Privacy Policy

We collect information you provide directly to us when creating an account, using our platforms, or contacting us. This includes: • Identity data: name, email address, phone number, job title, organisation name. • Health-related data: for Innerwork, this may include therapy session notes, client assessments, progress records, and medication information. For BloomPaws, this includes pet medical histories, vaccination records, and veterinary notes. • Usage data: how you interact with our platforms, features accessed, session durations, and device information. • Payment data: billing details processed securely through our payment processor. We do not store full card numbers.

We use the information we collect to: • Provide, maintain, and improve our platforms. • Process transactions and send related notices. • Send appointment reminders, vaccination due alerts, and other platform notifications you have opted into. • Respond to support requests and enquiries. • Monitor and analyse usage patterns to improve product experience. • Comply with legal obligations. We do not sell your personal data to third parties for marketing purposes.

We may share your data with: • Service providers who assist us in operating the platform (cloud hosting, payment processing, email delivery). All providers are bound by data processing agreements. • Within your organisation's tenant — staff and administrators you have authorised. • Regulatory bodies or law enforcement when required by applicable law. • In the event of a merger, acquisition, or sale, your data may be transferred to the successor entity. For Innerwork, data shared between clinicians and parents is governed by your organisation's internal policies and applicable healthcare regulations.

We retain personal data for as long as necessary to provide our services and comply with legal obligations. Specifically: • Active account data is retained for the duration of your subscription. • Health records and clinical notes may be subject to minimum retention periods under applicable healthcare law (which vary by jurisdiction). • After account termination, we retain data for 90 days before permanent deletion, unless a longer retention period is legally required. • Audit logs are retained for 7 years.

Depending on your jurisdiction, you may have the right to: • Access the personal data we hold about you. • Correct inaccurate or incomplete data. • Request deletion of your personal data (subject to legal retention requirements). • Object to or restrict certain processing activities. • Data portability — receive your data in a machine-readable format. • Withdraw consent where processing is based on consent. To exercise any of these rights, contact us at privacy@bloomsenz.com.

We implement industry-standard security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control, multi-factor authentication for admin accounts, and annual third-party penetration testing. For more detail, see our Security page.

Innerwork includes a child-facing interface for therapeutic activities. Child accounts are created by parents or guardians and are subject to parental controls. We do not knowingly collect personal data from children under 13 without verifiable parental consent. Parents may request deletion of their child's data at any time.

We use cookies and similar technologies to operate our platforms, remember your preferences, and analyse usage. See our Cookie Policy for full details.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-platform notification at least 14 days before the change takes effect.

For privacy-related enquiries, data subject requests, or to report a concern, contact our Privacy team: Email: privacy@bloomsenz.com Address: BloomSenzAI Pty Ltd, Sydney, Australia