Legal

This privacy policy ("Policy") will help you understand how THRVE APP PTY LTD ACN 681 810 542 ("Thrve," "we," "our," "us") uses and protects the data you provide to us when you visit and use https://thrve.com ("Website") and the Thrve App ("App"). We reserve the right to change this Policy from time to time, and any variations made will be updated on our Website. It is your responsibility to check our Policy periodically to ensure you are aware of any changes.

THRVE APP PTY LTD ACN 681 810 542, an Australian registered company, considers your privacy to be important, and we take our responsibility to protect it seriously. We understand that you are concerned about your privacy, along with the confidentiality and security of any personal information that you provide to us. This Policy sets out how we collect, hold, use, and disclose information about individuals who deal or interact with us. We treat all personal information collected by us in accordance with the Privacy Act 1988 (Cth) (Privacy Act), the Australian Privacy Principles contained within the Privacy Act, and this Policy. If there is any inconsistency between the Privacy Act and this Policy, the Privacy Act will prevail to the extent of the inconsistency.

Due to the nature of the services we provide, it is generally impractical for us to deal with you without knowing your name and your contact details.

Personal information is information or an opinion of an individual whose identity is apparent or can be reasonably ascertained. We store a range of personal information that is provided as part of our business and using our products and services. This information is collected from a wide variety of sources, including:

• Through access to our Website and App;
• From you conducting business or intending to conduct business with us, whether past, present, or future;
• By otherwise having some form of contact with us, such as by mail, telephone, email, internet, or use of the Website/App; and/or,

• Through any of our other business activities, promotions, or events. Personal information collected by us may include:
• Your name, gender, age, physical address, email, and phone number. These are collected when you register for the Services, subscribe to our marketing, or communicate with us.
• Information that you provide in connection with your Profile, and any additional information you choose to provide to enhance your use of the Services, including your gender, general location, and the identifiers listed above.
• Information relating to the programs that you select and participate in.
• Dietary and fitness preferences; language preferences.
• Where you choose to connect another company's device or account to your account or engage in our Services that features a partnership with a third party, we may, with your consent, collect information from your use of the connected device(s) to facilitate interaction with our Services. This may include information like heart rate or calories burned that may be considered consumer health information under certain applicable laws.
• Information related to products and Services you order, and delivery information (including billing, shipping, and delivery address) that you provide when you purchase products and Services. Please note, we do not store or capture any credit card information. This information is collected directly by our payment processing partners, but we would like to inform you about its collection since this information is collected from you through our site and from you, our customer.
• All logs, which may include information such as your internet protocol (IP) address, browser type, browser version, clickstream data, referring URLs, the pages of our Website that you visit, the time spent on any pages of our Website/App, and other log-related information relating to your use of our Website/App. We endeavor to only collect personal information about you where it is reasonably required.

Some of the information described in section 3 — including heart rate, calories burned, and other data collected from connected devices, along with dietary and fitness preferences you provide — may constitute "sensitive information" (including health information) under the Privacy Act 1988 (Cth). By creating a Thrve account and choosing to provide this information or connect a third-party device or account, you consent to our collection, holding, use, and disclosure of this sensitive information in accordance with this Policy. We do not sell this information, and we do not disclose it to third parties for their own marketing purposes. You may withdraw your consent to the collection of this information at any time by disconnecting a linked device or account, or by deleting relevant information from your Profile, though this may limit your ability to use certain features of the Services.

We automatically gather information to monitor the use of our Website/App. Much of the data we collect is aggregated, and this information is effectively anonymous to us. In general, we use personal information for providing, evaluating, improving, personalising, and developing our business, our Website/App, and the products and services that we may offer from time to time. More specifically, we use personal information for:

• Verifying your identity, setting up, and maintaining your account.
• Processing payments through our trusted third-party payment processors and fulfilling product orders.
• Providing access to on-demand workouts, programs, and wellness content, and participation, and workout tracking.
• Communicating and tracking your workout.
• Maintaining our services and operations.
• Providing workout recommendations based on our inferences about your preferences and practices.
• Establishing and maintaining your relationship with us.
• To answer your inquiries and provide you support.
• Improving user satisfaction.
• Promoting and marketing our services to you (each person may opt-out of direct marketing and sales communications).
• Our internal research and statistical purposes.
• Enabling us to forward to you other information or material which we believe may be of interest to you (each person may opt-out of our information sharing communications).

We use personal information, including your activity, preferences, and app usage, in automated features such as workout and content recommendations, as described in section 4. Where we use personal information to develop, test, or improve our recommendation features, algorithms, or any AI-assisted functionality more generally, rather than solely to provide a feature to you individually, we will first de-identify or aggregate that information so that it can no longer reasonably be used to identify you.

As set out above, we may use your personal information for the purposes of directly marketing our products and services to you. Where consent is required, we will only send such communications after you have provided that consent. If you do not wish to receive direct marketing communications from us, you can easily opt-out of receiving such communications by following the directions for unsubscribing in the communications that you have received from us.

We do not disclose your personal information to any third party without your personal consent. Aside from the above, we will only disclose personal information as legally required – either upon valid court order, as required under the Privacy Act, or where compelled by a law enforcement or governmental agency.

If Thrve is involved in a merger, acquisition, restructuring, sale of assets, bankruptcy, or similar corporate transaction, personal information may be disclosed to prospective or actual purchasers, investors, or their advisors as part of that process (including due diligence), and may be transferred to the successor entity as part of that transaction. Where required by law, we will notify you of any such transfer and any choices you may have regarding your personal information.

We take reasonable steps to protect personal information we hold from:

• Misuse, interference, and loss; and

• Unauthorized access, modification, or disclosure. The precautionary steps we take to protect personal information include:
• Adopting measures to protect our computer systems and networks for storing, processing, and transmitting personal information.
• Adoption of procedural and personnel measures for limiting access to personal information by our staff.
• Reviewing our information collection, storage, and processing practices; and

• Such other security measures we consider reasonable and appropriate from time to time.

Notwithstanding that we use our best endeavors to protect all personal information we collect and hold, please be aware that we unfortunately cannot guarantee its complete security and will not be responsible where it is obtained by illegal third-party actions.

We keep your personal information only for as long as it is reasonably necessary for the purposes described in this Policy. In particular:

• Account and profile information is retained for as long as your Thrve account remains active.
• Following account deletion, we delete or de-identify your personal information within 14 days, except where we are required to retain it for longer to comply with our legal, accounting, tax, or regulatory obligations, or to resolve disputes, where they will remain remain temporarily in secure backups until they are overwritten in accordance with our normal backup processes.
• Health and fitness data collected via connected devices (see section 3.1) is retained only for as long as your account is active and the relevant device or account remains connected, unless you delete it sooner.
• Aggregated or de-identified data (which is no longer personal information) may be retained indefinitely. When personal information is no longer required to be kept by us, we will take reasonable steps to destroy or delete the personal information in a confidential manner.

EU and UK users have several rights with respect to their personal data, including the following: the right to be informed, the right of access, the right of rectification, the right of erasure, the right to restrict processing, the right of data portability, the right to object to processing, and the rights in relation to automated decision making and profiling. EU or UK users also have the right to lodge a complaint about the collection or use of their personal information by notifying their EU (or UK) supervisory authority. Thrve's legal bases for collecting and processing personal data include performance of a contract and/or consent. Please feel free to contact us regarding this or any other EU or UK data subject right at privacy@thrve.com if you have any questions about these rights. You can also complain to a data protection authority about our collection and use of your personal information if you feel that Thrve has not acted in accordance with applicable laws. For more information, please contact your local data protection authority.

Cookies are files with small amounts of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer's hard drive. We use "cookies" to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some features of our products and services. Once you agree to allow our Website/App to use cookies, you also agree to use the data it collects regarding your online behavior (analyze web traffic, web pages you visit, and spend the most time on). The data we collect by using cookies is used to customize our Website/App to your needs. After we use the data for statistical analysis, the data is completely removed from our systems. Please note that cookies don't allow us to gain control of your computer in any way. They are strictly used to monitor which pages you find useful and which you do not so that we can provide a better experience for you. If you want to disable cookies, you can do it by accessing the settings of your internet browser. You can visit https://www.internetcookies.com, which contains comprehensive information on how to do this on a wide variety of browsers and devices.

Web beacons (also known as clear gifs, pixel tags, or web bugs) are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the online movements of web users or to access cookies. Unlike cookies which are stored on the user's computer hard drive, web beacons are embedded invisibly on web pages (or in e-mail). Web beacons may be used to deliver or communicate with cookies, to count users who have visited certain pages, and to understand usage patterns. Like many sites, we use web beacons to collect information which is done in accordance with this policy.

We store personal information on cloud servers located in multiple countries. Due to the nature of our infrastructure, the specific server location used may vary depending on your locality and cannot be exhaustively listed, but commonly includes Australia, New Zealand, the United States, and the United Kingdom. We store information across these locations for security and resiliency purposes.

We may use PostHog to help us understand how people use our Website and App so we can improve the overall experience. Where required by applicable law, PostHog analytics are only enabled after you have consented to their use. PostHog may process information such as pages viewed, interactions with features, and browser and device information for the purpose of providing analytics services to Thrve. We do not use IP addresses for analytics or to identify users through PostHog. IP addresses may, however, be processed separately where necessary for security, fraud prevention, abuse detection, system integrity and protection against malicious activity or attacks. To help protect your personal information, we assign a unique Thrve-generated lead identifier that allows us to understand a user journey without directly identifying you by your email address. We do not use PostHog to track health-related questions, sensitive questionnaire responses, or the content of health, fitness or wellbeing information you provide. We treat health information as sensitive information and do not provide it to third-party analytics providers for tracking purposes. We may also use internal tools to aggregate or de-identify analytics information for reporting, statistical analysis and service improvement, reducing the ability for that information to be associated with an individual user. Information processed through PostHog may be stored or processed in the United States. You can find PostHog’s privacy policy here: https://posthog.com/privacy

Other than as contemplated in this clause 11, we will only disclose your personal information to an overseas recipient if:

• You consent to the transfer; or

• The disclosure of the information is required or authorized by or under an Australian law, other applicable law, or a court/tribunal order. We will take reasonable steps to ensure such overseas recipients do not breach the Australian Privacy Principles (APPs) or are subject to laws or a scheme substantially similar to the APPs.

Our Website/App, software application, products, and the services we provide may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third-party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites, products, or services whatsoever. You should be aware that your ability to opt-out of a third-party tool or platform will depend on the conditions governing your agreement with that third party. Thrve will not lease, sell, or distribute your personal information to any third parties, unless we have your permission. We might do so if the law forces us. Your personal information will be used when we need to send you promotional materials if you agree to this privacy policy.

We will provide you with access to your personal information held by us unless:

• Giving access would be unlawful; or

• Denying access is required under the Privacy Act or any other applicable law.

You will have the option through your Thrve account to access your personal information supplied to us. You will also be provided with the ability to delete your personal information by way of canceling or terminating your Thrve member account. If you are unable to access any specific personal information you believe we have collected, you must contact us in writing making such a request. You may contact us via email at privacy@thrve.com. Following receipt of your request, we will contact you and either provide you with the information you have sought or return to you with an explanation detailing why we will not provide you with the information.

You will have the option through your Thrve account to amend and update your personal information supplied to us. If for some reason you are unable to amend personal information that we hold through your Thrve account, please contact us to request the amendment. You may contact us via email at privacy@thrve.com. If we elect not to correct your information, we will notify you, within a reasonable time, of the reason for our refusal, the mechanisms available for you to complain about our refusal, and such other matters required by the Privacy Act. If you wish to have your personal information deleted and cannot do so through your Thrve Group account, please let us know and we will take all reasonable steps to delete it, unless we need to keep it for legal reasons.

We strive to ensure our compliance with this Policy and to regularly review our practices against it. If at any time you have a complaint against us regarding our Policy, including a breach of the Privacy Act, we invite you to make a complaint at privacy@thrve.com. All complaints made will be dealt with in confidence. We endeavor to respond within 30 days of receipt of a complaint with a resolution or proposed resolution to the issue raised. Please note that you may also make a complaint to the Office of the Australian Information Commissioner (OAIC) about the handling of your personal information. Information on making a privacy complaint can be found on their website at: http://www.oaic.gov.au/privacy/making-a-privacy-complaint.

For any further information about this Policy, please contact us.