Privacy Policy

1. What information we collect

When you set up your Seniors Fitness account, access our website, use the services at Seniors Fitness or interact with our representatives (including through customer service or support), we may ask for and collect:

• Identity and contact details — name, date of birth, address, phone number, email, emergency contact.
• Health information — medical history, diagnoses, medications, assessment results, session notes, progress reports, referrals from GPs or specialists, Medicare/DVA/NDIS/insurance details, and information extracted from our clinical or booking software.
• Payment and billing information — bank account or card details processed through Xero, Stripe and Ezidebit or other payment gateway providers; direct debit and membership records.
• Photos and video — taken during classes or sessions, with separate consent (see our Consent Form).
• CCTV footage — recorded at our premises for security purposes.
• Website and enquiry data — information submitted through contact and booking forms, and lead information collected through Zoho CRM.
• Employment information — for job applicants, employees and contractors, including via our Exercise Physiologist and other role applications.

Except for use of photos and videos which require a separate consent, by accessing the services, payment platforms or website of Seniors Fitness, you agree to the way in which Seniors Fitness may collect, use or disclose any personal information you may provide to us in accordance with this Privacy Policy.

2. How we collect personal information

We collect personal information directly from you — in person, by phone, email, through our website, or via booking and intake forms — and, with your consent or as otherwise permitted by law, from your GP, specialists, family members, aged care providers, NDIS plan managers or nominees, funders (such as Medicare, DVA or private health insurers), and other health professionals involved in your care.

3. Why we collect, use and disclose your information

We may collect, hold, use and disclose personal information to:

• assess your suitability for our services and plan, deliver and review your exercise or clinical program;
• communicate with you about bookings, sessions, invoices and your membership or client agreement;
• prepare reports for you, your GP, specialist, funder or plan manager;
• process payments, reconcile accounts, and manage billing through providers including without limitation: Halaxy, Xero, Stripe and Ezidebit;
• manage leads and enquiries through Zoho CRM or other lead management software;
• meet our legal, insurance, accreditation and reporting obligations;
• maintain the security of our premises (CCTV) and manage room/gym hire to third parties outside our operating hours;
• with your separate, optional consent, use photos, video or testimonials for marketing;
• train our staff internally;
• train the underlying AI tools used in Seniors Fitness; or
• assess job applications and manage our staff and contractors.

4. Use of artificial intelligence (AI) tools

Seniors Fitness uses AI tools — currently Claude (Anthropic) and Co-pilot in Microsoft Office 365 — as part of delivering our services and running our business. This includes, on identifiable client information where relevant:

• drafting letters, emails and reports (including, at times, pasting in a client’s own email to respond to it);
• turning assessment results and session notes into progress reports for clients, their GP, funder or plan manager, and preparing program documents;
• administrative work, including reconciling payments and accounts;
• general business work such as policies, marketing and planning.

These AI tools are operated overseas, including in the United States (see section 6, Overseas disclosure).

We do not offer a per-client opt-out from this use, as it is a tool integrated into the delivery of our service. If you have concerns about this, please contact our Privacy Officer (section 11) — we’re happy to discuss it.

5. Who we disclose your information to

We may disclose personal information to:

• our employees and staff;
• your treating team — GPs, specialists, other allied health providers, hospitals;
• funders and payers — including, without limitation, Medicare, DVA, NDIS plan managers, private health insurers, aged care providers;
• our service providers — including, without limitation, Halaxy (clinical/booking software), Xero (accounting), Stripe and Ezidebit (payment processing), Microsoft 365 (email and document storage), Zoho CRM (lead and enquiry management), and AxIT (assessment system);
• virtual assistants and external consultants who support our administrative operations, based in Australia and, in some cases, overseas;
• our insurers, lawyers and accountants, and regulators or government bodies where required by law;
• a new owner or bona fide purchaser of the business, in the event Seniors Fitness is sold or restructured;
• our third parties including agents or subcontractors including IT service providers and data hosting service providers; or
• courts, police, tribunal or other regulatory or enforcement authorities as required by law in connection with any actual or prospective legal proceedings (including to exercise or defend our own rights);
• otherwise comply with applicable laws.

We do not sell personal information, and we do not disclose health information to third parties for their own marketing purposes. We also do not share any client information with organisations we hire our gym space to outside our operating hours — that arrangement is separate from, and does not involve, our clients’ personal information.

6. Overseas disclosure

Some of the third parties listed in section 5 store or process information overseas, including in the United States (for example, our AI tools, and elements of our Microsoft 365 and other cloud services). Where information is disclosed overseas, we take reasonable steps to ensure those recipients handle it consistently with the Australian Privacy Principles, including through the provider’s own contractual and security commitments. Under APP 8, Seniors Fitness may remain accountable for how an overseas recipient handles your information.

7. Data security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps include access controls on our clinical and business systems, use of reputable business-grade software providers, staff training, and physical security (including CCTV) at our premises. CCTV footage is retained only for as long as reasonably necessary for security purposes, and is then securely deleted or overwritten.

8. Data breaches

If we experience a data breach that is likely to result in serious harm to any individual, we will comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth) — including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as required.

9. How long we keep your information

We do not delete a client’s health records simply because they ask us to — health records must be retained by us for the periods above under applicable laws, even if a client requests deletion. When records are no longer required to be kept, we destroy or de-identify them securely. AI tools may also retain data in accordance with their data retention terms.

10. Access, correction and complaints

You have a right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact our Privacy Officer using the details in section 11. We will respond within a reasonable time and may need to verify your identity first. In limited circumstances permitted by law, we may need to refuse or limit access — if so, we will explain why.

If you have a concern or complaint about how we’ve handled your personal information, please contact our Privacy Officer first so we can try to resolve it. If you are not satisfied with our response, you can escalate your complaint to:

• the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au; or
• the NSW Information and Privacy Commission (IPC NSW) — ipc.nsw.gov.au, for complaints under the HRIP Act.

11. Contact us / Privacy Officer

Our Privacy Officer is Emily Moore.

• Email: contact@seniorsfitness.net.au
• Phone: 02 8056 2357
• Address: Suite 5, 35–45 Spring Street, Bondi Junction NSW 2022

12. Automated decision-making

Seniors Fitness does not use automated decision-making that significantly affects individuals — every decision about a client’s care, program, eligibility or fees is made by a practitioner. If this changes (including if a clinical or booking tool such as Halaxy introduces AI-driven decision features), we will update this policy accordingly, consistent with APP 1.7 requirements applying from 10 December 2026.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the services or software we use, or the law. The current version will always be available on our website, and the version date at the top of this document shows when it was last updated.

14. Related documents

This policy is supported by our Privacy Collection Notice and Consent Form, which clients and members sign before receiving services, and which separately addresses consent to matters such as photography and marketing.