Happy Without Histamine is operated by Luanne Hopkinson (ABN 93 816 394 809), trading from Suite 205, 330-332 Hawthorn Road, Caulfield, VIC 3162, Australia.

This document sets out the Privacy Policy for the Happy Without Histamine website, https://www.happywithouthistamine.com.

Happy Without Histamine is committed to providing quality services to you and this policy outlines our ongoing obligations to you in respect of how we manage your Personal Information.

We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information.

A copy of the Australian Privacy Principles may be obtained from the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.

Happy Without Histamine is bound by the Privacy Act 1988 (Cth), which sets out a number of principles concerning the privacy of individuals. Where clients in other countries are covered by their own privacy laws, the sections further below set out the specific rights that apply to you.

What is Personal Information and why do we collect it?

Personal Information is information or an opinion that identifies an individual. Examples of Personal Information we collect include: names, addresses, email addresses, phone numbers, and health information relevant to your care.

This Personal Information is obtained in many ways, including through our website, by email, through consultations, through our client booking and health history platform, and via cookies and website analytics. We don't guarantee website links or the privacy practices of authorised third parties.

We collect your Personal Information for the primary purpose of providing our services to you, providing information to our clients and marketing. We may also use your Personal Information for secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use or disclosure. You may unsubscribe from our mailing and marketing lists at any time by contacting us in writing or using the unsubscribe link in any email.

When we collect Personal Information we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

Collection of your personal information

There are many aspects of the site which can be viewed without providing personal information, however, for access to Happy Without Histamine customer support features, client bookings or program materials you are required to submit personally identifiable information. This may include but is not limited to a unique username and password, contact details, and health history relevant to your care.

Sharing of your personal information

We may hire other companies and use software platforms to provide services on our behalf, including but not limited to handling customer support enquiries, processing transactions, client bookings and session records. Those companies are permitted to obtain only the personal information they need to deliver the service. Happy Without Histamine takes reasonable steps to ensure that these organisations are bound by confidentiality and privacy obligations in relation to the protection of your personal information. The specific platforms we use are set out below.

Third-party services we use

To run our practice and deliver our programs, we use the following platforms, each of which may process some of your personal information:

• Stripe and Square, for processing card payments. Neither Stripe nor Square shares your full card details with us.
• GoHighLevel, which runs our website, checkout pages, email communications and customer records.
• Practice Better, our client portal for bookings, health history forms and program materials. Practice Better is a HIPAA compliant platform.
• Heidi, which we use to transcribe client sessions. Heidi is also a HIPAA compliant platform.
• Google Workspace, for email and secure file storage, including any lab results or test documents you provide.
• Mailchimp, for email marketing communications.

We previously used ActiveCampaign for email marketing and are in the process of closing this account. Any remaining historical data held there will be deleted once the account is closed.

Our practice, including the use of Practice Better and Heidi, is governed by the Australian Privacy Principles under the Privacy Act 1988 (Cth), not by the United States' HIPAA framework. Practice Better and Heidi are HIPAA compliant in addition to meeting Australian requirements, which provides a further layer of security around your health information beyond what Australian law requires.

Information we receive from third parties

Where reasonable and practicable to do so, we will collect your Personal Information only from you. However, in some circumstances we may be provided with information by third parties, for example a referring practitioner. In such a case we will take reasonable steps to ensure that you are made aware of the information provided to us by the third party.

Disclosure of Personal Information

Your Personal Information may be disclosed in a number of circumstances including the following:

• To the third-party platforms listed above, solely for the purpose of delivering our services;
• To other third parties where you consent to the use or disclosure; and
• Where required or authorised by law.

Sensitive Information

Sensitive information is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

As a nutrition and health practice, we collect health information, including case history and, where you provide them, lab or pathology results. This is sensitive information under the Privacy Act. We only collect it with your consent and only use it for the purpose of providing your care.

Sensitive information will be used by us only:

• For the primary purpose for which it was obtained
• For a secondary purpose that is directly related to the primary purpose
• With your consent; or where required or authorised by law.

Use of your personal information

For each visitor to reach the site, we collect the following non-personally identifiable information, including but not limited to browser type, version and language, operating system, pages viewed while browsing the site, page access times and referring website address. This collected information is used solely internally for the purpose of gauging visitor traffic, trends and delivering personalised content to you while you are on this site. Further detail on the specific tools used for this is set out in the Cookies and analytics section below.

From time to time, we may use customer information for new, unanticipated uses not previously disclosed in our privacy notice. If our information practices change at some time in the future we will use those new purposes only for data collected from the time of the policy change forward, and this policy will be updated accordingly.

Cookies and analytics

Our website uses cookies from Google Analytics and the Meta (Facebook) pixel to understand how visitors use the site and to measure the performance of our advertising. These tools may collect general information such as your approximate location, browser type and the pages you visit. They do not collect health information or anything you enter into a booking or health history form.

You can manage or disable cookies through your browser settings, and can opt out of Google Analytics and personalised advertising through the relevant settings on Google and Meta's own platforms.

Security of Personal Information

Your Personal Information is stored in a manner that reasonably protects it from misuse and loss and from unauthorised access, modification or disclosure.

When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify it. Most Personal Information is stored in client files, which are kept for a minimum of 7 years in line with our professional record-keeping obligations. Marketing and website analytics data is retained only for as long as needed for those purposes, or until you unsubscribe or object, whichever is sooner.

No method of transmission over the internet, and no method of electronic storage, is completely secure. Any Personal Information you send to us over the internet is sent at your own risk, and to the extent permitted by law, we are not liable for unauthorised access to, or interception or loss of, information transmitted to us that occurs outside our reasonable control. If you have chosen or been given a password to access our website, client portal or program materials, you are responsible for keeping that password confidential and should not share it with anyone.

International data transfers

Some of the platforms listed above, including Stripe, GoHighLevel and Google Workspace, store data on servers located outside Australia, including in the United States. Where Personal Information belonging to a person in the European Economic Area or the United Kingdom is transferred to a country without an equivalent level of data protection, we and our third-party platforms rely on the European Commission's standard contractual clauses, or the UK's International Data Transfer Addendum to those clauses, as the safeguard for that transfer. A copy of these safeguards is available on request using the contact details at the end of this policy.

Access to your Personal Information

You may access the Personal Information we hold about you and ask us to update, correct or delete it, subject to certain exceptions, such as information we are required by law to keep. If you wish to access, correct or delete your Personal Information, please contact us in writing.

Happy Without Histamine will not charge any fee for your access request, but may charge an administrative fee for providing a copy of your Personal Information.

In order to protect your Personal Information we may require identification from you before releasing the requested information.

Your rights under the GDPR and UK GDPR

If you are located in the United Kingdom or the European Union, the General Data Protection Regulation (GDPR) or UK GDPR gives you the following rights over your personal information, in addition to the rights set out above:

• The right to access the personal information we hold about you
• The right to have inaccurate information corrected
• The right to have your information deleted, where we are not required to keep it for legal or professional reasons
• The right to receive a copy of your information in a portable format
• The right to ask us to restrict the processing of your information, in certain circumstances
• The right to object to our processing of your information, in certain circumstances, including at any time for marketing purposes

To exercise any of these rights, contact us using the details at the end of this policy.

Your rights under the CCPA (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we collect about you, the right to ask us to delete it, and the right to opt out of the sale of your personal information. We do not sell your personal information to any third party. To exercise any of these rights, contact us using the details at the end of this policy, and we will not discriminate against you for doing so.

Children's privacy

Our services are not offered to anyone under the age of 16, and we do not knowingly collect personal information from children. As an exception, we may provide a one-to-one consultation to a minor where the minor's parent or guardian has given consent and is present throughout the consultation. Any personal information collected in that circumstance is collected and used in accordance with this policy, on the basis of the parent or guardian's consent. See the working with minors section of our terms and conditions for more detail.

Maintaining the Quality of your Personal Information

It is important to us that your Personal Information is up to date. We will take reasonable steps to make sure that your Personal Information is accurate, complete and up to date. If you find that the information we have is not up to date or is inaccurate, please advise us as soon as practicable so we can update our records and continue to provide quality services to you.

Complaints

If you have a concern about how we have handled your personal information, please contact us first using the details below so we can try to resolve it directly. If you are not satisfied with our response, Australian residents can contact the Office of the Australian Information Commissioner at www.oaic.gov.au, UK residents can contact the Information Commissioner's Office at www.ico.org.uk, and EU residents can contact their local data protection authority.

Changes to this Privacy Policy

Happy Without Histamine reserves the right to make amendments to this Privacy Policy at any time. If you have objections to the Privacy Policy, you should not access or use the Site.

Terms and conditions

Your use of this website, and your purchase of any program, is also governed by our terms and conditions, which should be read together with this policy.

Contacting us

Happy Without Histamine welcomes your comments regarding this Privacy Policy. If you have any questions about this Privacy Policy and would like further information, please contact us by any of the following means during business hours Monday to Friday.

Happy Without Histamine
Luanne Hopkinson, ABN 93 816 394 809
Suite 205, 330-332 Hawthorn Road,
Caulfield, VIC 3162, Australia

E-mail: [email protected]