Privacy Policy

1. About This Privacy Policy

This Privacy Policy sets out how CentredAudio (ABN 58 162 956 274) handles your personal information if you are an end user of the CentredAudio platform, accessed through an Organisation (such as a gym, shopping centre, corporate office, healthcare facility, school, dance studio, or childcare centre) that holds a subscription agreement with us. We are committed to complying with the Privacy Act 1988 (Cth) including the Australian Privacy Principles (APPs). In this Policy, personal information has the same meaning as in the Privacy Act. We may update this Privacy Policy from time to time. Updates will be published at centredaudio.com.au. Questions? Contact us using the details in section 12.

2. Understanding How You Access CentredAudio

CentredAudio operates a business-to-business (B2B) platform. This means:

• Our contractual relationship is with the Organisation that has subscribed to CentredAudio and invited you to use the platform — not directly with you as an end user.
• You access the platform via a QR code, link, or access portal provided by that Organisation.
• The Organisation may have access to certain data about your use of the platform as described in section 7. The Organisation is responsible for its own collection and use of your data in connection with their broader services. You should review the Organisation's own privacy policy to understand how they handle your personal information.
• CentredAudio's data practices, as described in this Policy, are independent of and in addition to the Organisation's own privacy obligations.

3. Our Services

CentredAudio provides an audio wellbeing platform including:

• Clinically informed guided audio sessions for focus, relaxation, meditation, and sleep
• Guided hypnotherapy and mindfulness audio programmes
• Brain entrainment audio experiences for wellbeing support
• Personalised audio recommendations based on listening preferences
• Access to a curated audio wellbeing library through web and mobile applications

4. Personal Information We Collect

4.1 End User Account Information

When you register or access CentredAudio through your Organisation's invitation, we may collect:

• Your name and email address
• Account credentials
• The Organisation through which you were invited to sign up
• Usage data about which audio sessions you access and listen to
• Preferences for audio categories and session types
• Device information and technical data including IP addresses, device types, and app usage patterns
• Customer support communications and feedback
• Session duration and frequency data to personalise recommendations

4.2 Website Visitors

When you visit centredaudio.com.au, we may collect:

• Pages visited, documents downloaded, and search terms used
• Date and time of visits and session duration
• Technical information such as IP address, device type, operating system, and browser type
• Location data (general geographic area only, not precise location)

We collect this information using cookies and similar technologies.

4.3 Sensitive Information

We may collect information about your wellbeing goals and audio preferences. Where this relates to health or wellbeing, it may constitute sensitive information under the Privacy Act. We collect this with your consent and use it solely to provide personalised audio wellbeing experiences.

5. How We Collect Personal Information

• Directly from you when you create an account or access the platform via an Organisation invitation
• Automatically through your use of our services via cookies, analytics, and listening session data
• From the Organisation that invited you, to the extent necessary to set up your access

6. How We Use Personal Information

6.1 To Provide the Service

• Provide access to our audio wellbeing library
• Personalise your audio experience based on listening history and preferences
• Send service updates and new content notifications
• Provide customer support and technical assistance
• Improve our services through usage analytics and feedback
• Ensure platform security and prevent unauthorised access
• Develop new audio wellbeing content and features

6.2 Customer Support, Safety, and Analytics

We process account and usage information to operate the service, respond to support requests, detect abuse or fraud, and understand aggregate product usage. Authorised personnel may access account and activity information when reasonably necessary, with access limited through role-based administrative controls. Usage signals come from interactions recorded in our systems (such as listening sessions and feature usage). They do not capture audio recordings or conduct blanket surveillance of your device. We apply data minimisation where practical.

7. Who We Share Your Personal Information With

7.1 The Organisation That Invited You

Because you access CentredAudio through an Organisation that holds a subscription with us, that Organisation has access to certain data about your use of the platform. This may include:

• Whether you have registered and are actively using the platform
• Aggregate or individual usage statistics related to their subscriber group
• Data as agreed between CentredAudio and the Organisation under their subscription agreement

The Organisation's use of your data is governed by their own privacy policy and their agreement with CentredAudio. We strongly recommend you review the privacy policy of the Organisation that invited you.

We do not share your personal information with any other Organisation or third party outside of the Organisation through which you were invited to sign up, except as described in sections 7.2 and 7.3 below.

7.2 Technology Service Providers

We may share personal information with technology service providers who help us deliver our services, including cloud hosting providers, analytics services, content delivery networks, and customer support platforms. All service providers are required to maintain appropriate privacy and security standards. For website measurement and advertising attribution, we use Meta (Facebook) technologies including the Meta Pixel and Meta Conversions API. When you visit our site or complete signup after arriving from a Meta ad or QR entry link, we may share event data (such as page views, lead events, and registration completion), device identifiers used for attribution (for example `_fbp` / `_fbc` or equivalent first-party cookies), and hashed contact details where you have submitted them as part of signup. We do not send Meta raw health information from listening sessions.

7.3 Professional Advisors and Legal Obligations

• Professional advisors including lawyers, accountants, and auditors when necessary for business operations
• Law enforcement or regulatory authorities when required by law or to protect our legal rights

7.4 What We Do Not Do

We do not sell, rent, or trade your personal information to any third parties for marketing purposes. Your data is not shared with any source other than the Organisation through which you were invited and the service providers necessary to operate the platform.

8. Termination of Organisation Access and Your Data

If the Organisation that invited you to CentredAudio terminates or does not renew their subscription agreement with us:

• CentredAudio reserves the right to terminate your access to the platform upon the end of the Organisation's agreement.
• Following termination, CentredAudio may delete or de-identify your personal data in accordance with our data retention practices described in section 9.
• We will provide reasonable notice where practicable before deleting personal data, unless we are required to act immediately for legal, security, or contractual reasons.

If you wish to retain a copy of your data before termination, please contact us at hello@centredaudio.com.au as early as possible.

9. How Long We Keep Personal Information

• Active account data: Duration of active access plus 7 years for legal and accounting compliance
• Usage and listening data: 3 years from last account activity
• Website analytics: Aggregated and anonymised after 26 months
• Customer support communications: 3 years from resolution
• Organisation-level billing records: 7 years as required by Australian taxation law

When personal information is no longer needed, we securely delete or de-identify it.

10. How We Store and Secure Personal Information

We store personal information on secure cloud-based servers with enterprise-grade encryption, access controls, and multi-factor authentication. Security measures include end-to-end encryption in transit and at rest, regular security audits, staff privacy training, automated backup procedures, and role-based access controls.

11. Overseas Transfer of Personal Information

Some service providers may be located overseas, including in the United States and the European Union. When we share personal information internationally, we ensure recipients provide adequate protection through privacy frameworks, standard contractual clauses, or other legally recognised transfer mechanisms.

12. Your Rights and Choices

Access and Correction You can request access to or correction of your personal information. We will respond within 14 days at no charge for reasonable requests. Account Deletion You can request deletion of your account and personal data, subject to legal retention requirements. Note that if access is provided through an Organisation, termination of that Organisation's agreement may also result in deletion of your data as described in section 8. Marketing Communications You can opt out of promotional emails at any time using the unsubscribe link in our communications or by contacting us directly. Cookies You can manage cookie preferences through your browser settings, though this may affect website functionality.

13. Privacy Complaints

If you have concerns about how we handle your personal information:

• Contact us first — we aim to resolve complaints within 14 days
• If unsatisfied, contact the Office of the Australian Information Commissioner (OAIC):

• Phone: 1300 363 992
• Website: oaic.gov.au
• Email: enquiries@oaic.gov.au
• Address: GPO Box 5288, Sydney NSW 2001

14. Contact Us

The Privacy Officer — CentredAudio Suite 210, 4 Columbia Court, Norwest NSW 2153, Australia Email: hello@centredaudio.com.au Website: centredaudio.com.au

This Privacy Policy is effective as of 25 June 2025 and replaces all previous versions. We recommend reviewing this policy periodically.