Redact a Medicare CardBefore You Hand It Over
Your Medicare number is a government related identifier. Organisations may sometimes need to sight it, but they generally must not adopt, use or disclose it. Cover it in your browser. Nothing uploaded.
Free daily redaction, no signup required
The Privacy Commissioner has already ruled on this
In April 2026 the Privacy Commissioner determined that the 2Apply rental application platform collected personal information that was not reasonably necessary, in breach of Australian Privacy Principle 3.2, and collected it by unfair means in breach of APP 3.5.
The determination named specific Medicare details as excessive: the number of names listed on the card, and the card colour. The Commissioner found the platform did not even perform the identity verification itself, so it did not need that information at all.
On tenancy generally the OAIC advises that if an agent needs a copy of a document carrying a government related identifier, you should “think about blanking out personal information the real estate agent doesn’t need”.
A Medicare number, a Centrelink customer reference number, a driver licence number and a birth certificate number are all government related identifiers. An organisation covered by the Privacy Act may collect one where reasonably necessary, but generally must not adopt, use or disclose it.
What To Cover On A Medicare Card
They are usually confirming you exist, not enrolling you in Medicare.
Cover these
- The 10 digit Medicare number
- Your individual reference number, the digit beside your name
- Other family members listed on the card
- The valid to date, unless specifically required
- The card colour, if you are sending a photo
Leave these visible
- Your own name
- That it is a Medicare card, if that is the point
How It Works
Under a minute, and the file never leaves your device.
Photograph or open the card
Drop the photo or scan in. It stays on your device.
Cover the number and other names
Black out the Medicare number, your reference digit and anyone else listed.
Send the redacted copy
Export and share that version rather than the original photo.
Your documents never leave your browser
Identity documents are the highest value target in any leaked dataset, because a Medicare number plus a name plus a date of birth is enough to start building an identity. The Privacy Commissioner has pointed directly at the security risk created by the volume of identity documents held across the rental sector.
RedactID does not add another copy. There is no upload step, because the redaction runs in the page you are already looking at. We never receive your file, so we cannot lose it.
How that actually worksCommon Questions
Can a real estate agent ask for my Medicare card?
They can ask, and Medicare cards are commonly used toward a 100 point identity check. But in April 2026 the Privacy Commissioner found that the 2Apply platform collected more Medicare detail than was reasonably necessary, specifically the number of names listed on the card and the card colour, and noted the platform did not perform identity verification itself. Collecting a document is not the same as needing every field on it.
What is a government related identifier?
A unique number on a government issued document, such as a Medicare number, a Centrelink customer reference number, a driver licence number or a birth certificate number. Under the Australian Privacy Principles an organisation may collect one where reasonably necessary for its functions, but generally must not adopt, use or disclose it as its own identifier for you.
Should I cover other family members on the card?
Yes. A family Medicare card lists several people. Their names and reference numbers are not yours to hand over, and no identity check on you requires them. Cover every name that is not the one being verified.
What is the individual reference number?
The single digit printed beside each name on a Medicare card, showing that person's position on the card. It is part of how a Medicare number identifies a specific individual, so treat it as part of the number rather than a harmless extra.
Is a photo of my card safer than the card itself?
Not inherently. A photo can be copied endlessly, forwarded, and stored on systems you will never see. That is the argument for sending a redacted photo rather than a complete one, and for asking whether the recipient can simply sight the card instead of keeping a copy.
Does RedactID upload my card image?
No. The redaction happens in your browser. The image is not sent to our servers, not stored, and not seen by us.