Privacy Policy

This Privacy Policy explains how Awareness Services Pty Ltd (Awareness Services, we, us or our) collects, holds, uses and discloses Personal Information, and how you can access or correct your Personal Information or make a complaint.

This Privacy Policy applies to Personal Information we handle through awareness-services.com and its related pages, our booking system, member accounts, Awareness AI, Joy, the Online Goal-Oriented Journal, our therapeutic resources, online forms and health and wellbeing assessments, and through our emails, calls, messages, webinars, events and social media channels (together, the Platform).

In this Privacy Policy:

• you means any individual whose Personal Information we handle, including website visitors, clients, members and prospective members of the Platform, and their representatives;
• Personal Information has the meaning given in the Privacy Act, being information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true and whether or not it is recorded in a material form;
• Sensitive Information has the meaning given in the Privacy Act, and includes Health Information and information about an individual’s racial or ethnic origin, religious beliefs, sexual orientation or practices, and criminal record;
• Health Information includes information or an opinion about an individual’s physical or mental health, wellbeing or disability (including participation in the National Disability Insurance Scheme (NDIS)), and about health services provided or to be provided to them;
• Member means a professional who holds a membership package with us;
• Practitioner means an independent health, mental health, wellbeing or allied professional who offers services to clients through the Platform;
• Privacy Act means the Privacy Act 1988 (Cth), and APPs means the Australian Privacy Principles in Schedule 1 to the Privacy Act.

We are bound by the Privacy Act and the APPs. Because we handle Health Information, we also comply with the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) and its Health Privacy Principles to the extent they apply to us.

This Privacy Policy deals with privacy only. Membership, fees, billing, cancellation and refunds are governed by our separate membership terms and conditions. Nothing in this Privacy Policy excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law or any other law that cannot lawfully be excluded.

Where it is lawful and practicable, you may deal with us anonymously or by using a pseudonym, for example when making a general enquiry. We need your name and contact details to create an account, take a booking, process a payment or provide our services, and a Practitioner may need to identify you to provide a health service lawfully.

The Platform is intended for adults. Membership is available only to individuals aged 18 or over. Where a Practitioner provides services to a person under 18, we expect a parent or guardian to make the booking and give any required consent, unless the young person has capacity to consent for themselves. We do not knowingly direct marketing to children. We will comply with any Children’s Online Privacy Code registered under the Privacy Act to the extent it applies to us.

Awareness Services Pty Ltd (ACN 671 588 800, ABN 38 671 588 800) is a company based in New South Wales, Australia.

We operate an online platform that connects independent Practitioners with clients, and provides Members with a booking system, administrative and compliance support tools, therapeutic resources, Awareness AI, Joy and related services.

We do not provide clinical treatment except where we expressly state otherwise. Each Practitioner is a separate business. Each Practitioner is responsible for its own clinical records and for its own compliance with privacy, health records, professional registration and NDIS obligations, and handles your Health Information under its own privacy policy. We handle booking, account and payment information as the operator of the Platform. Where a Practitioner stores information on the Platform, we hold it on the Practitioner’s behalf and use it only to provide the Platform to that Practitioner.

Our contact details, including for our Privacy Officer, are set out in section 16.

The Personal Information we collect depends on how you deal with us. It may include the following.

Visitors and enquirers:

• name, email address, phone number and the content of your enquiry;
• your communication preferences and records of your consents.

Clients:

• name, date of birth, contact details and emergency contact details;
• booking details, including the Practitioner you choose, appointment times and any information you provide when booking;
• Health Information you provide in health and wellbeing assessments, questionnaires or intake forms;
• NDIS information you choose to give us, such as your NDIS participant number, plan management type and plan manager details;
• content you enter into the Online Goal-Oriented Journal, Joy or Awareness AI;
• payment and billing records.

Members and Practitioners:

• name, business name, ABN and contact details;
• qualifications, professional registration details (for example, AHPRA registration), insurance details and NDIS registration status;
• documents you provide to us for NDIS registration support or compliance support, which may include worker screening check status and audit documentation;
• subscription, billing and payment details;
• support requests and other communications with us.

Technical and usage information: IP address, device and browser type, pages viewed, referring pages, approximate location, cookie identifiers and log data (see section 9).

Marketing records: consents, unsubscribe requests, webinar registration and attendance, and interactions with our emails and professional networking messages.

Card payments are handled by our third-party payment processor. We do not store full card numbers.

Please do not include Health Information or other Sensitive Information in general enquiry forms or ordinary email unless we ask you to.

We collect Personal Information directly from you when you use the Platform, including when you complete a form or assessment, create an account, make a booking, buy a membership, use the Online Goal-Oriented Journal, Joy or Awareness AI, register for or attend a webinar or event, contact us by phone, email or message, or interact with us on social media, including LinkedIn.

We collect some information automatically when you use the Platform, through cookies and similar technologies (see section 9).

We may collect Personal Information from third parties where it is unreasonable or impracticable to collect it from you directly, or where you have authorised it. These may include Practitioners, plan managers, support coordinators, referrers, parents or guardians, organisations that engage us for workplace programs (contact details only), our payment and booking providers, and public sources such as the AHPRA public register, the NDIS Provider Register and professional profiles published on LinkedIn.

If we receive Personal Information that we did not ask for, we will decide whether we could have lawfully collected it. If we could not, we will destroy or de-identify it as soon as practicable where it is lawful and reasonable to do so.

If you do not provide the information we request, we may be unable to provide some or all of our services to you.

We collect, hold, use and disclose Personal Information for the following purposes:

• to operate the Platform and manage accounts and memberships;
• to take bookings and connect clients with Practitioners;
• to process payments, issue tax invoices and manage billing;
• to deliver membership features, including NDIS registration support, compliance support, therapeutic resources and medical support referrals;
• to provide Awareness AI, Joy and the Online Goal-Oriented Journal (see section 7);
• to verify Practitioner credentials;
• to respond to enquiries and provide support;
• to send service and administrative messages;
• to send direct marketing where permitted (see section 8);
• to analyse and improve the Platform;
• to protect the security of the Platform and prevent fraud and misuse;
• to comply with our legal obligations, and to deal with complaints, disputes and legal claims.

We use and disclose Personal Information only for the primary purpose for which it was collected, for a related secondary purpose you would reasonably expect (for Sensitive Information, a directly related secondary purpose), with your consent, or as otherwise required or authorised by law.

We may disclose Personal Information to:

• the Practitioner you book with, including your booking details and any information you submit for the appointment;
• our service providers (see section 10);
• your plan manager, support coordinator, the National Disability Insurance Agency or another person you ask us to share it with;
• the NDIS Quality and Safeguards Commission or an approved quality auditor, where a Member asks us to support their registration or audit, or where the law requires it;
• our professional advisers, such as accountants, auditors and lawyers;
• a prospective purchaser of all or part of our business, under confidentiality obligations;
• courts, regulators, law enforcement and government agencies, where required or authorised by law.

If an employer or other organisation engages us to deliver a workplace program, your participation is voluntary. We do not disclose your identifiable results or Health Information to that organisation without your express consent. Any reporting to the organisation is aggregated and de-identified only.

Confidentiality has limits. We or a Practitioner may use or disclose Personal Information without consent where the Privacy Act or another law permits or requires it, including:

• where we reasonably believe it is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety;
• where it is required or authorised by law, a court or tribunal order, a subpoena or a warrant;
• to meet mandatory reporting obligations, including child protection obligations;
• where we suspect unlawful activity or serious misconduct, or for enforcement-related activities;
• to establish, exercise or defend a legal or equitable claim.

We do not sell Personal Information. We do not adopt government-related identifiers, such as NDIS participant numbers or Medicare numbers, as our own identifiers.

We collect Sensitive Information, including Health Information about physical health, mental health, wellbeing, disability and NDIS participation, only where it is reasonably necessary for our functions and you have given express consent, or where the law otherwise permits it.

We seek consent at the point of collection, for example through an opt-in checkbox or a signed form that explains what we are collecting and why. Consent must be voluntary, informed, current and specific, and must be given by a person with capacity to give it, or by their authorised representative.

You may withdraw your consent at any time by contacting us. Withdrawal may limit the services we can provide. It does not affect handling that took place before you withdrew consent, or information we must keep by law.

We use Sensitive Information only for the purpose for which it was collected or a directly related purpose you would reasonably expect. We do not use it for direct marketing without your express consent, we do not sell it, and we do not use it to train artificial intelligence models.

We treat content you enter into the Online Goal-Oriented Journal, Joy and Awareness AI as potentially Sensitive Information. Our staff do not access the content of your journal entries or your Joy or Awareness AI chats.

Where we help a Member with NDIS registration or compliance, we use the documents and information provided only for that purpose. Practitioners who are NDIS providers remain responsible for their own obligations under the National Disability Insurance Scheme Act 2013 (Cth) and the associated rules.

Where we reasonably believe there is a serious threat to your life, health or safety and it is unreasonable or impracticable to obtain your consent, we may contact emergency services or your nominated emergency contact.

Joy is an AI assistant that provides general information and reflection prompts about mental, financial and physical wellbeing. Awareness AI is a set of AI-assisted tools that Members can use to support their professional and administrative work.

Joy and Awareness AI provide general information only. They are not a doctor, counsellor, psychologist or financial adviser, they can make mistakes, and they are not a crisis service. In an emergency call 000, or Lifeline on 13 11 14. Please do not enter information you do not want processed in this way.

When you use Joy or Awareness AI, we process your prompts, messages, any content you upload and related account and usage information. This information is sent to our third-party AI service provider so that it can generate a response. That provider may process information outside Australia (see section 10).

We do not use your Personal Information to train or fine-tune AI models. Our AI service provider may process your inputs only to generate a response, under terms that restrict it from using your inputs and outputs to train its models.

We do not keep Joy conversation history after your session ends. If you want to keep anything from a Joy conversation, you will need to save it yourself, for example in the Online Goal-Oriented Journal. Where a Member chooses to save an Awareness AI output to their account, we keep that saved output as part of the Member’s account until it is deleted or the account is closed.

AI outputs are generated automatically and are not reviewed by a person before you see them. Our staff do not access the content of your Joy or Awareness AI chats or your journal entries. Joy is not a crisis service and conversations are not monitored by a person. If you are in crisis or at immediate risk of harm, call 000. For 24-hour crisis support, call Lifeline on 13 11 14.

We do not use computer programs to make decisions that could reasonably be expected to significantly affect your rights or interests, whether the program makes the decision itself or does something substantially and directly related to making it. Decisions about memberships, accounts, Practitioner verification, bookings and complaints are made by people.

Some routine processes are automated but do not involve such decisions. For example, the booking system confirms availability and sends reminders, and spam filters screen form submissions. Our payment provider may use automated fraud screening that can decline a transaction. If that happens, contact us and we will help you manually.

If we begin using automated decision-making of the kind described in clause 7.7, we will update this Privacy Policy beforehand to describe the kinds of Personal Information used and the kinds of decisions made, as required by APP 1.

We may use your Personal Information (other than Sensitive Information) to send you information about our services, webinars, events and Awareness Journal articles, where you have consented or where the APPs otherwise permit it. We use Sensitive Information for direct marketing only with your express consent.

Under the Spam Act 2003 (Cth), we send commercial electronic messages, including emails, SMS and commercial direct messages on platforms such as LinkedIn, only with your consent (express, or inferred where the Spam Act permits). Each message identifies Awareness Services, includes our contact details and includes a functional unsubscribe option. We act on unsubscribe requests within 5 business days and do not charge for them.

We may contact professionals using business contact details they have conspicuously published, such as on a business website or LinkedIn profile, where the message relates to their professional role and the publication does not state that they do not want to receive unsolicited messages. Every such message includes a way to opt out.

If you register for a webinar, we will send you messages about that webinar. We will send marketing follow-up only if you consented at registration. We will tell you before a webinar is recorded.

We do not make telemarketing calls to numbers on the Do Not Call Register unless you have consented, in line with the Do Not Call Register Act 2006 (Cth). Any telemarketing calls we make comply with the applicable industry standard, including its permitted calling hours.

We do not disclose your Personal Information to third parties for their own marketing.

You can opt out of marketing at any time by using the unsubscribe link, replying “STOP” to an SMS, or contacting us (see section 16). You may also ask us where we obtained your information. We will continue to send service and administrative messages that are necessary for your account or bookings.

Cookies are small files stored on your device. We and our providers also use similar technologies, such as pixels, tags and local storage (together, cookies).

We may use the following categories of cookies:

• Strictly necessary: cookies needed for security, log-in sessions, forms, and the shopping cart and checkout, without which the Platform cannot work properly;
• Functional: cookies that remember your choices and allow features such as our booking system to work;
• Analytics: cookies that help us understand, in aggregate, how visitors use the Platform, such as pages viewed, approximate location, device and browser type;
• Spam protection: tools that check device and browser information to confirm that form submissions are made by people and not automated programs;
• Advertising and social media (if used): cookies and pixels that help us measure the effectiveness of our advertising and reach relevant audiences.

It is our policy not to send Health Information, health assessment answers, journal content or Joy or Awareness AI content to analytics or advertising providers.

You can manage cookies through your browser settings, including by blocking or deleting them. Where we use analytics or advertising tools, the providers of those tools may also offer their own opt-out options. Blocking strictly necessary cookies may stop parts of the Platform, including bookings and forms, from working.

We use third-party service providers to operate the Platform. Depending on the services you use, they may include providers of:

• website hosting;
• our online booking system;
• website forms;
• e-commerce and payment processing;
• email and calendar services;
• customer relationship management and email marketing;
• webinars and online events;
• AI services (see section 7);
• analytics, spam protection and, if used, advertising (see section 9);
• professional networking platforms, such as LinkedIn.

We require our service providers to handle Personal Information securely and only for the purpose of providing services to us, through our contracts with them or their published terms.

Some of these providers store or process Personal Information outside Australia. The countries involved may include the United States of America and other countries where those providers or their data centres operate.

Before disclosing Personal Information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs, for example through contractual commitments, unless an exception under APP 8 applies. If we rely on your consent for an overseas disclosure, we will tell you beforehand that APP 8.1 will not apply.

We take reasonable steps to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encryption in transit (TLS), role-based access controls, firewalls and security software, regular updates and backups, staff confidentiality obligations, due diligence on service providers, and locked storage for any paper records.

No method of transmission or storage is completely secure. Ordinary email is not end-to-end encrypted, so please do not send Sensitive Information by email. We will tell you about a secure alternative where one is needed.

You are responsible for keeping your account password confidential. Please tell us promptly if you believe your account has been compromised.

We keep Personal Information only for as long as we need it for the purposes in this Privacy Policy, or for longer if the law requires. In particular:

• Health Information we hold as a health service provider is kept for at least 7 years after the last occasion of service for adults or, for a person who was under 18 when the information was collected, until they turn 25, whichever is later, as required by the HRIP Act;
• financial and tax records are kept for at least 7 years;
• Member account records are kept for the duration of the membership and afterwards for as long as reasonably needed for legal, tax and dispute-resolution purposes (generally up to 7 years);
• Online Goal-Oriented Journal content is kept while your account is active, until you delete it or until you close your account, unless the law requires otherwise. Joy conversations are not kept after your session ends (see clause 7.5);
• marketing records are kept until you unsubscribe. We then keep minimal details on a suppression list so that we can honour your opt-out;
• analytics data, where collected, is kept for a limited period set in the relevant analytics tool and is then deleted.

When we no longer need Personal Information, we take reasonable steps to securely destroy or de-identify it. For Health Information, we keep a record of the individual’s name, the period the information covers and the date it was deleted or disposed of, as required by the HRIP Act.

Practitioners are responsible for retaining and destroying their own clinical records.

We maintain a data breach response plan that requires us to contain a suspected breach, assess it, notify those affected where required, and review it to prevent recurrence.

Where we suspect an eligible data breach, we will take reasonable steps to complete an assessment within 30 days.

If an eligible data breach occurs under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, meaning a breach likely to result in serious harm to any of the individuals affected, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, and recommend steps you can take.

Where a breach involves a Practitioner or one of our service providers, we will coordinate our response with them. Our contracts require our service providers to tell us promptly about any breach.

If you suspect a breach involving the Platform, please contact us immediately (see section 16).

You may ask for access to the Personal Information we hold about you by contacting us (see section 16). We will need to verify your identity and will respond within 30 days.

We do not charge you to make a request. We may charge a reasonable fee for providing access, such as copying costs, and will tell you about it before we proceed.

We may refuse access in the circumstances permitted by APP 12 or the HRIP Act. If we refuse, we will give you written reasons and tell you how to complain.

If your request relates to records held by a Practitioner, please contact the Practitioner directly. We will help direct your request where we can.

If you believe your Personal Information is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. We will take reasonable steps to correct it and, if you ask, notify any third party we disclosed it to. If we refuse to make a correction, we will give you written reasons, and you may ask us to attach a statement to the information noting that you believe it is incorrect.

An authorised representative may make a request on your behalf if we are given appropriate evidence of their authority.

If you have a concern about how we have handled your Personal Information, please contact our Privacy Officer in writing (see section 16) with details of your concern.

We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, you may complain to:

• the Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001; or
• for complaints about Health Information handled in New South Wales, the NSW Information and Privacy Commission: www.ipc.nsw.gov.au, 1800 472 679.

The OAIC can investigate complaints, make determinations, issue infringement notices and seek civil penalties for interferences with privacy.

You may also have rights under the statutory tort for serious invasions of privacy in Schedule 2 to the Privacy Act. Nothing in this Privacy Policy limits those rights.

We may update this Privacy Policy from time to time to reflect changes in the law, our services or our practices. The current version will always be available on this page, with its date and version number.

We will notify Members of material changes by email or through the Platform before they take effect. If a change involves a new use of Sensitive Information, we will seek your consent before making that use.

This is Version 2.0, effective October 2026. It replaces the privacy provisions of the document titled “Privacy Policy, Terms & Conditions” dated September 2026. Membership terms previously included in that document are dealt with separately from this Privacy Policy.

For privacy questions, requests or complaints, please email our Privacy Officer at link@awareness-services.com. Awareness Services Pty Ltd (ACN 671 588 800, ABN 38 671 588 800) is based in NSW, Australia.

If you need an interpreter, contact the Translating and Interpreting Service on 131 450. If you are deaf or have a hearing or speech impairment, contact us through the National Relay Service.