Privacy policy.

1. Who we are

Irma Wellness, ABN 91 622 896 654, 3/999 Lower North East Road, Highbury SA 5089. Privacy contact: admin@irmawellness.com, 0426 355 675.

2. What information we collect

• Identity and contact details: name, phone, email, date of birth, emergency contact.
• Health information: medical history, conditions, injuries, medications, pregnancy status, surgeries and procedures, allergies, areas of concern, session notes and treatment records, and your answers on consent and health screening forms. This is sensitive information under the Privacy Act.
• Booking and payment information: appointment history, deposits and payments, gift voucher details. We do not store full card numbers. Card payments are processed by our payment providers: Zeller for in-person payments and Stripe for online bookings.
• Website information: device and browser data, IP address and cookies, and enquiries you send us.
• Communications: messages, emails and feedback you send us.

3. How we collect it

We collect information directly from you when you book, complete forms, attend appointments, contact us or use our website. With your consent, we may also collect information from your doctor or another health professional.

4. Why we collect and use it

We use your information to:

• deliver safe and appropriate services and assess whether a service is suitable for you;
• keep accurate health and treatment records so we can provide continuity of care;
• manage bookings, deposits, payments and cancellations;
• contact you about your appointments;
• meet our legal, insurance and professional obligations;
• improve our services and run our business; and
• with your consent, send you offers and news. You can opt out at any time.

5. Storage of your information and health records

By providing your information and using our services, you acknowledge that we may store your personal information and health records, including your consent forms, health history and treatment notes, in our client management and booking system and on our website platform, and in secure cloud-based systems. These systems may be hosted by third-party providers and, in some cases, outside Australia. Our platform provider, Lovable, stores customer data in supported regions across the United States, the European Union and Asia Pacific, through Lovable Cloud and its infrastructure sub-processors.

We take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, including password protection, access limited to authorised staff, and secure systems. If there is an eligible data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by law.

6. Who we share it with

We do not sell your information. We may share it only:

• with your consent, including with your doctor or other health professionals;
• with service providers who help us run the business (booking and records software, payment processing, email and website hosting, accountants, IT support), who must protect your information;
• with our insurers or professional bodies where needed;
• where required or authorised by law, for example a court order or a serious threat to health or safety; and
• in an emergency, to ambulance or medical personnel.

7. How long we keep it

We keep health records, consent forms and session notes for at least 7 years after your last appointment, and booking, payment and refund records for at least 7 years for tax, accounting and legal purposes. We keep this information so we can provide safe care, meet our tax and insurance obligations, and respond to any complaint, claim or legal request. After that, we securely destroy or de-identify it.

8. Your rights: access, correction and deletion

You can ask to see the personal information we hold about you and ask us to correct it. You can also ask us to stop contacting you for marketing, and we will do so straight away. You can ask us to delete your personal information, but we are generally not able to delete health records, consent forms, session notes or payment records during the 7-year retention period, because we need to keep them for tax, insurance and legal reasons. If we can't delete something, we will tell you why and make sure it is kept securely and used only for those purposes. Once the retention period has ended, we will securely destroy or de-identify your information. We may keep information for longer if we need it for an ongoing complaint, claim or legal matter.

To make any of these requests, contact our privacy contact (see section 1). We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first. In limited cases the law allows us to refuse access; if we do, we will tell you why.

9. Marketing

We will only send you marketing messages with your consent, and every message will let you unsubscribe. You can also contact us at any time to opt out. We handle these in line with the Spam Act 2003 (Cth).

10. Cookies and website analytics

Our website may use cookies and similar tools to make the site work, remember your preferences and understand how the site is used. You can adjust your browser settings to refuse cookies, but some features may not work.

11. Children

Our services are for clients aged 18 and over. We do not knowingly collect information from anyone under 18.

12. Photos and recordings

We may record photos or video of our space, services or clients to use as content on our social media. We only do this with your separate written consent on a content consent form, and we also ask for your verbal consent before recording. Content that identifies you is published only with that consent, and you can withdraw consent or ask us to remove content at any time. Declining will not affect your service.

13. Complaints

If you think we have breached your privacy, please contact our privacy contact in writing. We will investigate and respond within a reasonable time. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992.

14. Changes to this policy

We may update this policy from time to time. The current version will always be on our website. Continuing to use our services after an update means you accept the changes.

15. Your consent

By booking with us, completing our forms or using our website, you consent to the collection, use, storage and disclosure of your personal and health information as described in this policy.