1. About this Privacy Notice

Optismith Pty Ltd ("Optismith", "we", "us" or "our") provides a wellness and functional-health education service, delivered mainly through our mobile app and supporting website (together, the "App"). This Privacy Notice explains how we collect, hold, use, disclose and protect your personal information, including sensitive health information.

We are based in Australia and are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we have clients in New Zealand, the United Kingdom, the European Union, the United States, Singapore and Canada, additional privacy laws may apply to you depending on where you live (see section 12). Where those laws give you stronger rights, we honour them.

Optismith is not a medical service. Nothing in the App is medical advice, diagnosis or treatment. Please read this alongside our Terms of Service, which explains the limits of what we do.

2. Quick summary

We collect information you give us, information created as you use the App, and information from third parties you authorise (such as a lab).
We collect sensitive health information - including blood test results, symptom analyses and health questionnaires - and we only do this with your explicit consent.
We use artificial intelligence (AI) to help process and interpret your information. A human reviews outputs that matter, and we tell you where automated processing is involved.
Some of our service providers store or process data overseas, including in the United States.
You have rights over your information, including access, correction, and (in many cases) deletion, and you can complain to us or to a regulator.

3. The information we collect

3.1 Personal information

Identity and contact details: your name, email address, phone number, and country or region.
Account and login information: how you access the App (we use email one-time codes rather than passwords).
Payment and membership information: your membership status, program and subscription details, and records of payments. We do not store your full card number - payments are handled by our payment processor (see section 6).
Usage information: how you interact with the App, device and technical information, and log data.
Communications: messages you send us or your coach, support requests, and your marketing preferences.

3.2 Sensitive information (including health information)

Under the Privacy Act, health information is "sensitive information" and receives a higher level of protection. We only collect it with your consent. The health information we collect includes:

Blood test results and lab reports you upload or authorise us to receive.
Your Symptom Picture Analysis (SPA) and other health assessments and questionnaires you complete.
Information you enter about your symptoms, habits, diet, exercise, supplements and progress.
Anything you choose to tell us in messages, notes or uploaded documents.

PLEASE ONLY PROVIDE HEALTH INFORMATION ABOUT YOURSELF, OR ABOUT SOMEONE WHOSE CONSENT YOU HAVE.

If you upload information about another person, you confirm you are allowed to share it with us.

4. How we collect your information

Directly from you - when you sign up, complete an assessment, upload a document, book or attend a call, or message us.
Automatically - as you use the App, through cookies and similar technologies on our website (see section 9).
From third parties you authorise - for example, a pathology or blood-testing provider, where you have consented to them sharing your results with us.

5. Why we collect, use and disclose your information

We use your information to:

Provide the App and our wellness and education services, including generating your reports, analyses, plans and recommendations.
Personalise your experience and track your progress.
Communicate with you, respond to your questions and provide support.
Process your membership, program and payments, and manage failed or lapsed payments.
Improve, develop, secure and troubleshoot the App.
Send you marketing about our services where you have not opted out (you can unsubscribe at any time).
Meet our legal, tax and record-keeping obligations, and protect our legal rights.

We handle sensitive health information only for the purpose of providing our services to you, or for another purpose you would reasonably expect and that is directly related, or where you have consented, or where the law requires or permits it.

6. Who we share your information with

We do not sell your personal information. We disclose it only as needed to run our service, to the following kinds of recipients:

Technology and hosting providers who store and process data for us (including our database and storage provider).
Our AI technology providers, who process information to help generate analyses and content (see section 7).
Our payment processor, which handles card payments and subscriptions and stores your payment details on our behalf.
Communication and scheduling tools we use to email you, run video calls, and book appointments.
Blood-testing, pathology or other health providers you have chosen or authorised.
Professional advisers (such as lawyers and accountants), and, if our business is sold or restructured, the parties to that transaction.
Courts, regulators or law enforcement, where required or permitted by law, or to protect someone's safety.

7. Use of artificial intelligence and automated processing

We use AI and machine-learning technologies, including tools provided by third parties, to help deliver our services - for example, to help interpret blood results, generate draft analyses and reports, produce plans and recommendations, and answer general queries.

Human oversight.

Where AI output could meaningfully affect you, a person reviews it before it is relied upon. Our reports and health-related outputs are informational and educational; they are not automated medical decisions, and they do not replace advice from a qualified health professional.

Your information and AI training.

We do not permit your sensitive information to be used to train a third-party provider's AI models. Some AI processing occurs overseas, including in the United States (see section 8).

Automated-decision transparency.

Where we use a computer program to make, or substantially help make, a decision that could significantly affect your rights or interests, we will tell you and explain, in general terms, how that processing works. We maintain human review of any such decision.

8. Overseas disclosure

Some of our service providers, and their sub-processors, are located outside Australia or store data outside your own country - including in the United States. This means your personal information (including health information) may be stored, transferred or accessed overseas.

Where we disclose your information overseas, we take reasonable steps to ensure it is handled consistently with this Privacy Notice and applicable privacy law, including through our contracts with those providers. By using the App and providing your information, you consent to these overseas disclosures for the purposes described in this Notice.

9. Cookies and analytics

Our website uses cookies and similar technologies to keep you signed in, remember your preferences, keep the site secure, and understand how it is used so we can improve it. You can control cookies through your browser settings, though some features may not work if you block them. Where we use analytics or advertising tools, we will describe them and your choices in our cookie settings.

10. Storage, security and retention

Security.

We take reasonable steps to protect your information using appropriate technical and organisational measures, including access controls that restrict each client's records to that client and their assigned team, encryption in transit, and restricted staff access. No system is completely secure, and information transmitted over the internet is at your own risk, but we work to protect your information and to respond promptly to any incident.

How long we keep it.

We keep your information only as long as we need it for the purposes above or as the law requires. As a general guide:

Health and assessment records: retained for at least 7 years after your last interaction with us, or, if you were under 18 when the information was collected, until you turn 25 - whichever is later, consistent with Australian health-records practice.
Account, billing and transaction records: retained for 7 years to meet Australian tax and record-keeping obligations.
Marketing information: retained while you are subscribed; if you unsubscribe, we keep the minimum needed to honour your opt-out.
If you never become a client (for example, you only take a free quiz): retained for no longer than 3 years, then deleted or de-identified.

11. Your choices and rights

Access and correction: you can ask for a copy of the information we hold about you, and ask us to correct it if it is wrong or out of date.
Withdraw consent: you can withdraw your consent to us handling your health information; this may mean we can no longer provide some or all of the service.
Deletion: you can ask us to delete your information. We will do so unless we are required or permitted by law to keep it (for example, minimum health-record or tax retention periods), in which case we will tell you what we must keep and why.
Marketing: every marketing email has an unsubscribe link, and you can opt out at any time.

To exercise any of these, contact us using the details in section 14. We will verify your identity before acting on a request.

Closing your account in the App.

If you tap "Delete my account" in the App, we close your account and remove your ability to sign in, but we retain your records in our secure systems for the periods described in section 10 (for example, to meet health-record and tax obligations, and in case you return). If you would like your information erased sooner, contact us using the details in section 14 and we will erase whatever we are not required by law to keep. If you sign up again later with the same email address, we may reactivate your existing account and history.

12. Your rights depend on where you live

Australia and New Zealand: you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (and, in New Zealand, the Privacy Act 2020).
United Kingdom and European Union: if the UK/EU GDPR applies to you, you have additional rights, including data portability and the right to object to certain processing. Our lawful basis for handling health data is your explicit consent, and, for other data, performing our contract with you and our legitimate interests.
United States: depending on your state (for example, California), you may have rights to know, delete, correct and opt out of certain uses of your information.
Singapore and Canada: you have rights under the PDPA (Singapore) and PIPEDA (Canada) respectively.

Where more than one law applies, we aim to give you the stronger protection. This section is a general guide only and not legal advice.

13. Children

The App is intended for adults (18 and over) and is not designed for children. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, please contact us so we can address it.

14. Contact us and complaints

If you have a question, want to exercise a right, or wish to make a complaint, contact us at:

Optismith Pty Ltd

Email: riley@optismith.com

We will acknowledge your request, verify your identity, and respond within a reasonable time. If you are not satisfied with our response, you can escalate to the relevant regulator - in Australia, the Office of the Australian Information Commissioner (OAIC), 1300 363 992, oaic.gov.au. Clients in other countries can contact their local privacy regulator.

15. Changes to this Notice

We may update this Privacy Notice from time to time. We will post the updated version and, where changes are significant, take reasonable steps to notify you. Please check back periodically.