PRIVACY POLICY

Peppermint Nutrition (Carolyn Culliton), ABN 48 192 295 077 (“we”, “our” and “us”) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and disclose personal information when you use our website at https://www.peppermintnutrition.com (the “Website”), contact us, or use our products and services (together, the “Service”). Where we collect health information to provide care, we ask for your consent at the time of collection.

Please read this Privacy Policy carefully and contact us on the details below, if you have any queries.

1. TYPES OF PERSONAL INFORMATION WE COLLECT AND HOLD

1.1 The types of personal information that we may collect includes:

(a) personal details such as name, date of birth, gender and occupation;

(b) contact details such as billing and delivery address, home address, email address, telephone number and other contact details;

(c) health and lifestyle information including previous and current health and medical history, allergies, medications or current treatments, social history, family history and risk factors;

(d) profile data including username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses;

(e) transaction data which may include details about payments to and from you and other details of products and services you have purchased from us;

(f) records of our interactions with you;

(g) if you are an employee or prospective employee, information about your qualifications, skills, and work experience;

(h) if you are a supplier or prospective supplier, information about your business skills, services, products, and prices;

(i) your computer and connection information, statistics on page views, traffic to and from and other standard web log information;

(j) marketing and communication preferences;

(k) any other personal information that may be required to facilitate your dealings with us;

(l) any other personal information you may volunteer;

(m) recordings, transcripts and summaries of consultations, where you consent to recording.

1.2 Wherever lawful and practical, you have the option of not identifying yourself (or using a pseudonym) when dealing with us.

2. HOW WE COLLECT PERSONAL INFORMATION:

2.1 We collect your personal information in several different ways, including by way of:

(a) when you voluntarily acquire our Services;

(b) when you complete our intake forms, questionnaires and symptom trackers, online or through our client portal;
(c) during consultations, including telehealth sessions and, with your consent, session recordings;
(d) through messages sent via our secure client portal;

(e) personal contact with us at a face-to-face meeting or situation;

(f) correspondence, chats, social applications or services, mail, email, or telephone;

(g) when you apply for a job, internship, or other work placement with us;

(h) when you visit our Website;

2.2 Where possible, we will collect your Personal Information directly from you. However, where it is not reasonable or practicable to do so, we may collect information about you from third parties. For example, personal information may be collected from other sources, such as:

(a) your guardian or responsible person (if under 18); and

(b) other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services and pathology and diagnostic imaging services;

(d) our service providers.

2.3 In such a case we will take reasonable steps to ensure that you are made aware of the information provided to us by the third party.

2.4 If we receive your personal information from third parties, we will protect it as set out in this Privacy Policy.

2.5 If you do not provide us with personal information when requested to do so, we may not be able to provide our Services to you, carry out your instructions, or otherwise achieve the purpose for which the information has been sought.

2.6 We hold your personal information in electronic form.

2.7 We will destroy or de-identify information where we form the opinion that the information has been provided to us unlawfully or unfairly.

3. WHY WE COLLECT, HOLD, USE AND DISCLOSE YOUR PERSONAL INFORMATION

3.1 We will use and disclose your personal information only for the purpose (the “primary purpose”) for which you provide it to us, which may include:

(a) to provide you with any goods or services that you may request including enabling you to access and use the Services from time to time;

(b) to contact and communicate with you and otherwise provide customer support;

(d) for internal administration and operational purposes such as preventing fraud and abuse of our systems and to troubleshoot bugs;

(e) to assist in providing better products and services to you by tailoring the Services to meet your needs;

(f) to consider your employment or contractual engagement application;

(g) to provide you with further information about us or other websites or products or services offered by us or which we consider may be of interest to you;

(h) to carry out marketing, promotional and publicity activities (including direct marketing), market research and surveys;

(i) to keep our Website relevant and of interest to users;

(j) to show you advertising and information that is most relevant to you and your interests, based on website and email engagement, never on your health information;

(k) to allow us to run our business and perform administrative and operational tasks;

(l) to comply with legal and regulatory requirements; and

(m) for any other purpose which is stated to you at the time of collection or that you otherwise authorise.

3.2 When we collect Personal Information, we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

3.3 Sensitive information: Sensitive Information is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record, or health information.

As noted above, due to the nature of our business, we may collect sensitive personal information from you such as your health information. This sensitive information will be used by us only:

• For the primary purpose for which it was obtained

• For a secondary purpose that is directly related to the primary purpose

• With your consent; or where required or authorised by law.

3.4 We do not use your health information for marketing or advertising. Our email marketing list holds only your name, email address and your purchase history with us.

4. AUTOMATED DECISION-MAKING AND ARTIFICIAL INTELLIGENCE

4.1 Our online symptom tracker and intake forms use pre-set rules to (a) summarise your answers, (b) suggest which of our services may suit you, and (c) identify symptoms that need medical assessment, which may mean we recommend you see your GP before we can proceed. These tools use the information you enter, such as your symptoms, their timing and pattern, your medical history and your medications.

4.2 A practitioner reviews every intake before any care decision is made. No decision about your care is made by software alone. You can ask us to explain or review any outcome by contacting us using the details below.

4.3 With your consent, consultations may be recorded and summarised by an AI tool built into our practice management software (Practice Better’s AI Charting Assistant) to help prepare clinical notes. The practitioner reviews and corrects every note. Our software provider states that client data is not used to train AI models. You can decline AI-assisted notes at any time without it affecting your care.

4.4 We may use general AI tools to help draft educational materials or clinical documents. We do not enter information that identifies you into these tools.

5. COOKIES

While we do not use browsing information to identify you personally, we may use cookies, web beacons, and other tracking technologies to collect certain information about your use of the Website such as the pages you visit, the date and time of your visit, your IP address, and your interaction with the Website. A cookie is a small file containing a string of characters that is sent to your computer or mobile device when you visit a website. When you visit the website again, the cookie allows that site to recognise your browser. Cookies may store unique identifiers, user preferences and other information. You can reset your browser to refuse all cookies or to indicate when a cookie is being sent. However, some website features or services may not function properly without cookies.

6. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

6.1 We may disclose your personal information to:

(a) third party contractors engaged to perform functions or provide services relating to the purposes for which we collect personal information. If this is the case, we will do our best to ensure that their privacy policy adheres to similar standards of privacy protection and will request they comply with this Privacy Policy;

(b) third party service providers or affiliates within or outside of Australia and who work on behalf of or with us to provide some of our administrative and other services, such as processing payments (such as credit card payments). We require such service providers to agree not to use such information except as necessary to provide the services to us;

(c) our employees, contractors and/or related entities on a ‘need to know’ basis to continue to provide our products and services to you and to otherwise administer our organisation

(d) professional advisers such as our accountant, lawyer and insurer;

(e) any party to whom our assets or business may be transferred or with whom we are merged;

(f) when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety;

(g) when you are unable to act on your own behalf due to a health condition, we may need to discuss your health information with relatives or emergency contacts, in order that you are provided with appropriate care;

(h) when there is a statutory requirement to share certain personal information (e.g., some diseases require mandatory notification).

(i) supplement dispensaries and pathology or functional testing laboratories, to fulfil products or tests you choose to order;

(j) your GP or other treating health professionals, with your consent or where needed for your safety.

6.2 We are committed to ensuring that any personal information we share is complete, accurate, uptodate and relevant.

6.3 We may also disclose your personal information if we determine in good faith that disclosure is reasonably necessary to protect our rights and pursue available remedies, enforce our terms and conditions, investigate fraud, or protect our operations or users.

6.4 At your request, we will share your personal information with your representative or any person acting on your behalf (for example, financial advisers, lawyers, attorneys, accountants, executors, administrators, trustees or auditors).

7. COMMUNICATIONS AND MARKETING

7.1 We may from time to time use your personal information in order to communicate and market our products and services to you via newsletters, email invitations and updates about our products and/or services, upcoming workshops and events. We only send marketing emails to people who have subscribed or otherwise agreed to receive them, in line with the Spam Act 2003 (Cth). Every marketing email includes an unsubscribe link, and you can opt out at any time. Appointment reminders and messages about your care are not marketing.

7.2 We do not provide your personal information to other organisations for the purposes of direct marketing.

8. HOW WE STORE AND PROTECT YOUR PERSONAL INFORMATION

8.1 We are committed to ensuring the safety and security of your personal information. We will take reasonable technical and organisational precautions to protect your information from misuse, interference, loss, unauthorized access, modification, or disclosure. For example:

• we limit access to personal information to a “need-to-know” basis;

• we do not keep paper client records ;

• our devices are protected by password and are stored in secure premises;

• the devices we use to collect, hold, use and disclose personal information contain anti-virus software;

• all conversations involving the discussion of personal information take place in private, where they are unable to be overheard by unauthorised personnel;

• our Website contains pages encrypted with SSL (Secure Sockets Layer) to ensure the safety of any data submitted through use of this Website;

• we use two-factor authentication on all systems that hold client information;

• telehealth consultations are conducted from a private room.

8.2 Despite our best efforts to securely store your information, due to the nature of email and the internet, we cannot guarantee the privacy or confidentiality of your personal information.

8.3 Our consultations take place through our practice management platform’s secure telehealth service. If you contact us through email, contact forms, social media or other channels outside our client portal, we do not have full control over the transmission or storage of the personal information you share. Please use the client portal for health-related messages.

8.4 We keep health records for at least 7 years after your last contact with us (or, for clients under 18, until they turn 25), or longer where required by law or our professional obligations. After that we securely destroy or de-identify them. We never store complete credit card details.

8.5 Some of our service providers store or process personal information outside Australia, mainly in the United States. These include our practice management and client records platform (Practice Better), our email marketing platform (Kit), our website platform (Squarespace), our workflow automation tool (Zapier), our video messaging tool (Loom), and our payment processor (Stripe). Pathology and functional testing providers we refer you to may also process samples and results overseas. We take reasonable steps to ensure these providers protect your information to a standard consistent with the Australian Privacy Principles.

9. LINKS TO OTHER SITES

9.1 We may provide links on our Website to third party websites, for your information and convenience. Please note we do not have any control over such websites and are therefore not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. We note those websites are not governed by this policy. We encourage you to be safe and make sure you read their privacy policy before giving them your personal information.

10. HOW YOU CAN ACCESS AND CORRECT YOUR PERSONAL INFORMATION

10.1 We will take reasonable steps to ensure that any personal information we collect is up-to-date, complete relevant and not misleading, and any personal information that we use or disclose is up-to-date, complete relevant, and not misleading.

10.2 You may contact us using the details set out below to seek any of the following:

(a) Access: You can ask to be provided full information about your personal information that we hold.

(b) Change or correct information: You can also ask us to change or correct any information we hold about you.

(c) Delete your personal information: You can ask us to delete your personal information. We will delete information we no longer need, such as marketing and website data. Health records must be kept for the retention period in clause 8.4, so we cannot delete them before that period ends, but we will stop using them for any other purpose.

10.3 We will respond to any request to access information within 30 days.

10.4 We will not charge any fee for your access request but may charge an administrative fee for providing a copy of your Personal Information.

10.5 To protect your Personal Information, we may require identification from you before releasing the requested information.

11. COMPLAINTS ABOUT A PRIVACY BREACH

11.1 We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing. We will then attempt to resolve it within 30 days.

11.2 If you are not satisfied with our response, you may also contact the Office of the Australian Information Commissioner (OAIC). Generally, the OAIC will require you to give them time to respond before they will investigate. For further information visit www.oaic.gov.au or call the OAIC on 1300 363 992.

11.3 If a data breach involving your personal information is likely to cause you serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme.

12. CHANGES TO OUR PRIVACY POLICY

Any changes to this Privacy Policy will be posted onto the Website. Unless stated otherwise, changes will be effective immediately upon being placed onto the Website. Your continued use of the Website means you agree to be bound by the amended Privacy Policy. We will notify current clients of any significant changes.

13. CONTACT DETAILS

For any questions or notice, please contact us using these details:

Your privacy contact name: Carolyn Culliton

Email address: Carolyn@peppermintnutrition.com

Phone: +61 478 775 167

Postal address: Mount Hawthorn WA 6016

This Privacy Policy was last updated: 26/10/2026