PRIVACY POLICY

Breath & Sinew

Effective Date: 20 August 2026

Last Updated: 20 August 2026

1. Purpose and Scope

1.1 Joshua Matthew Bell, trading as Breath & Sinew (ABN: 21642800535) is committed to safeguarding your personal and health information. This Privacy Policy sets out how Breath & Sinew collects, uses, stores, discloses, and protects your information across our personal training, movement instruction, and fight choreography services.

1.2 Breath & Sinew complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic), and the Health Privacy Principles (HPPs). As a provider of physical training and movement services in Victoria collecting health information, Breath & Sinew complies with the Victorian HPPs regardless of small-business turnover exemptions under Commonwealth law.

2. Information We Collect

Breath & Sinew collects information necessary to deliver physical instruction safely, fulfill administrative functions, and comply with Victorian health and safety legislation.

2.1 Personal Information

  • Full name, date of birth, residential address, email address, and contact phone numbers.

  • Payment details, transaction logs, and billing histories processed via Square.

  • Emergency contact names, relationships, and phone numbers.

  • Media consent preferences for photography or video recorded during rehearsals or workshops.

2.2 Health & Sensitive Information Due to the physical, high-exertion, and tactile nature of personal training and fight choreography, Breath & Sinew collects health information, including:

  • Physical Activity Readiness Questionnaires (PAR-Q Forms).

  • Medical history, cardiovascular conditions, joint or musculoskeletal injuries, physical limitations, or relevant medications.

  • Explicit consent records for tactile cueing and hands-on physical adjustments during movement instruction.

2.3 Information Collected from Minors In accordance with the Working with Children Act 2005 (Vic) and child safety standards, collection practices for minors are structured as follows:

  • Children Aged 5–15: Health screening and PAR-Q data must be provided via a Parent-Completed PAR-Q Form executed by a parent or legal guardian.

  • Young Persons Aged 16–17: Information is collected via a Young Person PAR-Q Form. Where the young person demonstrates decision-making capacity, they may execute their own form; parent/guardian co-signature is requested where operationally appropriate or required for safety.

2.4 Digital & Technical Data When accessing our website, analytical data is collected via Squarespace Analytics, including IP addresses, device identifiers, browser types, and page interaction metrics.

3. Collection Methods & Software Stack

Breath & Sinew collects personal and health data directly from you (or your parent/guardian) through our digital software stack:

  • Booking & Scheduling: Acuity Scheduling and Squarespace.

  • Workout Programming & Health Tracking: Everfit.

  • Payment Processing: Square.

  • Document & Intake Storage: Google Workspace / Google Drive (encrypted cloud storage).

  • Direct Consultations: Verbal health intakes and physical screenings during sessions.

4. Purposes of Collection, Use, and Disclosure

Breath & Sinew collects, holds, uses, and discloses information for the following specific purposes:

4.1 Safe Service Delivery & Risk Mitigation: To evaluate physical readiness, tailor conditioning programs, structure safe fight choreography, apply tactile adjustments safely, and meet duties of care under the Occupational Health and Safety Act 2004 (Vic).

4.2 Administrative Operations: To process payments via Square, manage bookings through Acuity, and distribute workout plans through Everfit.

4.3 Emergency Medical Care: To share relevant medical histories or emergency contact details with first responders or medical personnel in the event of an acute injury or emergency during training.

4.4 Marketing & Communication: To send transactional scheduling updates and, where you have provided express consent, promotional newsletters via Squarespace Email Campaigns. You may opt out of promotional emails at any time using the "Unsubscribe" link.

4.5 Legal Obligations: To comply with statutory requirements under Victorian health records legislation and child protection standards.

5. Overseas Data Transfers (Cross-Border Disclosures)

5.1 Breath & Sinew utilizes reputable third-party cloud service providers to store and process data. These providers maintain cloud infrastructure located outside Australia, primarily in the United States:

  • Google Workspace / Google Drive (Document & PAR-Q storage)

  • Acuity Scheduling (Appointment & client booking)

  • Squarespace (Website hosting, analytics, email marketing)

  • Square (Payment gateway)

  • Everfit (Fitness programming & client tracking)

5.2 Pursuant to APP 8.1 and HPP 9, by submitting your information to Breath & Sinew, you consent to the transfer, storage, and processing of your personal and health data on these overseas cloud servers. Breath & Sinew ensures these vendors enforce industry-standard security frameworks, including SSL/TLS encryption and restricted access controls.

6. Storage, Security, and Retention Standards

6.1 Data Security: Digital records stored within Google Drive, Everfit, Acuity, and Square are secured using multi-factor authentication, strong password protection, and encrypted server protocols.

6.2 Mandatory Retention Periods: In compliance with HPP 4 (Health Records Act 2001 (Vic)):

  • Adult Health Records: Retained for 7 years from the date of the last health or physical training service provided.

  • Minors' Health Records: Retained until the participant reaches 25 years of age.

  • Destruction: Upon the expiration of statutory retention periods, health records will be permanently deleted or securely de-identified.

7. Accessing and Correcting Your Information

7.1 You have a statutory right to request access to the personal and health information held about you by Breath & Sinew, and to request corrections if the data is inaccurate, incomplete, out of date, or misleading.

7.2 Parents or legal guardians may request access to or correction of health records for dependent children (aged 5–15). Young persons aged 16–17 with decision-making capacity may exercise these rights directly.

7.3 To request access or corrections, email the Privacy Officer:

7.4 Written requests will be processed within 30 days. Identity verification is required before releasing health records.

8. Data Breach Response

In the event of a suspected or confirmed data breach involving personal or health information, Breath & Sinew will assess the incident immediately. If the breach is likely to result in serious harm, notification will be provided to the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

9. Inquiries and Complaints

9.1 If you have questions or wish to lodge a complaint regarding Breath & Sinew’s privacy practices, contact:

Privacy Officer

Breath & Sinew

Email: privacy@breathandsinew.com.au

9.2 We will investigate and respond to your complaint in writing within 30 days. If you are not satisfied with our response, you may contact:

  • Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au | 1300 363 992

  • Office of the Health Commissioner (Victoria): www.hcc.vic.gov.au | 1300 582 113