Privacy Policy 1 — Lettuce Talk Nutrition

Privacy Policy

Lettuce Talk Nutrition

1 INTRODUCTION

This document sets out the privacy policy of Gemma Barnes trading as Lettuce Talk Nutrition ABN 64 371 828 409 (referred to in this privacy policy as 'we', 'us', or 'our').

We are a dietetics practice. We take our privacy obligations seriously and we've created this privacy policy to explain how we collect, store, maintain, use and disclose personal information, including the sensitive health information we collect to provide our services.

We are committed to preventing serious invasions of privacy and ensuring the protection of your personal information, so you can contact us using the details below if you have any questions or concerns.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we are also bound by our professional obligations as an Accredited Practising Dietitian under the Dietitians Australia Code of Conduct.

By providing personal information to us, you consent to our collection, storage, maintenance, use and disclosure of personal information in accordance with this privacy policy.

We may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.

2 TYPES OF PERSONAL INFORMATION WE COLLECT

The personal information we collect may include the following:

(a) name, date of birth, and other identity details;

(b) mailing or street address, email address, telephone number and other contact details;

(d) Medicare details, private health fund information and referral information (including from a referring GP or specialist);

(e) payment and billing information, including invoices;

(f) information in connection with client surveys, questionnaires, promotions and giveaways;

(g) your device identity and type, I.P. address, geo-location information, page view statistics, advertising data and standard web log information, including data on how you use our website (such as pages viewed, links clicked, and time spent on our pages);

(h) data relating to your attendance at seminars, webinars, podcasts or other events held by us, and data about your experience with our website, products and services;

(i) if you apply to work with us, your employment and education history, qualifications, referee details and any other information contained in your application;

(j) information about third parties (such as your treating practitioners or, where you are under 18, your parent or guardian); and

(k) any other information provided by you to us via our website or our online presence or otherwise required by us or provided by you.

3 SENSITIVE INFORMATION WE COLLECT

Health information is 'sensitive information' under the Privacy Act and attracts a higher level of protection. We only collect sensitive information where it is reasonably necessary for our functions and activities, and with your consent (or where we are otherwise permitted or required by law to do so).

The sensitive information we collect may include the following:

(a) health information, including medical history, diagnoses, medications, allergies and intolerances, surgeries, pathology and test results, symptoms, menstrual history, pregnancy history and family medical history;

(b) nutrition information, including dietary intake, food preferences, food allergies and intolerances, eating habits, supplement use, food diaries, nutritional concerns and eating disorder history;

(d) mental health history;

(e) communications and reports from your healthcare team, including your GP, specialists, allied health practitioners, hospital discharge summaries, medical reports and results; and

(f) clinical records and records of our communications with you (including appointment reminders, emails, phone calls and file notes, SMS messages, faxes and telehealth records).

You do not have to provide us with this information. However, if you choose not to, we may not be able to provide you with our services safely or at all.

4 PERSONAL INFORMATION OF MINORS

We provide services to individuals under the age of 18. Where we do, we obtain consent from a parent or guardian, who enters into our terms and conditions of service on the child's behalf.

If we collect personal information from individuals under the age of 18, we will assess their capacity to consent on a case-by-case basis in accordance with the Australian Privacy Principles (APP) Guidelines. As a general principle, an individual under the age of 18 may have the capacity to consent if they demonstrate sufficient maturity to understand the nature and consequences of what is being proposed. Where it is determined that the individual does not have such capacity, we will seek verifiable consent from a parent or guardian.

If it is not practicable to assess capacity on a case-by-case basis, we will generally assume that individuals aged 15 and above have the capacity to provide consent, unless there are reasonable grounds to believe otherwise. Parents or guardians may contact us at gemma@lettucetalknutrition.com to review, manage, or request deletion of their child's personal information.

5 HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information either directly from you, or from third parties, including where you:

(a) contact us through our website, by email, telephone, SMS, fax or social media (including by direct message);

(b) complete our online intake, consent or client forms, or upload documents, through our practice management software, Halaxy;

(d) provide us with information such as food diaries, blood test results or medical reports;

(e) receive goods or services from us, or purchase items through our website (such as meal plans, guides or other resources);

(f) submit any of our online forms, including our website contact form, referral form, or ‘work with us’ form, our newsletter or waitlist sign up (which we collect through Google Forms), or any survey we ask you to complete;

(g) interact with our website, social applications, services, content and advertising; and

(h) otherwise voluntarily submit information to us.

We may also collect personal information about you from third parties, including from a referring GP or specialist, from other members of your healthcare team, and from Medicare or your private health fund.

We may also collect personal information from you when you use or access our website or our social media pages. This may be done through use of web analytics tools, 'cookies' or other similar tracking technologies (including web beacons) that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.

We use Google Analytics and Facebook (Meta) Insights to collect and process data about how our website and social media pages are used, including when you use third party websites or apps. To find out more about how Google uses this data, see 'How Google uses data when you use our partners' sites or apps' at www.google.com/policies/privacy/partners/.

6 USE OF YOUR PERSONAL INFORMATION

We collect and use personal information for the following purposes:

(a) to provide dietetic services to you, including assessment, nutrition management, meal plans and nutritional analysis;

(b) to provide goods, services, products or information to you, including items purchased through our website;

(d) to prepare and provide reports, including reports we are required to provide under a GP Chronic Condition Management Plan or an Eating Disorder Management Plan;

(e) for record keeping and administrative purposes, including managing accounts, billing, invoicing and processing Medicare and private health claims;

(f) to provide information about you to our contractors, employees, consultants, agents or other third parties for the purpose of providing goods or services to you;

(g) to improve and optimise our service offering, products, website experience and customer experience, including through analytics and market research;

(h) to provide customer support;

(i) to comply with our legal, regulatory and professional obligations, resolve disputes or enforce our agreements with third parties;

(j) to send you marketing and promotional messages and other information that may be of interest to you and for the purpose of direct marketing (in accordance with the Spam Act). In this regard, we may use email, SMS, social media or mail to send you direct marketing communications. You can opt out of receiving marketing materials from us by using the opt-out facility provided (e.g. an unsubscribe link);

(k) to administer your participation in promotions and giveaways;

(l) to assess and administer your application if you apply to work with us; and

(m) to send you administrative messages, reminders, notices, updates, security alerts, and other information requested by you.

We will not use your sensitive information for direct marketing without your express consent.

7 DISCLOSURE OF YOUR PERSONAL INFORMATION

We may disclose your personal information to:

(a) your treating practitioners and healthcare team, including your GP, specialists (for example an endocrinologist) and other allied health practitioners, to keep them informed about your dietetic care. Where you are seen under a GP Chronic Condition Management Plan or an Eating Disorder Management Plan, we are required to report to your referring GP;

(b) Medicare, and your private health fund, for the purpose of processing rebates and claims;

(c) our service providers, including our practice management software provider (Halaxy), our telehealth provider (Zoom), the email-to-fax service we use to send and receive reports (GoFax) and our IT, website, payment and administrative service providers;

(d) our email marketing and communications platform (Squarespace), where you have subscribed to our newsletter or joined our waitlist. We only provide your contact details for this purpose, and we do not disclose your health information to this platform;

(e) our professional advisers, including our insurers, lawyers and accountants; and

(f) any other person to whom we are required or permitted by law to disclose your information, or to whom you have consented to us disclosing your information.

We do not sell your personal information, and we do not disclose your health information for marketing purposes. We disclose your health information only to your treating practitioners and healthcare team, to Medicare and your private health fund, to the service providers who host our clinical systems and send our reports, to our professional advisers, and where we are required or permitted by law to do so.

8 USE OF ARTIFICIAL INTELLIGENCE

We may use AI-assisted note-taking and summarisation tools within, or integrated with, our practice management software (Halaxy) to help record and summarise consultation notes, and to summarise documents and images you or your healthcare team provide to us (such as test results, referrals and medical reports). This involves the processing of your health information.

Where we use the AI tools built into Halaxy, audio from your consultation is transcribed in real time and is not stored as a recording. Only the resulting transcription and summary are retained in your clinical record. Your information is not used to train the AI, is not shared with third parties, and is stored in Australia. Where we instead use an AI tool provided by a third party and integrated with Halaxy, that provider will process your health information in accordance with its own terms and privacy policy. We will take reasonable steps to ensure that any such provider handles your information consistently with this privacy policy and the Australian Privacy Principles, and we will update this privacy policy to identify the provider. In each case, notes and summaries generated using these tools are reviewed by your dietitian, form part of your clinical record, and are stored securely in accordance with this privacy policy. We do not use these tools to make decisions about you without human involvement, and your dietitian remains responsible for your clinical care.

You may ask us not to use AI-assisted note-taking or document summarisation in your consultations by contacting us at gemma@lettucetalknutrition.com. Your clinical notes will still be recorded and stored as part of your clinical record.

9 OVERSEAS DISCLOSURE

Your clinical records are stored in Australia by our practice management software provider (Halaxy).

Some other third party service providers we use may store or process personal information outside Australia, including our telehealth provider (Zoom), the online form tools we use to collect information from you (Google Forms), our website and email marketing platform (Squarespace), and our website analytics providers (Google Analytics and Meta), which may process information in the United States and other countries.

Where we disclose personal information to an overseas recipient, we will take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information.

10 HOW LONG WE KEEP YOUR INFORMATION

We are legally required to retain clinical records for a minimum period. We retain your clinical records for at least 7 years from the date of last contact. Where you were under 18 at the time the records were created, we retain them until you reach at least 25 years of age. We may retain your clinical records for longer than these minimum periods where it is necessary for your ongoing or future care, or to establish, exercise or defend a legal claim.

Where we hold personal information that we no longer need for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we will take reasonable steps to destroy it or ensure it is de-identified.

11 SECURITY

We take reasonable steps to ensure your personal information is secure and protected from misuse or unauthorised access. Your information is stored in our practice management software (Halaxy), which is a secure, password-protected platform, and we use a range of administrative and technical measures to protect our systems. However, we cannot guarantee the security of your personal information.

You acknowledge that communications sent by email, SMS, fax or telephone, and consultations conducted by telehealth, carry inherent privacy and security limitations, and that the security of information transmitted in this way cannot be guaranteed.

12 LINKS

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

13 DATA BREACHES

We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we become aware of a data breach involving your personal information that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and take steps to contain the breach and reduce the risk of harm.

14 REQUESTING ACCESS OR CORRECTING YOUR PERSONAL INFORMATION

If you wish to request access to the personal information we hold about you, including your clinical records, please contact us using the contact details set out below including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will deal with all requests for access to personal information within a reasonable timeframe.

If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected.

15 COMPLAINTS

If you wish to complain about how we handle your personal information or believe your privacy has been seriously invaded, please contact us using the details provided below with your name and contact details. We will investigate your complaint promptly and respond within a reasonable timeframe.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

16 CONTACT US

For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:

Name: Gemma Barnes - Lettuce Talk Nutrition

Email: gemma@lettucetalknutrition.com

Our privacy policy was last updated on 22 July 2026.