Privacy Policy.

This Privacy Policy explains how Firmin Fitness & Wellness handles personal information and health information collected in connection with our website, enquiries, bookings and treatment services.

We aim to handle information in a way that is fair, transparent and consistent with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and, where applicable, the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles.

This site is operated by Firmin Fitness, trading as Firmin Fitness & Wellness (ABN 50 119 842 773), a private, appointment-only massage and wellness studio in Lake Macquarie, NSW, Australia.

In this policy, "we", "us" and "our" refer to Firmin Fitness & Wellness.

Depending on how you interact with us, we may collect the categories of information set out below. We only collect information that is reasonably necessary for our services and business operations.

• Name, contact number and email address
• Enquiry details and correspondence with us
• Booking and appointment history
• Payment-related information processed by our payment providers
• Feedback, reviews and testimonials you choose to share

We may collect health and sensitive information where it is reasonably necessary to assess whether a treatment can proceed safely and to deliver the service you have requested. This may include details about your medical history, current conditions, medications, surgeries, pregnancy, or specific concerns relevant to treatment.

Where required, we will obtain your consent to collect this information. You are asked to provide accurate information, as this affects the safety and suitability of your treatment.

Health information is used for treatment planning, safety, appointment administration and related purposes permitted by law. It is not used for unrelated marketing without your appropriate consent.

Please do not send detailed medical information through general website enquiry forms. Where relevant, we will direct you to the appropriate intake form or health waiver process.

Where an appointment involves a child, we typically collect information from or with the involvement of a parent or legal guardian.

Only information reasonably needed for the appointment is collected. A parent or guardian may be asked to provide or confirm consent for treatment and for any related use of information.

Photographs involving children require separate and specific consent. The child's privacy and safety will be considered whenever information is used or disclosed.

We may collect information directly from you when you:

• Complete a website enquiry, contact form or newsletter form
• Phone, email or message us directly
• Make a booking or payment through Square
• Complete an intake form, health waiver or consent form
• Attend an appointment or communicate with us during treatment
• Interact with us on social media

In some cases we may receive information about you from a parent or guardian, an authorised representative, or a service provider we use to operate our business.

We use information to:

• Respond to enquiries and manage appointments
• Deliver treatments safely and appropriately
• Take payment for services or products
• Maintain treatment records and provide continuity of care
• Manage our business, including record keeping, safety and compliance
• Send appointment reminders, service updates and, where you have opted in, marketing communications
• Comply with our legal, professional and regulatory obligations

Bookings and payments are typically completed through Square. When you book or pay through Square, certain information you provide is handled by Square directly under its own terms and privacy policy.

We receive booking details necessary to prepare for and deliver your appointment. Any payment information you provide to Square is handled by Square directly under its own terms and privacy policy.

Our website uses enquiry and contact forms so you can get in touch with me. When you submit a form, the information is delivered to me through a customer relationship management (CRM) tool that helps me receive and respond to your message. I do not use these forms to build a marketing database, and I do not store medical information submitted through general website forms.

Please avoid sending detailed medical or health information through general enquiry forms. Where relevant, I will direct you to the appropriate intake or waiver process so your health information is captured through the correct channel.

I handle personal information collected through website forms in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Our website may use cookies and similar technologies that are necessary for the site to function, and to support features such as embedded booking, review widgets and social media content.

We use Google Analytics 4 to understand how visitors use our website in aggregate, including pages viewed, approximate location (typically country or city), device and browser type, referral source and time spent on the site. Google Analytics sets cookies in your browser and processes this information on our behalf. Data may be transferred to and stored on Google servers outside Australia. Google Analytics does not tell us who you are personally.

Our website is also registered with Google Search Console, which helps us monitor how the site appears in Google Search, which queries lead people to us and whether pages are being indexed correctly. Search Console does not place tracking cookies on visitors to our site, but Google receives aggregated information about searches that surface our pages.

You can control cookies through your browser settings, install the Google Analytics Opt-out Browser Add-on, or use your browser's Do Not Track or privacy features. Disabling some cookies may affect how parts of the website work. For more information, see Google's Privacy Policy at https://policies.google.com/privacy.

Identifiable treatment and before-and-after photographs may be personal information and, depending on the context, sensitive health information.

We obtain separate consent before taking or using such images, and consent can be limited to specific purposes (for example, treatment records only, or website and social media use). Declining marketing consent does not affect your access to treatment.

You may withdraw consent for future use at any time. Withdrawal will not affect uses that were lawfully completed before consent was withdrawn. Images are not published outside the purposes agreed by the client, or by the parent or guardian for a child.

From time to time we may send service updates or, where you have opted in, marketing communications about our services, offers or events. You can opt out of marketing communications at any time by using the unsubscribe link in a message or by contacting us directly.

Appointment reminders, safety information and communications directly relating to a booking are not marketing communications.

We may disclose information where reasonably necessary to run our business, deliver your service, or where required or authorised by law. This includes disclosure to trusted service providers, professional advisers, and regulators or authorities where applicable.

We use a limited number of confirmed third-party services to operate the business. Depending on the interaction, information may be handled by:

• Square, for booking and payment pathways
• A customer relationship management (CRM) tool, used to receive website enquiries and manage client communications and review requests
• Google, in connection with the display of Google reviews
• Website hosting and technical support providers
• Professional advisers, such as accountants or legal advisers, where required
• Government agencies, regulators or other parties, where disclosure is authorised or required by law

Third-party platforms operate under their own terms and privacy policies. We do not control the independent privacy practices of Square, Google, social media platforms or other third-party services.

Some technology providers we use may process or store information outside Australia. Where this occurs, we take reasonable steps as required by applicable law to protect the information.

We take reasonable steps to protect information from misuse, interference, loss, unauthorised access, modification or disclosure. However, no online service or method of storage can be guaranteed to be completely secure.

We retain information for as long as reasonably necessary for the purposes described in this policy, including to comply with our legal, professional and record-keeping obligations. Information that is no longer required is securely destroyed or de-identified.

You may request access to the personal information we hold about you, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact us using the details below.

If you have a privacy concern, please contact us so we can try to resolve it. If you are not satisfied with our response, you may also contact the Office of the Australian Information Commissioner, or another applicable regulator, about your concern.

In the unlikely event of a data breach that is reasonably likely to result in serious harm, we will assess and respond to the breach in accordance with our legal obligations, including notifying affected individuals and relevant authorities where required.

We may update this Privacy Policy from time to time. The most recent version will always be available on this page, along with the date it was last updated.

For privacy questions, access or correction requests, or to withdraw consent, please contact:

• Email: firminfitnesswellness@gmail.com
• Phone: 0430 150 945
• Location: Lake Macquarie, NSW, Australia