Privacy Policy

WellNest ("we", "us", or "our"), a division of CTRL ALT and FIX (ABN: 54 632 545 705), is committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the My Health Records Act 2012 (Cth). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the WellNest application ("App").

1. Information We Collect

We collect the following types of personal and sensitive information:

• Account Information: Your name, email address, and profile picture when you create an account or sign in using Google authentication.
• Sensitive Health Information: Symptom logs, pain entries, asthma logs, seizure events, medication records, appointment details, journal entries, and other health-related data you voluntarily enter into the App. Under the Privacy Act, health information is classified as sensitive information and is afforded a higher level of protection.
• Google User Data: When you sign in with Google, we receive your basic profile information (name, email address, and profile picture) as authorised by you through the Google OAuth consent screen. We only request the minimum scopes necessary to provide these features.
• Payment Information: Billing details processed securely through Stripe. We do not store your full payment card details on our servers.
• Usage Data: Information about how you interact with the App, including pages visited, features used, and session duration.
• Device Information: Browser type, operating system, and device identifiers.

2. How We Collect Information (APP 3 & APP 4)

We collect personal information only by lawful and fair means, and not in an unreasonably intrusive way. Where reasonably practicable, we collect personal information directly from you. We do not collect personal information from third parties without your knowledge, except where required by law.

Health information is only collected with your explicit consent, or where collection is authorised or required by Australian law.

3. Purpose of Collection (APP 5)

We use the information we collect to:

• Authenticate your identity and provide access to your WellNest account.
• Provide, maintain, and improve the WellNest application and its features.
• Personalise your health tracking experience and generate condition-specific insights.
• Process transactions and manage your subscription.
• Send you important updates, security alerts, and support messages.
• Comply with our legal obligations under Australian law.

We will not use or disclose your health information for a purpose other than the primary purpose of collection without your consent, unless required or authorised by Australian law.

4. My Health Records Act 2012 — Important Notice

If you wish to share your WellNest health data with your healthcare providers, you may do so by using WellNest's report generation features and sharing the output directly with your provider. We recommend discussing your WellNest records with your GP or specialist at your appointments.

5. Google API Services — Limited Use Disclosure

• Only uses Google user data for the purposes described in this Privacy Policy — to provide and improve WellNest's functionality for you.
• Does not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable laws, or as part of a merger/acquisition.
• Does not use Google user data for serving advertisements.
• Does not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, or required by law.

6. How We Share Your Information (APP 6)

We do not sell, rent, or trade your personal or health information to third parties. We may share information only in the following circumstances:

• Service Providers: With trusted third-party providers (e.g., hosting, payment processing) who assist us in operating the App, subject to confidentiality obligations and data processing agreements consistent with the APPs.
• Legal Requirements: When required or authorised by Australian law, regulation, legal process, or government request.
• Safety: To protect the rights, safety, or property of WellNest, our users, or the public — as permitted by APP 6.2(c).
• With Your Consent: When you have given us explicit, informed consent.
• Overseas Disclosure (APP 8): Some of our service providers may be located overseas (e.g., the United States). Before disclosing your information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information.

7. Data Storage and Security (APP 11)

Your data is stored on secure servers with industry-standard encryption (TLS in transit, AES-256 at rest) and access controls. We take reasonable steps to protect your personal information, including sensitive health information, from misuse, interference, loss, unauthorised access, modification, or disclosure, as required under APP 11.

Given the sensitive nature of health information, we apply additional safeguards including automatic session timeouts, role-based access controls, and regular security reviews.

While we take reasonable measures to protect your information, no method of electronic storage or transmission over the internet is 100% secure.

8. Data Retention and Deletion (APP 11.2)

We retain your personal data for as long as your account is active or as needed to provide our services. When your data is no longer needed, we take reasonable steps to destroy or de-identify it in accordance with APP 11.2.

• Account Data: Retained while your account is active. Upon account deletion, your data is permanently removed within 30 days.
• Health Data: Retained while your account is active. You may delete individual entries at any time through the App.
• Google User Data: Authentication tokens are stored only as long as needed to maintain your session.
• Payment Data: Transaction records may be retained as required by Australian tax and financial regulations (generally 7 years under the Tax Administration Act 1953).

9. Your Rights Under the Privacy Act (APP 12 & APP 13)

Under the Australian Privacy Act 1988, you have the right to:

• Access (APP 12): Request access to the personal information we hold about you. We will respond within 30 days and provide access unless an exception under the APPs applies.
• Correction (APP 13): Request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information.
• Deletion: Request deletion of your personal data, including health information.
• Opt-out: Withdraw consent for data processing at any time (noting this may affect your ability to use certain App features).
• Data Portability: Export your health data in a portable format via the App's export features.
• Complain: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs.
• Google Permissions: Revoke WellNest's access to your Google account at any time via your Google Account permissions page.

To exercise any of these rights, contact us at the details below. We will not charge a fee for access requests unless the request is complex or resource-intensive.

10. Notifiable Data Breaches (NDB Scheme)

WellNest is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. If we become aware of a data breach that is likely to result in serious harm to any individual whose data is involved, we will:

• Assess the breach as quickly as possible.
• Notify affected individuals and the OAIC as required by law.
• Take immediate steps to contain and remediate the breach.

11. Sensitive Information (APP 3.3)

Health information is classified as sensitive information under the Privacy Act. We only collect, use, and disclose your sensitive health information:

• With your consent (which you give by entering data into the App); or
• Where required or authorised by Australian law.

We never use your health information for direct marketing purposes.

12. Direct Marketing (APP 7)

We do not use your sensitive health information for direct marketing. We may use your contact details (name and email) to send you information about WellNest features, subscription updates, or service changes. You may opt out of marketing communications at any time by contacting us or using the unsubscribe link in any email.

13. Cookies and Tracking

We may use cookies and similar technologies to enhance your experience, remember your preferences, and analyse App usage. You can manage cookie preferences through your browser settings. We do not use cookies to track your health information.

14. Third-Party Services

WellNest integrates with the following third-party services:

• Google (Google LLC): For authentication. Google's privacy policy: policies.google.com/privacy.
• Stripe: For payment processing. Stripe's privacy policy: stripe.com/privacy.

15. Children's Privacy

WellNest is not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

16. Changes to This Policy (APP 1)

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the updated policy in the App and updating the "Last updated" date. Your continued use of WellNest after changes constitutes acceptance of the revised policy. Material changes will be communicated by email where reasonably practicable.

17. Complaints Process

If you have a complaint about how we have handled your personal information, please contact us first at privacy@wellnest.app. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• GPO Box 5218, Sydney NSW 2001

18. Contact Us

For any privacy questions, access requests, corrections, or complaints:

• Business: CTRL ALT and FIX
• ABN: 54 632 545 705
• Email: admin@ctrlaltandfix.com.au