Does this feel right under Australian privacy law?

Does the information identify you, or could it reasonably be linked back to you?

Name, phone, email, address, licence, Medicare, IP + browser fingerprint, photos of your face, voice recordings.

Is the organisation an Australian business, government agency, or trading here?

Most private businesses with turnover over $3M are covered. All health service providers are covered regardless of size. All federal agencies are covered.

Is the information reasonably necessary for something they actually do?

A cafe doesn't need your date of birth to sell a coffee. A pharmacy might need it for a prescription.

Were you told, at or before collection, who they are, why they want it, and who they'll share it with?

A visible privacy notice or a clear verbal explanation counts. A buried link in a footer usually does not.

Did you actively agree, or was consent bundled / assumed / pre-ticked?

Consent must be voluntary, informed, current, specific, and by someone with capacity.

Is any of the information sensitive (health, race, religion, sexuality, biometrics, political views)?

Sensitive information generally requires explicit consent and a much stronger reason.