Privacy Policy

This Privacy Policy explains how Acova Capital Pty Ltd (ABN 74 626 676 060), trading as Acova Capital (“Acova”, “we”, “us”, “our”), collects, holds, uses and discloses personal information. Acova holds Australian Financial Services Licence (AFSL) 509 631 and provides corporate advisory and investment services in the healthcare and technology sectors.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This policy describes how we handle personal information across our business, including through our investor portal and our investor onboarding and identity-verification processes. By providing us with personal information, or by using our portal or website, you agree to the handling of your personal information as set out in this policy.

1. The kinds of personal information we collect and hold

The personal information we collect depends on your relationship with us. It may include:

Investor onboarding and identity verification

• Your full name, date of birth, residential and postal address, email address and contact details;
• Identity document details (for example, passport, driver licence or other government-issued identification) used to verify your identity;
• Tax residency information and tax file number or equivalent (where required for tax reporting);
• Information evidencing your status as a wholesale, sophisticated or professional investor (for example, an accountant’s certificate);
• Bank account and payment details for the purpose of subscriptions, distributions and refunds;
• Information about your source of funds or source of wealth, and beneficial ownership and control information where you invest through a company, trust or other entity.

Portal account and transaction information

• Account credentials and authentication information for the investor portal (including two-factor authentication settings where you enable them);
• Your holdings, subscription documents, executed agreements and related correspondence;
• Signing records for documents you execute in the portal — including the date and time, the signing method, and the IP address and device details captured at the moment of signing, which form part of the signing certificate for that document;
• Compliance documents you upload (for example, government ID, wholesale investor certificate and tax residency declaration).

Communications and marketing

• Records of your communications with us, and your preferences for receiving our research and updates (such as the Acova Insights series).

Website and technical information

• Information collected automatically when you use our website or portal, such as IP address, device and browser information, and usage data (see Cookies and similar technologies).

Sensitive information

We do not generally seek sensitive information (as defined in the Privacy Act). Where we need to collect sensitive information, we will do so only with your consent or as otherwise permitted by law, and we will use and disclose it only for the purpose for which it was provided.

2. How we collect personal information

We collect personal information in a number of ways, including:

• Directly from you – when you register for or use our investor portal, complete onboarding, subscribe for securities, correspond with us, or subscribe to our communications;
• From third parties – for example, from our identity-verification provider and the Australian Government’s Document Verification Service, from the Australian Business Register and Super Fund Lookup when we verify an investing company or self-managed super fund, from your accountant or adviser (such as a person who issues a wholesale investor certificate), and from publicly available sources where appropriate;
• Automatically – through our website and portal, using cookies and similar technologies.

Where it is reasonable and practicable, we collect personal information directly from you. If you do not provide the information we request, we may be unable to onboard you as an investor, provide our services, or meet our regulatory obligations.

3. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for purposes including:

• Providing our corporate advisory and investment services;
• Onboarding investors, administering the investor portal, and processing subscriptions, holdings and distributions;
• Verifying your identity and meeting our customer due diligence and anti-money laundering and counter-terrorism financing obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and associated rules;
• Confirming your eligibility to receive offers made without disclosure (for example, to wholesale or sophisticated investors under the Corporations Act 2001 (Cth));
• Communicating with you, responding to your enquiries, and sending you research and updates you have asked to receive;
• Maintaining records, managing risk, and meeting our legal, regulatory and reporting obligations;
• Protecting the security and integrity of our systems and detecting and preventing fraud or misuse.

4. Dealing with us anonymously

Where it is lawful and practicable, you can deal with us without identifying yourself – for example, when making a general enquiry about our firm. In most of our dealings, however, the law requires us to know who you are: we cannot complete onboarding, confirm your investor eligibility, or meet our identity-verification and anti-money-laundering obligations without verifying your identity. For that reason, anonymous or pseudonymous dealing will usually not be possible once you begin onboarding or transacting with us.

5. Personal information we did not ask for

From time to time we may receive personal information we did not request – for instance, where a document you provide happens to contain details about another person. When this occurs, we consider whether the information is something we could have collected under this policy had we sought it. If it is not, and we are not required to keep it as part of a Commonwealth record, we will destroy it or remove identifying details within a reasonable time, where it is lawful and reasonable to do so. Information we could properly have collected is handled in the same way as the rest of the personal information described in this policy.

6. Identity verification and the Document Verification Service

Where you upload identity or compliance documents to the portal, those documents are held in secure, access-controlled storage located in Australia, and are retained only for as long as needed for the purposes described in this policy or as required by law.

7. Automated steps in onboarding

Some parts of onboarding are handled automatically. Identity verification produces an automated verified or not-verified result, and our portal applies set rules to help confirm whether you are eligible to receive a particular offer. These steps support decisions about your access to our services and the securities we can offer you.

We keep meaningful human involvement in these processes. An automated result does not, on its own, finally determine the outcome – our team reviews the verification and your application before it is accepted, and you can ask us about a result that affects you. We are setting this out ahead of the automated-decision transparency requirements that take effect under the Privacy Act on 10 December 2026, and we will expand this section as those requirements come into force.

8. How we share personal information

We may share personal information with:

• Service providers who help us operate our business and portal, who are authorised to use the information only for the purposes for which we engage them. These currently include our identity-verification provider (RatifyID), our cloud hosting and document storage provider (Amazon Web Services), our database provider (Supabase), our email-delivery provider (Resend), our address-lookup provider (Mapbox) and our security and bot-protection provider (Cloudflare);
• Professional advisers, including our lawyers, accountants and auditors;
• Issuers, registries and other parties to a transaction, where necessary to give effect to your investment;
• Parties to a corporate transaction involving our business – such as a merger, acquisition, restructure or sale of assets – where your information forms part of what is being transferred. We would take reasonable steps to ensure any such recipient continues to protect your information consistently with this policy;
• Regulators, government agencies and law enforcement, where required or authorised by law (for example, AUSTRAC, ASIC or the Australian Taxation Office).

We do not sell your personal information, and we do not share it so that any third party can market its own products or services to you.

9. Sending personal information overseas

Most of your personal information stays in Australia. Our cloud hosting and the secure storage holding your identity and compliance documents (Amazon Web Services) and our database (Supabase) are both located in Sydney, and identity verification (RatifyID and the Document Verification Service) is carried out in Australia, as are the Australian Business Register and Super Fund Lookup checks.

A limited amount of personal information is processed in the United States by the following providers:

• Resend – email delivery, which involves your name, email address and the content of the emails we send you;
• Mapbox – address autocomplete in our forms, which involves the address text you type;
• Cloudflare – protecting our sign-in page from automated abuse, which involves your IP address and browser signals.

Before personal information is handled overseas, we take reasonable steps to ensure the recipient manages it in a way consistent with the APPs – whether through our contract with them or because they are already subject to a comparable privacy regime. We will keep this section current as our providers change.

10. Marketing and updates

We may send you research, market commentary and updates (such as the Acova Insights series) where you have subscribed or where we are otherwise permitted to do so. Our marketing communications comply with the Spam Act 2003 (Cth) and include a simple way to unsubscribe. You can opt out at any time using the unsubscribe link in our communications or by contacting us using the details below, and you can also ask us where we obtained your details. Opting out of marketing will not affect communications we are required to send you in connection with your investment.

11. How we store and protect personal information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• Encryption of personal information in transit;
• Hosting our portal, database and document storage on infrastructure located in Australia;
• Access to the investor portal and administrative dashboards being restricted to authorised personnel only, on a need-to-know basis;
• Secure, access-controlled storage for compliance and identity documents;
• Optional two-factor authentication on accounts, and an additional verification step at the point of signing a document;
• Confidentiality obligations and privacy awareness for the people who handle personal information on our behalf;
• Use of reputable service providers with appropriate security practices.

While we take care to protect personal information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. How long we keep personal information

We keep personal information only for as long as it is needed for the purposes set out in this policy, or for as long as the law requires us to keep it (including record-keeping obligations under the Corporations Act 2001 (Cth) and anti-money-laundering legislation). As a general guide, records connected with your investment and with our identity-verification and anti-money-laundering obligations are kept for at least seven years after our relationship with you ends, and sometimes longer where a specific law requires it. When we no longer need information and are not required to retain it, we take reasonable steps to destroy it or remove identifying details.

13. Data breaches

We maintain procedures to respond to actual or suspected data breaches, including containing the breach, assessing the risk of harm, and remediating the cause. Where a breach is an eligible data breach under the Notifiable Data Breaches scheme in the Privacy Act, we will notify affected individuals and the OAIC as required.

14. Cookies and similar technologies

Our portal uses cookies that are necessary for it to work – principally to keep you signed in and to remember which account you are viewing. We do not use advertising cookies, and we do not use third-party analytics or tracking tools on the portal.

Our sign-in page uses Cloudflare Turnstile to distinguish genuine users from automated abuse; it sets its own cookie and processes your IP address and browser signals for that purpose. Our address-autocomplete field stores recent address suggestions in your browser to reduce repeat lookups. You can manage cookies through your browser settings, but disabling essential cookies will prevent you from signing in.

15. Accessing and correcting your personal information

Accessing your information

You can ask for a copy of the personal information we hold about you. We will respond within 30 days where practicable. There is usually no charge, although we may recover our reasonable costs where a request requires substantial work, in which case we will tell you first. We can give access in most cases, but the Privacy Act allows us to decline in limited situations – for example, where giving access would unreasonably affect another person’s privacy, relate to actual or anticipated legal proceedings, reveal commercially sensitive decision-making, or where a request is plainly unreasonable. If we decline, we will explain why in writing and let you know how to take the matter further.

Correcting your information

If anything we hold about you is inaccurate, out of date, incomplete or misleading, let us know and we will correct it. If we have already shared that information with another organisation and you ask us to, we will take reasonable steps to tell them about the correction. If we do not agree that a correction is needed, you can ask us to attach a short note to your record setting out your view, and we will do so.

16. Government related identifiers

We do not use or disclose a government related identifier (such as a tax file number or driver licence number) as our own identifier of you, and we handle such identifiers only as permitted by law, including where required for identity verification or tax reporting.

17. How to make a complaint

If you believe we have breached the APPs or mishandled your personal information, please contact us using the details below, setting out the details of your concern. We will acknowledge your complaint, investigate it, and aim to respond within 30 days. If we need longer, we will let you know and agree a timeframe with you.

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.

18. Changes to this policy

We may update this Privacy Policy from time to time, and we review it at least once a year. The current version will always be available on our website, and the “Last updated” date and version number above indicate when it was last revised. We encourage you to review it periodically.