About this policy
Fit and Feminine Pty Ltd (Fit and Feminine, we, us or our) respects your privacy and is committed to handling personal information responsibly.
This Privacy Policy explains how we collect, hold, use and disclose personal information when you:
- visit or use our website, forms, apps or online services;
- enquire about, apply for or participate in personal training or online coaching;
- purchase or access a digital product, including an eBook;
- communicate with us by email, telephone, social media, an app or another channel; or
- otherwise interact with our business.
This policy is intended to support our obligations under applicable privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and, where applicable, the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles.
The information we collect and hold
The personal information we collect depends on how you interact with us and may include:
Identity and contact information
- your name, date of birth, pronouns and contact details;
- emergency contact information;
- social media handle and communication preferences; and
- parent or guardian information where relevant.
Service, application and account information
- information supplied in enquiries, consultation forms and coaching applications;
- your goals, experience, preferences, availability and program participation;
- appointment, attendance, account and service history;
- messages, feedback, complaints and customer-support records; and
- information needed to manage contracts, memberships or coaching arrangements.
Health and other sensitive information
Where reasonably necessary to provide a safe and appropriate service, and generally with your consent, we may collect:
- physical or mental health information;
- injuries, pain, disability, medical conditions, symptoms and relevant medications;
- information about pregnancy, prenatal or postnatal recovery;
- information relevant to menstrual, reproductive or hormonal health, including conditions such as PCOS or endometriosis;
- dietary requirements, allergies, nutrition information and eating preferences;
- height, weight, body measurements, fitness assessments and progress information;
- progress photographs and exercise or technique videos; and
- information from a health professional or support person where you have authorised this or the law otherwise permits it.
Information collected while providing a health or fitness service may be treated as health information even if it would not ordinarily be sensitive in another context.
Purchase and payment information
We may collect:
- billing details, order history, transaction status and refund information;
- details of products or services purchased;
- payment method, payment reference and limited payment information made available by a payment provider; and
- digital-product access and download records.
Payments may be processed by third-party payment providers. We generally do not receive or retain your complete card number or security code.
Website and technical information
When you use our website or online services, we and our service providers may collect:
- IP address, browser, device and operating-system information;
- pages viewed, links selected, referral source and approximate location;
- session, cookie and similar technology information; and
- information used for website security, fraud prevention, analytics and service improvement.
How we collect information
We usually collect personal information:
- directly from you through conversations, consultations, forms, apps, checkout pages, bookings, email, social media and other communications;
- through our website and online services using cookies and similar technologies;
- from a parent, guardian, authorised representative, referrer or health professional where you have consented or collection is otherwise permitted;
- through coaching, scheduling, payment, communication and fitness platforms you choose to use or connect; and
- from our authorised staff, trainers and contractors when they record information needed to deliver or manage your service.
You may browse general website information without identifying yourself. However, we need accurate identifying, contact, payment and relevant health information to provide many of our services safely and effectively.
Please do not provide personal information about another person unless you have authority to do so.
Why we collect, hold, use and disclose information
We may handle personal information to:
- respond to enquiries and assess applications;
- determine whether a service is suitable and can be provided safely;
- design, deliver, monitor and adjust training, coaching and nutrition-support services;
- track progress, conduct check-ins and provide exercise-form feedback;
- communicate with you, schedule services and provide customer support;
- manage accounts, contracts, payments, refunds, orders and digital-product access;
- operate, protect and improve our website, services and business systems;
- manage staff, contractors, insurance, professional advice, disputes and complaints;
- prevent or investigate misuse, fraud or security incidents;
- meet our legal, regulatory, accounting and record-keeping obligations;
- send service-related notices; and
- send marketing where you have consented or where otherwise permitted, with a clear way to unsubscribe.
We will not use health or other sensitive information for direct marketing without your consent.
If you do not provide information we reasonably require, we may be unable to assess your application, personalise a program, process a purchase or provide a service safely.
Health information and consent
We only collect health and other sensitive information where it is reasonably necessary for our functions and where you consent or another legal basis permits the collection.
Where consent is required, we seek it through the relevant intake, application, consultation or app process. This policy provides information about our practices but is not a substitute for specific consent where specific consent is required.
You may withdraw consent to optional handling of sensitive information by contacting us. Withdrawal will not affect handling that occurred before withdrawal. It may also limit our ability to provide a safe or personalised service.
Our services do not replace medical diagnosis, treatment or advice. We may recommend that you obtain medical clearance or consult an appropriately qualified health professional before commencing or continuing a program.
Where you authorise us, we may communicate with a relevant health professional about matters needed to coordinate your service. We do not routinely disclose health information for unrelated purposes.
Photographs, videos and testimonials
Progress photographs and exercise videos supplied for coaching are used to deliver and monitor your service.
Promotional consent is optional and refusing it will not affect your access to coaching or other services. We will not publish your image, transformation, testimonial, health story or identifiable results for promotional purposes unless we have obtained separate, specific consent and, where appropriate, parent or guardian consent.
You may withdraw promotional consent for future use by contacting us. We will take reasonable steps to remove the material from channels we control, but material already lawfully distributed, copied or shared by others may not be capable of complete recall.
Who we may disclose information to
We may disclose personal information, where reasonably necessary, to:
- authorised Fit and Feminine staff, trainers and contractors on a need-to-know basis;
- technology, hosting, cloud-storage, email, website, form, scheduling, coaching and customer-support providers;
- payment, buy-now-pay-later, accounting, fraud-prevention and transaction providers;
- professional advisers, insurers, auditors, debt-recovery providers and legal representatives;
- a health professional or support person where you have authorised the disclosure;
- regulators, courts, law-enforcement bodies or other parties where required or authorised by law;
- emergency services or appropriate persons where reasonably necessary to lessen or prevent a serious threat to health or safety; and
- a purchaser or successor involved in a proposed or completed sale, restructure or transfer of all or part of our business, subject to appropriate confidentiality protections.
Systems and providers we use may include Trainerize, Jotform, WordPress and WooCommerce and their hosting or plugins, Stripe, PayPal, Afterpay, TidyCal, MyFitnessPal, Loom or Atlassian, together with email, cloud-hosting and analytics providers. The providers used may change as our business systems evolve.
A provider's own privacy terms may also apply where it collects information directly from you or handles it independently. This does not limit our responsibilities for our own handling of personal information. Where you connect an external account, wearable or app, the information exchanged will depend on your settings and the permissions you grant.
Overseas handling of information
Some service providers operate or store, process or support information outside Australia. As a result, personal information may be disclosed to, stored by, accessed from or processed by overseas recipients.
Depending on the service, transaction and account or data-residency settings, overseas recipients are likely to be located in the United States, Canada, New Zealand, the United Kingdom, Switzerland, Singapore, India, Japan, South Korea, the Philippines, China, Brazil, South Africa and countries in the European Union or European Economic Area, including Germany, Ireland, Sweden and Romania. Providers may also process information in other countries where they or their contracted service providers operate. This list does not mean that every record is handled in every listed country.
We take reasonable steps required by applicable law before disclosing personal information overseas. However, privacy protections in another country may differ from those in Australia.
You may contact us for current information about the likely locations relevant to a particular service.
Marketing communications
We may send marketing communications where you have consented or where permitted by law. You can unsubscribe using the link provided in an electronic message or by emailing us.
Unsubscribing from marketing will not prevent us from sending necessary transactional, safety, account or service communications.
Children and young people
We take additional care when handling information about children and young people.
We assess a young person's capacity to provide informed consent on a case-by-case basis. We will generally require the involvement and consent of a parent or legal guardian for a client under 15 or for any young person who does not have capacity to consent. We may also require parent or guardian involvement for any client under 18 as a condition of providing a particular service.
Where practicable, we will explain the relevant privacy matters to the young person in an appropriate way and involve them in decisions affecting their information.
A parent or guardian must not provide information about a child unless they have authority to do so.
Some connected third-party apps have their own minimum-age requirements. A young person must not use an external platform if doing so would breach that platform's terms, and we may offer an alternative process where reasonably available.
Storage, security and data breaches
Personal information may be held electronically or in hard copy by us or by contracted service providers.
We take reasonable administrative, technical and physical steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps may include access controls, passwords, secure systems, staff confidentiality requirements and limiting access to people who need the information for their role.
No method of transmission or storage is completely secure. If an eligible data breach occurs, we will investigate and make notifications required under applicable law.
Retention and deletion
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, insurance, accounting, dispute-management and record-keeping requirements.
As a NSW health service provider, we may be required to retain health information:
- for 7 years from the last occasion on which a health service was provided, where the information was collected while the individual was an adult; or
- until the individual reaches 25 years of age, where the information was collected while the individual was under 18.
Other records, including financial and transaction records, may be retained for different periods required by law.
When information is no longer required, we take reasonable steps to securely destroy or de-identify it, subject to legal and technical limitations. Backup copies may remain for a limited period until securely overwritten.
You may request deletion, but we may need to retain some information where required or permitted by law or where reasonably necessary to establish, exercise or defend a legal claim.
Accessing and correcting your information
You may request access to personal or health information we hold about you or ask us to correct information that is inaccurate, incomplete, out of date, irrelevant or misleading.
To make a request, email cindy@fitandfeminine.com.au. Please describe the information concerned and the action requested. We may need to verify your identity before releasing or changing information.
We will respond within the period required by applicable law and without undue delay. Access may be refused or limited only where the law permits. If we refuse a request, we will generally provide written reasons and available complaint options. We will tell you in advance if a permitted administrative charge applies.
Privacy enquiries and complaints
If you have a privacy question or believe we have mishandled your information, please contact:
Privacy OfficerFit and Feminine Pty LtdKingsgrove, New South Wales, Australiacindy@fitandfeminine.com.auPlease provide enough information for us to understand and investigate the issue. We will acknowledge your complaint, investigate it fairly and aim to respond within 30 days. If more time is reasonably required, we will explain why and provide an updated timeframe.
If you are not satisfied with our response, you may contact:
- the Office of the Australian Information Commissioner at oaic.gov.au; or
- for a complaint involving health information in New South Wales, the Information and Privacy Commission NSW at ipc.nsw.gov.au.
Automated and computer-assisted decisions
As at the last-updated date, we have not arranged for a computer program to use personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests.
We may use automated features for routine reminders, scheduling, administration and program prompts. Material coaching and suitability decisions involve human oversight. If we introduce a relevant automated or computer-assisted decision arrangement, we will update this policy to explain the kinds of personal information used and the kinds of decisions made or assisted by the program, as required by law.
Changes to this policy
We may update this Privacy Policy when our services, technology, providers or legal obligations change. The current version will be published on our website with the date it was last updated.
We encourage you to review the policy periodically.