In this Privacy Policy, 'us' 'we' or 'our' means Villa Verve Pty Ltd ACN 623 844 164 trading as ‘Salutegenics’ and our related bodies corporate. We are committed to respecting your privacy. Our Privacy Policy sets outs out how we collect, use, store and disclose your personal information. We are bound by the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) (Privacy Act), as well as state-based privacy legislation including the Health Privacy Principles under the Health Records Act 2001 (Vic) (Health Records Act) and the Health Records and Information Privacy Act 2002 (NSW), as well as the Health Practitioner Regulation National Law (National Law).

By providing personal information to us, you consent to our collection, use and disclosure of your personal information in accordance with this Privacy Policy. We may update this Privacy Policy at any time by publishing changes to it on our website: salutegenics.com.au (Website). We encourage you to check the Website for updates.

If you do not provide us with your personal information, we may not be able to provide our products or services to you.

WHO WE ARE AND WHAT WE DO

Salutegenics is a specialist provider of evidence-based clinical psychology, counselling, and proactive organisational wellbeing solutions.  Our services are designed to support both individual and organisational mental health, resilience, and performance. 

For individuals, we offer confidential clinical psychology and counselling services, delivered by registered health practitioners, to address a wide range of mental health, wellbeing, and personal development needs. For organisations, we deliver a suite of corporate resilience and wellbeing programs, including:

• SOMA: A proactive, neuroscience-informed mental fitness program offering confidential, reflective sessions for employees and leaders.  

• SOMA Circuits: Facilitated group reflective practice sessions that foster psychological safety, emotional regulation, and cultural uplift within teams.

• Resilience Recruitment and Teams: An asset-based assessment and development suite for fair, strengths-focused recruitment and team building.  

• Mental Fitness Workshops: These are evidence-based interactive learning modules adapted from neuroscience research and delivered in plain language. They deliver clear focus points, raise awareness, teach strategies and offer practice points.

In the course of providing these services, we collect and handle a range of personal and health information about our clients and program participants.

We are committed to managing this information in accordance with applicable privacy laws and professional standards, and to maintaining the highest standards of confidentiality and ethical practice in our work.

COLLECTION

Personal information we collect

We collect personal information such as your full name, date of birth, contact details (email, phone, residential address), emergency contact details, employment and organisation details (e.g. role, team, business unit), and payment/transaction details.

For clients receiving health services and for participants in our corporate wellbeing programs, we also collect health information (as that term is defined in the Health Records Act) and sensitive information (as that term is defined in the Privacy Act), including:

• assessment data (e.g. resilience, wellbeing and other psychometric measures);

• intake information, session/clinical notes, treatment or support plans, diagnoses and progress notes;

• information needed to process rebates or claims (e.g. Medicare number, private health insurance membership details and claim information);

• information you provide in surveys, feedback forms, registrations and attendance records for programs and training cohorts;

• referral information and correspondence from other health professionals;

• information about prescribed medications and relevant medical history;

• information about cultural background, language preferences, or Aboriginal and Torres Strait Islander status (where relevant to service delivery);

• information about disability, accessibility or support needs; and

• information about gender identity, sexual orientation or relationship status (where relevant and provided by you).

We may also collect photographs or video recordings at our events and workshops for purposes such as marketing, training, or internal reporting. We will obtain your consent before recording or using your image or voice, and you may opt out at any time.

We only use or disclose your sensitive information for the purpose for which it was collected, or for a directly related purpose that you would reasonably expect, unless you consent otherwise or an exception applies.

When engaged by an organisation to deliver resilience and wellbeing programs, we may collect individual participant information (as set out above) for program administration, assessment and evaluation. Unless otherwise agreed with you or required by law, any reporting to the corporate client is provided in deidentified or aggregated form.

Methods of collection

We may collect personal information and sensitive information (including health information) directly from you when you:

• contact us via any of the forms on the Website;

• request information through any part of the Website;

• attend and participate in our events and workshops; interact with us via our social media channels;

• attend an interview or apply (or express an interest to apply) for a job with us; or

• in any other situation where you request our products and/or services, or where the collection of personal information is reasonably necessary for us to provide, or take steps to provide, our products and/or services, or to otherwise operate our business.

We may also collect personal information and, where permitted or required by law, sensitive information from third parties, such as other health professionals, service providers, contractors, or publicly available sources, where it is unreasonable or impractical to collect the information directly from you. Personal and sensitive information is collected by lawful and fair means, and, where reasonable and practicable, directly from you. We take reasonable steps to ensure you are aware of the purposes for which we collect your personal information at or before the time of collection, or as soon as practicable afterwards.

If you do not provide the personal or sensitive information we request, we may not be able to provide you with our products or services, process your orders, respond to your enquiries, or otherwise interact with you as required for our business operations.

Anonymity and use of pseudonyms

Where lawful and practicable, you have the option of not identifying yourself, or of using a pseudonym, when interacting with Salutegenics (for example, when making a general enquiry or providing feedback). However, in many cases, such as when accessing clinical services, participating in wellbeing programs, or where required by law, we may need to collect your name and other identifying information in order to provide our services safely and effectively, meet our legal obligations, and maintain accurate records.

If you wish to use a pseudonym or remain anonymous, please let us know at the time of your enquiry, and we will advise you if this is possible in your circumstances.

USE

The purposes for which we may use your personal information include:

• delivering clinical services and corporate resilience and wellbeing programs, including administering assessments, providing support, and evaluating program outcomes;

• processing Medicare rebates and private health insurance claims, invoicing and payments;

• communicating with you about your appointments, programs, assessments and enquiries;

• coordinating care with your referring practitioner or other providers with your consent or as permitted by law;

• generating deidentified or aggregated insights for program evaluation and service improvement;

• maintaining our records and complying with legal, regulatory and professional obligations (including duties of care and recordkeeping requirements); and

• improving our services, platforms and user experience, including via feedback and analytics.

We will only use your personal information for the purpose for which it was collected, or for related purposes that you would reasonably expect, unless you have consented to another use or we are otherwise permitted or required by law to do so.

Sensitive information, such as health information, will only be used for the primary purpose for which it was collected, or for a directly related secondary purpose that you would reasonably expect, unless you have provided further consent or we are otherwise permitted or required by law.to Services Australia/Medicare and private health insurers, or as required by law.

DISCLOSURE

The circumstances in which we may disclose your personal information include:

• to third party contractors engaged to assist in the operation of our business, including our practice management and electronic health record platform, Halaxy, which we use to hold medical clinical data and claims, as well as ODOO, which we use to manage our customer relationship management (CRM) and billing functions;

• to Services Australia/Medicare and private health insurers to process rebates and claims;

• to referring practitioners and other health service providers involved in your care, with your consent or as permitted by law;

• to our employees and contractors who are bound by confidentiality and only where access is necessary for their role;

• to our corporate clients in deidentified or aggregated form for program reporting and evaluation (unless otherwise agreed with you or required by law); and

• where we are required or authorised by law, or where we reasonably believe disclosure is necessary to prevent or lessen a serious threat to life, health or safety (duty of care and other legal obligations).

Except as set out in this Privacy Policy, we do not sell, disclose or transfer personal information to third parties.

Duty of care and limits of confidentiality

We respect and uphold your confidentiality. However, in accordance with our ethical, professional and legal obligations, we may use or disclose personal information without consent where required or authorised by law, including to prevent or lessen a serious threat to life, health or safety, to report suspected child abuse, or as otherwise required under professional and legal obligations. These duties apply to our clinical services and to participants in our training cohorts where risks are identified.

Use or disclosure outside Australia

We use third party service providers, including Halaxy (for practice management and health records) and ODOO (for CRM and billing), to support our business operations. While personal information may be stored on third party systems, these providers act on our instructions and do not have independent rights to use your information. We retain effective control over your personal information at all times and take reasonable steps to ensure that any overseas access or storage is managed in accordance with applicable privacy requirements.

Similarly, your personal information may be stored on digital cloud storage or web hosting servers provided by third party service providers. These providers may operate globally, and as such, your personal information may be stored in various countries outside Australia. Due to the nature of these services, it is not practicable for us to specify in advance the countries in which your personal information may be stored, as server locations may change without notice to us.

We will not disclose your personal information to overseas recipients unless we have taken reasonable steps to ensure they comply with the Australian Privacy Principles, as required by APP 8, or unless you have provided your consent, or we are otherwise permitted or required by law.

UNIQUE IDENTIFIERS

We may assign, use, or disclose unique identifiers (such as client or patient numbers) to help us manage our services and records efficiently. We will only assign unique identifiers to you where it is necessary to carry out our functions effectively, or as required or authorised by law.

We will not adopt as our own, use, or disclose a unique identifier assigned to you by another organisation except as permitted by the Health Privacy Principles (HPPs), such as where it is necessary for us to fulfil our obligations to you, to communicate with other health service providers involved in your care, or as required by law. We take reasonable steps to protect the privacy of unique identifiers and to ensure they are only used or disclosed in accordance with applicable privacy laws.

DATA RETENTION & SECURITY

We are committed to protecting the personal information we collect and hold about you. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including by using password protection, device encryption, firewalls and restricting access to authorised personnel only.

Clinical records and health Information

Our primary systems of record is Halaxy, an encrypted electronic health record and practice management platform, and ODOO, our CRM and billing platform. All clinical and health data are securely stored within these systems, which is designed to meet industry standards for data security and privacy.

Administrative and program-related documents are stored securely on encrypted devices used solely by the principal clinicians and directors. No other staff members have access to these devices or to clinical records.

Confidentiality and access controls

All personnel with access to personal information are bound by strict confidentiality obligations. Access to clinical and administrative systems is role-based and limited to those who need it to perform their duties.

Retention and disposal

We retain health information in accordance with the National Law, the Psychology Board of Australia’s Code of Ethics (which is to be replaced with the new Code of Conduct on 1 December 2025) and relevant state or territory health records legislation. Records are retained for at least 7 years from the last occasion on which a health service was provided to an individual, and for individuals under 18, until they turn 25.

Records relating to corporate wellbeing programs that constitute health information are retained in line with these requirements. Where information is no longer required and is not subject to a legal retention requirement, we take reasonable steps to securely destroy or permanently deidentify it.

Security limitations

While we take reasonable steps to protect your information, no method of transmission or electronic storage is completely secure. Please notify us immediately if you suspect any misuse, loss, or unauthorised access to your information.

PAYMENTS, MEDICARE AND PRIVATE HEALTH CLAIMS

We do not store your full credit or debit card details in our systems. Payment transactions and claim processing are facilitated through Halaxy, Stripe (for website payments), Square (for in-person payments at conferences and events) and/or our financial institution and are handled in accordance with applicable security standards. We may disclose information necessary to process Medicare rebates and private health insurance claims to Services Australia/Medicare and private health insurers, or as required by law.

USE OF COOKIES AND SIMILAR TECHNOLOGIES

When you visit the Website, we may collect information about your device and your use of the Website using cookies, pixels, web beacons and similar technologies. This information may include your IP address, browser type, pages visited, links clicked, social media handles/usernames, and other actions you take on the Website.

Some of this information may be considered personal information under Australian law. We use this information to improve the operation and security of the Website, to direct you to the most relevant content, to remember your preferences for future visits, and for analytics purposes.

We may also use this information for marketing and advertising, including displaying targeted advertisements, and may share it with third party service providers who assist us with these activities. Some of these third parties may be located overseas; for more information, please refer to the "Use or disclosure outside Australia" section of our Privacy Policy. You can manage or opt out of cookies by changing your browser settings. Please note that disabling cookies may affect your experience of the Website.

DIRECT MARKETING

We may use your personal information to send you information about our services, programs, events, or updates that we believe may be of interest to you.  We will only use or disclose your personal information for direct marketing purposes where permitted by law, such as where you have provided your consent or where you would reasonably expect us to use your information for this purpose. We will consider our ethical and professional duties when sending any direct marketing communications. We will not use sensitive information (such as health information) for direct marketing without your express consent.

You may opt out of receiving direct marketing communications from us at any time.  Each direct marketing communication we send will include a simple means for you to unsubscribe or opt out, such as an unsubscribe link in emails.  You may also opt out by contacting us at: admin@salutegenics.com.au.

We do not sell, disclose, or transfer your personal information to third parties for their own direct marketing purposes.

SOCIAL MEDIA

You may choose to provide personal information to us via our social media sites or applications. If you interact with us through these platforms, or connect your account(s) with our social media sites, we may collect certain personal information, such as your name, email address, profile information and details of your interactions with our content. Some of this information may be considered personal information under the Privacy Act.

We will only use personal information collected via social media in compliance with our professional and legal obligations and the terms of this policy. This means we will not use or disclose any personal or sensitive information obtained through social media for any purpose other than to respond to your enquiries, improve our services, or as otherwise permitted or required by law. We will not use information obtained via social media for direct marketing or for the provision of health services without your express consent.

HOW TO CONTACT US & ACCESS TO INFORMATION

You can contact us using the following details: Email: admin@salutegenics.com.au Telephone: +61 3 9374 2949

Transfer of health information to other providers

Upon your request, we will make your health information available to another health service provider, as required by the Health Records Act 2001 (Vic) and any other applicable state or territory health privacy legislation.

Data quality

We take reasonable steps to ensure that the health information we collect, use, and disclose is accurate, complete, and up to date, in accordance with the Health Records Act and any other applicable state or territory health privacy legislation.

You have the right to request access to the personal information we hold about you, and to request correction if you believe any of the information is inaccurate, out-of-date, incomplete, irrelevant, or misleading. We will respond to your request within a reasonable period.

There is no fee for making a request, but if we need to charge a fee to cover the cost of providing access, we will let you know the amount and the basis for the charge in advance.

Privacy enquiries

If you have a complaint or privacy-related concern, please contact us using the details above. We will acknowledge your complaint, investigate the matter, and aim to provide a response within 30 days. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) or the Health Complaints Commissioner (Victoria).

For further information on Australian privacy laws, you can visit the Office of the Australian Information Commissioner (OAIC) website at www.oaic.gov.au or the Health Complaints Commissioner website at: www. hcc.vic.gov.au.

Last updated: September 2025

‍