Privacy Policy

Who we are and who this policy applies to

This policy applies to Bottoms Up Colonics (“Bottoms Up Colonics”, “we”, “us” or “our”). It covers personal information handled through:

• clinics operating under the Bottoms Up Colonics name;
• bottomsupcolonics.com.au, our online store and related websites;
• courses, training, workshops, webinars, conferences and events;
• our clinic licensing program; and
• email, SMS and social media communications.

Client records are not shared between separately owned clinics unless you ask us to—for example, to continue care at another location—or the law otherwise allows or requires it.

The privacy laws we follow

In Australia, we comply with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and applicable state and territory health-records laws. Our electronic marketing is managed in accordance with the Spam Act 2003 (Cth).

In New Zealand, we comply with the Privacy Act 2020, including the Information Privacy Principles, the Health Information Privacy Code 2020 where it applies, and the Unsolicited Electronic Messages Act 2007.

The personal information we collect

We collect personal information that is reasonably necessary for our services and activities. Depending on how you interact with us, this may include:

• Contact and identity details: name, email, phone, postal address, date of birth and emergency contact.
• Health information: relevant history, current conditions, medications, suitability factors, treatment notes and practitioner details. Under Australian law, health information is sensitive information and is collected with consent or where law permits.
• Booking and payment information: appointment history, deposits, invoices and transaction records. We do not store full payment-card details.
• Store information: orders, delivery details, purchase history and professional customer details.
• Student and practitioner information: enrolment, qualifications, background, attendance, assessment, progress and certificates.
• Licensing, event and job information: business details, registrations, dietary requirements, recordings where notified, résumés, references and interview notes.
• Communications: enquiries, emails, messages, feedback, reviews, surveys and complaints.
• Website and device information: IP address, browser, device, pages viewed, links clicked, referral source and approximate location.

We do not use government identifiers such as Medicare, driver licence or tax file numbers as our own identifiers, and collect them only where genuinely required.

How we collect information

Most information comes directly from you when you book, complete a form, enquire, shop, enrol, register, subscribe, use social media or speak with our team.

We may also receive information from a parent, guardian or authorised representative; a practitioner with your consent; a clinic or head office where needed for a requested service; our booking, payment, event and learning platforms; social media lead forms; and public business sources for relevant professional communications.

Where information comes from someone else, we take reasonable steps to notify you where the law requires it.

How we use information

• Provide, manage and follow up consultations and treatments, including reminders.
• Assess whether treatment is appropriate and safe.
• Process bookings, orders, payments, refunds and deliveries.
• Deliver education, certification, events and professional development.
• Manage licensing enquiries and arrangements.
• Provide customer support and respond to enquiries.
• Send marketing where you have agreed or law otherwise permits.
• Understand website and campaign performance and improve our services.
• Prevent fraud, protect people and systems, and meet legal and professional obligations.

We use or disclose information for another purpose only where you consent, where you would reasonably expect it and the use is related to the original purpose (directly related for sensitive information), or where law allows or requires it.

Extra protection for health information

Your health information receives our highest level of care.

Marketing and your choices

We send marketing emails and SMS only with your consent or where law otherwise allows. Every commercial message provides a straightforward unsubscribe option. For Australian communications, we honour unsubscribe requests within five working days.

Opting out of marketing does not stop service communications you have asked for, such as appointment reminders, order updates, course access or event changes.

We may use securely encoded (“hashed”) contact details from email subscribers or online-store customers to show relevant advertisements on Meta or Google, or to avoid advertising to existing customers, where permitted. We do not use clinical records for this purpose. Contact us to request exclusion.

Cookies, pixels and analytics

Our websites use cookies, pixels and tags to operate, remember preferences, understand use and measure advertising. Providers may include Google Analytics, Google Ads, Google Tag Manager, Meta and PostHog.

These tools may record pages viewed, button clicks, enquiries or completed purchases. We configure them not to send health information, form contents or booking details to advertising platforms. Where interaction analytics are used, text entered into forms is masked and not recorded.

• Block or delete cookies in your browser, noting some features may be affected.
• Use the Google Analytics opt-out add-on.
• Manage ads in Meta Ad Preferences and Google My Ad Center.

Individual clinic pages may use tools operated by that clinic’s marketing provider. Where this occurs, those tools are limited to that clinic’s pages.

Who we share information with

We share information only where needed for the purposes in this policy. Recipients may include your clinic’s practitioners and team; the relevant clinic operator or head office; a practitioner, parent, guardian or representative where appropriate and authorised; service providers; accreditation bodies where requested or required; professional advisers, insurers and auditors; and regulators, courts or authorities where law permits or requires it.

Providers may change. We limit disclosures to information needed for the service and consider privacy and security when selecting providers.

Sending information overseas

Some providers may store or process information outside Australia or New Zealand, including in the United States, Canada, United Kingdom, Ireland and other European Union countries, and Singapore. Information may also move between our Australian and New Zealand operations.

We take reasonable steps required by applicable law when using overseas providers. For New Zealand disclosures, this includes considering whether the recipient is subject to comparable safeguards or using another permitted basis. Where possible, we select Australian-based storage for Australian clinical records.

Automated decisions and artificial intelligence

Software helps us send reminders, deliver requested communications and manage advertising. We do not use these tools to make decisions that significantly affect access to our treatment, education or licensing services.

Payment and store providers may use automated fraud screening based on transaction, billing, delivery, device and IP information, and may decline a payment or hold an order for review. Contact us if you believe this has happened in error.

We do not enter health information or clinical records into general-purpose artificial-intelligence tools. A person remains responsible for decisions about care, enrolment and licensing.

How we protect information

We take reasonable technical and organisational steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures include reputable platforms and encryption in transit, role-based access, strong passwords, multi-factor authentication for key systems, confidentiality duties, privacy training, secure paper storage and access reviews.

No online transmission or storage method is completely secure. We review and improve our safeguards over time.

How long we keep information

We retain information only while needed for the purpose described, to meet legal or professional obligations, or to manage a complaint or claim. We then securely destroy or de-identify it.

• Clinical records: for the period required by the law that applies to the clinic. Requirements vary across Australian states and territories. As examples, Victorian and New South Wales private-sector health-record laws generally require adult records to be retained for at least seven years, with longer periods for records created while a person was under 18. New Zealand health agencies generally retain health information for at least ten years from the day after the last service.
• Financial records: for applicable tax and corporate record-keeping periods.
• Student and certification records: while needed to administer training, verify completion and meet legal or accreditation duties.
• Marketing records: until you unsubscribe, after which a minimal suppression record may be kept so we do not contact you again.
• Unsuccessful job applications: generally up to 12 months unless you agree to a longer period.

Dealing with us anonymously

You may browse our website, read resources or make a general enquiry anonymously or using a pseudonym. We cannot provide treatment, process orders, enrol students or issue certificates anonymously because identity is needed to do those things safely and properly.

Accessing and correcting information

You may ask to access personal information we hold about you, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact the Privacy Officer using section 21. We will verify identity before releasing information.

We aim to respond within 30 days in Australia and, where New Zealand law applies, as soon as reasonably practicable and no later than 20 working days unless a lawful extension applies. There is no charge to make a request. If access involves a permitted charge, we will explain it first.

If access or correction is refused, we will explain the applicable reason and complaint options. Where a requested correction is not made, you may ask us to attach a statement recording your position.

Children and young people

Our online store, courses and events are intended for people aged 18 and over. Where treatment is provided to a person under 18, we involve a parent or guardian where required and take the young person’s capacity, maturity, circumstances and wishes into account. Parent or guardian access to a young person’s information is considered under applicable law.

Testimonials, photos, communities and events

We publish a testimonial, review, photo or video of you only with consent. You may ask us to remove it from channels we control, although we cannot always remove copies shared by others.

Course communities hosted on third-party platforms are visible to other members and subject to that platform’s privacy policy. Please consider carefully before posting personal health information. We let participants know before recording an online event or session.

If there is a data breach

We maintain a response process for privacy incidents. We act to contain and assess a breach and reduce potential harm. Where a breach is likely to result in serious harm and notification is required, we notify affected people and the Office of the Australian Information Commissioner or New Zealand Office of the Privacy Commissioner, as applicable.

Making a privacy complaint

Send your concern to our Privacy Officer in writing. We aim to acknowledge it within five business days, investigate fairly and respond within 30 days.

Changes to this policy

We may update this policy when laws, services or information practices change. The latest version will remain on this website with its update date. If we make a significant change affecting health information, we will take reasonable steps to let affected people know.

Contact our Privacy Officer

Contact us to ask a privacy question, access or correct information, withdraw a marketing preference or make a complaint. If your request relates to a particular clinic, tell us which clinic so we can direct it to the correct operator.