BupaBooker

Privacy Policy

Our privacy policy and how we use your data

Last updated: 16 October 2026

BupaBooker is operated by a sole trader based in Victoria, Australia ("we", "us", "our"). This policy explains what personal information we collect, why we collect it, who we share it with and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. Information we collect

Your account

  • Your name and email address.
  • Your password, which we store only in a securely hashed form. If you sign in with Google, we receive your name, email address and profile picture from Google.
  • Two-factor authentication settings, if you turn them on.

Your watches

  • Your postcode, state, the Bupa Medical Visa Services centres you choose and how far you are willing to travel.
  • The contact name, email address and mobile number we send alerts to.
  • A record of the alerts we send for your watch: the centre, date and time of each slot, and when and how we sent the alert.

We do not ask for your HAP ID letter, passport details or other visa applicant details. You give those directly to Bupa when you book.

Payments

Card payments are handled by Stripe. Your full card number never reaches our servers. We store references Stripe gives us (such as a checkout or payment ID) together with the amount, currency and status of your payment.

Technical information

When you sign in we record your IP address and browser user agent against your session, and we keep short-lived request counters to protect the service from abuse. We do not use analytics or advertising trackers.

2. How we use your information

  • To create and secure your account and let you sign in.
  • To check Bupa Medical Visa Services availability against your watch and send you slot alerts by SMS and email.
  • To send you service emails, such as sign-in verification, payment receipts and watch updates. We do not send marketing emails or marketing texts.
  • To take payment for your watch and handle refunds.
  • To prevent fraud and abuse, keep the service secure and meet our legal obligations.
  • To answer your questions and support requests.

3. Who we share information with

We do not sell or rent your personal information, and we do not send it to Bupa. We share it only with:

  • Stripe: to process your payment.
  • Twilio: our SMS delivery provider, which receives your mobile number and the text of each alert so it can send it to you.
  • Google: only if you choose to sign in with Google.
  • Service providers who run our infrastructure on our behalf, including our application and database hosting provider (Railway) and our email delivery provider. They may only use your information to provide their services to us.
  • Authorities, where we are required or authorised by law to disclose it.

4. Overseas storage and disclosure

Our service is hosted in the United States, so your personal information is stored and processed there. Stripe, Twilio (including your mobile number), our email delivery provider and Google may also process your information in the United States and other countries. We take reasonable steps to make sure these providers protect your information in a way that is consistent with the Australian Privacy Principles.

5. How we protect your information

We use encrypted connections (HTTPS), hashed passwords, encrypted storage of sign-in tokens and access controls that limit your watch details to you and the people who run the service. No system is perfectly secure, but we work to protect your information from misuse, loss and unauthorised access. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by law.

6. How long we keep it

  • We keep your account and watch information while your account is open.
  • When you delete your account from your settings page, we delete your account, your watches and their alert history.
  • We keep payment records for as long as Australian tax law requires (generally five years). Stripe and Twilio keep their own records under their privacy policies.

7. Your choices and rights

You can update your account details from your settings page, cancel a watch to stop further alerts and delete your account at any time. You can also ask us for access to the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. We will respond within 30 days.

You can use BupaBooker under a pseudonym for your account name, but we need a working email address and mobile number to send you alerts.

8. Cookies

We use only the cookies needed to run the site, such as keeping you signed in and remembering your theme. See our Cookie Policy for details.

9. Children

Our service is for adults. If you set up a watch for a child, you must be their parent or guardian.

10. Complaints

If you have a concern about how we have handled your personal information, please email us at [email protected] first and we will try to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the "Last updated" date. If a change materially affects how we use your information, we will tell you by email.

12. Contact us

For any privacy question or request, email [email protected].