Privacy Policy
Last updated: 2 October 2026
Who we are
Ready Set Rove is operated by Brooke Richards, trading as Ready Set Rove, in Australia. Contact for anything in this policy: contact@readysetrove.com.
The short version
There are no accounts and no marketing list. Browsing and checking an itinerary sends us nothing that identifies you. We collect your email address only when you ask us to email you something or buy a pack, and your trip selections only to build what you asked for. Your medication selections are health information, and we treat them that way. Certificate requests sent to a clinic hold more, and are deleted on the schedule set out below. We never sell personal information and never use it for advertising.
Does the Privacy Act apply to us
Small businesses with turnover under A$3 million are often exempt from the Privacy Act 1988 (Cth). We do not rely on that exemption. Medication selections and certificate requests are health information, which the Act treats as sensitive information, and the clinics we work with are bound by the Act in full. So we handle all personal information in line with the Australian Privacy Principles (APPs) whether or not the law strictly requires it, and this policy is written to APP 1.
What we collect, and why
Nothing, if you browse or run the checker. The itinerary checker builds its answer from your selections in your browser. Choosing medications and destinations does not send us your name, your email, or anything that identifies you.
Where you live and your passport, if you tell the checker. Both questions are optional. We ask because some countries' rules differ by where a traveller lives or the passport they carry, and we use the answers only to show you the rule that applies to you. In the free checker they stay in your browser like the rest of your selections. They leave it only in the two ways set out below: in the link in a summary email you ask for, and with a trip pack you buy.
Your email address, when you ask for a summary. We use it to send that one email and do not store it afterwards. The email lists your destinations and their status, and carries a link that reopens your itinerary. That link contains your medication and destination selections, and where you live and your passport if you gave them, because that is how the page rebuilds itself. They sit after a # sign in the link, a part of a web address that your browser keeps to itself, so opening the link does not send them to our servers. The email does not name your medications in its text.
Your trip and email, when you buy a trip pack. Stripe collects your email and payment details at checkout. Your card details never touch our systems. The trip you built (your medication selections, destinations, transit stops, travel date, nights per stop, days of supply, the country you live in if you entered it, and your passport country if you entered it and a rule on your trip turns on it) is attached to your Stripe checkout record, together with the rules it was priced against, encrypted with a key that only our own systems hold, so Stripe stores it but cannot read it. That is how your pack is generated and how the link in your email finds it again. Where you live and your passport, if you gave them, are used to read each stop's rule for you and to check it again each week. Your passport country is used for nothing else, so for a trip where no stop's rule turns on it we do not keep it. Where you live is stated on the doctor's certificate in your pack. We use your email to send the pack link, to send you a notice if a published rule for one of your stops changes before your travel date, and, if you ask on the recovery page, to send your links again.
Your email, when you ask for your links again. On the recovery page we use the address you enter to look up purchases made with it at Stripe and to email the links to that same address. The page never says whether anything was found, and nothing is sent if nothing was.
Your details, when you send a certificate request to a clinic. This is optional and you do it yourself from inside your pack. You see the full list of what will be shared before you send, and you tick a box to consent. We collect your name, date of birth and email (required), and passport number, nationality, country of residence, address, a note, and your pharmacy's name and email (each optional), together with your medications and the countries and dates on your trip. The purpose is to let the clinic you name issue the medical certificate you asked for, and, if the clinic chooses, to write to your pharmacy about early supply. The certificate records a diagnosis of ADHD alongside your medications; that is what the document is for.
Clinic and clinician details, for practices that sign up. Practice name, address, phone, email and ABN; each clinician's name, qualifications, AHPRA registration number, prescriber number and email; and, if the clinician adds one, a signature image (drawn on screen or uploaded) and a letterhead. These print on certificates and letters the practice issues. A clinician can remove their signature image at any time, and it is then deleted.
Checking a document. Each certificate and pharmacy letter a clinic issues prints a reference. Anyone holding the document can enter that reference on our verification page to confirm it was issued. The page shows the kind of document, the practice, the prescriber's name and AHPRA registration number, the date and how it was signed, or that it was withdrawn. It shows nothing about you, your medication or your trip. If the person checking chooses the PDF, their browser works out a fingerprint of the file and sends only that; the file is not uploaded. We record the time of each check on the request and nothing about who made it. The reference stops working when the request is deleted.
Technical data. Our hosting provider keeps standard server logs for a limited time. Our code is written not to put names, email addresses, medications or destinations into those logs. Client IP addresses are used briefly in memory to limit abuse of the email, clinic-request and document-checking forms and are not stored.
Health information and your consent
Your medication selections, and everything in a certificate request, are health information. We collect it only when you choose to give it to us for the specific thing you asked for. At checkout, a notice above the payment button says what is attached to your purchase and what your email will be used for. You tick a box to agree before the button works, and the version of that notice is recorded on your purchase. For a certificate request, you tick an explicit consent box after reading what the clinic will see, and the time you gave consent is recorded. You can decline either by not sending the form: the free checker, the country pages and the printable letter work without them. We do not use health information for any other purpose, and we do not disclose it to anyone except the recipients listed next.
Who receives your information
| Recipient | What they receive | Why |
|---|---|---|
| Stripe (payments) | Your payment details, your checkout email, and your trip and the rules it was priced against, encrypted so that Stripe cannot read them | To take payment and bind your pack to your purchase |
| Vercel (hosting, file storage, analytics) | Everything the site processes; stored files include per-purchase rule snapshots, clinic and clinician records, certificate requests and filed PDFs; analytics receives anonymous events only | To run the site and store what the clinic flow needs |
| SMTP2GO (email delivery) | The address and content of every email we send: pack links with your stops, medications and dates; rule-change notices; summary emails; clinic sign-in links and account security notices to clinicians; certificate-request notices naming the patient; issued-certificate links; a notice to you if a clinic does not issue your certificate; reminders to a clinic that requests are waiting, with a count and no patient details; pharmacy letters as PDF attachments | To deliver the email you or your clinic asked for |
| The clinic you name | Your whole certificate request, including your pack | To issue your certificate. The clinic is itself bound by the Privacy Act and its own record-keeping duties |
| The clinic's practice software (Cliniko or Halaxy), if the clinic has connected it | Your name and date of birth, to find your record in the clinic's own system; then the signed certificate or pharmacy letter as a PDF, with a one-line description naming the document and the prescriber. Never your itinerary or medication list on its own. The names, dates of birth and email addresses that software returns for the search pass through our server only to be shown to the clinic member choosing the record, and are not kept | Only at the clinic's instruction, so the signed document sits in your clinical record there. The clinic chooses whether to connect and which record to file to |
| Your pharmacy, if the clinic writes an early-supply letter | Your name, date of birth, medications, days of supply and travel dates, on the clinic's letterhead. If we email it for the clinic, you are copied in. If the clinic sends it from its own email, the clinic sends it and decides who is copied | Only if the clinic chooses to write, to the pharmacy you gave or one the clinic enters |
We do not give a clinic any information about a patient who redeems its code but does not send a request. We do not share personal information with advertisers, and we do not send marketing email.
Where your information is handled, and overseas disclosure
Our code runs on Vercel's servers in Sydney, Australia. The files we store (clinic and clinician records, certificate requests, filed PDFs, letterheads and signatures, and the rule snapshot behind each purchase) are held in a private Vercel Blob store in Sydney, Australia. Stripe takes payment and holds your checkout record in the United States. SMTP2GO is a New Zealand company with servers in Australia, the United States and Europe; it keeps email data for 35 days by default. Cliniko and Halaxy host Australian practices in Australia, and Cliniko files uploaded documents through Amazon Web Services storage in the region the practice's account lives in.
So your information is likely to be disclosed to recipients in the United States and New Zealand. Those recipients are not bound by the Australian Privacy Principles. When you use a feature that sends information to one of them, you agree to that. Here is what the agreement means. The Privacy Act would otherwise require us to take reasonable steps to make sure an overseas recipient handles your information as the Australian Privacy Principles require (APP 8.1). With your agreement, that requirement does not apply, and we may not be able to make the recipient follow those principles. You do not have to agree: the checker, the country pages and the printable letter send nothing anywhere. We still use only the services named above, and we rely on each provider's published privacy and security commitments.
How we hold it, and what to keep secret
Clinic records, certificate requests, filed PDFs and uploaded images are held in private storage with no public address: every read is authenticated and made by our own server, and the storage paths are derived from a secret salt as a second layer. Two things in this system are links that work for anyone who holds them, like a piece of mail: your pack link, and the link to a signed certificate (which also stops working after 30 days, and immediately if the clinic withdraws the certificate). Keep both to yourself. Clinic sign-in links work once and expire in fifteen minutes, and a clinic account also needs a code from an authenticator app on the clinician's phone, at sign-in, again each time a certificate is signed, and again to open the clinic's software for searching and filing, which then stays open to that clinician for fifteen minutes; clinic sessions last 30 days and can be ended from the profile page on every device at once.
How long we keep it
| Information | Kept until |
|---|---|
| Summary or recovery email address | Not stored. Used to send the email and discarded. |
| Your purchase and trip, at Stripe | As long as your pack link needs to work, and as a transaction record for the period tax law requires (seven years). Ask us and we will remove the trip details from the record sooner. |
| Our copy of the rules your pack was priced against | Deleted 30 days after your travel date. It holds no name or email. |
| A certificate request the clinic did not act on | Deleted 90 days after you sent it, with everything in it. |
| A certificate request the clinic issued or declined, including the filed PDF and any pharmacy letter | Deleted 12 months after you sent it. The clinic keeps its own copy in your medical record under its own obligations; ours exists so you can retrieve the document for the trip. |
| Clinic and clinician profiles, signature and letterhead images | Until the practice removes the clinician or asks us to close the account. |
| Copies of sent email at SMTP2GO | 35 days, SMTP2GO's default storage period. We do not switch on its longer archiving. |
| Hosting request logs and anonymous analytics at Vercel | Request logs for at most a day; analytics under Vercel's own retention policy. Neither holds a name, an email address or a medication. |
Analytics
We use Vercel Analytics, which is cookieless and does not identify you. The events we record carry counts only: that a check was completed and how many stops it had, that a checkout started, that a purchase happened. They never carry medication names, destinations, email addresses or pack links, and the pack and checker page addresses are stripped of their query strings before they are recorded.
Referral links
If you arrive through a clinic's or a partner's link (an address on this site starting with /r/), we set one first-party cookie holding that partner's code and nothing else, for 30 days from a clinic's link or 90 from a partner's. It does three things: it applies a clinic's or a sponsoring organisation's code at checkout so nobody has to type it, it fills in a clinic's practice code on the form you use to send a certificate request, where you can change it, and it lets us count the purchases a partner referred so we can pay them. It holds no name, no email, no itinerary and no medication. Clinics and partners receive counts and amounts only, never who bought. Clearing your cookies removes it and nothing on the site depends on it.
Decisions made or helped by software
From 10 December 2026 the Privacy Act requires a privacy policy to describe any computer program that makes, or does something substantially and directly related to making, a decision that could significantly affect a person's rights or interests. Here is our position, stated now.
The personal information our software uses. Your medication selections, destinations, transit stops, travel date, nights per stop and days of supply, and where you live and your passport country if you gave them; and, on a certificate request, your name, date of birth and the other details you enter.
Decisions made solely by software: none. The status of each medication at each border, the apply-by dates and the rule-change notices are computed from published government rules and your selections. They are the same for anyone who enters the same selections, and they grant or refuse you nothing.
Things software does that feed a person's decision. When you send a certificate request, our software pre-fills the certificate from what you entered: your medications and their Australian scheduling, your itinerary, and the days of supply you will hold on arrival at each stop. A clinician at the clinic you named reads that draft and decides whether to sign it, correct it or decline it. That decision is the clinician's, made under their own professional obligations; the software presents what you entered and recommends nothing. Every view and download of a certificate request is logged on the record so the clinic can see who looked at it, and the log is deleted with the record. You can ask us how anything above was computed at contact@readysetrove.com.
Your rights
You can ask what personal information we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Email contact@readysetrove.com from the address you used with us and we will respond within 30 days. For a certificate request, we can delete what we hold; anything the clinic has already filed in your medical record is theirs to manage under their own obligations, and we will tell you that is where to ask. For a purchase, we can remove the trip details from the Stripe record and delete our rule snapshot, and must keep the bare transaction record for tax purposes.
If you think we have mishandled your personal information, email contact@readysetrove.com. We will acknowledge it within seven days and respond within 30. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
If something goes wrong
We keep a written data breach response plan. If we become aware of a breach involving your information that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme, and we aim to do so within 72 hours of confirming it.
If you are outside Australia
This service is designed for travellers departing Australia: prices are in Australian dollars, the departure guidance is Australian, and the clinic flow is built around Australian prescribers. We do not target residents of any other country. The site can still be reached from anywhere, and if you use it from elsewhere the following applies in addition to everything above.
European Union and United Kingdom. Where the GDPR or UK GDPR applies to you, our lawful basis for handling your information is your consent, and for health information your explicit consent, which you give at checkout or on the clinic request form as described above. You can withdraw it at any time by asking us to delete what we hold. You have the rights of access, rectification, erasure, restriction, portability and objection; email contact@readysetrove.com and we will respond within one month. Your information is transferred to the United States and New Zealand through the providers named above. We have not appointed a representative in the EU or UK because we do not offer services there. You can complain to the supervisory authority in your country.
United States. We are not a HIPAA covered entity or business associate. Some states, including Washington, Nevada and Connecticut, regulate consumer health data without a size threshold. If one of those laws applies to you: the categories of health data we collect, where it comes from, why we collect it, who it is shared with and how long it is kept are set out above; we do not sell health data and do not use it for advertising; you can withdraw consent and ask us to delete it by email, and we will confirm within 45 days; and you may appeal a refusal by replying to our response.
New Zealand and elsewhere. If the Privacy Act 2020 (NZ) or another country's law gives you rights over your information, the same email route applies and we will honour access, correction and deletion requests on the same terms as for Australians.
Children
A trip pack or certificate request may concern a child travelling with a parent or guardian. In that case the adult enters the details and gives consent on the child's behalf, and the information is handled exactly as described above. The site is not directed at children and we do not knowingly collect information from a child directly.
Changes
This policy describes what the product actually does, so it changes when the product does, and the date at the top moves with it. The terms of service incorporate it.