About this policy

1.1 This Privacy Policy explains how the FxGroup companies collect, use, hold, disclose and protect personal information. “FxGroup”, “we”, “us” or “our” means the FxGroup company you are dealing with for a particular interaction, account or order (the “relevant company”), as identified on the website, form, invoice or correspondence concerned. This policy applies to: 

RN Labs Pty Ltd, a company incorporated in Australia (ABN: 57 154 338 226), trading as RN Labs. 

1.2 We comply with the New Zealand Privacy Act 2020 (including the Information Privacy Principles) where the relevant company is a New Zealand company, and the Australian Privacy Act 1988 (Cth) (including the Australian Privacy Principles) where the relevant company is an Australian company. Where we operate across both countries, we apply the standard that gives your information the greater protection. 

2. How this policy is organised 
 Most of this policy applies to everyone we deal with — practitioners, patients, retailers, website visitors, account holders and guarantors. 

3. What personal information we collect 

Depending on how you interact with us, we may collect: 

• Identity and contact details — name, business/clinic name, email, phone, delivery and billing addresses; 

• Account and professional details — for practitioners, qualifications, association membership and registration evidence; for retailers, business and trade details; 

• Order and transaction information — products and services ordered, order history, correspondence; 

• Payment and credit information — payment details, and (where you apply for credit) creditworthiness and guarantor information (see Section 6); 

• Communications — records of your contact with us, including phone calls, emails and chat, which may be recorded, transcribed or summarised for support, training and quality assurance; 

• Technical and website information — device, browser and usage data, and cookies 

For our practitioner services only, we also collect health and patient information as described in Section 11. 

4. How we collect personal information 

4.1 We collect personal information directly from you when you contact us, register an account, place an order, submit a sample, or use our websites and platforms. 

4.2 We also collect information from third parties where you have authorised it or where it is publicly available, including credit reporting agencies, professional associations (to verify practitioner status), and our service providers. 

4.3 Indirect collection of patient information. For our practitioner services, we often collect a patient’s information from their practitioner rather than from the patient directly. Where we do, we and the practitioner take reasonable steps to ensure the patient is made aware of the collection and of the matters in this policy, consistent with Information Privacy Principle 3A of the New Zealand Privacy Act 2020 and Australian Privacy Principle 5. Under our practitioner terms, the practitioner confirms they have informed the patient and obtained the necessary consents (see Section 11). 

5. Why we collect and how we use personal information 

We use personal information to: 

• provide, process and deliver our products, testing services and platforms; 

• manage accounts, payments, credit and debt recovery; 

• provide customer support and respond to enquiries and complaints; 

• verify practitioner eligibility and meet regulatory obligations; 

• operate, secure, analyse and improve our services and business, including through AI and automated tools (see Section 7); 

• communicate with you, including marketing where permitted (see Section 10); and 

• comply with our legal obligations. 

We use personal information for the purpose for which it was collected, for directly related purposes you would reasonably expect, and otherwise with your consent or as permitted by law. 

6. Credit information 

6.1 Where you apply for a credit account, you and any guarantor authorise us to collect, hold, use and disclose information about you to assess creditworthiness, to obtain or provide a credit reference, for debt collection, and to notify default — including to and from credit providers and credit reporting agencies. Where you are an individual, these are authorisations and consents for the purposes of applicable privacy law. 

7. Use of AI and automated processing 

7.1 AI is part of how we operate. We use artificial intelligence, machine learning and automated data-analysis tools, including tools provided by third parties and offshore processing partners (“AI Tools”), as an integral part of how we deliver, support and improve our services. Uses include customer support; order, account and logistics processing; demand forecasting; fraud prevention; quality assurance; analytics; and — for our practitioner services — supporting the analysis and interpretation of functional test results and preparing draft reports for practitioner review. 

7.2 Integral to our services. Our services are provided on the basis that AI Tools form part of their delivery. We do not offer a version of our services that excludes AI-assisted processing. 

7.3 Human oversight. AI Tools support our decision-making; they do not replace it. We do not use AI Tools to make solely automated decisions that produce legal or similarly significant effects on an individual without human involvement. For practitioner services, the prescribing practitioner is always responsible for clinical decisions and for reviewing any AI-assisted output before relying on it; AI outputs are not medical advice and not a diagnosis. 

7.4 Safeguards. Wherever practicable, we de-identify or anonymise personal information before it is processed by an AI Tool, and we do not input identifiable personal or sensitive information into publicly accessible AI systems (such as the public versions of consumer generative-AI tools). Where AI Tools are provided by third parties, we require by contract that they protect personal information and do not use it to train or improve their own underlying models. Information generated or inferred about an individual by an AI Tool is treated by us as personal information. 

7.5 We keep our AI practices under review as technology and the law evolve, including the automated decision-making transparency provisions commencing under the Australian Privacy Principles on 10 December 2026. 

8. When we disclose personal information 

We may disclose personal information to: 

• service providers who help us operate, including IT, hosting, payment, logistics, communications, analytics and AI providers, and (for practitioner services) testing laboratories; 

• credit providers and credit reporting agencies (see Section 6); 

• professional associations and regulators, where necessary to verify status or meet legal obligations; 

• other FxGroup companies, for the purposes described in this policy; 

• a buyer or successor in connection with a sale or restructure of our business; and 

• others where required or permitted by law, or with your consent. 

We require our service providers to protect personal information and to use it only for the purposes for which we engage them. 

9. Sending information overseas 

9.1 Some of our service providers, laboratories and AI Tools are located outside New Zealand and Australia, including in the United States. This means your personal information may be stored or processed overseas. 

9.2 Before disclosing personal information overseas, we take reasonable steps to ensure the recipient protects it to a standard consistent with the New Zealand Privacy Act 2020 (Information Privacy Principle 12) or the Australian Privacy Act 1988 (Australian Privacy Principle 8), as applicable, including through contractual protections. 

10. Marketing and your choices 

10.1 We may send you marketing about our products and services where the law allows. You can opt out at any time using the unsubscribe link in our messages or by contacting us. Opting out of marketing does not affect processing that is necessary to provide our services to you. 

11. Health and patient information 

11.1 Sensitive information. Health information is “sensitive information” under Australian law and is subject to additional protection under New Zealand law. We collect and use it only to provide and support testing and clinical products, with consent or as otherwise permitted by law. 

11.2 Collection through practitioners. Patient health information is generally provided to us by, or through, the patient’s practitioner. Under our practitioner terms, the practitioner confirms that they have a genuine practitioner-patient relationship, are authorised to act for the patient, have informed the patient about the processing described in this policy (including AI-assisted and offshore processing), and have obtained the consents necessary for it. 

11.3 Test results. We release test results only to the ordering practitioner, or to an alternate practitioner with the patient’s written authorisation. We do not provide results, clinical interpretation or healthcare advice directly to patients. 

11.4 AI-assisted interpretation. As described in Section 7, we may use AI Tools to support the analysis and interpretation of test results. This is always subject to the prescribing practitioner’s independent review, and is not a solely automated decision and not a diagnosis. 

11.5 Offshore laboratory and AI processing. Samples and related information may be processed by laboratories and AI Tools located overseas, as described in Section 9. 

12. Storing, securing and retaining your information 

12.1 We take reasonable steps to protect personal information from loss, misuse and unauthorised access, use or disclosure, including access controls, encryption in transit and at rest where appropriate, and contractual protections with service providers. No system is completely secure, and information provided over the internet is provided at your own risk. 

12.2 We keep personal information only for as long as needed for the purposes described in this policy or as required by law (including clinical, tax and regulatory record-keeping), after which we securely destroy or de-identify it. 

13. Accessing and correcting your information 

13.1 You may request access to, or correction of, the personal information we hold about you, consistent with the New Zealand Privacy Act 2020 (Information Privacy Principles 6 and 7) or the Australian Privacy Act 1988 (Australian Privacy Principles 12 and 13), as applicable. These rights cannot be excluded by contract. 

13.2 To make a request, contact our Trust Centre at [email protected]. We may need to verify your identity before responding. For patient information held through a practitioner, we may ask you to direct your request through that practitioner where appropriate. We respond within the timeframes required by law and will explain if an exception applies (for example, where information must be retained, or relates to another person). 

14. Complaints 

14.1 If you have a concern about how we have handled your personal information, contact our Trust Centre at [email protected] and we will investigate and respond. If you are not satisfied, you may complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or the Office of the Australian Information Commissioner (oaic.gov.au), as applicable. 

15. Children 

15.1 Our services are directed to practitioners and businesses, not to children. Where a patient is a minor, their information is handled through their practitioner and, where required, with the consent of a parent or guardian. 

16. Changes to this policy 

16.1 We may update this policy from time to time. The current version will be published on our websites with its effective date. Material changes will be notified where reasonably practicable. 

17. How to contact us 

17.1 For any privacy question, request or complaint, contact our Trust Centre at [email protected]