Health Meister Pty Ltd Privacy Policy

This policy explains how Health Meister Pty Ltd handles personal information when you visit our website, buy products, contact us or use our Ultimate Human Gene Test distribution service. It also explains your privacy choices and how to request access, correction or make a complaint.

Health Meister sells Ultimate Human Gene Tests, shares customer names and email addresses with Ultimate Human (TUH), and receives sealed samples that are identifiable to individual customers. We forward those samples unopened to TUH. We do not conduct genetic testing or access customers’ genetic test results. TUH and LifeDNA handle testing and results.

1 About us and this policy

In this policy, “we”, “us” and “our” mean Health Meister Pty Ltd. “Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true or recorded in a material form. Sensitive information includes health information and certain genetic information.

We aim to handle personal information consistently with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), and must comply with the privacy and other laws that apply to our activities. This policy does not limit your statutory rights.

[VERIFY V1: Confirm the company’s legal identity and website scope, and obtain advice on Privacy Act coverage, including any health service or other small business exception. Assess the NSW Health Records and Information Privacy Act 2002 and any other applicable state or territory health privacy laws. Do not assume that turnover below $3 million removes privacy obligations.]

Our privacy contact is Health Meister Pty Ltd, email info@healthmeister.com.au, postal address PO Box 593, Roseville NSW 2069, Australia. You can request a free copy of this policy, including in another reasonably accessible form, using these details.

2 Information we collect and hold

Depending on your dealings with us, we collect and hold the following types of information:

• Identity and contact information, such as your name, email address, billing and delivery addresses, and telephone number if supplied.

• Order and account information, such as products purchased, order references, delivery and return records, customer account information where accounts are enabled, and payment status or transaction references.

• Communications, including enquiries, feedback, complaints and records needed to respond to you.

• Marketing preferences and records of consent or withdrawal of consent.

• Website and device information, such as IP address, browser and operating system, device identifiers, pages viewed, referral information, and cookie or similar technology identifiers.

• Gene test administration information, including customer name and email, relevant order details, and customer identifiers associated with sealed sample packaging and forwarding records.

We do not access customers’ genetic test results. Please do not send us reports, raw genetic data or medical histories for routine order enquiries. If you send sensitive information that we have not requested, we assess whether it is lawful and necessary to retain it. Where required by law, and where lawful and reasonable, we destroy or de-identify unsolicited personal information that we could not lawfully have collected. Information lawfully retained is handled under this policy.

3 How we collect information and your choices

We collect information directly from you through checkout, website forms, marketing programs, subscriptions, correspondence and sample return packaging. Our website and service providers also collect technical information through cookies and similar technologies. We may receive information from payment and delivery providers to confirm payment, delivery or returns, and from TUH as needed to administer the gene test service, without access to results.

We collect personal information by lawful and fair means and limit collection to what is reasonably necessary for our functions or activities. For sensitive information, we obtain your consent where required, unless a lawful exception applies. Consent should be voluntary, informed, current and specific, and given by someone with capacity to understand the choice.

Where reasonable, we provide a collection notice at or before collection, or as soon as practicable afterwards. It explains the purpose, usual disclosures, consequences of not providing information and how to find this policy. A privacy policy is not a substitute for a notice or consent required for a particular activity.

You may make general enquiries anonymously or using a pseudonym where lawful and practicable. We normally need accurate identifying, payment and delivery details to fulfil orders, verify access requests or arrange an identifiable gene test. If you choose not to provide necessary information or consent, we may be unable to provide the relevant service. Marketing consent is optional and is not a condition of purchase.

4 How we use personal information

We use personal information to process payments and orders; arrange delivery, returns and refunds; communicate about purchases; respond to enquiries and complaints; administer customer accounts where available; operate and improve our website; and maintain necessary business records.

For gene tests, we use relevant information to arrange the purchase, share your name and email with TUH for service administration, and receive and forward sealed identifiable samples. Section 8 explains this arrangement in more detail.

We may use relevant information to detect fraud, protect our systems, meet legal obligations and establish, exercise or defend legal claims. These purposes do not permit unlimited collection or disclosure. We use or disclose information for its primary purpose, or for another purpose only where permitted by law, including with consent where required. For sensitive information, the rules for secondary purposes are more restrictive.

Marketing and website analytics are addressed in sections 6 and 7. We do not use access to genetic results for these purposes because we have no such access. Any proposed use of gene test purchase information or other health related information for audience profiling or marketing must first be assessed for sensitivity and lawful consent requirements.

5 Disclosures and service providers

We disclose relevant personal information to recipients where necessary for the purposes explained in this policy or otherwise permitted by law. Recipients may include:

• Shopify and relevant e-commerce applications supporting our store, checkout and customer administration.

• Payment processors, banks and fraud prevention providers supporting transactions.

• Postal, courier and fulfilment providers arranging deliveries, returns and sample transport.

• TUH for gene test administration and receipt of sealed samples; LifeDNA and other testing recipients through the testing arrangements described in section 8.

• Providers of email, SMS, analytics, website support, hosting and business record services, where those services are used.

• Professional advisers, regulators, courts or other persons where disclosure is required or authorised by law or otherwise lawfully necessary to deal with a claim.

If our business is sold, merged or reorganised, relevant information may be disclosed as reasonably necessary for a lawful transaction and ongoing service, subject to applicable privacy requirements and appropriate safeguards. A breach of our terms of service does not by itself authorise disclosure of personal information.

We seek appropriate arrangements for providers handling information on our behalf. Some providers also handle information for their own purposes under their own privacy policies. Review those policies to understand their practices. Linking to another policy, or moving you to another website, does not remove our obligations for our own collection, use or disclosure.

Shopify and payments

Our online store is hosted on Shopify. Shopify provides the e-commerce platform and processes information used to operate the store. Payment information is handled by the payment provider used for your transaction. The information visible to us and retained by each provider depends on the payment method and store configuration.

Shopify’s privacy policy is available at https://www.shopify.com/legal/privacy and its terms at https://www.shopify.com/legal/terms. Separate payment provider policies may also apply.

We offer payment options including credit and debit cards, PayPal, Apple Pay and Afterpay. Payments are processed through providers including Stripe and PayPal, depending on the option selected and our checkout configuration.

The relevant payment provider, digital wallet provider, card network or financial institution handles information needed to process and authorise your payment. Their own privacy policies also apply. We receive transaction information needed to administer your order, payment, refund or dispute.

Additional payment options may be displayed at checkout.

6 Email and SMS marketing

We send commercial email or SMS messages only with consent as required by applicable law. Where we rely on inferred consent for ordinary contact information, the circumstances must support it; a purchase or acceptance of this policy is not automatic consent to every form of marketing. Sensitive information is used for direct marketing only with consent where required by the APPs.

Marketing messages identify us and provide a functioning unsubscribe method. You can use the unsubscribe link in an email, follow the opt-out instruction in an SMS, or contact info@healthmeister.com.au. Reply STOP should be used only where the sending service supports replies; otherwise use the method stated in the message. We action unsubscribe requests within five working days and do not charge for handling the request.

Opting out of marketing does not stop necessary order, delivery, safety or service communications that are not marketing. We may retain a minimal suppression record to respect your choice. Where applicable, you can ask us to stop using or disclosing information for direct marketing or to explain its source, and we will respond as required by law.

7 Cookies analytics and advertising

Our website and its service providers use cookies and similar technologies, such as pixels or local storage, to support functions such as maintaining a cart, remembering settings, operating sessions and securing the site. Additional technologies may measure website use or support advertising, depending on our configuration and your choices.

Technical identifiers and browsing information can be personal information, particularly when linked with accounts or other identifiers. We do not describe all analytics data as anonymous.

Our existing policy identifies Google Analytics as a website analytics service. Google’s privacy policy is available at https://policies.google.com/privacy. [VERIFY V7: Confirm current Google Analytics use, settings, event data, retention, advertising features and data transfers. Identify any advertising pixels, customer audience uploads or other tracking services; remove this statement if Google Analytics is no longer used.]

You can manage cookies through your browser settings, including deleting or blocking them. Blocking essential cookies may affect checkout or other website functions. Where our website offers privacy or cookie preference controls, you can use them to manage available choices. Browser controls may not prevent every form of tracking or undo information already disclosed.

8 Ultimate Human Gene Tests

Our role and information sharing

Health Meister is the retailer and forwarding intermediary for Ultimate Human Gene Tests. We share the customer’s name and email address with TUH to facilitate the service. We also handle purchase, delivery and sample forwarding information needed for our part of the service. [VERIFY V8: Confirm every additional field shared with TUH, including kit identifiers, order references, addresses or telephone numbers, and update this wording to match the actual flow.]

Customers return samples to Health Meister in sealed packaging identifiable to the individual customer. We receive and forward those samples unopened to TUH. We do not open samples, extract genetic information, conduct analysis or interpret results. TUH and LifeDNA handle testing and results. Health Meister never accesses customers’ genetic test results.

Identifiable sample packaging and associated customer records require privacy protection while in our custody. The fact that a sample is sealed or that we do not see results does not remove our responsibilities for information and materials we handle.

Consent and collection notices

Before you submit a sample, you should receive clear information about who receives it, why it is collected, where it is sent, the testing and results process, and the relevant privacy policies and consent documents. We obtain any express consent required for our handling of sensitive information. Separate informed consent for sample collection, analysis and the testing provider’s handling must be addressed through the testing provider’s consent process.

Buying a test, submitting an order or accepting this policy does not by itself replace any required sensitive information or testing consent. Consent to marketing or optional research should be separate from consent needed to provide the test.

Samples results and provider policies

We forward samples to TUH for the testing service. TUH’s privacy policy is linked on our website. Please review the gene testing provider’s applicable privacy and consent documents for how samples, genetic data and results are processed, retained, shared and deleted, and how to contact the provider about those activities. See TUH privacy policy here. https://www.theultimatehumanwellness.com/privacy-policy

Contact Health Meister about orders, the information we hold or samples while in our custody. Contact the testing provider about analysis, results and its retention or deletion practices. We can help identify the relevant contact, but cannot provide access to results we do not hold. A request concerning both organisations may need to be addressed to each.

If you wish to withdraw consent or stop a sample being forwarded, contact support@theultimatehuman.com We will explain what is still possible based on whether it remains in our custody. We cannot promise to retrieve a sample already forwarded, reverse completed testing or require deletion of records that must lawfully be retained. Contact the testing provider separately about stopping testing or deleting material it holds.

9 Overseas handling and disclosures

Shopify and other service providers may store or process personal information outside Australia. The gene testing arrangements may also involve overseas recipients, including transfers of sealed identifiable samples and associated information. Overseas laws and access by public authorities may differ from Australian requirements.

Before an overseas disclosure, where APP 8 applies, we take reasonable steps to ensure the recipient does not breach the APPs in relation to the information, unless a lawful exception applies. This can include assessing the recipient and appropriate contractual and handling arrangements. We may remain accountable for an overseas recipient’s handling under Australian law. An overseas provider’s own policy is not, by itself, a substitute for these obligations.

This policy and purchase of a product do not seek a blanket waiver of overseas disclosure protections. Any reliance on an informed consent exception to APP 8 must be separately assessed and explained, including the consequences, before consent is requested.

10 Security and privacy incidents

We take reasonable steps appropriate to the information and risks to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. For identifiable samples and related records, the measures must also address physical handling and transport risks.

No system or transmission method can be guaranteed completely secure. Please contact us promptly if you suspect a privacy incident involving our store or a sample in our custody. We assess and respond to incidents, take appropriate containment and remedial steps, and notify affected individuals and regulators where required by law, including under the Notifiable Data Breaches scheme where it applies.

11 Retention and disposal

We retain personal information for as long as needed for the purposes for which it may lawfully be used, including fulfilling orders, handling returns and complaints, keeping required tax and business records, and meeting legal obligations. Relevant information may need to be retained for an unresolved dispute or legal hold. Different records may have different retention periods.

When personal information is no longer needed for a permitted purpose, we take reasonable steps to destroy or de-identify it as required by applicable law, subject to any lawful retention requirement. Disposal must address physical records, electronic records and service provider arrangements; backups may require a managed deletion cycle.

Samples are received for forwarding to TUH rather than for ongoing storage by Health Meister. TUH and LifeDNA’s sample, genetic data and result retention practices must be checked in their applicable policies and consent documents. Health Meister cannot promise a provider’s deletion timeframe.

12 Access correction and deletion requests

You can ask for access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 1. We may take reasonable steps to verify your identity and authority, without collecting excessive identity information.

We respond within a reasonable period; our target is within 30 days. Access and correction are subject to applicable legal requirements and exceptions. We do not charge for making an access request or for correction. If a reasonable, non-excessive charge for providing access is permitted, we explain it before proceeding. Where reasonable and practicable, we provide access in the way requested.

If we refuse access or correction, we give written reasons, except where it would be unreasonable to do so, and explain complaint options. Where applicable, you can ask us to associate a statement of disagreement with the record or notify another recipient of a correction. We take reasonable steps to maintain information quality, and you can help by telling us when your contact details change.

You may ask us to delete information or withdraw consent. Australian privacy law does not provide an unrestricted right to immediate erasure of every record. We assess the request against our permitted purposes and retention obligations and explain what action we can take. Withdrawal generally affects future handling and does not automatically undo lawful past handling. It may prevent us from continuing a service that depends on that information or consent.

13 Children and young people

Capacity to consent depends on the young person’s understanding and maturity and the circumstances; it is not established solely by accepting website terms. Where consent is required and the young person lacks capacity, consent must be obtained from a person legally authorised to give it. A purchaser’s consent is not automatically consent from the person whose sample is submitted.

If you believe a child’s information or sample has been supplied without appropriate authority, contact us so we can assess and respond. We must also respect a young person’s own privacy rights where they have capacity.

14 Complaints

If you are concerned about how we handle your personal information, email info@healthmeister.com.au or write to Health Meister Pty Ltd, PO Box 593, Roseville NSW 2069, Australia. Please describe the issue, relevant dates, the service involved and the outcome you seek. Avoid sending genetic reports or unnecessary sensitive information.

We acknowledge your complaint, assess it and investigate as appropriate. We aim to provide a substantive response within 30 days. If more time is needed, we explain why and give an expected response date. There is no charge for lodging a privacy complaint with us.

If you are not satisfied with our response, or we have not responded within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC), where it has jurisdiction. Information is available at https://www.oaic.gov.au/privacy/privacy-complaints or by telephone on 1300 363 992. Other complaint pathways may apply under state or territory law.

Complaints about testing or results can also be raised with the relevant testing provider. We still address complaints about our own information handling or sample custody; referring you to TUH does not remove that responsibility.

15 Changes to this policy

We may update this policy to reflect changes to our activities or legal requirements. The current version is available on our website and states its effective date. For material changes, we provide an appropriate notice, such as a website notice or direct communication where warranted.

A policy update does not itself authorise a new use or disclosure or retrospectively supply consent. We provide further notices and obtain fresh consent where required before making the relevant change.