Privacy Policy

1. About this policy

IgniteHeal provides naturopathic consultations, nutritional and lifestyle support, and related services by telehealth. We work with clients in Australia, Singapore, Indonesia and the UK.

We collect health information, which is sensitive information. This policy explains what we collect, why, who we share it with, and what rights you have.

We handle personal information in accordance with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles
• Singapore's Personal Data Protection Act 2012 for clients in Singapore
• Law No. 27 of 2022 on Personal Data Protection (UU PDP), for clients in Indonesia
• the UK GDPR and Data Protection Act 2018 for clients in the United Kingdom

2. What we collect

Information you give us

When you enquire or join a waitlist: your name, email address, and anything you choose to tell us about what you're looking for.

When you become a client: contact details, date of birth, and the health information needed to provide care, including your health history, symptoms, current and past medications and supplements, allergies, diet, lifestyle, family history, and any test results you share with us.

When you pay: billing details. Card details are handled by our payment provider and are not stored by us.

Information generated in the course of care

Consultation notes, treatment plans, prescriptions and recommendations, correspondence with you, functional test results, and records of appointments.

Information from others, with your consent

Referrals, correspondence and test results from your GP, specialists or other practitioners, and results returned directly to us by laboratories.

Technical information

Our website collects IP address, browser and device information, and usage data through cookies and analytics. See our Cookies Policy for more detail.

3. Information about children

We provide consultations to children. Where the client is under 18:

• A parent or guardian must provide consent for the consultation and for us to collect the child's health information.
• A parent or guardian must be present for consultations with clients under 16.
• Health records for children are retained until the client turns 25, or seven years after their last appointment, whichever is later, as required by law.
• A parent or guardian may generally access their child's records, though we may decline where we consider disclosure would not be in the child's interests. For older children we will take the young person's own views into account.

4. Why we collect it

We collect and use your information to:

• provide naturopathic consultations and nutritional and lifestyle support
• assess whether recommendations are safe for you, including checking for interactions with your medications
• order testing and interpret results
• dispense or arrange practitioner-only supplements
• take payment and issue receipts
• communicate with you about appointments
• correspond with your other healthcare providers, with your consent
• meet our record-keeping, professional and legal obligations
• with your consent, send you updates about our services

5. Who we share it with

We do not sell your information. We share it only as follows.

Service providers who help us operate:

• Nabooki — appointment booking, scheduling and clinical records
• Stripe — payment processing
• Wise — payment processing
• Gmail — email communication
• Typeform — enquiry and waitlist forms
• Pathology and functional testing laboratories — where you have consented to testing
• Dispensary / supplement supplier — where products are shipped to you

Your other healthcare providers, where you have consented, for example, a summary letter to your GP.

Where required or permitted by law, including to comply with a court order or a legal obligation, or where there is a serious threat to someone's life, health or safety.

6. How we protect it

• Records are stored in Nabooki, with access restricted to those who need it
• Data is encrypted in transit and at rest
• Access is protected by strong authentication
• Consultations are not recorded unless you agree in writing
• Regular backups are maintained

If a data breach occurs that is likely to cause you serious harm, we will notify you and the relevant regulator as required by law — under Australia's Notifiable Data Breaches scheme, Singapore's PDPA, the UK GDPR, and Indonesia's UU PDP, which requires notification within 72 hours.

7. How long we keep it

Health records are subject to minimum retention periods set by law. We retain:

• Adult client health records — at least seven years from your last appointment
• Records for clients who were under 18 — until they turn 25, or seven years after their last appointment, whichever is later
• Financial and tax records — as required by tax law, generally five years
• Waitlist and marketing contacts — until you unsubscribe or ask us to remove you

After these periods, records are securely destroyed or de-identified.

8. Your rights

Access. You can request a copy of your personal information, including your health records. We will respond within 30 days. There is no charge for a standard request.

Correction. If information we hold is inaccurate or incomplete, tell us and we will correct it. Where a clinical record is disputed, we may add a note recording your view rather than altering the original entry, as clinical records must remain a true account of what occurred.

Deletion. You can ask us to delete your information, but we cannot delete health records before the legal retention period has expired. Marketing contact details can be removed at any time.

Marketing. You can unsubscribe from emails at any time using the link in any message, or by contacting us.

Complaints. If you are unhappy with how we have handled your information, contact us first at admin@igniteheal.com and we will respond within 30 days. If you are not satisfied, you can complain to:

• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• Singapore: Personal Data Protection Commission — pdpc.gov.sg
• Indonesia: Ministry of Communication and Digital Affairs (Komdigi), or the Personal Data Protection Authority once established
• United Kingdom: Information Commissioner's Office — ico.org.uk

9. Cookies

Our website uses cookies for basic functionality and to understand how the site is used. You can control cookies through your browser settings, though some features may not work correctly if you disable them. Full details are in our Cookies Policy.

10. Changes to this policy

We may update this policy. Material changes will be posted here with an updated date, and where the change significantly affects how we handle your information, we will let you know directly.

11. Contact us