Healthlab Online Privacy Policy

1. PURPOSE OF OUR POLICY
   1. Healthlab Online Limited (Company Number 10616389) of East Witheridge Penn Road, Knotty Green, Beaconsfield, Buckinghamshire, United Kingdom, HP9 2TW and/or each of its subsidiaries (as applicable), including Prescribed Investments Pty Ltd trading as HealthLab Australia (ABN 92 169 233 916) (we, us or our) provides health, nutrition and fitness programs, which may consist of online information, forums and services (Online Services), diet plans, recipes, exercises, forums and professional in-person training and consultation (Programs). Our websites include www.cleverguts.com, http://www.ifast12.com, www.ifast12online.com; https://www.thebloodsugardiet.com.au, thebloodsugardiet.com, www.fast-exercises.com and any other URL operated by the Company.
   2. A participant in any Program (Participant) may also engage services from a qualified health professional independent of the Company (Professional).
   3. We have adopted this Privacy Policy to ensure that we have standards in place to protect the Personal Information that we collect about individuals that is necessary and incidental to:
      1. Providing the system and services that we offer (including Programs); and
      2. The normal day-to-day operations of our business.
   4. This Privacy Policy follows the standards of the Australian Privacy Principles set by the Australian Government for the handling of Personal Information under the Privacy Act 1988 (Cth)) and application in the United Kingdom of the Data Protection Act 1998. This Policy also takes into account general application in the European Union of the General Data Protection Regulation (GDPR) from 25 May 2018. Together, we refer to applicable data protection regulation as the Privacy Law.
   5. By publishing this Privacy Policy we aim to make it easy for our customers and the public to understand what Personal Information we collect and store, why we do so, how we receive and/or obtain that information, and the rights an individual has with respect to their Personal Information in our possession.
2. WHO AND WHAT THIS POLICY APPLIES TO
   1. Our Privacy Policy deals with how we handle personal data, including “personal information”, “health information” and “electronic health records” (EHR), as those terms are defined under applicable Privacy Law (and together referred to in this Privacy Policy as Personal Information).
   2. We handle Personal Information of adults and in our own right and also for and on behalf of our customers and users.
   3. We do not knowingly solicit data from or market to children under the age of 18. If a parent or guardian becomes aware that his or her child has provided us with information or may be receiving communications, we ask that this be brought to our immediate attention. We will make it our priority to address this situation and delete information relating to a child as soon as practicable. In such an event, please contact us.
   4. Our Privacy Policy does not apply to information we collect about businesses or companies, however it does apply to information which we collect about the people in those businesses or companies.
   5. The Privacy Policy applies to all forms of information, physical and digital, whether collected or stored electronically or in hardcopy.
3. CONSENT TO COLLECTION OF DATA
   1. An individual may withdraw consent or opt to not have us collect their data and communicate with them at certain times by not providing express content This may prevent us from offering them some or all of our services and may terminate their access to some or all of the services they access with or through us.
      1. Opt In – Consent. Where relevant, the individual will have the right to consent to having information collected and/or receive information from us; or
      2. Opt Out. Where relevant, the individual will have the right to exclude himself or herself from some or all collection of information and/or receiving information from us. An individual may revoke their consent at any time, and the decision to opt out will be made through the same media which allowed the individual to opt in (and potentially other media).
   2. We may send an individual important notices, such as changes to our terms, conditions and policies. Because this information is important to the individual’s interaction with us, they may not opt out of receiving these communications.
   3. If an individual believes that they have received information from us that they did not opt in or out to receive, they should contact us on the details below.
4. THE INFORMATION WE COLLECT
   1. In the course of business, it is necessary for us to collect Personal Information where we have a legitimate interest, pursuant to contract or with your consent, which we will maintain in accordance with this Privacy Policy.
   2. This information allows us to identify who an individual is for the purposes of our business, share Personal Information when asked of us, contact the individual in the ordinary course of business and transact with the individual.
   3. In connection with our Online Services and the Programs, we will collect and process the following information:
      1. Website: When you use our websites, whether for browsing, looking at free content, signing up to one of our Programs, accessing the free forums or to sign up to any one of our newsletters or promotional emails, you may be asked to fill in forms to create your own account – we may ask you to provide us with the following information: name (first name and surname), email address, account user name, phone number, address.
      2. Purchases: To complete your online purchase for any Program you will also be asked to provide our third party payment service provider with: phone number, billing address, shipping address (if different), payment details (e.g. credit card details). We do not store any credit card or other payment details ourselves.
      3. Online services and Programs: We may also obtain additional personal data, which could include more sensitive data, health information and EHR when you supply information through our websites, forums, sign-up forms, emails, Facebook community groups, programs or when completing a quiz. We also collect information regarding program completion and progression.
      4. Social Media: We may also interact with social media accounts. By interacting with us on social media platforms by way of “liking”, “following”, commenting, “retweeting” or “sharing”, you consent to our interaction with you.
      5. Website Analytics: We use website analytics to evaluate and improve our websites, offer and improve our service to all of our customers.  We may collect your IP address and device-specific information, such as the hardware model, operating system version, advertising identifier, unique application identifiers, unique device identifiers, browser type, language, wireless network, and mobile network information (including the mobile phone number);
      6. Marketing: Our third party service providers collect information when you visit our Website, in order to track browsing behaviour and shopping intent, so we can show you relevant and targeted advertising across advertising networks such as Google, Facebook and several others, and for analytics purposes and other statistical information. This information is pseudonymised to protect your privacy.
   4. Most information will be collected in association with an individual’s use of our website or a Program, an enquiry about a Program or generally dealing with us. However we may also receive Personal Information from staff, recruitment agencies and our business partners when consent has been obtained from an individual for that purpose.  In particular, information is likely to be collected as follows:
      1. Contact Information. We may collect information such as an individual’s email address, address and other information that allows us to contact the individual;
      2. Information an individual sends us. We may collect any personal correspondence that an individual sends us, or that is sent to us by others about the individual’s activities.
      3. Access When an individual accesses us physically we may require them to provide us with details for us to permit them such access.  When an individual accesses us through the internet we may collect information using cookies (if relevant – an individual can adjust their browser’s setting to accept or reject cookies) or analytical services; and/or
   5. Where a third party provides data or other information about any individual, we ensure that third party warrants has obtained necessary consent to provide such information to us for the purpose specified.
   6. We will publish changes to the way that information is collected at the point of collection and within this policy.
   7. As there are many circumstances in which we may collect information both electronically and physically, we will ensure that an individual provides express consent when their Personal Information is being collected in any other way.
   8. Where we obtain Personal Information without an individual’s knowledge (such as by accidental acquisition from a client) we will either delete/destroy the information, or inform the individual that we hold such information.
5. WHEN PERSONAL INFORMATION IS USED & DISCLOSED
   1. We will not use any Personal Information other than for the purpose for which it was collected other than with the individual’s permission, pursuant to contract or where we have a legitimate interest. The purpose of collection is determined by the circumstances in which the information was collected and/or submitted.
   2. The primary reason Personal Information is used or disclosed is to deliver the website and any Programs.
   3. Information is also used to enable us to operate our business, especially as it relates to an individual. This may include, subject to express consent (as required):
      1. The provision of goods and services between an individual and us;
      2. Verifying an individual’s identity;
      3. Communicating with an individual about:
         1. Their relationship with us;
         2. Our goods and services;
         3. Our own marketing and promotions to customers and prospects;
         4. Competitions, surveys and questionnaires, for which we will get express consent at the point of submission;
      4. Investigating any complaints about or made by an individual, or if we have reason to suspect that an individual is in breach of any of our terms and conditions or that an individual is or has been otherwise engaged in any unlawful activity; and/or
      5. As required or permitted by any law (including applicable Privacy Law).
   4. It is necessary for us to disclose an individual’s Personal Information to third parties in a manner compliant with applicable Privacy Law in the course of our business. This may include releasing the Personal Information in EHRs to Professionals if authorised by the Participant, by giving them access to the EHR.
   5. We will not disclose or sell an individual’s data to unrelated third parties under any circumstances unless applicable consent has been obtained for us to engage other companies to perform tasks on our behalf and we need to share your information with them to provide products and services to you. We will ensure that any such providers comply with the principles of applicable Privacy Law.
   6. There are some circumstances in which we must disclose an individual’s information:
      1. As part of a sale (or proposed sale) of all or part of our business;
      2. Where we reasonably believe that an individual may be engaged in fraudulent, deceptive or unlawful activity that a governmental authority should be made aware of; and/or
      3. As required or permitted by any law (including applicable Privacy Law).
6. HOW & WHERE DATA IS STORED
   1. The data that we collect from you may be transferred to, and stored outside of Australia and/or the European Economic Area (EEA) (as applicable) including with third parties. Personal information may also be transferred, processed and stored outside Australia and/or the EEA for data processing. By submitting your personal data, you agree to this transfer, processing and/or storage.
   2. We utilise third-party service providers to process information, communicate with individuals to store Personal Information and to host or transmit basic health information. These services include:
      1. Amazon Web Services: operated by Amazon Web Services Inc. (a company incorporated in the United States of America) that host on servers that may be located in Australia, The United States of America and/or the United Kingdom; and
      2. Media Cloud: who provide us with email and website hosting services.
      3. Mailchimp: who store and manage website user and program user email addresses and other information, as well as providing with email automation services.
      4. PayPal: who provide payment processing services.
      5. Google Analytics: who monitor anonymised website browser behaviour and navigation across the Website.
      6. Signifi Media: for direct marketing and statistical purposes.
      7. Stopforumspam.com and Akismet for spam filtering purposes.
      8. WordPress: for website and program building along with content and user management.
      9. LearnDash- learning management system used in some of our programs.
      10. HotJar: used to monitor user interaction on websites and programs. This data is anonymised.
      11. Facebook: to track Facebook advertising conversion analytics (utilising the Facebook pixel plugin)
   3. Any such information shall be processed on terms which are substantially the same as those set out in this Privacy Policy, GDPR and/or subject to the protection of the EU-U.S. Privacy Shield (To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce’s Privacy Shield List at https://www.privacyshield.gov/list).
   4. We are not responsible for the privacy practices of third parties providing services to you directly (for example, Facebook) and the information we may obtain from those services often depends on your settings or their privacy policies. You should read the privacy policies of third party service providers so you can understand the manner in which your personal information will be handled by these providers.
   5. We will retain data for the period necessary to fulfil the purposes outlined in this Policy unless a longer retention period is required or permitted by law. Whilst the retention vary according to the type of record, in respect of certain EHR in Australia and the United Kingdom we allow for 8 years from (i) the date of last treatment for adult records and (ii) for children eight years after their 18 birthday or until 25 years of age. In certain circumstances we may be legally required to maintain records indefinitely.
7. THE SAFETY & SECURITY OF PERSONAL INFORMATION
   1. We will take all reasonable precautions to protect an individual’s Personal Information from unauthorised access. This includes appropriately securing our physical facilities and electronic networks.
   2. The Online Services of our Programs use SSL encryption to store and transfer Personal Information. We also help keep your data secure by following our internal policies of best practice and data protection. Despite this, the security of online transactions and the security of communications sent by electronic means or by post cannot be guaranteed. Each individual that provides information to us via the internet or by post does so at their own risk.
   3. We are not responsible for the privacy or security practices of any third party (including third parties that we are permitted to disclose an individual’s Personal Information to in accordance with this policy or any applicable laws). The collection and use of an individual’s information by such third parties may be subject to separate privacy and security policies.
   4. If an individual suspects any misuse or loss of, or unauthorised access to, their Personal Information, they should let us know immediately.
   5. To the extent permitted by law: we cannot accept responsibility for misuse or loss of, or unauthorised access, where the security of information is not within our control; and we are not liable for any loss, damage or claim arising out of another person’s use of the Personal Information where we were authorised to provide that person with the Personal Information.
   6. In the unlikely event of a criminal breach of our security we will inform the relevant regulatory body within 72 hours and, if your personal data were involved in the breach, we shall also inform you.
8. HOW TO ACCESS AND/OR UPDATE INFORMATION
   1. Users of a Program can update their Personal Information from within their Online Service account or profile.
   2. Subject to applicable Privacy Law, an individual has the right to request from us the Personal Information that we have about them, and we have an obligation to provide them with such information within 28 days of receiving their written request.
   3. If an individual cannot update its own information, we will correct any errors in the Personal Information we hold about an individual within 7 days of receiving written notice from them about those errors.
   4. It is an individual’s responsibility to provide us with accurate and truthful Personal Information. We cannot be liable for any information that is provided to us that is incorrect.
   5. We may charge an individual a reasonable fee for our costs incurred in meeting any of their requests to disclose the Personal Information we hold about them if such a request is manifestly unfounded or excessive. We reserve the right to clarify the specific information your request relates to.
   6. Information will be provided within one month of receipt of the request.
9. YOUR RIGHTS, COMPLAINTS AND DISPUTES
   1. You have the right to object to processing not based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); and direct marketing, unless we hold legitimate grounds for processing or the processing is for the establishment, exercise or defence of legal claims.
   2. You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data infringes the General Data Protection Regulation.
   3. You have the right to object to:
      1. processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
      2. direct marketing; and
      3. processing for purposes of scientific/historical research and statistics

      unless we hold legitimate grounds for processing or the processing is for the establishment, exercise or defence of legal claims.

   4. If an individual has an objection or complaint about our handling of their Personal Information, they should address their complaint in writing to the details below.
   5. If we have a dispute regarding an individual’s Personal Information, we both must first attempt to resolve the issue directly between us.
   6. If we become aware of any unauthorised access to an individual’s Personal Information which is likely to result in a high risk for the rights and freedoms of the data subjects we will inform the individual without undue delay after becoming aware of it once we have established what was accessed and how it was accessed.
10. CONTACTING US
    1. All correspondence with regards to privacy should be addressed to:
       HealthLab Online Limited
       East Witheridge Penn Road, Knotty Green, Beaconsfield, Buckinghamshire, United Kingdom, HP9 2TW
       info@healthlabaustralia.comYou may contact us by email in the first instance.
11. ADDITIONS TO THIS POLICY
    1. If we decide to change this Privacy Policy, we will post the changes on our website. Please refer back to this Privacy Policy to review any amendments.
    2. We may do things in addition to what is stated in this Privacy Policy to comply with applicable Privacy Law, and nothing in this Privacy Policy shall deem us to have not complied with the Australian Privacy Principles, Data Protection Act 1998 (Act) and/or GDPR.