PRIVACY POLICY

1. Personal Information We Collect

The information we collect depends on how you interact with BX1 and may include:

• identity and contact details, such as name, date of birth, address, email address, mobile number, gender where relevant to a requested service, emergency contacts and parent or guardian details;
• membership and service information, such as membership type, trial, class and personal-training bookings, attendance, check-ins, account status, freezes, cancellations, preferences and communications;
• payment and transaction information, such as nominated account or card details handled through payment providers, payment status, failed-payment information, invoices, purchases, refunds and delivery information;
• health and safety information, such as injuries, medical conditions, pregnancy, allergies, medication, disability, accessibility or support needs, medical clearance, incident reports and information relevant to safe participation;
• Kids program information, such as a child's age, school, authorised collectors, pickup arrangements, attendance, behaviour or support needs, emergency information and parent or guardian instructions;
• media and premises information, such as photographs, video, audio, CCTV footage and records of incidents or conduct;
• digital information, such as IP address, browser and device details, cookie identifiers, referring pages, website and app activity, form submissions and interactions with emails, SMS messages, advertisements or social-media content;
• communications, such as enquiries, feedback, complaints, survey responses, call notes and conversations with staff or digital assistants;
• online shop information, such as items ordered, billing and delivery details, delivery status, returns and customer-service history; and
• business and compliance records, such as consents, waivers, contracts, identity or authority checks, suspected fraud, legal claims and records required by law.

We seek to collect only information that is reasonably necessary for our functions and activities. If you provide information about another person, you must be authorised to do so and, where practicable, tell them about this policy.

2. Health and Other Sensitive Information

Health information is sensitive information. We generally collect it with the individual's consent or, for a child, the consent or authority of a parent or legal guardian. We may also collect, use or disclose it where permitted or required by law, including where reasonably necessary to respond to a serious threat to life, health or safety.

We use relevant health information to assess and manage safe participation, make reasonable adjustments, communicate relevant limitations to coaches, provide first aid, respond to incidents, contact emergency services and manage legal, insurance or safeguarding matters.

We limit access to health information to staff, coaches and service providers who reasonably need it for an authorised purpose. Please do not provide detailed medical information through an unrequested channel or public social-media message. Contact reception if you need a safer or more appropriate way to provide it.

3. Children's Privacy

BX1 provides Kids, Junior and Teen classes, school-holiday programs, birthday parties and related services. We treat a child's best interests, safety and dignity as primary considerations when handling their information.

Where appropriate, we collect a child's information from or with the involvement of a parent or legal guardian. We may also collect relevant information from the child, a coach, an authorised school or program partner, or an authorised collector.

We use children's information only for purposes reasonably connected with registration, age-appropriate placement, attendance, coaching, support, pickup, emergency response, safeguarding, communication, billing and the administration of the relevant program, or as otherwise permitted by law.

We do not knowingly use a child's health information for direct marketing. We do not require marketing photo or video consent as a condition of membership or participation.

A parent or guardian may request access to or correction of a child's information. Depending on the child's age, maturity, wishes, safety and legal rights, BX1 may need to involve the child or limit information provided to a parent or guardian where required or permitted by law.

Child-specific privacy enquiries and consent withdrawals may be sent to email the BX1 Kids team.

4. How We Collect Information

We usually collect information directly from you or a parent or guardian, including when you:

• create an account, enrol, purchase a service, complete a waiver or register for a trial;
• use the BX1 Gym app, website, online forms, booking system, check-in device or online shop;
• book or attend a class, personal-training session, event or Kids program;
• contact us by phone, email, SMS, social media, web chat or in person;
• enter the premises, where CCTV operates; or
• consent to a photograph, video, testimonial, survey or promotion.

We may also collect information from coaches, staff, emergency contacts, schools or program partners acting with appropriate authority, referrers, publicly available sources, payment and booking providers, website and analytics providers, social-media platforms, insurers, advisers, regulators or law-enforcement bodies.

If we receive unsolicited personal information, we will determine whether we could lawfully have collected it. If not, we will securely destroy or de-identify it where lawful and reasonable.

5. Anonymous and Pseudonymous Dealings

You may make a general enquiry anonymously or using a pseudonym where practicable. We will need accurate identifying and contact information where it is required for membership administration, age verification, bookings, payments, attendance, child pickup, health and safety, emergency response or compliance with law.

6. Why We Collect, Use and Disclose Information

We may collect, hold, use and disclose personal information to:

• provide and administer memberships, trials, classes, personal training, Kids programs, events, promotions, products and online orders;
• create and manage accounts, bookings, waitlists, check-ins, attendance, eligibility, progress and customer support;
• process payments from a nominated account or card, issue invoices and refunds, and manage failed or disputed payments;
• protect health, safety, security and child welfare, including first aid, emergency contact, authorised pickup, incident investigation and insurance;
• communicate timetable, booking, account, payment, closure, safety and service information;
• respond to enquiries, complaints, access or correction requests and legal claims;
• personalise and improve services, communications, website performance, facilities and business operations;
• send direct marketing where permitted by law and manage marketing preferences;
• prevent and investigate fraud, misuse, unlawful conduct, serious misconduct and security incidents;
• meet legal, regulatory, tax, accounting, employment, insurance and record-keeping obligations; and
• carry out another purpose disclosed at collection, authorised by consent, or otherwise permitted or required by law.

7. Membership, Booking and Check-In Systems

BX1 uses third-party systems, including Mindbody and the branded BX1 Gym app, for services such as account creation, booking, attendance, check-in, membership administration and payments. Information entered into or generated through those systems is handled by BX1 and the provider in accordance with applicable arrangements and the provider's own privacy terms.

Check-in records help verify attendance, manage capacity, support safety and administer membership entitlements. Please keep your account credentials secure and notify BX1 promptly if you suspect unauthorised access.

8. Payments and Financial Information

Payments may be processed by Mindbody, a direct-debit provider, a bank, a card network or another authorised payment provider. The provider may collect and hold full account or card details. BX1 generally receives transaction records, status information and limited or tokenised payment details needed to administer the account, although authorised staff access depends on the relevant system and provider.

We do not intentionally place complete card details in website cookies. You should provide payment information only through an approved BX1 payment channel.

9. Photographs, Video, Audio and Testimonials

Consent to a membership, trial, waiver or these terms does not by itself give BX1 permission to use an identifiable image, recording or testimonial for marketing.

When BX1 seeks consent for a new promotional use of an identifiable image or recording after the Last Updated date, consent will be requested separately and the proposed use will be explained. For a child, consent will be requested from a parent or legal guardian using a separate YES or NO option. Declining consent does not affect membership or participation.

BX1 will use an identifiable image or recording for promotional purposes only within the scope of a valid consent obtained at the relevant time. For a child, the image or recording may be used without the child's full name on BX1's website, social media, email, digital advertising or printed material, as described in the applicable consent. Separate permission will be sought before publishing a child's full name together with an identifiable image, unless the use is otherwise permitted by law.

Consent may be withdrawn for future use at any time by emailing email BX1, or email the BX1 Kids team for a child. BX1 will stop new uses within a reasonable period. Withdrawal cannot undo lawful publication, printing or distribution that occurred before the withdrawal, and content shared by other users or third-party platforms may remain outside BX1's control.

BX1 may capture images for safety, incident documentation or evidence where consent is not the legal basis and the collection is otherwise permitted by law. Those images will not be repurposed for marketing without appropriate permission.

10. CCTV and Premises Security

CCTV operates at BX1 premises, including outside staffed hours, for safety, security, incident investigation, protection of people and property, and the prevention and detection of unlawful or serious misconduct. Signage may notify visitors of CCTV use.

Cameras are not intentionally placed in toilets, changing rooms or other areas where people reasonably expect a high level of privacy. Footage is accessed only by authorised people and may be disclosed to police, emergency services, insurers, legal advisers, building management or another person where reasonably necessary and permitted or required by law.

Footage is kept only for as long as reasonably necessary for security and operational purposes, but relevant footage may be retained longer where it relates to an incident, complaint, investigation, insurance matter or legal obligation.

11. Website, Cookies, Analytics and Digital Tracking

Our website, app, emails and digital services may use cookies, pixels, software development kits and similar technologies. These technologies may collect device, browser, IP address, referral, page-view, session, interaction and campaign information.

We use this information to operate and secure digital services, remember settings, understand website use, measure campaigns, improve services and, where permitted, personalise advertising or communications. Providers may connect this information with information they already hold under their own privacy policies.

BX1 currently uses services that may include Google Analytics, Mindbody and Attentive. We may change providers as our operations evolve.

You can restrict cookies through your browser or device controls and use opt-out settings offered by relevant providers. Some functions may not work properly if necessary or functional technologies are blocked. Where consent is required by law for a particular technology or use, we will seek it.

12. Automation and AI-Assisted Services

BX1 may use automated tools to route enquiries, manage waitlists, send reminders, follow up trials, segment communications, identify service needs, help answer general questions or assist with booking guidance. This can affect which communications or suggested services a person receives.

An AI-assisted concierge or chat service may process the content of a conversation through a technology provider. Responses may be automated, may be reviewed by authorised staff, and may not always be accurate. Do not rely on an automated response for medical, emergency, child-safety or legal advice.

BX1 does not currently arrange for a computer program to make a decision without meaningful human involvement that could reasonably be expected to significantly affect a person's legal rights, membership eligibility, safety restrictions or interests. If that practice changes, we will update this policy and provide the transparency and review options required by law.

13. Direct Marketing

Where permitted by law, BX1 may use contact details and information about enquiries, trials, purchases, attendance, interests or engagement to send offers, class news, event information, reminders and other promotional communications by email, SMS, phone, app notification, social media or online advertising.

We may use service providers such as Attentive to manage email and SMS communications, audiences and automated follow-up. We do not use health information or a child's sensitive information for direct marketing without express consent.

You can opt out at any time by using the unsubscribe link or instructions in the message, replying STOP where supported, or contacting email BX1. We will action an electronic marketing opt-out within the period required by law, generally within five working days. There is no charge to opt out.

After you opt out, we may keep limited suppression information so we do not send marketing to that address or number again. An opt-out from marketing does not stop necessary service, safety, payment, booking, membership or child-related communications.

14. Service and Operational Communications

BX1 may send non-promotional communications reasonably necessary to provide a service or administer a relationship. These may include booking confirmations, waitlist notices, account and payment information, timetable or closure changes, safety notices, policy or terms updates, emergency communications, child absence or pickup enquiries and responses to a request.

Trial follow-up may include both service assistance and marketing. Marketing components remain subject to your opt-out rights.

15. Who We Disclose Information To

BX1 may disclose personal information, where reasonably necessary for an authorised purpose, to:

• BX1 directors, employees, coaches and contractors who need the information to perform their roles;
• membership, booking, app, check-in, direct-debit and payment providers, including Mindbody and associated payment services;
• website hosting, cloud storage, cybersecurity, IT support, communications, analytics, advertising and customer-service providers, which may include Attentive and Google;
• couriers, fulfilment providers and suppliers involved in online orders;
• parents, guardians, authorised collectors, schools and program partners where appropriately authorised or reasonably necessary for a child's service or safety;
• emergency services, medical personnel and other people where reasonably necessary to respond to a serious threat to life, health or safety;
• insurers, accountants, auditors, debt-recovery providers, professional advisers and dispute-resolution bodies;
• police, courts, regulators, government agencies or other recipients where permitted or required by law; and
• a genuine prospective purchaser, successor or adviser in connection with a proposed sale, merger, restructure or transfer of BX1, subject to appropriate confidentiality and legal safeguards.

BX1 does not sell or rent personal information. A service provider may receive payment for providing services to BX1; that is not a sale of your information by BX1.

16. Overseas Disclosure and Processing

Some technology and service providers operate or store information outside Australia. Personal information is likely to be disclosed to or accessible by recipients in the United States of America and may also be processed in other countries where our providers, their related companies or subcontractors operate.

Relevant providers may include Mindbody, Attentive, Google and cloud, communications, security or support providers. Provider locations and infrastructure can change. Where practicable, BX1 will take reasonable steps required by law before disclosing personal information to an overseas recipient.

Privacy protections and legal access rights in another country may differ from those in Australia. You may contact us for current information about likely overseas locations relevant to a particular service.

17. Schools, Pickup and Safeguarding

For a school pickup, school-based activity, Kids program or similar service, BX1 may exchange limited information with a school, parent, guardian, authorised collector, transport provider or relevant authority to verify authority, coordinate attendance and pickup, protect a child and respond to an incident.

BX1 may record attendance, late or missed pickup, unsuccessful contact attempts, behavioural or safety concerns and the identity of an authorised collector. We may refuse to release a child where authority cannot be reasonably verified or a safeguarding concern exists.

Where permitted or required by law, BX1 may report or disclose information to police, emergency services, child-protection authorities or another appropriate body without consent.

18. Online Shop, Delivery and Returns

If you purchase goods, BX1 may use billing, delivery, order and communication details to process payment, fulfil and track the order, provide support, manage returns or warranties, prevent fraud and comply with accounting and consumer-law obligations.

We may disclose the minimum information reasonably needed to payment, courier, fulfilment and technology providers. Their own privacy terms may also apply when they provide a service directly to you.

19. How We Hold and Protect Information

Information may be held electronically or in physical records at BX1 premises and in systems operated by contracted service providers. We take reasonable technical and organisational measures appropriate to the sensitivity and risk of the information. These may include access controls, individual accounts, passwords, multi-factor authentication where available, encryption in transit, staff access limits, secure backups, provider review, physical safeguards and secure disposal practices.

No system, transmission or storage method is completely secure. BX1 cannot guarantee absolute security, but we will respond to suspected unauthorised access, loss, misuse or disclosure and take reasonable remedial action.

You can help protect your information by keeping login details confidential, using a strong unique password and promptly telling us about suspected unauthorised use.

20. Retention and Disposal

BX1 keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, a related authorised purpose, dispute management, safety, insurance, fraud prevention, backups or a legal and regulatory obligation.

Different records have different retention periods. For example, transaction and contract records may be retained for tax, accounting and limitation periods. CCTV is generally kept for a shorter operational period unless preserved for an incident.

Where statutory health-record retention requirements apply to BX1 as a private health service provider in New South Wales, health information collected about an adult may need to be retained for at least seven years from the last occasion a health service was provided, and information collected while a person was under 18 may need to be retained until that person turns 25.

When information is no longer required, we take reasonable steps to securely destroy or de-identify it, subject to lawful record-keeping requirements. Residual copies may remain in secure backups until they are overwritten through the normal backup cycle.

21. Accuracy and Updates

BX1 takes reasonable steps to keep personal information accurate, complete, current and relevant for the purpose for which it is used. Please promptly update your contact, emergency, authorised-pickup, health and payment information through the BX1 Gym app where available or by contacting reception.

22. Access and Correction

You may request access to personal information BX1 holds about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Send a request to email BX1, or to email the BX1 Kids team for a child-specific matter. Please identify the information requested and provide enough detail for us to locate it. We may need to verify your identity or authority before responding.

We will respond within a reasonable period and aim to complete straightforward requests within 30 days. We do not charge to make a request. If the law permits a reasonable charge for providing access, we will tell you in advance.

Access may be refused or limited where permitted or required by law, including where it would unreasonably affect another person's privacy or create a serious threat to health or safety. If we refuse access or correction, we will generally give written reasons and explain available complaint options, unless it would be unreasonable or unlawful to do so.

23. Government Identifiers

BX1 does not use a government-related identifier as its own customer identifier. We collect, use or disclose a government identifier only where reasonably necessary and permitted by law, for example to administer an eligible government voucher or verify an entitlement.

24. Data Breaches

BX1 maintains a process for responding to suspected data breaches. We will take reasonable steps to contain and investigate an incident, reduce potential harm, preserve necessary evidence and improve controls.

Where a breach is an eligible data breach or another notification obligation applies, BX1 will notify the Office of the Australian Information Commissioner, the NSW Privacy Commissioner, affected individuals or another regulator as required by law.

25. Privacy Questions and Complaints

Please send a privacy question or complaint to the BX1 Privacy Officer using the contact details below. Describe what happened, the information involved, the outcome you seek and any relevant dates or documents.

We will acknowledge the matter promptly, investigate it fairly and aim to provide a substantive response within 30 days. If more time is reasonably needed, we will explain why and provide an updated timeframe.

If you are not satisfied, you may be able to complain to:

• the Office of the Australian Information Commissioner; or
• for health information in New South Wales, the Information and Privacy Commission NSW.

The regulator may expect you to give BX1 a reasonable opportunity to resolve the complaint first.

26. Third-Party Sites and Platforms

BX1's website, app, emails or social-media pages may link to services controlled by other organisations. Their privacy policies and terms apply to their handling of information. BX1 is not responsible for an unrelated third party's privacy practices, but will remain responsible for its own handling of information and any obligation that cannot lawfully be transferred.

27. Changes to This Policy

We may update this policy to reflect changes in law, technology, providers or BX1 services and practices. The current version will be published on this page with its effective date.

Where a change materially affects how we handle information already collected, we will take reasonable steps to provide additional notice and obtain consent where required by law. A policy update does not retrospectively create consent where consent is required.