with our response to your privacy requests/concerns, you can complain to the Office of the Privacy Commissioner of Canada (OPC) or the relevant provincial regulator, where applicable:
This annex lists the responsible entities (i.e. data controllers) and the services they manage in relation to the processing of personal data.
This annex lists the contact information for each region. For general privacy queries, you can also contact privacy@eucalyptus.vc