Privacy Policy
Last updated 7 September 2026
Draft for legal review in two jurisdictions. [ UAE entity name ] is incorporated in the UAE and sells to consumers in Australia, so both UAE law and Australian law are in play. This page has not been reviewed by a lawyer in either country. Every field marked [ like this ] must be completed and every statement checked against how the business actually operates.
This policy explains how [ UAE entity name ], a company incorporated in Dubai, handles your personal information.
Two laws apply to us
Australia. The Privacy Act 1988 (Cth) applies to an overseas organisation that carries on business in Australia. Since December 2022 that is the only test — we do not have to hold your data in Australia for the Act to bind us. We therefore treat ourselves as bound by the 13 Australian Privacy Principles and the Notifiable Data Breaches scheme.
UAE. As a UAE company we are also subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Its Executive Regulations had still not been published as at the date above, so some obligations remain undefined. We will update this policy when they issue.
Your health information is sensitive information
Under Australian law health information is sensitive information and carries stricter rules. We collect it only with your consent, only where reasonably necessary to deliver your program, and we do not use it for anything you would not reasonably expect.
1. What we collect
- Identity and contact — name, email, phone, date of birth.
- Health information — health history, medications, symptoms, allergies, dietary needs, measurements, and anything you tell your dietitian.
- Program activity — habit logs, meal photos, step and water data, check-in notes, chat messages.
- Payment — handled by our payment provider. We do not store full card numbers.
- Technical — device, browser and usage data from our site and app.
2. Why we collect it
- To deliver the program and build and adjust your plan.
- So your dietitian can advise you safely.
- To verify habit completion for the deposit earn-back.
- To support you and respond to your questions.
- To meet our legal and record-keeping obligations.
- With your consent, to send marketing. You can opt out any time.
3. Your data leaves Australia
This is the most important thing to understand about us. We operate from the UAE, so your personal and health information is disclosed to and handled in the United Arab Emirates and possibly other countries where our providers operate.
Australian Privacy Principle 8 requires us to take reasonable steps to ensure an overseas recipient handles your information consistently with the Australian Privacy Principles, and in many cases we remain accountable for what that recipient does with it.
[ List every country where data is stored or accessed — UAE plus any hosting, app, payments, email or analytics provider — and the safeguards in place, such as contractual clauses binding them to APP-equivalent standards ]
4. Device and health app sync
If you connect a device or health app to sync steps, we receive only the data you authorise. Disconnect it in the app at any time and the sync stops.
5. Who we share it with
- The dietitian assigned to you.
- Our service providers: [ app / hosting / payments / email / analytics ], bound to protect it.
- Anyone you ask us to share it with, such as your GP.
- Where required or authorised by law, in Australia or the UAE.
We do not sell your personal information.
6. Security and retention
We take reasonable steps to protect your information from misuse, loss and unauthorised access. [ Describe your actual measures: encryption in transit and at rest, access controls, staff training, vendor review ]
We keep it as long as needed to deliver the service and meet legal obligations. Health records can carry minimum retention periods. [ Confirm the period you apply and under which law ]
7. Data breaches
If a breach is likely to cause serious harm to Australian individuals, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. We will also meet any UAE notification duty once the Executive Regulations define it.
8. Access and correction
Ask for a copy of what we hold, or ask us to correct it, at [ support@ email ]. We aim to respond within 30 days. If we refuse, we will tell you why in writing.
9. Automated decisions
From 10 December 2026, Australian privacy law requires privacy policies to disclose where computer programs make decisions that significantly affect individuals. [ State whether any part of the program — habit verification, refund eligibility, meal plan generation — is automated, and describe it. If nothing is automated, say so ]
10. Cookies and tracking
[ List cookies, analytics and advertising pixels, what they do, and how to opt out ]
11. Complaints
Contact us first at [ support@ email ] and we will investigate. If you are not satisfied, an Australian resident can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Since 10 June 2025 Australian law also provides a statutory right to sue for serious invasions of privacy.
12. Changes
We may update this policy. The current version is always here with its last-updated date.
13. Contact
[ UAE entity name ]
Licence no. [ Dubai licence / free zone registration no. ]
[ Registered Dubai address ], United Arab Emirates
[ support@ email ]
[ Data protection contact, if you appoint one ]