Chemist Warehouse

Comprehensive scope statement, clear definitions section, specific contact details including privacy officer, current version date, and structured overview. Strong transparency with detailed contact mechanisms and policy availability.

Clear primary and health-specific collection purposes, explicit marketing consent requirements with opt-out mechanisms, and disclosure of analytics and inference uses. However, some purposes are broadly defined for general business operations.

Clear update notification mechanism with website URL, specific privacy officer contact details, mandatory staff training commitment, and comprehensive customer service contact information. Missing specific review frequency and governance framework details.

Detailed enumeration of personal information types with specific examples, clear collection methods including automated tracking, comprehensive sensitive information disclosure, and explicit legal basis for collection with consequences of non-provision.

No relevant claims found in policy.

No specific findings.

Adequate security measures disclosed including encryption, firewalls, access controls, and physical security. Mandatory employee training is a strong point, but lacks specific certifications, breach notification commitments, or audit practices.

Adequate disclosure naming specific countries and regions for overseas transfers, but lacks adequacy mechanisms, binding rules, or specific safeguards beyond general notification of transfer purposes.

No relevant claims found in policy.

No specific findings.

Very weak disclosure with only implied automated processes through data analytics and personalisation. No explicit ADM disclosure, opt-out rights, human review availability, or algorithmic transparency provided.

Minimal provisions with general requirement for awareness when providing others' information and patient representative coverage. Lacks specific age thresholds, verification mechanisms, or proactive child-specific protections.

No specific findings.