Privacy Policy

1. Purpose

Smart Bear Consulting Pty Ltd (ACN 678 249 413) T/As Smart Bear Health (Smart Bear, We, Us, Our) is committed to complying with its privacy obligations under relevant laws. Smart Bear content, products and services include online health information, education programs, decision support resources, educational content, clinician resources, research initiatives and related products and services designed to support health literacy and informed decision-making as an adjunct to conventional healthcare (the Services).

2. Applicability & Scope

Employees and subcontractors of Smart Bear are required to comply with this policy.

3. Policy Statement

Smart Bear has corporate governance arrangements in place to align with its responsibilities for how it collects, uses and discloses personal and/or health and sensitive information necessary for the provision of its Services and business operations in accordance with this Privacy Policy under the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs) and other applicable privacy laws.

3.1 - User Outcome Statement

Smart Bear places Users at the centre of the planning, monitoring, and improving its Services.

We will take all reasonable and proportionate steps to act in accordance with the following rights balancing Our obligations under other laws:

  • (a) an individual has a right to have the individual's:

    • (i) personal privacy respected; and

      (ii) personal information protected; and

  • (b) an individual has a right to access their personal information, including health information, subject to permitted exceptions.

3.2 - Organisation Outcome Statement

Smart Bear is committed to clearly communicating the personal information handling practices to give individuals a better and more complete understanding of the type of personal information Smart Bear collects and the way this is handled.

3.3 - Privacy Policy Changes

We may need to update this Privacy Policy from time to time by notice to You. In the event of a material change, We will advise You via email and/or a prominent notice on the website  with reasonable notice, and We will update the  Our Privacy Policy on Our Website, to reflect the date of the changes.

Continued use of any information obtained through or on the Website or other content following receipt of the reasonable notice of changes constitutes acceptance of the revised Privacy Policy.

4. Definitions

In this policy:

  • Aggregated Data means information that has been combined or summarised with information from other individuals so that it does not identify, and it is not reasonably capable of identifying, any specific individual.

  • Content means the words, design, layout, look, graphics, photos, images, videos, gifts, blog posts, articles, appearance, information, ideas, opinions, materials, documents, products, programs, resources, data, databases and all other information and intellectual property accessible on or through the Smart Bear Websites, programs, products, social media, community spaces or other mediums, including the Products & Programs themselves in full and in part, all of which are protected by applicable Intellectual property laws.

  • Data means information contained in a record including but not limited to Personal Information such as personal, health and sensitive information.

  • Data Controller means the party that determines the purpose and means of data collection and processing. For example, Smart Bear is a data controller because We are collecting and using Your Personal Information.

  • Data Processor means the individuals, organisations or programs that handle, process or store data on behalf of the data controller and are generally bound by strict contractual obligations. For example, Stripe is a data processor that handles payments, and Google Workspace is a data processor that handles emails and document storage.

  • Data Subject means any individual whose Personal Information is collected, stored, used or processed by an organisation. For example, a User completing an online form or program.

  • De-identified Data means information that has been processed so that it no longer identifies, and is not reasonably capable of identifying, an individual. De-identification may involve removing, altering, coding, aggregating or otherwise modifying information to reduce the risk of identification.

  • Health Information means:

    • (a) information or an opinion about:

      • (i) the health, including an illness, disability or injury, (at any time) of an individual; or

        (ii) an individual’s expressed wishes about the future provision of health services to the individual; or

        (iii) a health service provided, or to be provided, to an individual;

        that is also personal information;

    • (b) other personal information collected to provide, or in providing, a health service to an individual;

      (c) other personal information collected in connection with the donation, or intended donation, by an individual of his or her body parts, organs or body substances;

      (d) genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

  • Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

    • (a) whether the information or opinion is true or not; and

      (b) whether the information or opinion is recorded in a material form or not.

  • Record means any material that contains information including but not limited to paper documents and electronic files of all types.

    • Sensitive information means

      (a) information or an opinion about an individual’s:

      • (i) racial or ethnic origin; or

        (ii) political opinions; or

        (iii) membership of a political association; or

        (iv) religious beliefs or affiliations; or

        (v) philosophical beliefs; or

        (vi) membership of a professional or trade association; or

        (vii) membership of a trade union; or

        (viii) sexual orientation or practices; or

        (ix) criminal record;

        that is also Personal Information; or

    • (b) health information about an individual; or

      (c) genetic information about an individual that is not otherwise health information; or

      (d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or

      (e) biometric templates.

5. Collection of Personal Information

  • We collect Personal Information directly from You unless it is not practicable or reasonable to do so or You have granted Us permission to obtain the information from someone else or We are otherwise authorised or required to do so. For example, We may need to collect information from Your health professionals and government agencies in order to provide Services to You. Every effort will be made to collect the Personal Information in an environment that protects the Personal Information and maintains confidentiality.

  • Collection of Personal Information directly from You can include, but is not limited to, interacting with Us over the phone, online, via surveys and questionnaires, electronic data collection devices, subscribing to a mailing list, applying for a position as an employee, contractor, or in another capacity, purchasing or applying for a Smart Bear product, program or Service.

  • Smart Bear may collect Personal Information from individuals who visit its website, make enquiries, subscribe to communications, or otherwise interact with Smart Bear online or otherwise, even if they do not become Users.

  • This information may include names, contact details, enquiry content, technical data (such as IP address and browser information), and other information voluntarily provided. This Privacy Policy applies to the handling of such information.

  • Smart Bear will endeavour to work with individuals who wish to provide Personal Information anonymously or in a deidentified format. Given the nature of Our Services and the need to identify persons so as to provide appropriate Services, in many cases this is not practicable e.g. where lack of Personal Information could impact the delivery of Services to You, impact Our ability to fulfill Our regulatory obligations or otherwise unreasonably impact Our business processes.

6. Use, Holding & Disclosure of Personal Information

  • We collect and hold Personal Information in Our data management system in order to provide Our Services and to run Our business. The use of this information collected shall be limited to the purposes set out in this Privacy Policy, the Terms and Conditions and any other individual contracts You have entered into with Us.

6.1 - Primary Use

  • Our primary use of personal information is in the provision of Our products and Services, support and communications related to Your purchases and improving Your User experience. We may disclose Your Personal Information to Our associated health care providers, third party data or payment processors, and/or Service and product delivery providers where applicable.

6.2 - Secondary Use

  • We may also use Your Personal Information for secondary purposes which are related to the primary use including activities related to Our business including billing, record keeping, rostering, recruitment and management of staff, budgeting, marketing, platform improvement, aggregate insights and administration activities and activities necessary to fulfill Our obligations and conduct Our business in an efficient and prudent manner. In addition to this, We may also use personal information for program improvement, training, research, quality and safety activities.

6.3 - Direct Marketing

  • We may also use Personal Information for direct marketing purposes such as communicating with You about Our products and Services, and any promotions or special offers that may interest You, from which You can unsubscribe at any time. We may also use the data You provide to Us to run targeted social media advertisements and/or create look-alike audiences for advertising purposes.   We will not use Your sensitive information, including health information for marketing purposes without Your consent.

  • We will not send You misleading information or excessive emails constituting spam, nor will We sell, rent or share Your email address. You may opt out of receiving marketing communications from Us at any time by unsubscribing to the relevant communication as advised on that communication or otherwise advising Us that You do not wish to receive a particular or any marketing materials.

6.4 - Research Activities

  • As part of Our commitment to improving health education, User outcomes, and the quality of healthcare resources available to the community, Smart Bear may conduct, participate in, support, or facilitate research, evaluation, quality improvement, Service development, and related activities.

  • These activities may include the collection, analysis and reporting of information obtained through the use of Our programs, Services, surveys, questionnaires, outcome measures, educational resources, websites, communities, and other interactions with Smart Bear.

  • Where required by law, ethics, contractual obligations, or the nature of the activity, We will obtain Your consent before collecting, using or disclosing Your Personal Information for research purposes. Participation in research activities is voluntary unless otherwise clearly stated, and a decision not to participate will not affect Your access to Our products or Services unless participation forms part of a specific research project.

  • Research activities may be conducted by Smart Bear independently or in collaboration with researchers, healthcare professionals, academic institutions, healthcare organisations, government agencies, industry partners, or other appropriately authorised organisations.

  • Information collected through research activities, with Your consent or otherwise as permitted by law, may be used to:

    • (a) improve Our products, Services, programs and educational resources;

      (b) better understand health conditions, symptom patterns, recovery trajectories and management approaches;

      (c) support quality improvement and service evaluation activities;

      (d) contribute to scientific, educational, clinical, policy or public health knowledge;

      (e) develop clinician resources, education materials, publications, presentations and reports; and

      (f) inform future research projects and healthcare initiatives.

  • Where practicable and appropriate, information used for research purposes will be de-identified, anonymised, aggregated, or otherwise processed in a manner that reduces the likelihood of identifying individual persons.

  • Additional information relating to specific research projects, including participant information sheets, consent forms, ethics approvals and project-specific privacy information, may be provided separately where applicable.

6.5 - De-identified & Aggregated Data

  • Smart Bear may create, use and disclose de-identified, anonymised, pseudonymised or aggregated information derived from Personal Information for purposes including research, quality improvement, service evaluation, educational content development, reporting, statistical analysis and business improvement activities.

  • Information that has been de-identified or aggregated may no longer be considered Personal Information under applicable privacy laws and may be retained and used for these purposes where permitted by law. Due to the nature of de-identified or aggregated data sets, personal information may no longer be reasonably capable of being attributed back to a specific individual. As a result, once Personal Information has been de-identified or aggregated, it may not be possible to identify, remove or withdraw that information from the dataset.  

  • Smart Bear takes reasonable steps to ensure that de-identification processes are appropriate to the nature of the information and the intended use of the data.

6.6 - Disclosure

  • Your information may need to be disclosed to government bodies, a court, tribunal or official organisations as required by law, to Our advisors and marketing providers from time to time, to health care or service providers who may be involved in Your care or Service delivery and as required at law.

  • We may also disclose Personal Information in circumstances where We in good-faith believe that:

    • (a) such action is necessary to protect and defend Our property or the rights of Our  Users or licensees;

      (b) to act as immediately necessary to protect the personal safety or rights of Our Users or the public; or

      (c) to investigate or respond to any real or perceived violation of this Privacy Policy, the Terms and Conditions, or any other policy or contractual agreement.

  • Without the ability to collect, hold and use Your Personal Information to provide Services and run Our business, We would be unable to provide You with quality care, products and Services that are tailored to You.

6.7 - Third Parties

  • We may share Your information with Our Services providers to enable Us to provide the Services such as Our email service provider to contact You via email, Our client portal host to facilitate programs, Our merchant accounts to process payments, and with Google, affiliates, and social media accounts in order to run advertisements etc.

  • We use Google’s software platform (Google Workspace) and High Level’s software platform (Go High Level) to collect, store and manage User and practitioner information, including personal and health information, for the purpose of delivering Our products and Services, and managing research and administrative functions. We maintain contractual agreements with these third party processors to provide a level of privacy and security in compliance with relevant laws  for safeguarding protected health information.

  • Information entered into Google Workspace is stored and managed in accordance with Google’s privacy policy and security standards, a copy of which is available on Google’s website at: https://policies.google.com/privacy/embedded?hl=en-US. For more information about how personal information is secured, view the Google Workspace Legal & Compliance Centre at: https://knowledge.workspace.google.com/admin/compliance/google-workspace-legal-and-compliance.

  • Information entered into the Go High Level platform is stored and managed in accordance with High Level’s privacy policy and security standards, a copy of which is available on High Level’s website: https://www.gohighlevel.com/privacy-policy. For more information about how personal information is secured, view the Go High Level Privacy and Security Centre at: https://www.gohighlevel.com/privacy-and-security.

  • We also use reputable third-party payment processors, including Stripe and PayPal, to process payment for Your products and Services, which involves the use of Your Personal Information. A copy of their privacy policies can be obtained from the respective websites at: https://stripe.com/au/privacy and https://www.paypal.com/au/legalhub/paypal/privacy-full.  

  • Smart Bear takes reasonable steps to contractually require where possible that third-party service providers such as Google and High Level maintain appropriate privacy, confidentiality and data security protections consistent with Australian privacy laws.

6.8 - AI & Automated Decision Making

  • Smart Bear does not currently use artificial intelligence (AI) automated decision-making systems to make eligibility, diagnosis, treatment, employment or other significant decisions affecting individuals.

  • We may use AI tools and applications in connection with Our business operations, service improvement, content development, administrative functions and, in some cases, the delivery of Our Services.

  • Where Personal Information is processed using AI tools, We will take reasonable steps to ensure that appropriate privacy, confidentiality and security safeguards are maintained, We will also advise You and obtain Your consent through Our agreements with You.

  • We use technology tools to innovate Our Service offering including the use of software programs on Our website and the collection of data to improve Our Services. 

  • While We currently do not use automated decision making, this may change in the future with technological advancements.

    In any event, We comply with Our privacy obligations in relation to the use of technology.

6.9 - Online Privacy of Children

  • Our website, programs and content are intended for adults aged 18 years and over. We do not intentionally collect personal information directly from individuals under the age of 18 years. If We become aware that We have unintentionally collected personal information from a person under 18 years of age without appropriate authorisation, We will take reasonable steps to delete that information.

7. Data Subject Rights

  • You can request information about how Your Personal Information is being used at any time. You are entitled to request access to, amendment or erasure of Your Personal Information held by Us, unless an exception applies.

  • We encourage You to inform Us of any changes to Your Personal Information as soon as possible. You may ask Us to correct any error or omission in Your Personal Information.

  • If You wish to view Your personal record, You can ask for access or make a formal request in writing. To ensure privacy of Your information, appropriate identification requirements will need to be met.

  • A reasonable fee may be charged if the Personal Information is to be provided such as photocopying costs.

  • We may decline to provide access in special circumstances, for example, if a health professional advises Us that they consider the access would be harmful to You or another person.

  • You may at any time withdraw Your consent or object to Our use of Your Personal Information, restrict the processing of Your Personal Information or request erasure of Your Personal Information.

8. Security, Protection & Processing of Personal Information

  • Smart Bear takes reasonable steps to ensure that the Personal Information We hold is kept confidential and secure including by having robust security of any physical premises, databases and records; taking measures to restrict access to only personnel who need that Personal Information for Service delivery or to run Our business; providing employees with education about privacy and cyber security; and by having technological measures in place such as anti-virus software, firewalls, data encryption, role-based access controls and password protected access to systems.

  • It should be noted that scammers, hackers and those motivated by unlawful purposes can be extremely sophisticated,  and well-funded, in their attempts to access Personal Information. For this reason, it is not possible to guarantee that security protocols can never be breached.

  • If We become aware of data breach, We will comply with Our obligations under the Privacy Act and other applicable privacy laws.

8.1 - Online Activity

  • Smart Bears’ uses cookies. These cookies recognise when Your device has visited Our website so We can distinguish You from other website Users. This improves Your experience and Smart Bear’s website. If You do not wish to use the cookies, You can amend the settings on Your internet browser so it will not automatically download cookies, but this may impact Your browsing experience and Our website's functionality for You.

  • Our website uses data analytics such as Google Analytics and Meta Pixel (Facebook) to help us better understand who visits Our website so We can improve Our Services. These tools allow Us to gather information about Your interactions with Our website and advertisements, which help support Our business. They allow Us to contact You if You are placing an order, remind You about an ‘abandoned cart’ and ‘remarket’ to You appropriately. If You wish to opt-out of these analytic tools, You can do so through Google’s ad settings and through the Cookie settings on Our website.

  • Although this data is mostly anonymous, it is possible under certain conditions that We can connect it to You.

8.2 - Social Media Ads

  • We may collect Your Personal Information if You interact with one of Our social media platforms.

  • We may use that information to support Our business advertising efforts. By using social media ads, We may collect information from You and use Your information in accordance with this Privacy Policy. We abide by the data use requirements and restrictions of social media companies, and We use this data on an aggregate and anonymous basis to assess the performance and effectiveness of Our social media ads.

  • Any personally identifiable information that We collect may be used with Our service providers, but they must limit the use of that data and keep it secure and confidential in line with contractual obligations. We do not sell or share this information or Our social media data with any ad networks, exchanges, data brokers or other advertisers.

8.3 - Retention of Personal Information

  • We will not keep Your Personal Information for longer than We need to. However, We will retain information for as long as reasonably necessary under applicable laws for business, legal, regulatory, contractual and research purposes, after which it will be securely destroyed or de-identified where practicable. This may mean that We will need to retain Your Personal Information for longer than the duration of Your relationship with Us.

8.4 - International Data Transfers

  • Personal Information may be transferred, stored, processed or accessed in countries outside Australia through the use of cloud-based service providers, including Google Workspace, Go High Level, Stripe and PayPal. These providers may utilise data centres and personnel located in the United States, Europe, Asia-Pacific and other jurisdictions.

8.5 - Viewable Spaces

  • Whenever You may voluntarily make Your Personal Information available for viewing by others online (such as through the website, social media channels, engagement with community groups, live sessions or other content) it may be seen, heard, collected and used by others. We cannot be responsible for any unauthorised or improper use of the information that You voluntarily share in forums or spaces viewable by others (such as commenting on a blog post, posting in a Facebook group or other communities We manage, sharing details on a live group call etc).

  • Group spaces, such as Facebook, open forums, online communities and other groups may be included in Our Website and are subject to Our Terms and Conditions and Our Social Media Moderation & Acceptable Use Policy. You acknowledge and agree that such group spaces are viewable spaces on a public or private group platform and therefore, We cannot guarantee the privacy of what You voluntarily share in such groups.

8.6 - Passwords

  • To use certain features of the website and Our Content, such as the learning portal to access Our community groups, programs and Services, You may require a username and password. You are responsible for maintaining the confidentiality of the username and password, and all activity conducted using it.

  • You are not permitted to share Your username or password with anyone. If You share Your username or password with others, they may be able to access Your Personal Information at Your own risk. We cannot and will not be liable for any loss or damage arising from Your failure to protect Your username, password or account information.

  • You agree to notify Us immediately of any unauthorised or improper use of Your username or password, or any other breach of security. To help protect against unauthorised or improper use, make sure that You log out at the end of each session requiring Your username and password.

  • We use Our best efforts to keep Your username and password(s) private and will not otherwise share Your password(s) without Your consent, except as required by law or in the event We believe in good-faith that action is necessary, such as when disclosure is necessary to identify, contact or bring legal action against a person who may be causing harm to others or otherwise interfering with Our rights or property.

8.7 - Third Party Websites

  • We may provide links and references to other websites or content. We have no control, responsibility or liability for the content and activities of any other individual, company or entity whose website or materials may be linked to Our website or content. We cannot thus be held liable for the privacy of the information or activity on their website or materials. You must review their privacy policy for guidelines as to how they respectively store, use and protect the privacy of Your Personal Information and any information You voluntarily share with them.

9. Alternative Format Request

  • This Privacy Policy can be accessed via Our website or by hard copy. Should You require a copy of this policy in an alternative form, please send Your request via Our general enquiries to the enquiries process set out in Our Terms and Conditions.

10. Enquiries & Support

  • Please refer to Our Terms and Conditions on the options available and processes for requests, complaints, enquiries and other additional support services.

11. Related Policies

Last Updated: 29/06/2026

© Smart Bear Consulting Pty Ltd T/As Smart Bear Health 2026