Privacy

Privacy Policy

How Kindling Nutrition collects, uses and looks after your personal and health information.

Kindling Nutrition
Annaleise Kennedy, Accredited Practising Dietitian · ABN 89 539 552 603
Caloundra, Queensland · info@kindlingnutrition.com.au

Last updated: 7 November 2026

Your health information is personal, and I take looking after it seriously. This policy explains what information Kindling Nutrition collects, why, how it's kept safe, who it may be shared with, and how you can access or correct it.

Kindling Nutrition ("we", "us", "our") is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. As a dietitian, I also follow the Dietitians Australia Code of Conduct, which includes keeping client information confidential.

1. What information we collect

We only collect information that's reasonably needed to provide our services. Depending on how you deal with us, this may include:

Your contact and identity details: your name, date of birth, email, phone number and address.

Health information, which the law treats as sensitive information. This may include:

  • your medical history, conditions, medications and supplements
  • pathology and blood test results
  • what you eat, your lifestyle, physical activity, sleep and stress
  • weight and body measurements, if relevant and only with your agreement
  • menstrual, reproductive, perimenopause and gut health information
  • relevant mental health information, such as your relationship with food
  • referrals, management plans and letters from your GP or other health professionals
  • notes from your consultations, the plans we make together, and your progress

Billing and rebate details: your Medicare number, your private health insurance details if you choose to claim, and payment records. Card payments are processed securely by Stripe through Zanda's integrated payments. We don't see or store your full card details.

Communications: emails, contact form enquiries, and messages you send us, including through Instagram or other social media.

Website information: how you use our website (see section 6).

2. How we collect it

Most information comes directly from you: when you complete our contact form, book through our online booking system, fill in intake forms, talk with us in a consultation, or email or message us.

Sometimes we receive information from other people, with your consent. For example, your GP or another health professional may send a referral or management plan, or a parent or guardian may provide information for a client under 18.

Some information is collected automatically when you visit our website, through cookies and similar technologies (see section 6).

Consultations are held online by video through Zanda Telehealth. We do not record consultations unless we've discussed it with you and you've agreed.

If we receive information about you that we didn't ask for and don't need, we'll destroy or de-identify it where it's lawful and reasonable to do so.

Staying anonymous

You're welcome to ask general questions without giving your name, or by using a pseudonym. To provide individual dietetic care, keep accurate health records or process Medicare and health fund claims, though, we need to know who you are.

3. Why we collect, use and hold it

We use your information to:

  • provide dietetic assessment, advice and ongoing care that's safe and suited to you
  • manage appointments, payments, receipts, and Medicare and private health insurance claims
  • communicate with you about your care, including reminders and follow-up
  • communicate with your GP or other health professionals involved in your care, with your consent or where Medicare requires it (see section 4)
  • meet our legal and professional obligations, including record-keeping
  • respond to enquiries and complaints
  • improve our website, resources and services, using de-identified or aggregate information where possible

We only use or disclose your health information for these purposes, for a directly related purpose you would reasonably expect, with your consent, or where the law requires or allows it.

Testimonials and stories. We will never use your name, image, story or results in testimonials, social media or marketing without your express written consent. Client examples shared on our channels are de-identified so you can't be recognised.

4. Who we may share it with

We don't sell or rent your personal information.

We may share your information with:

  • Your GP and other health professionals involved in your care, with your consent. If you're seeing us under a GP Chronic Condition Management Plan, Medicare requires us to send a written report back to your referring GP.
  • Medicare (Services Australia) to process rebates, and your private health insurer when you ask us to process or support a claim.
  • Service providers who help us run the practice, under their own confidentiality and security obligations:
    • Zanda: practice management, online booking, clinical records and telehealth video consultations
    • Stripe: card payments made through Zanda
    • Squarespace: website hosting and contact form submissions
    • Zoho Mail: business email, stored in Zoho's Australian data centre
    • Google Analytics and Meta: website analytics and advertising measurement, using website usage data only and no health information
  • Others where the law requires or allows it. For example, to lessen or prevent a serious threat to someone's life, health or safety, or when required by a court order or another law.

5. How we keep it secure

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, changes or disclosure, including:

  • keeping clinical records in Zanda, a secure, password-protected practice management system built for healthcare
  • using strong passwords and multi-factor authentication on our business accounts
  • holding consultations through Zanda Telehealth, the secure video service built into our practice management system
  • not keeping paper records, or storing any paper securely and shredding it when no longer needed
  • limiting access to your information to people who need it to provide your care

Please avoid sending detailed health information through social media messages or the website contact form. We're happy to cover it securely in your appointment or through our booking system.

How long we keep records

Health records are kept for at least seven years after your last consultation, or for clients under 18, until they turn 25, whichever is later. After that, records are securely destroyed or permanently de-identified. Other information, such as general enquiries that don't lead to an appointment, is deleted when it's no longer needed.

Data breaches

If a data breach is likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

6. Our website, cookies and analytics

Like most websites, ours uses cookies, which are small files stored by your browser:

  • Essential cookies from Squarespace make the website work.
  • Google Analytics shows how people find and use the site, such as which pages are visited and roughly where visitors are from. This information is aggregated and doesn't identify you personally.
  • The Meta pixel helps us understand visits from Instagram and Facebook and measure any advertising we run. It records that a page was visited. It doesn't receive anything you type into our forms or any health information.

Booking pages are hosted by Zanda, not on our website, and are covered by Zanda's privacy and security practices.

You can block or delete cookies in your browser settings, opt out of Google Analytics with Google's browser add-on, and manage how Meta uses your activity in your Facebook or Instagram ad settings. The website will still work if you do.

7. Information stored or accessed overseas

Some of our service providers store or process information outside Australia:

  • Website and analytics: Squarespace, Google and Meta may store website usage and contact form data in the United States and other countries where they operate.
  • Card payments: Stripe may process payment details in the United States and other countries where it operates.
  • Clinical records: your health records are stored in Zanda, hosted on Amazon Web Services data centres in Sydney, Australia. Appointment confirmation and reminder emails sent through Zanda may be processed by its email delivery provider outside Australia.

We choose established providers with strong security practices and only share what they need to provide their service.

8. Accessing and correcting your information

You can ask to see the personal and health information we hold about you, and ask us to correct anything that's inaccurate, out of date or incomplete. Just email info@kindlingnutrition.com.au.

We'll need to confirm your identity first. We'll respond within 30 days. There's no fee to make a request. If providing access involves significant cost, such as copying a large record, we'll tell you about any reasonable charge before going ahead.

In limited cases the law allows us to refuse access, for example if giving access would pose a serious threat to someone's life, health or safety. If that happens, we'll explain why in writing and tell you how to complain.

9. Questions and complaints

If you have a question about privacy, or think we've mishandled your information, please contact us first:

Annaleise Kennedy, Kindling Nutrition
info@kindlingnutrition.com.au

We take every concern seriously and will respond within 30 days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC):

10. Changes to this policy

We may update this policy from time to time, for example when we change how we work or which providers we use. The current version is always on this page, with the date it was last updated.