Pricing is patient-reported and not verified against invoices.
Privacy
CostDoc is designed around de-identification, minimal collection, and practical anonymity. Patients should be able to help improve pricing transparency without exposing their medical story.
Last updated: 26 April 2026
CostDoc collects personal information through several touchpoints on the site. Below is a complete list of what we collect and when.
When you subscribe via a guide, Medicare page, insights capture, or the site footer, we store your email address, optional procedure and city context, the page URL, and the timestamp. A page-view overlay (PageViewGate) exists in code but is not currently shown on the live site.
Our contact form collects your name, email address, enquiry category, and message. This information is stored securely and used solely to respond to your enquiry.
Signed-in healthcare providers who wish to claim their profile submit a work email address, role, and optional verification note linked to the provider they are claiming. This information is used to verify ownership and manage the claimed profile.
Users can submit their out-of-pocket medical costs. These submissions are anonymised before being displayed publicly. We do not publish any personally identifying information alongside cost data.
Invoice and receipt uploads are stored privately for manual review. They are not published on the public site, and they are only accessible to authorised reviewers using time-limited access links.
We collect personal information to provide cost transparency for Australian patients, deliver relevant follow-up content, respond to enquiries, verify provider claims, and improve the accuracy of our cost dataset. We do not collect more information than is necessary for these purposes.
Your personal information is stored in our Supabase database in the Sydney (Australia) region, encrypted at rest, and protected by row-level security policies that restrict read access to authorised service credentials. Personal information is transmitted between your browser, our site, and our processors over TLS.
When you subscribe for pricing updates, you will receive a confirmation email. You may then receive up to two follow-up emails: one at approximately six weeks and one at approximately three months. These emails ask whether you have received any quotes you would be willing to share, helping us improve cost accuracy for other patients. We do not send marketing newsletters or promotional material beyond these follow-ups.
Every email we send contains a tokenised unsubscribe link for that email address. Using that link removes the address from future follow-up emails. If the link fails, you can still email hello@costdoc.com.au and we will process the request manually.
If an email-capture prompt is shown, CostDoc may use short-lived cookies to remember whether you have dismissed or completed it (that overlay is not currently enabled on the live site). CostDoc also uses third-party analytics tools that may set cookies or similar identifiers in your browser; those tools are described in the "Analytics and site performance" section below. CostDoc does not sell data for ad personalisation.
CostDoc uses a small number of analytics and site-performance tools to understand how the site is used and to detect bugs. These tools set cookies or similar identifiers in your browser and send aggregated, pseudonymous usage data - for example pages viewed, approximate location by country or state, device and browser type, session duration, and interaction events - to third-party processors. We currently use:
You can block or limit these tools by using browser privacy controls, a tracking blocker, or the Global Privacy Control signal where supported.
We disclose personal information to three processors: Supabase (database, authentication, and private file storage), Resend (transactional email delivery), and Vercel (web application hosting and edge delivery). These services may process information outside Australia depending on how requests are routed. In addition to the processors above, our analytics and site-performance providers (Google LLC, Microsoft Corporation, and Vercel Inc.) process limited usage data outside Australia, primarily in the United States. See the "Analytics and site performance" section for the categories of data and the purposes. We take reasonable steps to ensure each processor handles personal information consistently with the Australian Privacy Principles, including through contractual data-processing terms and service-level controls.
Email addresses and contact information are retained until you unsubscribe or request deletion. Cost submissions are anonymised and retained indefinitely for the public benefit of maintaining accurate medical cost data in Australia. Provider claim information is retained for as long as the provider profile remains active. You may request deletion of your personal data at any time by contacting hello@costdoc.com.au.
CostDoc is designed so users can contribute cost data without publishing their identity. Public pages display de-identified aggregates, not personal narratives. We take care to ensure that no combination of displayed data could reasonably identify an individual patient.
We do not sell personally identifying information under any circumstances. Any future data export or licensing arrangement will use fully de-identified and aggregated data only.
If CostDoc experiences an eligible data breach that is likely to result in serious harm, we will assess the incident under Part IIIC of the Privacy Act 1988 (Cth) and, where required, notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. If we suspect an eligible data breach, we will take all reasonable steps to complete our assessment within 30 calendar days, and sooner where possible. Notifications will describe the breach, the information involved, and the steps you can take to protect yourself.
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the right to:
We aim to respond to access and correction requests promptly and will usually do so within 30 days. If you are not satisfied with our response, you may contact the OAIC at www.oaic.gov.au.
Contact us at hello@costdoc.com.au or read our methodology page for more detail on how we handle data.