This policy explains how Fig Health Australia Pty Ltd ("FIG") handles personal and health information when you use usefig.com, the FIG patient portal or the FIG app for iOS and Android, or when you contact the FIG care team.

Last updated: 17 October 2026.

FIG may handle:

• contact and account details, such as your name, email address, phone number and date of birth;

• assessment and health information, such as your quiz answers, check-ins, weight and side-effect reports;

• identity and Medicare or IHI details;

• consultation, prescription and care-plan records;

• order, subscription, payment status and purchase history;

• messages with the care team and support communications;

• security and audit records, such as sign-in history.

Payment card details are handled by FIG's payment provider and are not stored by FIG.

FIG uses information to:

• assess eligibility and provide and administer care;

• secure accounts;

• fulfil orders and process payments;

• send service updates;

• meet legal obligations;

• improve the service.

FIG shares information only where needed: with the practitioners treating you, with pharmacy and prescribing partners, with the service providers listed below, and with regulators when the law requires it. Staff access is limited by role and recorded in FIG's audit systems. FIG does not sell your information, and does not use your health information for advertising.

The FIG app for iOS and Android is for existing FIG patients. You can't create an account or buy a service in the app.

What the app collects

• Signing in. Your email address. FIG emails you a one-time sign-in link and code, then sends a 6-digit security code by email, or by SMS if FIG uses SMS for your account. Sign in with Apple and Continue with Google only find your existing FIG account by its verified email address.

• Your care. The health information you enter: check-ins, weight and progress entries, side-effect reports, repeat prescription requests and consultation bookings.

• Messages. The messages you send to your care team.

• Notifications. If you allow notifications, a notification token, your reminder preferences (such as check-in and injection reminder times) and a random installation ID. FIG uses these to send notifications to the right phone and to stop them when you sign out.

• App usage. To improve the app, FIG records which screens you open and when you finish actions such as signing in, completing a check-in or sending a message, with the app version, language and phone type. These records never include what you type or enter.

What stays on your phone

• Calendar. If you add a consultation to your calendar, the app finds your default calendar and adds the event. It doesn't read your existing events, and doesn't send calendar information to FIG.

• Sign-in tokens are kept in your phone's secure storage.

What this version of the app does not do

• It doesn't connect to Apple Health or Health Connect, and reads no data from them.

• It doesn't use your camera, photo library or microphone.

• It doesn't use Face ID, Touch ID or fingerprint unlock.

FIG will update this policy before any of these are added, and will explain what data is read, which permissions are asked for, how it's used and how to disconnect.

• Cookies. usefig.com uses cookies and similar technologies to keep the site working, remember your choices, and measure visits and sign-ups, including through FIG's own analytics and Google Tag Manager. When the website shows a cookie banner, you can choose Only essential. You can also block or delete cookies in your browser settings.

• Measuring FIG's ads. FIG measures how its ads perform by sending limited information about website visits and sign-ups to advertising platforms, such as Meta, Google and TikTok, through FIG's own server. FIG never sends your quiz answers, health information or clinical details to them.

• The app doesn't use cookies and doesn't track you for advertising.

FIG stores your information in its own systems, hosted in Australia (Sydney). FIG uses trusted service providers to run the service:

• cloud hosting and transactional email, in Australia;

• an SMS provider, to send security codes and reminders;

• a payment provider, for card payments;

• Apple and Google, for Sign in with Apple, Continue with Google and delivering notifications to your phone;

• a mobile app platform provider, to send notifications and deliver app updates;

• an analytics provider, for the app usage records described above;

• advertising platforms, for measuring FIG's ads on the website only;

• pharmacy, prescribing and clinical-record partners, for your care.

Some of these providers may process limited information outside Australia, including in the United States. This includes notification tokens, device information, app usage records, website measurement data and the phone number a message is sent to. FIG requires its service providers to protect your information to the same standard as this policy and as Australian privacy law requires.

• Service messages. FIG sends account, security, booking, billing and care-related messages by email and SMS. Clinical details are never put in an ordinary email or SMS: FIG asks you to sign in to read them.

• Your phone number is used only for security codes, reminders and service messages, never for marketing.

• Marketing. FIG may send marketing by email if you agreed to it. You can unsubscribe at any time from the link in the email, or in your account settings. You will still get essential account, security, billing and care messages.

FIG protects your information as follows:

• information is encrypted in transit between your phone or browser and FIG;

• sensitive details are stored encrypted;

• staff access is limited by role, and access to patient records is recorded;

• health information is kept separate from marketing systems;

• staff sign in with a second security step.

How long FIG keeps information. Health records about your care, including consultation and prescribing records, are kept for at least 7 years after your last consultation. If they were collected when you were under 18, they are kept until you turn 25, if that is later. Australian health-record laws require this. FIG deletes or de-identifies other information when it is no longer needed, unless the law requires FIG to keep it, for example for tax or fraud prevention.

How to delete your account and data:

• In the app: go to Profile, then Your data, then Delete account and data.

• On the web: sign in at usefig.com and go to Patient portal, then Data and privacy, then Right to be Forgotten.

• By email: write to hello@usefig.com from the email address on your account.

What happens next. FIG confirms your request. It then closes your account and deletes or de-identifies your non-clinical information, such as contact and marketing details, from its active systems within 30 days. Health records are kept for the periods above, and then deleted or de-identified.

Withdrawing consent. You can turn off notifications in your phone's settings, unsubscribe from marketing at any time, and sign out to stop the app's notifications.

• Access and correction. You can ask to see or correct your information through the secure patient portal, or by emailing hello@usefig.com.

• Complaints. If you have a privacy concern, email hello@usefig.com. FIG will reply within 30 days. If you are not satisfied with the reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

• Contact. Fig Health Australia Pty Ltd, hello@usefig.com.

FIG handles Australian records in line with the Privacy Act 1988 (including the Australian Privacy Principles) and applicable health-record laws. If this policy changes, FIG will update it here and show the new date at the top.