Last Updated: 27 September, 2026

1. Introduction

ThyroBase is a brand of Apoteka Pty Ltd ("we", "us", "our"). We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, who we share it with, and the choices you have.

2. Who we are and how to contact us

Apoteka Pty Ltd, Level 19, 180 Lonsdale St, Melbourne VIC 3000, Australia.
Privacy contact: support@thyrobase.com

3. Information we collect

• Your name, email address, phone number, and billing and delivery addresses.
• Order, subscription and transaction details.
• Account details, if you create a customer account.
• Messages you send us, and any reviews you choose to post.
• Your marketing preferences.
• Your quiz answers, if you take our quiz (see section 4).
• Device and usage information collected automatically, such as your IP address and approximate location, browser and device type, the pages you visit, how you move through them, and how you found us.

Payment details are processed by Shopify Payments and the other payment providers shown at checkout. We never see or store your full card number.

4. Health information

You don't need to give us any health information to buy ThyroBase. Some information you may choose to give us is health information, which the Privacy Act treats as sensitive information. This includes your quiz answers (for example, which thyroid situation describes you, and whether and when you take thyroid medication) and anything health-related you tell us in an email.

We collect this information only with your consent, which you give by completing the quiz or by telling us. We use it only to:

• tailor the information and product guidance we send you (for example, when to take your AM serve);
• answer your questions and provide customer support; and
• improve our products, in de-identified, aggregate form.

We never share your health information with advertising platforms and we never sell it. Our email platform (Klaviyo) stores it on our behalf. You can ask us to delete it at any time.

5. How we collect information

• Directly from you: at checkout, when you create an account, sign up to our emails, take our quiz, leave a review or contact us.
• Automatically, through cookies, pixels and similar technologies when you use our website.
• From our service providers involved in payments, fulfilment, fraud prevention and analytics, limited to what they need to give us.

6. How we use information

• To process payments and fulfil your orders.
• To manage subscriptions and customer accounts.
• To send order, shipping and subscription emails.
• To provide customer support, including refunds under our 60-Day Empty Pouch Promise.
• To send marketing emails, where you have agreed to receive them.
• To understand how our website is used and improve it.
• To measure and improve our advertising.
• To prevent fraud and keep transactions secure.
• To meet our legal and regulatory obligations.

7. Who we share information with

We share personal information only with service providers who help us run the business, and only what they need:

• Shopify: our online store, checkout and payment processing.
• ReCharge: subscription management and billing.
• Klaviyo: email marketing and order-related emails.
• Our fulfilment partner and couriers: warehousing and delivery of your order.
• Judge.me: product reviews.
• Meta (Facebook and Instagram): advertising and ad measurement.
• Google (Google Analytics and Google Ads): website analytics and ad measurement.
• Microsoft Clarity: website analytics that records how visitors use our pages, such as clicks, scrolling and mouse movement, so we can improve them.
• Professional advisers (such as our accountants and lawyers), and regulators or law enforcement where the law requires it.

These providers must handle your information in line with applicable privacy laws and may not use it for their own purposes. We do not sell personal information.

8. Overseas data storage

Several of our providers, including Shopify, ReCharge, Klaviyo, Meta, Google and Microsoft, store or process information outside Australia, including in the United States. Where we disclose information overseas, we take reasonable steps to make sure it is protected consistently with the APPs (APP 8).

9. Cookies, analytics and advertising

We use cookies and similar technologies to make the site work, remember your preferences, understand how the site is used, and measure our advertising. Advertising platforms such as Meta and Google may use these to show ThyroBase ads to people likely to be interested, and to measure whether ads led to a visit or purchase. We may also share email addresses in an encrypted (hashed) form with advertising platforms, for example so existing customers don't keep seeing ads for things they already have. You can control cookies through your browser settings and any cookie tools on our site. Blocking some cookies may affect how the site works.

10. Marketing emails

You can unsubscribe from marketing emails at any time using the link in any email, or by contacting us. We'll still send emails you need, such as order confirmations, shipping updates and subscription notices.

11. Security

We take reasonable steps to protect personal information from misuse, loss and unauthorised access, including encryption in transit and access controls. No method of internet transmission is completely secure, so we can't guarantee absolute security.

12. Data breaches

If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

13. How long we keep information

We keep personal information only as long as we need it for business and legal purposes. Some records, such as tax and accounting records, are kept for up to 7 years. Health information is kept only as long as needed for the purpose it was collected, unless the law requires otherwise.

14. Your rights

You can ask to access the personal information we hold about you, ask us to correct it, or ask us to delete it (unless the law requires us to keep it). Email support@thyrobase.com and we'll respond within 30 days.

15. Children

Our products and website are not directed at anyone under 18, and we don't knowingly collect personal information from children. If you think we have, contact us and we'll delete it.

16. Complaints

If you have a concern about how we've handled your personal information, email support@thyrobase.com and we aim to respond within 30 days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

17. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows the current version.