Privacy Policy

Introduction

KĀYA Health Clubs (“we”, “us”, “our”) is an APP entity and is committed to protecting your privacy. This Privacy Policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act and the APPs. 

This Privacy Policy applies to all personal information we handle, whether collected online, in person, by telephone, or by any other means. 

By providing us with your personal information, or by continuing to use our services, you acknowledge that you have read and understood this Privacy Policy. 

What is Personal Information?

Personal information includes, but is not limited to: 

• Your name, address, email address, and phone number 
• Date of birth and gender
• Financial information including bank account or credit card details
• Tax file numbers and government-issued identifiers
• Health and medical information (sensitive information)
• Racial or ethnic origin, political opinions, religious beliefs (sensitive information)
• Criminal record information (sensitive information)
• Biometric information and templates (sensitive information)
• IP addresses, cookie data, and other online identifiers

We will only collect sensitive information with your consent, or where otherwise permitted by law. 

Collection of Personal Information 

What We Collect

We will only collect personal information that is reasonably necessary for one or more of our functions or activities. We may collect the following types of personal information: 

• Membership information such as your name, date of birth, contact information, emergency contact information, health information, occupation, employer and payment details. 
• Employment information if you apply to work with us or you do work with us such as identification information, financial and tax information, health information, your resume, certifications and qualifications (if applicable).  

How We Collect Personal Information

We collect personal information in a variety of ways, including: 

• Directly from you when you enquire about membership, sign up for a membership, complete a form, make a purchase, sign into the guest register, or contact us 
• When you visit our website, through cookies, web beacons, and similar tracking technologies 
• From third parties, including business partners, referrers, and publicly available sources 
• From government agencies or bodies where permitted by law 

Anonymity and Pseudonymity

Where it is lawful and practicable, we will give you the option of interacting with us anonymously or using a pseudonym. However, in some circumstances, we may need to identify you to provide our services or comply with our legal obligations. 

For the safety of our members and staff, it is impracticable for you to be anonymous or use a pseudonym when signing up for a membership. 

Unsolicited Personal Information

If we receive personal information that we did not solicit, we will determine whether we could have collected that information under the Privacy Act. If we determine that the information could not have been collected in this way, we will, as soon as practicable, destroy or de-identify the information (provided it is lawful and reasonable to do so).

Notification at Collection  

At or before the time (or as soon as practicable after) we collect your personal information, we will take reasonable steps to notify you of: 

• Our identity and contact details 
• Whether we are collecting the information directly from you or from a third party 
• The purposes for which we are collecting the information 
• The main consequences (if any) for you if we do not collect the information 
• Any other organisations to whom we usually disclose the information 
• That this Privacy Policy contains information about how you may access or correct your personal information and how to make a complaint 
• Whether we are likely to disclose personal information to overseas recipients 

 Notification is usually provided through a collection notice at the point of collection (such as on a form or on our website). 

Use and Disclosure of Personal Information

Primary Purposes

We will only use or disclose personal information for the primary purpose for which it was collected. Our primary purposes include: 

• Providing services to our members, guest, former members, and employees 
• Processing payments and managing our members’ accounts 
• Communicating with members about the services they are interested in 
• Marketing and sales. 

Secondary Purposes

We may also use or disclose your personal information for secondary purposes where: 

• You have consented to the secondary use or disclosure 
• The secondary purpose is related to the primary purpose and you would reasonably expect us to use or disclose the information in that way 
• The use or disclosure is required or authorised by or under Australian law or a court or tribunal order 
• A permitted general situation applies, such as to lessen or prevent a serious threat to life, health, or safety 

Disclosure to Third Parties

We may disclose your personal information to: 

• Our service providers including IT providers, payment processors and other service providers 
• If you are a part of a corporate membership, we may disclose your information to your employer  
• Professional advisers such as lawyers, accountants, and auditors 
• Government agencies and regulators as required by law 

We take reasonable steps to ensure that third parties who receive personal information from us protect that information in a manner consistent with the Privacy Act. 

Direct Marketing

We may use your personal information to send you marketing communications about our products and services where in accordance with the Privacy Act. 

If you are a prospective, current or former customer, we may use your contact details to send you direct marketing about our products and services that are similar to those you have already purchased or expressed an interest in, unless you opt out. 

In all direct marketing communications we will: 

• Clearly identify ourselves as the sender 
• Provide you with a simple means to opt out of receiving future communications (e.g., an “unsubscribe” link) 
• Honour any opt-out request within a reasonable time  

 To opt out of direct marketing communications, you can: 

• click the ‘Unsubscribe’ link in any email 
• reply to opt out to an SMS 
• contact our Privacy Officer at the details in Section 12 

 We do not use sensitive information for direct marketing without your express consent. 

Cross-Border Disclosure of Personal Information

We use some service providers that are based overseas including MailChimp, Google, Meta and SMS Global. For more information about how these services providers handle personal information, please see their privacy policies. 

In the event that a cross-border disclosure is necessary, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to your personal information including entering intoappropriate contractual arrangements with each service provider. 

Quality of Personal Information (APP 10) 

We take reasonable steps to ensure that the personal information we collect is accurate, up-to-date, and complete. We also take reasonable steps to ensure that the personal information we use or disclose is accurate, up-to-date, complete, and relevant, having regard to the purpose for which it is used or disclosed. 

You can assist us in keeping your information current by notifying us of any changes. To update your personal information, please contact us using the details in Section 13. 

Security of Personal Information

Security Measures 

We take reasonable steps to protect the personal information we hold from misuse, interference, and loss, and from unauthorised access, modification, and disclosure. Our security measures include: 

• Encryption of sensitive data in transit and at rest 
• Access controls and authentication requirements for staff 
• Regular security assessments and penetration testing 
• Staff training on privacy and data security 
• Physical security measures for premises and paper records 

Notifiable Data Breaches

If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the OAIC as required by the NDB scheme, and will take all reasonable steps to contain the breach and prevent further harm. 

Retention and Destruction 

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. When we no longer need personal information for any purpose, we will take reasonable steps to destroy or de-identify it. 

Access to Your Personal Information 

You have the right to request access to the personal information we hold about you. To make an access request, please contact us using the details in Section 12. 

How to Make an Access Request 

Please submit your request in writing, including: 

• Your full name and contact details 
• A description of the information you wish to access 

Our Response 

We will respond to your request within 30 days. We may ask you for identification to verify your identify. We will provide you with access to the requested information unless one of the exceptions under APP 12.3 applies, including where: 

• Providing access would pose a serious threat to life, health, or safety 
• Providing access would have an unreasonable impact on the privacy of other individuals 
• The request is frivolous or vexatious 
• The information relates to existing or anticipated legal proceedings and would not be accessible by the process of discovery in those proceedings 
• Providing access would be unlawful 

 Charges 

We will not charge you for making an access request. We may charge a reasonable fee to cover our costs in providing access. We will notify you of any applicable charges before we process your request.  

Correction of Personal Information 

If you believe that personal information we hold about you is incorrect, out-of-date, incomplete, irrelevant, or misleading, you may request that we correct it.
To request a correction, please contact us using the details in Section 12 with details of the correction you are seeking.
We will respond to your correction request within 30 days. If we make the correction, we will also take reasonable steps to notify any third parties to whom we have previously disclosed the incorrect information, where requested.
If we decline to make a correction, we will provide you with written reasons. You may then request that we associate a statement with the information noting that you believe it is incorrect. 

Privacy Complaints

Contacting Us

If you have concerns about how we handle your personal information, or if you wish to make a complaint, please contact us: 

Handling Your Complaint 

We will acknowledge receipt of your complaint within 5 business days and will endeavour to resolve your complaint within 30 days. We may ask you for further information to assist in resolving your complaint. 

Escalation to the OAIC 

If you are not satisfied with our response, you may make a complaint to the OAIC (defined in Section 1): 

• Website: www.oaic.gov.au 
• Phone: 1300 363 992 
• Post: GPO Box 5218, Sydney NSW 2001 

The OAIC can investigate complaints about alleged breaches of the Privacy Act by APP entities. 

Our Website and Cookies 

When you visit our website, we may collect information about your visit using cookies, web beacons, and similar technologies. This information may include your IP address, browser type, pages visited, time and date of your visit, and referring URL. 

We use this information to analyse website traffic, improve our services, and provide a better user experience. We use Google Analytics and Meta Pixel, which may collect information about your browsing activity. 

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. 

Changes to This Privacy Policy 

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will post the updated Privacy Policy on our website and update the ‘Last Reviewed’ date at the top of this document. 

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes your acceptance of the updated Policy.