Privacy Policy

The Information We Collect

Personal information is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable.

The types of personal information we may collect about you include:

• •Identity Data including your name, age, National Disability Insurance Scheme (NDIS) plan and reference number.
• •Contact Data including your telephone number, address and email.
• •Financial Data including bank account and payment card details (through our third-party payment processor, who stores such information and we do not have access to that information).
• •Transaction Data including details about payments to you from us and from you to us and other details of products and services you have purchased from us or we have purchased from you.
• •Technical and Usage Data when you access any of our websites or platforms, details about your internet protocol (IP) address, login data, browser session and geo-location data, statistics on page views and sessions, device and network information, acquisition sources, search queries and/or browsing behaviour, access and use of our website (including through the use of Internet cookies or analytics), and communications with our website.
• •Profile Data including your username and password for Fam Shop, profile picture, purchases or orders you have made with us, content you post, send receive and share through our platform, information you have shared with our social media platforms, and support requests you have made.
• •Care Management information including daily activities, medical appointments, reminders and care routines.
• •Interaction Data including information you provide to us when you participate in any interactive features, including surveys, contests, promotions, activities or events.
• •Marketing and Communications Data including your preferences in receiving marketing from us and our third parties and your communication preferences.
• •Professional data including where you are a worker of ours or applying for a role with us, your professional history such as your previous positions and professional experience, or whether you hold required authorisations or licences.
• •Sensitive information is a sub-set of personal information that is given a higher level of protection. Sensitive information means information relating to your racial or ethnic origin, political opinions, religion, trade union or other professional associations or memberships, philosophical beliefs, sexual orientation or practices, criminal records, health information or biometric information. The types of sensitive information we collect include:
  • ○where you are a user of our services, information about you or your Dependents, including your NDIS reference number; and
  • ○Comprehensive health records including growth measurements, immunisation records, developmental assessments, medical history, illnesses, injuries and family health history; and
  • ○where you apply for a role with us:
    • ■results of criminal records checks; and
    • ■your professional registrations and associations (where applicable);

How We Collect Personal Information

We collect personal information in a variety of ways, including:

• • when you provide it directly to us, including face-to-face, over the phone, over email, or online;
• • when you complete a form, such as registering for any events or newsletters, or responding to surveys;
• • when you use any website we operate (including from any analytics and cookie providers or marketing providers. See the "Cookies" section below for more detail on the use of cookies);
• • from third parties, such as the National Disability Insurance Agency (NDIA) and any other third-party authorised by you such as your support coordinator (if it is not us) and your plan manager (if it is not us); or
• • from publicly available sources.

Why we collect, hold, use and disclose personal information

Personal information: We collect, hold, use and disclose your personal information for the following purposes:

• • to operate the FAM care management app, including maintaining health records for care recipients, logging care activities and appointments, enabling care coordination between invited users, and providing AI-powered tools for care management;
• • to enable you to access and use our shop;
• • to enable you to share care recipient information with other users you invite to the platform (such as family members, co-parents, support workers or other carers), with access permissions controlled by you
• • to work or do business with you, including to dispatch and deliver our products to you;
• • to contact and communicate with you about our business, including in response to any support requests you lodge with us or other enquiries you make with us;
• • to contact and communicate with you about any enquiries you make with us via any website we operate;
• • for internal record keeping, administrative, invoicing and billing purposes;
• • for analytics, market research and business development, including to operate and improve our business, associated applications and associated social media platforms;
• • for advertising and marketing, including to send you promotional information about our events and experiences and information that we consider may be of interest to you;
• • to run promotions, competitions and/or offer additional benefits to you;
• • if you have applied for employment with us, to consider your employment application; and
• • to comply with our legal obligations or if otherwise required or authorised by law.

Sensitive information: We only collect, hold, use and disclose sensitive information for the following purposes:

• • any purposes you consent to;
• • the primary purpose for which it is collected;
• • secondary purposes that are directly related to the primary purpose for which it was collected, including disclosure to the below listed third parties as reasonably necessary to work with you as a customer or supplier of our business;
• • to contact emergency services, or to speak with your family, partner or support person where we reasonably believe there is a serious risk to the life, health or safety of you or another person and it is impracticable for us to obtain your consent; and
• • if otherwise required or authorised by law.

Our disclosures of personal information to third parties

Personal information: We will only disclose personal information (excluding sensitive information)to third parties where it is necessary as part of our business, where we have your consent, or where permitted by law. This means that we may disclose personal information (excluding sensitive information)to:

• • our employees, contractors and/or related entities;
• • IT service providers, data storage, web-hosting and server providers such as Shopify;
• • marketing or advertising providers;
• • delivery or logistics providers who deliver our goods to you;
• • suppliers who may process orders on our behalf;
• • professional advisors, bankers, auditors, our insurers and insurance brokers;
• • payment systems operators or processors;
• • our existing or potential agents or business partners;
• • sponsors or promoters of any promotions or competition we run;
• • if we merge with, or are acquired by, another company, or sell all or a portion of our assets, your personal information may be disclosed to our advisers and any prospective purchaser’s advisers and may be among the assets transferred;
• • courts, tribunals and regulatory authorities, in the event you fail to pay for goods or services we have provided to you;
• • courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;
• • third parties to collect and process data, such as analytics providers and cookies;
• • third parties nominated by you such as your plan manager; and
• • any other third parties as required or permitted by law, such as where we receive a subpoena.

Sensitive information: We will only disclose sensitive information with your consent or where permitted by law. This means that we may disclose sensitive information to:

• • other users of the platform whom you have invited and granted access to view care recipient health records and activity logs;
• • our employees, contractors and/or related entities;
• • the NDIA, your support coordinator or your plan manager;
• • IT service providers, data storage, web-hosting and server providers;
• • professional advisors;
• • if we merge with, or are acquired by, another company, or sell all or a portion of our assets, your personal information may be disclosed to our advisers and any prospective purchaser's advisers and may be among the assets transferred;
• • courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;
• • third parties to collect and process data, such as analytics providers and cookies; and
• • any other third parties as required or permitted by law, such as where we receive a subpoena.

Google Analytics: We may use Google Analytics Advertising Features. We and third-party vendors may use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers together. These cookies and identifiers may collect Technical and Usage Data about you.

You can opt-out of Google Analytics Advertising Features including using a Google Analytics Opt-out Browser add-on found here. To opt-out of personalised ad delivery on the Google content network, please visit Google's Ads Preferences Manager here or if you wish to opt-out permanently even when all cookies are deleted from your browser you can install their plugin here. To opt out of interest-based ads on mobile devices, please follow these instructions for your mobile device: On android open the Google Settings app on your device and select "ads" to control the settings. On iOS devices with iOS 6 and above use Apple's advertising identifier. To learn more about limiting ad tracking using this identifier, visit the settings menu on your device.

To find out how Google uses data when you use third-party websites or applications, please see here.

Overseas disclosure

We store your personal information in Australia and in the United States. Where we disclose your personal information to third parties, those third parties may store, transfer or access personal information outside of Australia, including but not limited to the United States. We will only disclose your personal information overseas in accordance with the Australian Privacy Principles.

Your rights and controlling your personal information

Your choice: Please read this Privacy Policy carefully. If you provide personal information to us, you understand we will collect, hold, use and disclose your personal information in accordance with this Privacy Policy. You do not have to provide personal information to us, however, if you do not, it may affect our ability to do business with you.

Information from third parties: If we receive personal information about you from a third-party, we will protect it as set out in this Privacy Policy. If you are a third-party providing personal information about somebody else, you represent and warrant that you have such person's consent to provide the personal information to us.

Restrict and unsubscribe: To object to processing for direct marketing/unsubscribe from our email database or opt-out of communications (including marketing communications), please contact us using the details below or opt-out using the opt-out facilities provided in the communication.

Access: You may request access to the personal information that we hold about you. An administrative fee may be payable for the provision of such information. Please note, in some situations, we may be legally permitted to withhold access to your personal information. If we cannot provide access to your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal. If we can provide access to your information in another form that still meets your needs, then we will take reasonable steps to give you such access.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to promptly correct any information found to be inaccurate, out of date, incomplete, irrelevant or misleading. Please note, in some situations, we may be legally permitted to not correct your personal information. If we cannot correct your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal.

Complaints: If you wish to make a complaint, please contact us using the details below and provide us with full details of the complaint. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take in response to your complaint. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Storage and security

We are committed to ensuring that the personal information we collect is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures, to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.

While we are committed to security, we cannot guarantee the security of any information that is transmitted to or by us over the Internet. The transmission and exchange of information is carried out at your own risk.

Facebook/Meta APIs

We may use tools provided by Meta, such as the Meta Pixel, advanced matching, and Conversions API. These allow us to measure ad performance and deliver ads that may be relevant to you on Meta platforms based on your activity on our website or app.

You can control whether we can join data from third-party partners with your Meta account for ads by adjusting your preferences within Meta's settings. You can disconnect this data from your Meta account by changing your settings for Off-Facebook activity. For more information, please see Meta's Privacy Policy.

User-Generated Content

Our services may enable you to post product reviews, comments, photos and other user-generated content. Any content you choose to submit to public areas of the services will be considered public information and will be accessible by anyone, including third parties not associated with us. We have no control over how others may use or misuse information you make publicly available through the services. We are not responsible for the privacy, security or accuracy of any user-generated content you choose to post or for the use or misuse of that information by any third parties.

Cookies

We may use cookies on our website from time to time. Cookies are text files placed in your computer's browser to store your preferences. Cookies, by themselves, do not tell us your email address or other personally identifiable information. However, they do recognise you when you return to our online website and allow third parties to cause our advertisements to appear on your social media and online media feeds as part of our retargeting campaigns. If and when you choose to provide our online website with personal information, this information may be linked to the data stored in the cookie.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

Links to other websites

Our website may contain links to other parties’ websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

Amendments

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Privacy Policy on our website. We recommend you check our website regularly to ensure you are aware of our current Privacy Policy.

This Privacy Policy describes how Fam Shop (the "Site","we","us", or"our") collects, uses, and discloses your personal information when you visit, use our services, or make a purchase from shop.fam.life (the "Site") or otherwise communicate with us regarding the Site (collectively, the "Services"). For purposes ofthis Privacy Policy,"you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

Please read this Privacy Policy carefully.By using and accessing any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law.

How We Collect and Use Your Personal Information

To provide the Services, we collect personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us.

In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide or improve the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

What Personal Information We Collect

The types of personal information we obtain about you depends on how you interact with our Site and use our Services. The information we collect varies depending on whether you are using our shopping platform, care management app, or both services. When we use the term "personal information", we are referring to information that identifies, relates to, describes or can be associated with you.

Information We Collect Directly from You

Information that you directly submit to us through our Services may include:

• • Contact details including your name, address, phone number, and email.
• • Order information including your name, billing address, shipping address, payment confirmation, email address, and phone number.
• • Account information including your username, password, security questions and other information used for account security purposes.
• • Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services.
• • Health and care management information including health records when using the FAM care management app.

Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.

Information We Collect About Your Usage

We may also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.

Information We Obtain from Third Parties

Finally, we may obtain information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as:

• • Companies who support our Site and Services, such as Shopify.
• • We may use third party for email communication, user engagement, and related purposes. The third party provider may store and process personal information outside of Australia.
• • We may use third-party artificial intelligence providers and services, to enhance and personalise your experience. All third-party providers are required to handle your personal information securely and only as instructed by us.
• • Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with products or services you have requested.
• • When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we or third parties we work with may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries, and cookies.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy.

How We Use Your Personal Information

We use your personal information for the following purposes:

• • Providing Products and Services. We use your personal information to provide you with the Services in order to perform our contract with you, including to process your payments, fulfill your orders (for shopping services), maintain and manage care recipient health records, enable care coordination features, and provide AI-powered care management tools (for care management app services). We may also enhance your shopping experience by enabling Shopify to match your account with other Shopify services that you may choose to use. In this case, Shopify will process your information as setforth in its Privacy Policy and Consumer Privacy Policy.
• • Marketing and Advertising. We may use your personal information for marketing and promotional purposes, such as to send marketing, advertising and promotional communications by email, text message or postal mail, and to show you advertisements for products or services. This may include using your personal information to bettertailorthe Services and advertising on our Site and other websites.
• • Security and Fraud Prevention. We use your personal information to detect, investigate ortake action regarding possible fraudulent, illegal or malicious activity. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password, or other access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• • Communicating with You and Service Improvement. We use your personal information to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you, to provide effective services to you, and to maintain our business relationship with you.

Cookies

Like many websites, we use cookies on our Site. For more details about the cookies used in connection with our Shopify-powered store, please visit Shopify’s Cookie Policy. We use cookies to power and improve our Site and Services (e.g., remembering your actions and preferences), to perform analytics, and to better understand user interactions. These are in our legitimate interests to administer, improve, and optimise the Services. We may also allow third parties and service providers to use cookies on our Site to help tailor services, products and advertisements.

Most browsers automatically accept cookies, but you can change your settings to remove or block cookies. Note that doing so may negatively impact your experience, cause features to not work correctly, or disable parts of the Services. Blocking cookies may also not completely stop information sharing with third parties such as our advertising partners.

Use Artificial Intelligence (AI)

We may use artificial intelligence and machine learning technologies (AI Technologies) in our business operations and the provision of our Services, including our tools for NDIS plan interpretation. This section explains how we use AI Technologies and how we protect your Personal Information when doing so.

What AI Technologies do we use and why?

We use AI Technologies developed internally by Provider Choice Shop. We do not share your Personal Information with commercial AI providers. We may use AI Technologies to:

• •Interpret de-identified NDIS plans;
• •Generate responses to questions about NDIS plans; and
• •To improve and optimise our services and operations

How do we protect your Personal Information when using AI Technologies?

Data Protection and Security: Where we use service providers who provide AI Technologies to us, we will take reasonable steps to ensure that such service providers handle your personal information according to privacy law, including by ensuring that we have contracts in place requiring the service provider to protect personal information.

We will not input your personal information into any platform provided by an AI Technology service provider which then trains its model based on that information.

What are your rights regarding our use of AI Technologies?

We will treat information generated or inferred by the AI Technologies about individuals as personal information and you maintain all rights over your personal information as outlined in this privacy policy, regardless of whether AI Technologies are used in processing. When using AI Technologies with your personal information:

• •Transparency and control: we will inform you when AI Technologies are being used to make decisions that may significantly affect you. We will implement processes to verify the accuracy of AI-generated outputs and we will take reasonable steps to maintain human oversight and review of significant AI-generated decisions. Our staff are trained to understand the limitations of AI systems and verify outputs before they are relied upon; and
• •Security: we implement appropriate technical and organisational measures to ensure that our use of AI Technologies maintains the security and integrity of your personal information. This includes regular testing and monitoring of AI outputs for accuracy and reliability; and
• •Risk mitigation: We regularly assess and document the risks associated with our use of AI Technologies in processing personal information and implement appropriate mitigation measures. This includes ongoing monitoring of AI Technologies and regular reviews of their performance and impact.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for contract fulfillment purposes, legitimate purposes and other reasons subject to this Privacy Policy. Such circumstances may include:

• •With vendors or other third parties who perform services on our behalf (e.g., IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping).
• •With business and marketing partners to provide services and advertise to you. Our business and marketing partners will use your information in accordance with their own privacy notices.
• •When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations, with your consent.
• •With our affiliates or otherwise within our corporate group, in our legitimate interests to run a successful business.
• •In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.

We disclose the following categories of personal information and sensitive personal information about users for the purposes set out above in "How we Collect and Use your Personal Information" and "How we Disclose Personal Information":

We do not use or disclose sensitive personal information without your consent or for the purposes of inferring characteristics about you.

third-party Websites and Links

Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.

Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third-party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used directly by children. Children may be care recipients whose information is managed by their parent or legal guardian through the platform. If you are under 18, you must have your parent or guardian's permission to use the Services directly. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.

As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use insecure channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide the Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

Your Rights

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

• •Right to Access / Know: You may have a right to request access to personal information that we hold about you, including details relating to the ways in which we use and share your information.
• •Right to Delete: You may have a right to request that we delete personal information we maintain about you.
• •Right to Correct: You may have a right to request that we correct inaccurate personal information we maintain about you.
• •Right of Portability: You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third-party, in certain circumstances and with certain exceptions.
• •Restriction of Processing: You may have the right to ask us to stop or restrict our processing of personal information.
• •Withdrawal of Consent: Where we rely on consent to process your personal information, you may have the right to withdraw this consent.
• •Appeal: You may have a right to appeal our decision if we decline to process your request. You can do so by replying directly to our denial.
• •Managing Communication Preferences: We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.

You may exercise any of these rights where indicated on our Site or by contacting us using the contact details provided below.

We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address or account information, before providing a substantive response to the request. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority.

International Users

Please note that we may transfer, store and process your personal information outside the country you live in. Your personal information is also processed by staff and third-party service providers and partners in these countries.

If we transfer your personal information out of Europe, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us using the details below: