POS Spark makes check-in, booking and dispensary workflow software for Australian community pharmacies. Pharmacies use it to handle prescriptions and health information, so we take privacy seriously. This policy explains what personal information POS Spark handles, why, and the choices you have. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we treat all health information as sensitive information.
Who we are
In this policy, "POS Spark", "we" and "us" means POS Spark, operated by Marcus Nguyen, Gold Coast, Queensland, Australia. You can contact us about privacy at contact@posspark.com or on 0466 598 617.
Our role and the pharmacy's role
When a patient uses a POS Spark kiosk, app or booking page, they are dealing with their pharmacy. The pharmacy decides what information it collects and is responsible for its own patient records under its own privacy policy. POS Spark provides the software and handles that information only on the pharmacy's behalf and on its instructions.
We are directly responsible for the information we collect for our own business, such as pharmacy customer accounts, support requests and enquiries through this website.
What we collect
Patients using POS Spark at a pharmacy. Depending on what the pharmacy uses, this can include:
- name, mobile number, and date of birth where the pharmacy asks for it;
- eScript tokens and images or scans of paper prescriptions;
- whether the patient is waiting in store or collecting later;
- consult bookings: the service booked, date and time, and the answers to any screening questions the pharmacy asks;
- pharmacy key fob numbers, if the patient is given a fob;
- in the patient app, account details and any loyalty or rewards card number the patient adds.
Pharmacies and their staff. Business name and address, contact names, email addresses, phone numbers, billing details, staff logins, and records of actions taken in our software.
Devices. Technical information about the computers running POS Spark, such as software versions, error codes and whether a kiosk, printer or scanner is working. This doesn't include patient details.
Website visitors. What you choose to send us through the demo request or by email or phone.
We collect information directly from the person or from the pharmacy using our software. We don't buy personal information, and we only collect what the software needs to do its job.
How we use it
- to deliver the service the pharmacy has asked for, such as passing a check-in to the dispensary, showing a patient's name on the waiting-room screen, or confirming a booking;
- to provide support, fix problems, and keep the software secure and up to date;
- to manage licences, billing and our relationship with each pharmacy;
- to reply to enquiries and demo requests.
We do not sell personal information. We do not use patient or health information for marketing, advertising or profiling, and we do not use it to train artificial intelligence models.
eScripts and prescriptions
An eScript token is the QR code or link a patient receives from their prescriber. POS Spark reads the token only to pass it to the pharmacy chosen by the patient, so the pharmacy can dispense through its own dispensing system and the national prescription delivery service. Tokens and prescription images are kept on the pharmacy's own network and only for as long as the pharmacy needs to finish dispensing. We do not use prescription information for any other purpose.
Who we share it with
We share personal information only:
- with the pharmacy the patient chose to deal with;
- with service providers who help us run POS Spark, such as hosting, email and SMS providers, under contracts that require them to protect it and use it only for us;
- with an IT provider authorised by the pharmacy to install or support POS Spark at that pharmacy;
- where the law requires or allows it, for example to lessen a serious threat to someone's life, health or safety.
Storage and overseas disclosure
Most patient information stays on computers inside the pharmacy. Information held by POS Spark Cloud, such as pharmacy accounts, licences, fob numbers and device health reports, is stored in Australia wherever we can arrange it. Online booking requests pass through POS Spark Cloud to the pharmacy and are not stored by the cloud.
Some of our service providers, such as our website host and email provider, may store or process information outside Australia, including in the United States. Where this happens we take reasonable steps to make sure they protect it in line with the Australian Privacy Principles.
Security
We protect information with measures that include:
- encrypted connections between kiosks, screens and the pharmacy's Store Server, limited to the pharmacy's private network;
- encryption of sensitive records stored by our software, including the link between a fob and a patient;
- passwords and two-step sign-in for administrator access, with sign-in lockouts and activity logs;
- signed software updates, so a kiosk only installs updates that genuinely come from us;
- remote support that only starts after a staff member approves it on screen, times out automatically and is logged.
No system is perfectly secure, but we review our security as the software changes and fix problems quickly.
How long we keep it
We keep personal information only as long as we need it for the purposes above or as the law requires. Pharmacies control how long their own patient records are kept. When information is no longer needed we delete it or make it permanently de-identified.
Access and correction
You can ask for access to the personal information we hold about you, or ask us to correct it. Patients will usually get the quickest answer from their pharmacy, since the pharmacy holds their records. If you contact us, we'll help or pass your request to the right pharmacy. We'll reply within 30 days, and we won't charge you to make a request.
Data breaches
If we become aware of a data breach that is likely to cause serious harm, we will act quickly to contain it, tell the affected pharmacies, and notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Our website
This website doesn't use advertising or tracking cookies. Our host may keep standard server logs, such as IP addresses and the pages requested, for security and to keep the site running. The demo request form opens your own email app, so what you send reaches us as an ordinary email.
Questions and complaints
If you have a question or complaint about how we handle personal information, contact us at contact@posspark.com or 0466 598 617. We'll reply within 30 days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
We may update this policy as POS Spark changes. The latest version is always on this page, with the date it was last updated.