For visitors from the United Kingdom please view privacy policy here.
1. SP Health Co Pty Ltd (ABN 73 123 248 046) and Digital Wellness Pty Ltd (ABN 14 629 478 860) collectively, (DW) is committed to managing personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act) and other applicable privacy laws.
2. This Privacy Policy explains how and why DW and any of its affiliates (collectively, we, us and our) collect, use, hold and disclose your personal information in connection with our websites, platforms, applications, products or services (collectively, Services).
3. “Personal Information” is any information (or opinion) about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true. Personal Information includes, for example, your name, email address, birth date, phone number, gender and location. Personal Information may also include personal and other information which is treated as “sensitive information” under the Privacy Act.
4. “Sensitive Information” includes, for example, Personal Information that includes information or an opinion about your racial or ethnic origin, your sexual orientation, your religious beliefs or your membership of a professional association, trade association or trade union. Sensitive information also includes your health information, genetic information and some aspects of biometric information.
5. Because we provide health and wellbeing services, much of the Sensitive Information we collect is health information. We treat your health information with a high level of protection. We comply with the APPs and any applicable State and Territory health records laws when handling your health information.
6. The Personal Information generally held by DW includes your name, address, date of birth, contact details (including both or either postal and/or email addresses), marital status, employment status, occupation, records of correspondence and information relating to your use of the Services.
7. Information that you provide in your initial health assessment may include Sensitive Personal Information, such as information about your personal and family medical history and status, dietary requirements, previous illnesses or injuries or current or expected state of health (such as information about your height, weight and age). We may also collect sensitive Personal Information if you have a consultation with one of our allied health practitioners, for example, at the end of your treatment program so that a final report on your progress can be prepared. However, we will only hold this information where it has been collected with your express consent for us to do so.
8. We collect Sensitive Information (including health information) only where it is reasonably necessary for one or more of our functions or activities and either you have consented to the collection, or the collection is otherwise permitted under the Privacy Act, for example where a permitted health situation exists or the collection is required or authorised by law. Where we rely on your consent, that consent must be express. You may withdraw your consent at any time by contacting our Privacy Officer using the details set out below, although doing so may mean that we cannot provide some or all of the Services to you.
9. We collect your Personal Information primarily as a result of your use of the Services. For example, this includes the information you provide:
(a) when completing your initial health assessment (which may be conducted, for example in person or via video call);
(b) when registering or participating in any associated program (such as the Total Wellbeing Diet program, the DNA Diet Plan and Clickfit);
(c) when participating in the coaching sessions;
(d) when providing feedback or posting material on any of our social network forums;
(e) when subscribing to our newsletter;
(f) when purchasing products from us; and
(g) in any other correspondence between you and DW.
10. We may also collect your Personal Information from third parties, such as your health insurer, your health practitioner where you have provided consent to them to disclose your Personal Information to us.
11. In the event of a complaint, we may also receive Personal Information about you from other parties or from other users of this Services or third parties who may communicate information to us in relation to that complaint.
12. You can always decline to give us any personal information we request, but that may mean we cannot provide you with some or all of the Services you have requested. If you have any concerns about personal information we have requested, please let us know.
13. Where it is lawful and practicable to do so, you may deal with us anonymously or under a pseudonym, such as when making a general enquiry. However, because our Services require customers to establish an account using a valid email address, we will generally be unable to provide the Services to you on an anonymous or pseudonymous basis.
14. Our Services are intended for individuals aged 18 years and over. Users are required to provide their date of birth and declare that they are at least 18 years of age when registering for an account. Although we do not verify age using identification documents, we do not knowingly collect Personal Information from or provide our Services to persons under 18. If you believe that an individual under 18 has provided us with Personal Information, please contact our Privacy Officer and we will take reasonable steps to investigate and, where appropriate, delete that information.
15. If you apply for a role with us, we collect the Personal Information reasonably necessary to assess your application, such as your name, contact details, qualifications and work history, and we may collect information from third parties such as recruitment agencies and the referees you nominate. We handle the personal information of job applicants and our personnel in accordance with the Privacy Act.
16. We record dietitian coaching sessions and other video consultations for quality assurance, training and record-keeping purposes. We will notify you that sessions are recorded and, where required by law, obtain your consent. As recording is part of the delivery of our Services, participants cannot opt out of recording. However, participants may request that a recording be deleted after the session, and we will consider such requests in accordance with applicable legal and operational requirements.
17. From time to time, we may receive information relating to you that we have not requested (“Unsolicited Information”). In the event that we do receive Unsolicited Information, we will check whether it’s reasonably necessary for us to keep it. If it is, we will treat the Unsolicited Information in the same way as other information that we request you to provide to us. If determine that it is not reasonably necessary for us to keep it, we will, as soon as practicable, destroy or de-identify the relevant Unsolicited Information.
18. Depending on the circumstances, we may hold your Personal Information in either hard copy or electronic form, or both. Generally, a copy of all written correspondence is held in hard copy, and our client database and email correspondence is held in electronic format.
19. We will take reasonable steps to destroy or de-identify your Personal Information once it is no longer needed, unless we are required by Australian law, or a Court or tribunal order to retain it.
20. All Personal Information in electronic form is held on servers in Australia and the United States of America, as set out in this Policy.
21. We use your Personal Information:
(a) to provide you with the Services including, for example, conducting an initial health assessment, providing you with a treatment program and a final report at the end of your participation in a program;
(b) to register, set up and manage your account;
(c) to conduct Dietitian Coaching Sessions;
(d) to contact you regarding your program or respond to any feedback you request from us and for providing other customer services;
(e) to liaise with your health practitioner and/or health insurer (where you have provided consent);
(f) for internal purposes such as procedural assessments, risk management, product and service reviews;
(g) to provide you with information about our programs, services, promotions and competitions either by way of communications directly from us (for example by email, mail, phone or sms) or through communications via social media platforms;
(h) for the prevention of fraud and/or identifying and investigating any suspicious use of our Services;
(i) for our internal business and management processes, for example accounting or auditing purposes;
(j) for any other purpose to allow us to comply with our obligations under law; and
(k) for any purpose that would be reasonably expected by you.
22. We also use IP addresses in order to analyse trends, administer our websites, track users’ movements and gather broad demographic information. IP addresses are not linked to Personal Information. We also use de-identified Personal Information to analyse results of our programs, and disseminate these findings as publications or reports, conference abstracts or presentations.
23. You can opt out of receiving direct marketing communications from us at any time by using the unsubscribe facility included in our electronic messages, or by contacting our Privacy Officer using the details set out below. We will give effect to your request within a reasonable time. We do not use or disclose your Sensitive Information (including health information) for direct marketing purposes without your consent. We send commercial electronic messages, including marketing emails and SMS, in accordance with the Spam Act 2003 (Cth) and the Spam Regulations 2021, and we comply with the Do Not Call Register Act 2006 (Cth) in relation to any telemarketing calls. Every marketing message we send includes a functional unsubscribe facility.
24. Automated decision-making and AI-generated recommendations: We may use artificial intelligence (AI) tools and other technologies that process Personal Information to provide personalised features of the Services, including generating meal plans, recommendations and similar content. Members may choose to use our AI-powered meal planning feature, which is designed and trained within the guardrails of the CSIRO Total Wellbeing Diet Program. Where this feature is used, meal plans and recommendations are generated automatically by AI and are not subject to ongoing human review or approval. We do not use these tools to make decisions that have a legal or similarly significant effect on you. If we use a computer program to make, or substantially assist in making, a decision that could reasonably be expected to significantly affect your rights or interests, we will explain this in this Privacy Policy and provide information about how that process operates.
25. We may disclose Personal Information where we are permitted under the Privacy Act. This includes:
(a) if you give your consent (for example, your Personal Information may be shared with your healthcare practitioner, your carer and/or your health insurer);
(b) where we are legally required to do so, including pursuant to court or tribunal orders, taxation laws;
(c) if there is a serious threat to an individual’s health or safety (for example, your Personal Information may be shared with their doctor, the police or other emergency service providers if there are serious concerns regarding the individual’s health or wellbeing);
(d) where there is reasonable suspicion of unlawful activity;
(e) for the conduct of surveillance and intelligence gathering by an enforcement body; and
(f) to assist in locating a missing person.
26. We may disclose your Personal Information to operators of social media platforms for the purposes of enabling us to provide you with information about our products and services to you or others through the relevant social media platform. Third parties may unlawfully intercept or access transmissions or private communications. As a result, while we strive to protect your Personal Information, we cannot ensure or warrant, and do not warrant, the security, privacy or confidentiality of any information, including Personal Information that you transmit to us, and you do so at your own risk.
27. We may provide de-identified information to the CSIRO in connection with evaluating the use of the website, the tools made available on the website and the effectiveness of the Total Wellbeing Diet program. For example, information provided may include information about the number of unique users who visit the website, the demographic breakdown of the users of the website, the activities that visitors to the website engage in while on the website, food diary information, exercise logs and weigh-in details.
28. We may also provide de-identified information to the CSIRO so that the CSIRO can use that information to analyse the results of participants in the CSIRO Total Wellbeing Diet program, conduct research and disseminate these findings as publications or reports, conference abstracts or presentations.
29. We may engage independent contractors, vendors and suppliers (collectively, "Outside Contractors") to provide specific services and products related to our Services, such as hosting and maintaining our social network forums and developing applications for this Website and email services. These Outside Contractors may sometimes have limited access to information we collect, including your Personal Information, in the course of providing products or services to us. Access to your Personal Information by these Outside Contractors is limited to the information reasonably necessary in order for the Outside Contractors to perform their limited function for us. We also require that these Outside Contractors:
(a) protect the privacy of your Personal Information consistent with this Privacy Policy, and
(b) not use or disclose your Personal Information for any purpose, other than providing us with the products or services for which we contract.
30. We partner with private health insurers (Health Fund Partners) to make our programs available to their members. If you access the Services as a member of, or under an arrangement with, a Health Fund Partner, we may collect from and disclose to that Health Fund Partner the Personal Information reasonably necessary to verify your eligibility, enrol you, administer any subsidy, discount or member benefit, and confirm your participation in or completion of a program. The information shared in this way may include your name, contact details, membership or policy number, and your program enrolment, participation and completion details. Where the information shared is health information, we will only disclose it with your consent, unless the disclosure is otherwise permitted under the Privacy Act. We do not disclose your individual program results to a Health Fund Partner for the purpose of setting your insurance premiums. Each Health Fund Partner handles your Personal Information in accordance with its own privacy policy.
31. We hold all hard copy and electronic records of Personal Information in a secure manner to ensure that they are protected from unauthorised access, modification or disclosure. Our staff follow strict information handling procedures and we restrict access to your Personal Information to staff who are required to use and access it. We use multiple security measures to protect personal information, e.g. Secure Socket Layer (SSL) technology, encryption when data is being transferred, encrypted payment gateways, firewalls, etc.
32. We destroy your Personal Information once it is no longer needed by us or required to be kept by law, for example, by shredding hardcopy records and degaussing (demagnetising) electronic records.
33. Despite the steps we take to protect your Personal Information, data breaches can still occur. We maintain and follow an Incident Response Policy to guide our assessment, management and communication processes in the event of a suspected or actual data breach. If we have reasonable grounds to suspect that an eligible data breach involving your Personal Information may have occurred, we will assess the relevant circumstances and take all reasonable steps to complete that assessment within 30 days. Where we are required to do so under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, that is, where a data breach is likely to result in serious harm to one or more individuals and we have not been able to prevent that likely risk of serious harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable.
34. A cookie is a piece of data temporarily stored on the user's hard drive containing information about the user. The cookie helps the user to save time. For instance, by setting a cookie on this Website, the user would not have to log in a password more than once, thereby saving time while on this Website. Web browsers can be set to reject cookies. If a user rejects the cookie, they may still use this Website but may not be able to take advantage of certain features.
35. We use cookies and similar technologies to recognise you when you return to the Website, to remember your preferences and keep you signed in, to operate and secure the Website, and to understand how the Website is used so that we can improve it. The technologies we use include cookies that are strictly necessary for the Website to function, as well as analytics, performance and advertising cookies, which we use with your consent where required.
36. Third parties may also use cookies, web beacons, and similar technologies to collect or receive information from your website and elsewhere on the internet and use that information to provide measurement services and target ads
37. We use third-party service providers and technologies to support the operation, analytics, measurement, marketing and advertising activities associated with our Website and communications. These technologies may include analytics, attribution, customer engagement, advertising, social media, tag management and campaign measurement tools. They may use cookies, software development kits, pixels, web beacons and similar technologies to collect information about your device and your interactions with our Website and communications. This information may be combined with information collected from other sources to help us understand and improve the performance of our Website, services and marketing activities, personalise content and communications, deliver relevant advertising, and measure the effectiveness of our campaigns.
38. If you would like to opt out of third-party cookies, please disable or delete the cookies in your browser or use the www.aboutads.info/choices service, or, in Australia, the www.youronlinechoices.com.au service. You can also control personalised advertising through your Google and Meta (Facebook) account settings.
39. Our website may contain links to websites operated and maintained by third parties over which we have no control. These third party websites are not subject to this Privacy Policy or our privacy standards and procedures. We are not responsible for the content, actions or policies of such third party websites. The inclusion of third party links on our website in no way constitutes an endorsement of such websites’ content, actions or policies.
40. You may lodge a complaint with our Privacy Officer at the contact details set out below. We take complaints very seriously and will respond shortly after receiving written notice of your complaint. You may also contact our Privacy Officer to enquire about the progress of the complaint at any time.
41. If you are not satisfied with our response, you are entitled to lodge a complaint with the Office of the Australian Information Commissioner. Information regarding how to lodge a complaint is available from the Commissioner's website at www.oaic.gov.au or by ringing the Commissioner's information line on 1300 363 992.
42. You may request access to your Personal Information at any time by sending a written request to our Privacy Officer at the contact details set out below. Once we have verified your identity, we arrange for access to be provided to you in an appropriate manner within a reasonable time, usually within 30 days of receipt of your request.
43. You will not be charged for making a request to access your personal information but you may be charged for the reasonable time and expense incurred in compiling information in response to your request. We will notify you in advance of any likely charges (or the basis for our calculation) for providing access to your information.
44. If your account is held in conjunction with another individual, we may provide a person named on the account with access to Personal Information held about another account holder.
45. We may decline your request to access to your Personal Information in certain circumstances in accordance with the APPs. If we are unable to provide you with the requested access, we will let you know and provide you with an explanation of our position.
46. We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you or if your personal details change.
47. If you consider any Personal Information we hold about you is out-of-date, incorrect, incomplete, irrelevant or misleading, you are entitled to request correction of the information. After receiving a request from you, we will take reasonable steps to correct your information.
48. We may decline your request to correct your personal information in certain circumstances in accordance with the APPs. If we refuse your request, we will provide to you within a reasonable period a written notice setting out the reason(s), and the complaint mechanisms available to you.
49. We may disclose your Personal Information to recipients located outside Australia. For example, we store Personal Information in cloud-based and other networked electronic storage that uses data centres located outside Australia, and we engage service providers located overseas to help us deliver and support the Services. The countries in which these recipients are located include the United States of America. We may also disclose your Personal Information overseas where the disclosure is to you or your authorised representative, where you have consented to the disclosure, or where the disclosure is otherwise required or authorised by law.
50. Before disclosing your Personal Information to an overseas recipient, we take such steps as are reasonable in the circumstances to ensure that the recipient does not handle your Personal Information in a way that breaches the APPs, unless an exception under APP 8 applies. One of those exceptions, introduced by amendments to the Privacy Act that commenced in December 2024, applies where the recipient is subject to a law or binding scheme that has been prescribed under the Privacy Act as providing protection that is at least substantially similar to the protection given by the APPs. Where we rely on your consent to disclose your Personal Information to an overseas recipient, we will first inform you that, if you give your consent, we will not be required to take those reasonable steps.
51. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or our legal obligations. The current version of this Privacy Policy is the version published on our Website, and the date on which it was last updated is shown at the end of this Privacy Policy. Where we make a significant change, we will take reasonable steps to bring it to your attention, for example by placing a notice on our Website or, where appropriate, by contacting you directly.
52. We recommend that you visit our website regularly to keep up to date with, and act upon if so desired, any changes to this Privacy Policy.
53. If you have any queries or requests about this Privacy Policy, please contact our Privacy Officer either by mail to PO Box 1971, North Sydney NSW 2059, by telephone on (02) 8294-9126, by facsimile on (02) 9923 8223 or by email to: [email protected].
This Privacy Policy was last updated on 12 August 2026 (Version 2.0). Effective date: 12 August 2026. Last reviewed: August 2026. This Privacy Policy supersedes all earlier versions.