Privacy Policy

1. About this policy

This Privacy Policy describes how Sydney Metabolic Institute (ABN 49 630 270 263, ACN 630 270 263) trading as twoxtwo® (“we”, “our”, “us”) collects, uses, stores, discloses and otherwise handles your personal information when you visit our website or make a purchase from us.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth). This policy sets out how we comply with those obligations.

twoxtwo® is a Food for Special Medical Purposes (FSMP). Because our verified-access model involves collecting clinician details and treatment-related information, we handle sensitive information as defined under the Privacy Act. We take these obligations seriously and apply a higher standard of care to sensitive information.

After reviewing this policy, if you have questions, wish to exercise a privacy right, or wish to make a complaint, please contact us via the twoxtwo® website.

2. Personal information we collect

We collect personal information that is reasonably necessary for our functions. The categories of personal information we collect, and the purposes for which we collect them, are set out below.

Device and website information

We collect information about your device and your interaction with our website automatically when you visit, using cookies, log files and similar technologies. This includes:

• IP address and approximate location
• Web browser version and type
• Pages viewed and time spent on the site
• Referring website or search terms
• Cookie identifiers

We collect this information to operate and improve the website, to diagnose technical issues, and to understand how visitors use the site. This information is shared with Shopify, our e-commerce platform provider.

Order and account information

When you place an order or create an account, we collect:
• Name, email address and phone number
• Billing and shipping address
• Payment information (processed securely via our payment provider; we do not store full card numbers)
• Order history and communications

We collect this information to process and fulfil your order, to communicate with you about your order, to detect fraud, and to comply with our legal obligations. This information is shared with Shopify and our payment and logistics providers as necessary to fulfil these purposes.

Verified-access and health-related information (sensitive information)
Our verified-access model requires us to collect information about your healthcare provider and, in some cases, information about your treatment status or clinical circumstances. This may include:

• Name and contact details of your treating clinician or healthcare provider
• Confirmation of access authorisation issued by your clinician
• Information about your clinical context provided voluntarily when contacting us

This information constitutes sensitive information under the Privacy Act and attracts heightened obligations. We collect it only with your consent, or as otherwise permitted by law, and only to the extent necessary to verify your eligibility to purchase twoxtwo® and to administer the access model required under Standard 2.9.5 of the Australia New Zealand Food Standards Code.
We do not use sensitive information for marketing or advertising purposes.

Customer support information

If you contact us for support or to report an issue, we collect the information you provide in that communication, including any personal or health-related information you choose to share. We use this information only to respond to your enquiry and to address any adverse event or complaint.

3. Sensitive information and health data

Under APP 3, we may only collect sensitive information with your consent or where collection is required or authorised by law. By completing our verified-access process, you consent to us collecting and handling the access-related sensitive information described in Section 2 for the purposes described in this policy.

We take additional security measures in relation to sensitive information. We limit access to sensitive information to staff who need it for the relevant purpose, and we do not disclose it to third parties except as described in Section 5 of this policy or as required by law.

4. How we use your personal information

We use your personal information only for the purposes for which it was collected, or for related purposes you would reasonably expect, or as required or permitted by law. These purposes include:

• Processing and fulfilling your order
• Verifying your eligibility to access and purchase twoxtwo®
• Communicating with you about your order, account or enquiry
• Detecting and preventing fraud
• Operating, maintaining and improving our website
• Complying with our legal and regulatory obligations, including under the Food Standards Code and the Privacy Act
• Responding to adverse event reports and complaints
• Keeping records as required by applicable law

We do not use your personal Information for behavioural advertising, targeted advertising or direct marketing without your consent. We do not sell personal information to third parties.

5. Disclosure of personal information

We may disclose your personal information to third parties in the following circumstances:

• Shopify: our e-commerce platform processes order, payment and website data on our behalf. See Shopify’s Privacy Policy at shopify.com/legal/privacy for details of how Shopify handles your information.
• Payment providers: your payment information is processed securely by our payment gateway provider. We do not receive or store full card numbers.
• Logistics and fulfilment providers: we share name and address information with our shipping carriers to fulfil your order.
• Healthcare professionals: where relevant, we may confirm access or fulfilment details with your nominated treating clinician.
• Legal and regulatory authorities: we may disclose personal information where required to do so by law, court order, or a request from a regulatory authority including the Office of the Australian Information Commissioner (OAIC), FSANZ or the TGA.

We do not disclose personal information to third parties for their own marketing or advertising purposes.

6. Overseas disclosure

Some of our service providers, including Shopify, may store or process your personal information outside Australia, including in the United States and Canada. Where we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles, including through contractual arrangements.

By using our website or placing an order, you acknowledge that your personal information may be transferred to and stored overseas in accordance with this policy.

7. Data security

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our e-commerce system uses industry-standard encryption for online transactions. Access to personal information within our organisation is limited to staff and contractors who need it for the relevant purpose.

If we become aware of an eligible data breach as defined under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act, we will notify the OAIC and affected individuals as required by law, as soon as practicable after becoming aware of the breach. Notifications will include details of the breach and the steps we have taken or intend to take in response.

8. Retention of personal information
We retain personal information for as long as it is needed for the purposes for which it was collected, or as required by law. Order and transaction records are retained in accordance with our legal and tax obligations. Sensitive information relating to the verified-access process is retained only for as long as is necessary for that purpose and is then securely destroyed.

You may request deletion of your personal information in accordance with Section 10 of this policy. We will comply with such requests to the extent permitted by law.

9. Automated decision-making

In accordance with the transparency requirements introduced by the Privacy and Other Legislation Amendment Act 2024, we disclose the following about automated decision-making in connection with your personal information.

Our payment processor Shopify uses limited automated decision-making to detect and prevent fraud, including temporary flagging of IP addresses and payment credentials associated with repeated failed transactions. These automated processes do not result in a final legal decision affecting your rights and are subject to human review where a concern is identified.

We do not use your personal information for any other fully automated decision-making that would produce a legal or similarly significant effect on you.

10. Your privacy rights

Under the Australian Privacy Principles, you have the following rights in relation to your personal information:

• Access: you may request access to the personal information we hold about you.
• Correction: you may request that we correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading.
• Deletion: you may request deletion of your personal information, subject to our legal obligations to retain certain records.
• Complaint: you have the right to complain about our handling of your personal information.

To exercise any of these rights, please contact us via the twoxtwo® website.
We will respond to your request within a reasonable time and in accordance with our obligations under the Privacy Act. We do not charge a fee for access requests in ordinary circumstances.

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Please also note that under the Privacy and Other Legislation Amendment Act 2024, a statutory tort for serious invasions of privacy has applied in Australia since 10 June 2025. Individuals may seek remedies through the courts in respect of serious invasions of privacy, in addition to the OAIC complaint pathway.

11. Children and minors

twoxtwo® is a Food for Special Medical Purposes and is not for use by persons under the age of 18. Our website is not directed at or intended for use by minors. We do not knowingly collect personal information from persons under the age of 18.

If you believe a minor has provided us with personal information, please contact us via the twoxtwo® website and we will take steps to delete that information.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational or regulatory reasons. When we make material changes, we will update the “Last updated” date at the top of this policy. We encourage you to review this policy periodically.

13. Contact and complaints

For all privacy enquiries, requests to access or correct your personal information, or to make a privacy complaint, please contact us via the twoxtwo® website.
We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with:

Office of the Australian Information Commissioner (OAIC)
Website: oaic.gov.au
Phone: 1300 363 992
GPO Box 5218, Sydney NSW 2001

Sydney Metabolic Institute - ABN 49 630 270 263