Nutrition Joy Privacy Policy

1Operating entity and overseas partner company

The following companies participate in operating Nutrition Joy and providing related services.

1.1 Australian operating entity

This company is responsible for the services it provides in Australia and fulfils the relevant personal information protection obligations under applicable Australian privacy laws.

1.2 Overseas partner company in mainland China

As Nutrition Joy’s overseas partner company, 广州营悦营养健康咨询有限公司 (Guangzhou Yingyue Nutrition and Health Consulting Co., Ltd.) may, according to specific business cooperation arrangements, participate in client enquiries, nutrition and health management, client communications, service follow-up, information analysis, operations, technical support and other necessary service support work.

The two companies are separate legal entities. The contracting entity, service provider and payment entity for a particular order are as stated on the relevant purchase page, order or service agreement.

For personal information collected by the Australian operating entity and provided to the Guangzhou partner company, the Guangzhou partner company must process it within the scope of its authorisation and applicable law, and must not use it for unrelated purposes without authorisation.

References to “we”, “us” and “our” in this policy mean the relevant operating entity and the authorised service teams lawfully involved in processing information, depending on the particular service and processing circumstances. No cooperation arrangement removes either company’s own legal responsibilities for privacy protection.

2Our services

Nutrition Joy primarily provides:

• Online nutrition consultations, dietary guidance and health education;
• Weight management, fat loss and related health improvement services;
• Assessments of health status, nutritional needs and lifestyle;
• Personalised nutrition and health management plans;
• Ongoing follow-up guidance from dietitians, nutritionists and other appropriate professionals;
• AI-assisted health analysis, client service and nutrition management support;
• Bookings, client communications, orders and after-sales support relating to these services.

The specific services, personnel, fees and scope of application are as stated on the purchase page and in the relevant service agreement.

3Personal information we collect

Depending on the circumstances, we may collect the following information to respond to your enquiries, assess your service needs, provide health management services and fulfil relevant obligations.

3.1 Basic personal information

This includes your name or nickname, age or year of birth, gender where relevant to the service, city or region, telephone number, email address, WeChat account and other contact details you voluntarily provide.

3.2 Health and lifestyle information

With the necessary consent or another applicable legal basis, we may collect:

• Height, weight, waist circumference, body composition and weight changes;
• Eating habits, food records, meal photographs and nutritional intake;
• Physical activity, sleep habits and lifestyle;
• Health goals, fat-loss goals and health management history;
• Health conditions, medical history, medication use and allergies relevant to the service;
• Health check reports, blood test reports, laboratory results and related medical information, where genuinely necessary, appropriately authorised and submitted through the designated channel;
• Other information reasonably required to provide the particular nutrition and health management services.

Health information generally constitutes “sensitive information” under Australian privacy laws, and we apply appropriate additional safeguards in accordance with applicable law. Complete health check reports, blood test reports and similar medical documents should not be submitted through WeChat or WeCom. Please contact your nutrition professional first to obtain the dedicated receiving email address. See section 8.3 for details.

3.3 Enquiry and service records

These include:

• Health questionnaires and consultation content;
• WeChat, WeCom, email and other communication records;
• Text, images, voice messages, files and related materials you voluntarily provide;
• Nutrition management plans, food records and service follow-up records;
• Service bookings, progress, feedback, complaints and after-sales records.

If additional recording of an audio or video consultation is required, we will inform you beforehand and obtain the necessary authorisation in accordance with applicable law.

3.4 Order and payment information

This includes services purchased, order numbers, payment amounts, payment status, purchase dates, refunds, invoice information and necessary financial records.

If a third-party payment provider is used, that provider may handle necessary payment information under its own privacy policy.

3.5 Private health insurance information

If you would like to understand whether a service may meet private health insurance claim requirements, we may collect the insurer’s name, policy product, cover category and related claim needs, according to what is actually required.

Unless genuinely necessary and appropriately explained to you, we will not ask for your insurance account password, complete bank card details or other sensitive identity information unrelated to the service.

3.6 Website usage and technical information

When you visit our website, we and the technology providers actually used may process:

• Your IP address and approximate location;
• Browser, device and operating system information;
• Visit times, pages viewed and referral sources;
• Cookie, website analytics and security verification information.

See section 9 for details of the relevant technologies and providers.

4How we collect personal information

We mainly collect information directly from you when:

• You complete a website form, health questionnaire or enquiry request;
• You purchase, book or use Nutrition Joy services;
• You contact us through WeChat, telephone, email or another channel;
• You submit information necessary for the service using the designated method explained beforehand by your nutrition professional;
• You communicate with an authorised dietitian, nutritionist or service team member;
• You provide feedback during ongoing health management.

Where permitted by applicable law, we may also obtain information needed to provide services from family members, professionals or other third parties you have authorised.

If you submit information on behalf of a family member, you should ensure that you have appropriate authorisation or another lawful basis.

For unsolicited personal information that is unrelated to our services, we will assess whether it needs to be deleted or de-identified in accordance with the law.

5Sensitive health information and consent

Under Australian privacy laws, health information is sensitive information. Its collection generally requires appropriate consent and must be reasonably necessary to provide services, unless another applicable legal basis exists.

At the time of collection, we will appropriately explain the purposes of processing, the main recipients and the possible consequences of not providing necessary information.

5.1 Authorisation for health information

You may give authorisation by selecting an authorisation option in a health questionnaire, signing service documents or taking another affirmative action that clearly demonstrates your informed and voluntary consent.

The relevant authorisation may cover:

1. Collecting necessary health information for health assessment and nutrition management;
2. Allowing authorised dietitians, nutritionists and service personnel to view and use relevant information;
3. Analysing dietary, health and behavioural data according to service needs;
4. Using appropriate digital and AI-assisted tools to support services that have been explained to you;
5. Allowing 广州营悦营养健康咨询有限公司 (Guangzhou Yingyue Nutrition and Health Consulting Co., Ltd.) to participate in necessary health management and service support, subject to legal and relevant authorisation requirements.

While the relevant authorisation remains valid and the processing purpose has not materially changed, we may continue providing services within the authorised scope without asking you to authorise every routine follow-up again.

5.2 Purchasing services and this Privacy Policy

When this policy and the necessary information processing explanations are made available on the purchase page, and you confirm a purchase or complete payment, you acknowledge that you have been informed of, and confirm, the relevant information processing we undertake to process the order, deliver the services, arrange personnel and carry out necessary client communications.

Purchasing a service does not, by itself, automatically constitute valid consent to all processing of sensitive health information, separate marketing, non-essential AI model training or particular overseas disclosures.

Where consent is legally required to use identifiable personal and health information to train Nutrition Joy’s own AI models, we will seek separate, optional authorisation. Declining will not affect your free initial assessment or normal nutrition services.

For matters that legally require separate consent, we will obtain the necessary authorisation at the relevant stage.

5.3 Refusing or withdrawing consent

You may request to withdraw consent to a particular processing activity using the methods set out in this policy.

If the information or processing activity is genuinely necessary to provide a particular service, refusing or withdrawing consent may affect our ability to provide that service.

Withdrawing consent does not affect processing previously carried out lawfully, and does not automatically cancel contractual obligations already incurred or statutory record-retention requirements.

6Why we collect and use personal information

Subject to applicable law, we may use necessary information for the following purposes:

• Client enquiries and service assessment: Responding to enquiries, understanding nutrition and health needs, explaining our services and assessing whether they are suitable for your needs.
• Nutrition and health management: Conducting health assessments, developing and adjusting nutrition plans, and providing personalised guidance and ongoing follow-up.
• Client communications and service support: Sending booking confirmations, nutrition advice, health management reminders, service notices and after-sales responses through channels you choose or agree to.
• Order and client relationship management: Handling payments, refunds, invoices, service periods, complaints, after-sales support and necessary client service records.
• Digital and AI-assisted services: Using appropriate software and AI tools within the service scope explained to you to assist with organising and analysing information, matching services and improving service efficiency.
• Service quality and internal operations: Undertaking necessary personnel management, service quality assessment, client experience improvements and internal operational analysis.
• Legal and security requirements: Meeting legal obligations, maintaining system security, preventing fraud, handling complaints and dealing with lawful disputes.

Where the processing purpose can be achieved in that way, we prioritise aggregated or appropriately de-identified data.

If we propose to use personal information for another purpose that is inconsistent with the original collection purpose and cannot be undertaken directly under applicable law, we will obtain the necessary additional consent as required.

7Artificial intelligence and automated assistance

In providing nutrition and health management services, we may use artificial intelligence and other digital tools to assist with organising and analysing information and improving our service processes.

We require our staff to follow information protection procedures, and we take measures proportionate to the risk to restrict unauthorised handling of personal and health information.

Where permitted by applicable law, we may also use effectively de-identified data for service quality analysis and process improvement.

8WeChat, WeCom and related Tencent services

To provide convenient, continuous client communications and health management support for Chinese-speaking users, we may use WeChat, WeCom and Tencent communication, client management or other technology services that are actually enabled.

These tools may be used to:

• Receive and respond to client enquiries;
• Send service descriptions, quotes and booking information;
• Send nutrition advice, health management plans and service reminders;
• Receive meal photographs, health records and client feedback;
• Manage enquiry and service communication records;
• Carry out necessary information organisation and analysis within the service scope explained to you;
• Provide client follow-up, after-sales support and other necessary service support.

Depending on your chosen service channel, the processing purpose and the necessary authorisation, relevant information may include WeChat accounts or identifiers, contact details, text, images, voice messages, files, service needs and necessary health information you voluntarily provide.

8.1 Data processing by Tencent platforms

When you use WeChat, WeCom or other Tencent services, relevant information may be processed by Tencent and the corresponding service operators under their terms of service and privacy policies.

These services may involve processing, storage or access outside Australia, including in mainland China and other regions actually used by the relevant service.

We cannot directly control every aspect of Tencent’s information processing as an independent platform operator. However, we remain responsible for complying with applicable law in relation to the collection, use and disclosure activities within our own control.

In a 2V1 service, authorised nutrition support personnel located in China may view necessary questionnaires, weight records, meal photographs and feedback on implementation, according to their duties. Complete health check reports, blood test reports and other sensitive medical documents should not be submitted in WeChat or WeCom chats. If submission is genuinely necessary, please contact your nutrition professional first to obtain the dedicated receiving email address. See section 8.3.

8.2 Your choice to use WeChat

If you actively choose WeChat as your enquiry or service communication channel, we will contact you through that channel for the service purposes explained to you and within the scope permitted by applicable law.

Choosing WeChat does not mean that you waive your rights under Australian privacy laws, and does not automatically constitute consent to all overseas disclosure of sensitive health information.

If additional authorisation is legally required for the relevant processing, we will obtain the necessary consent at an appropriate stage.

If you do not wish to communicate through WeChat, you can contact us to ask about email or other available alternatives.

WeChat and WeCom are mainly used for general enquiries, bookings and everyday nutrition service communications. They are not submission channels for sensitive medical documents such as complete health check reports, blood test reports or medical records. Please do not send these documents in chat messages, photographs, screenshots or attachments, and do not send account passwords or identity information unrelated to the service.

8.3 Submitting health check reports, blood test reports and other sensitive materials

Please do not send us health check reports, blood test reports, laboratory reports, medical records, prescriptions or other medical documents containing sensitive personal health information through WeChat or WeCom chats. This includes photographs, scanned copies, screenshots and attachments.

If these materials are genuinely needed for a nutrition assessment or subsequent services, please first contact the nutrition professional responsible for your care. They will help confirm which materials are relevant to the service, explain the collection purpose and necessary authorisation, and provide a dedicated email address for receiving reports and submission instructions. Please send only necessary materials to that designated address. Do not send them to ordinary WeChat chats, the privacy contact email address published on the website or any other non-designated email address.

Please provide only content directly relevant to the service wherever possible. Where it will not affect the assessment, you may cover unnecessary identity document numbers, residential addresses and similar information. Email and other internet transmission methods cannot be guaranteed to be completely secure. We will take reasonable protective measures appropriate to the sensitivity of the information, in accordance with this policy.

If you have already sent a report through WeChat or WeCom by mistake, please contact us promptly. We will assess whether access needs to be restricted and, where permitted by applicable law and no record-retention obligation applies, take reasonable steps to delete or de-identify unnecessary information within our control. Content independently processed or retained by third-party platforms may remain subject to their terms and privacy policies.

9Cookies, website analytics and security verification

We may use the following technologies and service providers to support website operation, visitor statistics, client communications, security and improvements to the user experience.

The relevant functions depend on the services and configurations actually enabled on our official website.

9.1 Cloudflare

We may use Cloudflare for:

• Website hosting and content delivery;
• Website security protection;
• Storage of form data and related files;
• Cloudflare Turnstile security verification;
• Necessary website access logs and operational support.

Depending on the functions used, Cloudflare may process IP addresses, browser information, device characteristics, access logs and data submitted through its hosting or storage functions.

Cloudflare Turnstile is primarily used to identify and reduce automated submissions, bot visits and other misuse.

9.2 Google Analytics

We may use Google Analytics to understand website usage, including:

• Page views;
• Visitors’ approximate countries or regions;
• Traffic sources;
• Device and browser types;
• Website visits and interactions.

Google Analytics may process relevant visit data through cookies and similar technologies.

We will take reasonable steps to avoid sending clients’ names, contact details, medical histories or other sensitive health information submitted in health questionnaires to Google Analytics.

You can manage cookies through your browser settings or use Google’s Analytics opt-out tool:

tools.google.com/dlpage/gaoptout

9.3 Google Gmail

Our personnel may use Google Gmail for client enquiries, booking arrangements, service follow-up and other necessary business communications.

If you contact us by email, the content, attachments and technical email information may be processed and stored by Google’s email service.

For sensitive medical documents such as health check reports or blood test reports, please contact your nutrition professional first to obtain the dedicated report-receiving email address and submission instructions. General contact or privacy enquiry email addresses published on the website are not report-submission channels. See section 8.3.

9.4 Tencent services

If you communicate with us through WeChat, WeCom or other Tencent tools that are actually enabled, the relevant information may be processed as set out in section 8 and section 11 of this policy.

9.5 Managing cookies

You can manage some cookies and website tracking functions through your browser settings.

Disabling certain necessary technical functions may affect the normal operation of the website.

For non-essential tracking or marketing analytics activities that legally require additional consent, we will provide appropriate notices and choices.

We will not arbitrarily combine website visit data with clients’ health information for unrelated marketing profiling simply because we hold that visit data.

10Who we disclose information to

We disclose personal information to relevant recipients only within the scope permitted by applicable law, actual service needs and necessary authorisation requirements.

10.1 Service providers you choose or are told about in advance

If you would like us to help book, contact or refer you to a dietitian, nutritionist, other health professional or partner service provider, we may give the provider you choose, or a provider we have told you about in advance, the necessary information directly related to making contact and arranging the service.

This usually includes:

• Your name or preferred form of address;
• Your telephone number, WeChat account or other necessary contact details;
• The type of service you would like;
• Convenient times for contact or appointments;
• Other necessary service information you agree to provide.

We will not provide detailed health records, examination reports or complete chat records to unrelated providers merely because you make an enquiry.

If a referral requires disclosure of sensitive health information, we will comply with applicable law and the necessary consent requirements.

Providers that operate as independent organisations must comply with applicable privacy and health information protection laws and are responsible for their own independent information processing activities.

10.2 Overseas partner company

Subject to the law and relevant authorisation arrangements, we may disclose information necessary to provide services to the following overseas partner company:

This company may participate in client enquiries, nutrition and health management, information organisation, service follow-up, client communications, digital service support and other necessary work.

We will limit the scope of its access, use and further disclosure of personal information according to the specific service purpose, and adopt appropriate contractual and security management measures.

10.3 Technology service providers

We may use the following technology providers:

Cloudflare

For website hosting, content delivery, form data storage, security protection and Turnstile verification.

Google

For Google Analytics website analytics and the Gmail email service used by our team.

Tencent

If you communicate with us through WeChat, WeCom or other Tencent services that are actually enabled, the relevant platforms and technical functions may be supported by Tencent and the corresponding service providers.

Typeform

For collecting initial human assessment questionnaires and the personal and health information submitted in them.

Alibaba Cloud and Tencent Cloud

We may use cloud computing, storage and related technical support according to the products actually enabled. The specific data categories and processing regions depend on the actual deployment.

Other necessary technology providers

According to actual business needs, we may also use cloud computing, database, AI-assistance, client management, payment and cybersecurity providers.

For providers acting as processors on our behalf, we will restrict the purpose and scope of processing through contracts or other reasonable measures, according to applicable law and the provider’s particular role.

Some platform providers may be independently responsible for processing activities they determine themselves and may handle relevant information under their own privacy policies.

10.4 Authorised personnel and professional service personnel

To deliver services, authorised dietitians, nutritionists, client service personnel, health management personnel and necessary operational support personnel may access relevant personal information to the extent required for their duties.

We will set appropriate access permissions and confidentiality requirements according to each role.

10.5 Professional advisers

We may disclose relevant information to accountants, lawyers, auditors or other professional advisers to the extent necessary.

Those advisers must comply with applicable confidentiality and personal information protection obligations.

10.6 Legal and regulatory requirements

Where required or authorised by law, we may provide necessary information to relevant government departments, regulators, courts or law enforcement agencies.

10.7 Business sale, merger or restructuring

If our business undergoes a sale, merger, asset transfer or restructuring, personal information may be transferred to the entity taking over the relevant business, subject to legal requirements.

We will take appropriate measures to protect the transferred information and address any legally required notices or authorisations. The receiving entity must comply with applicable privacy laws and relevant information protection obligations.

10.8 We do not sell personal information

We do not sell or rent your personal information or health data.

Without the necessary authorisation, we will not provide your personal information to insurers, data brokers, advertisers or other third parties for their independent marketing purposes.

If you actively ask us to assist with an insurance claim or another insurance-related matter that involves providing information to an insurer, we will explain the arrangements and obtain the necessary authorisation according to the particular service and applicable law.

11Overseas disclosure and cross-border data processing

To provide services, support client communications and maintain website operations, we may use overseas partner companies and technology providers, or allow them to access relevant information under authorisation.

11.1 Overseas partner company: mainland China

Our main overseas partner company is:

Depending on the specific service arrangements and applicable law, authorised personnel of the Guangzhou partner company may access or process necessary personal information in mainland China, including:

• Names, nicknames and contact details;
• WeChat accounts and necessary communication records;
• Health questionnaires and service needs;
• Necessary health information relating to nutrition management;
• Food records, service plans and follow-up records;
• Other information genuinely necessary to provide the relevant services.

The information may be used for nutrition consultations, health management, client communications, service follow-up, information organisation and necessary service support.

In accordance with applicable law, we will take reasonable measures to limit the purposes, scope and permissions for the overseas partner company’s processing of information.

11.2 Overseas processing by Cloudflare and Google

Depending on the actual deployment and service configuration, Cloudflare and Google may process, transfer or store relevant data outside Australia.

This may involve the United States and the locations of data centres or services actually used by the relevant providers.

Different providers process different data:

Cloudflare: May process website access logs and information submitted or stored through its hosting, form and database functions.

Google Analytics: May process website visit, device, browser and statistical information.

Google Gmail: May process emails exchanged between you and us, attachments and related technical information.

Based on actual system configurations and information that can reasonably be determined, we will identify relevant overseas recipients and their countries or regions, and update the relevant notices where required by applicable law.

11.2A Typeform and cloud services

We currently use Typeform to collect initial assessment questionnaires. Its primary hosting facilities are in the United States; some eligible plans support EU data hosting, and the actual processing region depends on our account configuration. The service team in mainland China may access necessary information within the authorised scope. If Alibaba Cloud or Tencent Cloud is enabled, we will disclose the relevant cross-border processing arrangements according to the regions and service configurations actually used.

11.3 Overseas processing by WeChat and Tencent

If you choose to communicate with us through WeChat, WeCom or other Tencent services, relevant information may be processed by Tencent and the corresponding providers.

These activities may involve mainland China and other regions actually used by the relevant Tencent services.

We cannot directly control every aspect of Tencent’s processing as an independent platform operator. Its own processing activities may be governed by its terms of service, privacy policies and applicable law.

However, we remain responsible for complying with applicable Australian privacy laws in relation to information we actively provide to Tencent services and the collection, use or disclosure activities we determine ourselves.

You may choose not to communicate through WeChat and ask us about email or other available channels.

11.4 Cross-border information protection under APP 8

We handle disclosures of personal information to overseas recipients in accordance with the applicable requirements of Australian Privacy Principle 8 (APP 8).

Where APP 8.1 applies, we will take reasonable steps appropriate to the particular risks to ensure that overseas recipients handle personal information in accordance with the relevant requirements.

These steps may include:

• Assessing overseas recipients’ information protection capabilities;
• Establishing appropriate contractual and confidentiality obligations;
• Restricting processing purposes and access permissions;
• Limiting further disclosure or subcontracted processing where needed;
• Applying appropriate security safeguards to sensitive information;
• Establishing security incident response and information deletion arrangements.

In circumstances specified by applicable law, the Australian operating entity may remain responsible for an overseas recipient’s improper handling of information.

11.5 Separate consent for particular overseas disclosures

If we propose to rely on the specific informed-consent exception in APP 8.2(b) for an overseas disclosure, we will clearly explain the relevant legal consequences and obtain valid consent before the disclosure, as required by law.

This may include clearly explaining that, if you consent to a disclosure under that exception, APP 8.1 will not apply to that disclosure. If the overseas recipient subsequently mishandles the information, we may no longer bear the responsibility that would otherwise apply under section 16C of the Australian Privacy Act, and you may be unable to obtain the corresponding remedies under the Australian Privacy Act for that overseas recipient’s conduct.

We will not assume that you have agreed to give up the protection of APP 8.1 merely because you browse our website, purchase services or choose WeChat.

11.6 Transfers of NSW health information outside the jurisdiction

If the information we handle is subject to the Health Records and Information Privacy Act 2002 (NSW), we will also comply with its applicable requirements for transferring health information outside the jurisdiction, including Health Privacy Principle 14.

11.7 Choices and enquiries about cross-border processing

You may contact us to understand the main cross-border processing arrangements relating to you.

Where permitted by applicable law, you may withdraw relevant consent or make other privacy requests.

If a particular cross-border processing activity is genuinely necessary to provide a specific service, we will explain available alternatives and how refusing or withdrawing consent may affect that service.

12Promotional messages and client communications

We may respond to service enquiries, provide service descriptions and quotes, and carry out necessary enquiry follow-up through the channel you actively use to contact us.

For clients who have purchased services, we may send necessary notices such as booking confirmations, health management reminders, nutrition advice, service progress updates, payment information and after-sales communications.

If we send separate commercial promotions, offers or other direct marketing messages, we will comply with the Spam Act 2003 (Cth) and other applicable laws, including obtaining the required consent and providing appropriate unsubscribe methods.

We will not assume that you consent to the use of sensitive health information for advertising targeting or other independent marketing purposes merely because you have purchased a service.

You can stop receiving relevant marketing messages by replying to unsubscribe, using the relevant unsubscribe function or contacting us.

Opting out of marketing does not affect necessary service notices.

13Client stories, reviews and service outcomes

Nutrition Joy may invite clients to provide feedback or reviews about our services.

We may use aggregated or appropriately de-identified information to evaluate service outcomes and improve service quality.

If we wish to publicly display content that can identify you, such as:

• Your name, photographs or videos;
• Weight changes and before-and-after body photographs;
• Personal health experiences and service outcomes;
• WeChat screenshots or client reviews;
• Other identifiable client stories;

We will obtain the relevant separate authorisation under applicable law and explain the public purpose, manner and scope of use.

Your decision about whether to agree to a public client story should not affect your normal access to services you have purchased.

Without the necessary authorisation, we will not publicly disclose personal health information that identifies you.

14Information storage, security and retention

We will take reasonable technical and organisational measures appropriate to the sensitivity of the personal information and the specific risks to protect it against loss, misuse, unauthorised access, modification or disclosure.

Depending on the systems and risks involved, these measures may include:

• Limiting access to authorised personnel;
• Appropriate account and access-permission management;
• HTTPS-encrypted website transmission;
• Appropriate security measures for data storage and backups;
• Confidentiality requirements for employees and partners’ personnel;
• Reasonable system security and incident response procedures;
• Management of overseas partners’ access to and use of information.

We may use Cloudflare and other authorised technology providers that are actually enabled to store website forms, service records or related files.

Email, WeChat and other communication content may also be processed according to the technical and storage arrangements of the relevant platforms.

Information may be stored in Australia, mainland China and other actual processing locations disclosed in accordance with the law.

14.1 Retention periods

We retain information only for as long as necessary to provide services, meet reasonable business needs, comply with legal obligations and deal with lawful disputes.

For information subject to NSW private health service record-retention requirements:

• Relevant health records for adult clients generally must be kept for at least 7 years after the last health service was provided;
• Relevant health records collected when a client was under 18 generally must be kept until the client turns 25.

Other applicable laws or lawful record-retention requirements may prescribe different or longer periods.

For non-health-service records, enquiry leads, order information and other personal information, we determine the appropriate retention period according to the processing purpose, applicable law and reasonable business needs.

When information is no longer needed and there is no legal requirement to retain it, we will take reasonable steps to securely delete or de-identify it.

If applicable NSW law requires records of the deletion, disposal or transfer of health information to be kept, we will also comply with those obligations.

We cannot guarantee that any internet transmission or data storage method is completely secure, but we will take reasonable measures to reduce the relevant risks.

15Anonymity, pseudonyms and children’s information

You may browse publicly available website content without providing your real name.

Where lawful and practicable, we also allow you to use a nickname for an initial enquiry.

However, we may need necessary, accurate identifying information to provide personalised health management or professional consultations, process payments or meet legal obligations.

For clients under 18, we generally require a parent or legal guardian to participate in service arrangements, and obtain appropriate consent according to the young person’s age, understanding and applicable law.

Where the relevant law recognises a young person’s capacity to make their own decisions, we will consider their understanding, privacy rights and the particular service circumstances.

If you provide information on behalf of a family member, you should ensure that you have appropriate authorisation or another lawful basis.

16Data breaches and security incidents

If a personal information breach, unauthorised access, loss or other security incident occurs or is suspected, we will take reasonable steps appropriate to the circumstances to investigate, assess the risks, contain the incident and reduce possible harm.

If an incident meets the notification requirements of Australia’s Notifiable Data Breaches Scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

If an incident involves an overseas partner company or technology provider, we will also coordinate the response according to applicable law and the relevant cooperation arrangements.

17Access, correction, withdrawal of consent and deletion requests

Within the scope provided by applicable law, you may:

1. Request access to personal information we hold about you;
2. Request correction of inaccurate, out-of-date, incomplete or misleading information;
3. Withdraw consent previously given for a particular processing activity;
4. Request deletion of information that no longer needs to be retained under the law;
5. Ask how we use, disclose or process your information across borders;
6. Raise questions or complaints about the handling of personal information.

You may send requests to the privacy contact email address listed in section 20. We will also handle relevant requests received through other reasonable means in accordance with the law.

We may ask to verify your identity to protect information security.

There is no application fee for making an access or correction request. If a reasonable, legally permitted fee for providing information applies, we will explain it in advance.

We generally aim to respond to requests within 30 days, subject to the timeframes and exceptions under applicable law.

We may be unable to immediately delete health records, financial information and other information that must legally be retained, but will restrict unnecessary further processing according to applicable requirements.

Withdrawing consent does not affect processing previously carried out lawfully, and does not automatically remove contractual or legal obligations already incurred.

You may contact our Privacy Officer to withdraw optional consent for training our own AI models. For processing previously completed lawfully and models already trained, we will handle relevant requests according to applicable law and technical feasibility.

18Complaints and dispute handling

If you believe we have handled personal information improperly or breached this policy or applicable privacy law, you may complain to the privacy contact email address listed in section 20.

We will investigate carefully and generally aim to provide a substantive response within 30 days of receiving a complaint.

If you are dissatisfied with the outcome, you may contact:

Office of the Australian Information Commissioner (OAIC)

Website: www.oaic.gov.au

For matters subject to NSW health privacy laws, you may also refer to the relevant procedures of the Information and Privacy Commission NSW (IPC NSW):

Website: www.ipc.nsw.gov.au

19Updates to this Privacy Policy

We may update this policy because of changes in laws or regulations, adjustments to our services, technological developments or business operational needs.

The updated version will be published on our official website and show its last-updated date.

If a change may materially affect how personal information is handled, we will take appropriate steps to notify you.

For processing activities that legally require renewed consent, publishing an updated policy will not replace the necessary authorisation process.

20Contact us

If you have questions about this Privacy Policy or the collection, use, storage or disclosure of personal information, or would like to access or correct personal information, withdraw relevant consent or make a privacy complaint, you can contact us as follows.