Privacy Policy

Last updated: July 2026

This Privacy Policy explains how InnerHub Pty Ltd (ACN 695 719 165) (InnerHub, we, us or our) collects, holds, uses, discloses and protects Personal Information when you access or use the InnerHub platform at www.innerhub.com.au (Platform), engage with our services as a client, register or operate as a practitioner, or otherwise interact with us (collectively, our Services).

InnerHub is an online wellness marketplace that connects users (Clients) with independent wellness practitioners (Practitioners) for non-clinical, talk-based support, counselling-style sessions and wellbeing services. InnerHub does not itself provide clinical, medical, psychiatric, diagnostic or crisis services. Practitioners are independent contractors who are solely responsible for the Practitioner Services they provide through the Platform.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). Where overseas data protection laws apply to your interactions with us (including, where relevant, the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR)), we will also handle Personal Information consistently with those laws.

Because the Services are intended to support your health and wellbeing (including your mental health), InnerHub is treated as a health service provider, and as an organisation that provides a health service, for the purposes of the Privacy Act. This means that much of the information we collect about Clients is Health Information and Sensitive Information, which is subject to stricter protections under the Privacy Act. We handle that information accordingly.

By creating an account, ticking the acceptance box at sign up, or otherwise using the Platform or Services, you confirm that you have read, understood and agree to be bound by this Privacy Policy and you consent to the collection, use and disclosure of your Personal Information as described in it. If you do not agree, you must not use the Platform or the Services.

1. About This Policy

1.1 Scope

This Privacy Policy applies to all Personal Information that we collect, hold, use or disclose about Clients, Practitioners, prospective users, website visitors, business contacts and any other individuals who interact with the Platform or our Services.

1.2 Other documents

This Privacy Policy should be read together with our Client Terms and Conditions, our Contractor Terms and Conditions, and any other terms we publish on the Platform from time to time. If there is any inconsistency between this Privacy Policy and another document concerning Personal Information, this Privacy Policy prevails to the extent of the inconsistency in relation to privacy matters.

1.3 Updates

We may update this Privacy Policy from time to time by posting an updated version on the Platform. Material changes will be notified to active account holders by email or in-app notice prior to taking effect. The version in force at the time you use the Services applies to that use.

2. Personal Information We Collect

2.1 What is Personal Information

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act. Sensitive Information has the meaning given in the Privacy Act and includes Health Information.

2.2 Categories of Personal Information we collect

Depending on how you interact with us, we may collect the following categories of Personal Information:

Identity and contact information, including your full name, date of birth, gender, email address, mobile number, country and city of residence, time zone, and emergency contact details (where you choose to provide them).
Account and authentication information, including your username, password (in encrypted form), profile photo, account preferences, and verification information.
Client onboarding and matching information, including your reasons for seeking support, presenting concerns, preferences for a Practitioner (such as language, gender, modality or availability), responses to intake questionnaires, wellbeing self-assessments, mood ratings and goals.
Session and communications information, including booking history, scheduling data, written messages exchanged with Practitioners or our support team through the Platform, journaling entries, worksheets, homework, and metadata about audio or video sessions (such as session length, connection quality and timestamps).
Health and wellbeing information, including self-reported information about mental health, emotional wellbeing, relationships, lifestyle and other matters you choose to share in the course of using the Services. This is Sensitive Information and Health Information.
Payment and financial information, including billing name, billing address, payment method tokens and transaction history. Full card numbers are processed by our third party payment processor and are not stored by us.
Practitioner information (for Practitioners), including qualifications, registrations, professional memberships (for example with the Australian Counselling Association), CV, identity documents, working with children or police check outcomes (where applicable), insurance certificates, bank or payment account details, tax information, references and onboarding interview notes.
Technical and usage information, including IP address, device identifiers, browser type and version, operating system, language settings, referring URLs, pages viewed, features used, click and scroll behaviour, session duration, crash logs and diagnostic data.
Marketing and engagement information, including email open and click data, survey responses, testimonials and feedback, and your communication and marketing preferences.

2.3 How we collect Personal Information

We collect Personal Information in a range of ways, including:

directly from you when you create an account, complete intake or onboarding forms, book a session, communicate with us or with a Practitioner through the Platform, complete questionnaires or surveys, contact our support team, or otherwise submit information to us;
automatically when you use the Platform, through cookies, pixels, software development kits and similar technologies as described in clause 6;
from Practitioners, where they record session notes, progress information or communications relating to the support they provide to you through the Platform;
from third parties, including identity verification providers, payment processors, background and credential check providers (for Practitioners), marketing partners, analytics providers, and publicly available sources; and
from any other source where you have authorised the disclosure to us or where collection is otherwise permitted or required by law.

2.4 If you do not provide Personal Information

If you choose not to provide Personal Information we reasonably require, we may not be able to provide you with access to the Platform, match you with a Practitioner, process bookings or payments, or otherwise provide the Services.

2.5 Information about other people

If you provide Personal Information about another person (for example, an emergency contact), you confirm that you have that person's consent to provide their Personal Information to us for the purposes set out in this Privacy Policy and that you have made them aware of this Privacy Policy.

3. Sensitive and Health Information

3.1 Nature of the information

InnerHub does not provide AHPRA-regulated health services. However, as explained above, InnerHub is treated as a health service provider for the purposes of the Privacy Act. In the course of using the Services, you may choose to share information about your mental, emotional or physical wellbeing, lifestyle, relationships and other personal matters. This information is Sensitive Information and, in many cases, Health Information under the Privacy Act.

3.2 Consent to collection

By accepting this Privacy Policy and choosing to provide Sensitive Information or Health Information through the Platform (including through intake forms, questionnaires, in-session communications, messages and journals), you expressly consent to InnerHub collecting, holding, using and disclosing that information for the purposes described in this Privacy Policy, including to enable matching with, and the provision of services by, your Practitioner.

We use a layered consent approach so that you can understand and control how your information is handled. At sign-up and at relevant points in the Platform, we ask you separately for:

your general acceptance of our Client Terms and Conditions and this Privacy Policy;
your specific consent to our collection and handling of your Health Information and other Sensitive Information;
your specific consent to the disclosure of your Personal Information (including Sensitive Information and Health Information) to Practitioners and service providers located overseas, as described in the clause headed "Overseas disclosure and cross-border transfers"; and
a separate, optional consent to receive marketing communications.

The consents in paragraphs (a) to (c) are necessary for us to provide the Services. The marketing consent in paragraph (d) is optional, is not a condition of using the Services, and can be withdrawn at any time.

3.3 Limits on use

We will only use and disclose Sensitive Information and Health Information for purposes that are directly related to the primary purpose of collection (which is to enable the operation of the Platform and your engagement with Practitioners), unless:

you have consented to another use or disclosure;
the use or disclosure is required or authorised by or under an Australian law or a court or tribunal order; or
a permitted general situation or permitted health situation under the Privacy Act applies, including where we reasonably believe the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual.

3.4 Sharing with Practitioners

Sensitive Information and Health Information you provide through the Platform may be made available to the Practitioner you are matched with, and to any subsequent Practitioner you choose to engage through the Platform, so that they can provide the relevant Practitioner Services. Practitioners are independent contractors and have their own obligations in relation to confidentiality and the handling of your information, which are set out in our Contractor Terms and Conditions and the contractual arrangements between InnerHub and each Practitioner.

3.5 Retention

We retain Sensitive Information and Health Information only for as long as reasonably necessary for the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Where you close your account, we will de-identify or securely destroy Sensitive Information and Health Information in accordance with clause 8, except where retention is required by law or is reasonably necessary for legitimate business purposes (such as managing complaints or claims).

3.6 Not a crisis service

The Platform is not a crisis service and is not designed for emergency mental health support. If you are in crisis or believe you may be at risk of harm, you should immediately contact emergency services on 000 (in Australia) or the relevant crisis service identified on our Crisis Resources page. We may, but are not obliged to, take steps consistent with the Privacy Act to disclose your information to emergency services or other appropriate persons where we reasonably believe this is necessary to lessen or prevent a serious threat to life, health or safety.

4. Why We Collect, Hold, Use and Disclose Personal Information

4.1 Primary purposes

We collect, hold, use and disclose Personal Information for the following primary purposes:

to create, verify, administer and secure your account;
to enable matching between Clients and Practitioners and to facilitate bookings, scheduling, messaging and sessions through the Platform;
to onboard, vet, credential and manage Practitioners, including verifying qualifications, professional memberships, insurance and identity;
to process payments to InnerHub and disbursements to Practitioners, and to manage refunds, chargebacks and disputes;
to provide customer and technical support, and to respond to your enquiries, complaints and feedback;
to operate, maintain, secure, monitor, improve and develop the Platform and the Services;
to comply with our legal and regulatory obligations, including under the Privacy Act, the Australian Consumer Law, the Spam Act 2003 (Cth) (Spam Act) and anti-money laundering, tax and record-keeping laws; and
for any other purpose disclosed to you at the time of collection or to which you have otherwise consented.

4.2 Secondary purposes

We may also use or disclose Personal Information for secondary purposes that you would reasonably expect, that are related to a primary purpose of collection (or, in the case of Sensitive Information, directly related), or where you have consented or the use or disclosure is otherwise permitted by the Privacy Act.

4.3 Marketing communications

Where you have given us a separate, optional marketing consent, we may use your contact details to send you marketing communications about the Platform, the Services, special offers, content and updates that we think may be of interest to you. Marketing consent is optional and is not a condition of using the Platform or the Services, and you can withdraw it at any time by using the unsubscribe function in our emails, updating your preferences in your account settings, or contacting us using the details in clause 12.

We do not use your Sensitive Information or Health Information for direct marketing. We will only send commercial electronic messages in accordance with the Spam Act, including by obtaining the necessary consent, identifying ourselves as the sender and providing a functional unsubscribe facility.

4.4 De-identified and aggregated data

We may de-identify or aggregate Personal Information so that individuals are no longer reasonably identifiable, and use and disclose that de-identified or aggregated data for analytics, research, benchmarking, product development, marketing and other lawful business purposes, including by sharing it with third parties. De-identified and aggregated data is not Personal Information and is not subject to this Privacy Policy.

5. Matching, Profiling and Automated Processing

5.1 How matching works

When you sign up as a Client, you complete an intake questionnaire and provide preferences relating to the support you are seeking. We use that information, together with information about available Practitioners (such as their stated areas of focus, languages, modalities, availability, location and reviews), to suggest one or more Practitioners we consider may be a suitable match.

5.2 Inputs to matching

The inputs into our matching processes may include:

your stated reasons for seeking support and presenting concerns;
your stated preferences (for example, language, gender, modality, time zone or session times);
information you provide in self-assessments or wellbeing questionnaires;
prior engagement with Practitioners on the Platform, including ratings and feedback; and
general usage patterns, such as preferred session times and communication channels.

5.3 Nature of the process

Matching is supported by automated processes (including rule-based logic and may include machine learning models) but is not a clinical assessment, diagnosis or recommendation of treatment. You remain in control of your choice of Practitioner and can change Practitioner at any time through your account or by contacting our support team.

5.4 No solely automated decisions with legal effect

We do not use Personal Information to make decisions that produce legal or similarly significant effects on you based solely on automated processing without human involvement. Where automated processing materially informs a decision (for example, a fraud or risk flag on an account), a human reviewer is involved before any adverse action is taken.

6. Cookies, Analytics and Online Tracking

6.1 What are cookies

Cookies are small data files placed on your device when you visit a website or use an application. We and our service providers use cookies, pixels, tags, software development kits, local storage and similar technologies (Cookies and Similar Technologies) to recognise you, remember your preferences, secure the Platform, measure performance, and tailor content and advertising.

6.2 Types of cookies and similar technologies we use

We use the following categories:

Strictly necessary, which are required for the Platform to function, including authentication, session management, security and load balancing.
Functional, which remember your preferences and choices (such as language and time zone) and improve your experience.
Analytics and performance, which help us understand how users interact with the Platform so we can measure and improve performance. We use analytics tools such as Google Analytics and similar providers.
Advertising and marketing, which include third party pixels and tags (such as Meta Pixel, Google Ads and similar) used to measure the effectiveness of our marketing, build audiences, and serve remarketing or interest-based advertising on third party platforms.

6.3 Your choices

On first visit, where required, we present a cookie banner that allows you to accept or decline non-essential Cookies and Similar Technologies. You can also adjust your browser or device settings to refuse or delete cookies, and you can opt out of interest-based advertising through industry tools such as the Digital Advertising Alliance of Australia or the relevant third party platform's settings. If you disable certain Cookies and Similar Technologies, some features of the Platform may not function properly.

6.4 Cookies and retargeting advertising

We may occasionally use cookies on our online services. These are small files stored in your browser that remember preferences. While cookies do not themselves identify you by name or email address, they can enable advertising partners such as Google and Meta to show you our ads on social media and other online platforms. If you provide us with personal information, it may be associated with data collected through cookies.

6.5 Do Not Track

The Platform does not currently respond to browser Do Not Track signals.

7. Disclosure of Personal Information

7.1 Categories of recipients

We may disclose Personal Information to the following categories of recipients for the purposes set out in clause 4:

Practitioners matched with you or selected by you, who use that information to provide Practitioner Services through the Platform.
Our related bodies corporate, officers, employees, contractors and professional advisers who have a need to access the information for the purposes described in this Privacy Policy.
Service providers that support our business, including cloud hosting and infrastructure providers, communications providers (such as email, SMS and video session providers), payment processors, identity verification and credentialing providers, analytics providers, marketing and advertising platforms, customer support tooling, and IT and security providers.
Third parties involved in any actual or proposed sale, merger, restructure, financing, due diligence process or other corporate transaction involving InnerHub, subject to appropriate confidentiality arrangements.
Regulators, courts, law enforcement and other government bodies where required or authorised by law, or where we reasonably believe disclosure is necessary to protect our rights or the rights, safety or property of any person.
Other persons to whom you have consented to us disclosing your Personal Information, or as otherwise permitted by the Privacy Act.

7.2 Sale of Personal Information

We do not sell Personal Information.

8. Overseas Disclosure and Cross-Border Transfers

8.1 Overseas locations

Because the Platform engages Practitioners based outside Australia and uses globally distributed technology providers, Personal Information may be disclosed to, accessed from, processed or stored in countries outside Australia.

The countries to which Personal Information is likely to be disclosed include:

the Philippines and Brazil (in connection with Practitioners based in those markets);
other countries in South America, Asia and elsewhere where Practitioners may be located from time to time;
the United States, the European Economic Area and the United Kingdom (in connection with cloud hosting, communications, analytics, marketing and other service providers); and
any other country disclosed to you at the time of collection, including via the Platform interface or our list of sub-processors made available on request.

8.2 APP 8 safeguards

Before disclosing Personal Information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure that the recipient does not breach the APPs in relation to that information, which may include:

entering into written contracts that require the recipient to handle Personal Information in a manner consistent with the APPs and applicable data protection laws;
conducting due diligence on the recipient's information security practices, certifications and policies;
limiting the categories of Personal Information disclosed and applying minimisation, pseudonymisation or encryption controls where appropriate; and
monitoring the recipient's ongoing compliance with its contractual obligations.

8.3 Consent to overseas disclosure

In some cases, particularly in connection with the disclosure of Personal Information to overseas Practitioners and certain overseas service providers, we rely on your consent under APP 8.2(b). By accepting this Privacy Policy, you expressly consent to the disclosure of your Personal Information (including any Sensitive Information and Health Information you provide) to recipients located in the countries identified in this clause 8 for the purposes described in this Privacy Policy and you acknowledge that, where you give such consent, APP 8.1 will not apply to that disclosure and InnerHub will not be accountable under section 16C of the Privacy Act for any act or practice of the overseas recipient that would breach the APPs.

9. Data Quality, Retention and Destruction

9.1 Accuracy

We take reasonable steps to ensure that the Personal Information we collect, hold, use and disclose is accurate, up to date, complete and (in the case of use and disclosure) relevant for the purpose. You should keep your account details up to date through your profile settings.

9.2 Retention periods

We hold Personal Information only for as long as we reasonably need it for the purposes for which it was collected or a related purpose, or as required or authorised by law. Indicative retention periods include:

account, transaction and tax records, for at least 7 years after closure of your account, to comply with tax and record-keeping obligations;
session metadata, messaging and intake information, for the period your account is active and for a further period of up to 7 years following closure (or a shorter period where we are reasonably able to minimise retention consistent with the Privacy Act);
complaint and dispute records, for at least 7 years after the matter is closed; and
marketing data, until you opt out or your account is closed, whichever occurs first.

9.3 Destruction or de-identification

Once Personal Information is no longer required by us for any authorised purpose and we are not legally required to retain it, we will take reasonable steps to destroy or de-identify it.

10. Security

10.1 Security measures

We take reasonable steps to protect Personal Information from misuse, interference and loss and from unauthorised access, modification or disclosure. These measures include:

encryption in transit (TLS) and at rest for sensitive data stores;
role-based access controls, multi-factor authentication and least privilege access for personnel and contractors;
network security controls, monitoring, logging and intrusion detection;
contractual security and confidentiality obligations on Practitioners and service providers;
regular reviews of security practices, policies and incident response procedures; and
staff and contractor training on privacy and information security.

10.2 Internet transmission

Despite our security measures, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of Personal Information transmitted to or stored by us.

10.3 Eligible data breaches

If we become aware of an eligible data breach affecting your Personal Information, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. We maintain a documented data breach response plan that sets out the roles, assessment steps and notification timeframes we follow if we suspect a breach has occurred, and we require Practitioners and key service providers to report suspected breaches to us promptly so that we can meet our obligations.

11. Access and Correction

11.1 Right to access

You may request access to the Personal Information we hold about you by contacting us using the details in clause 12. We will respond to your request within a reasonable period, usually within 30 days. We may need to verify your identity before providing access.

11.2 Right to correction

If you believe that any Personal Information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. We will take reasonable steps to correct the information so it is accurate, up to date, complete, relevant and not misleading.

11.3 When we may refuse

We may refuse a request for access or correction in the limited circumstances permitted under the Privacy Act. If we refuse, we will provide you with written reasons and information about how to complain about the refusal.

11.4 Fees

We do not charge for making a request for access or correction. We may charge a reasonable fee for the costs of giving access (for example, where significant retrieval or collation work is required) but not for making the request itself.

12. Complaints

12.1 How to make a complaint

If you have a complaint about how we have handled your Personal Information, please contact our Privacy Officer using the details in clause 14. You should include sufficient information to allow us to investigate, including a description of what happened, the Personal Information involved, and the outcome you are seeking.

12.2 Our process

We will:

acknowledge receipt of your complaint within 5 business days;
investigate the complaint, which may include asking you for further information and contacting any third parties involved;
aim to provide a substantive written response within 30 days of receiving your complaint, or, where this is not possible, keep you informed of the expected timeframe; and
if your complaint is upheld, take reasonable steps to remedy the matter, which may include correcting or deleting Personal Information, updating our processes, or providing an apology.

12.3 Escalation

If you are not satisfied with our response, or if we have not responded within 30 days, you can refer your complaint to the OAIC at www.oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001. If you are based in the European Economic Area or the United Kingdom, you may also lodge a complaint with your local data protection authority.

13. Children

13.1 Age restriction

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect Personal Information from children under 18. If you become aware that a child has provided Personal Information to us, please contact us and we will take reasonable steps to delete that information.

14. Contact Us

14.1 Privacy Officer

You can contact our Privacy Officer with any questions, requests or complaints about this Privacy Policy or our handling of your Personal Information using the following details:

Entity: INNERHUB PTY LTD (ACN 695 719 165)
Attention: Privacy Officer
Email: support@innerhub.com.au
Website: www.innerhub.com.au

15. Definitions and Interpretation

In this Privacy Policy, capitalised terms have the meanings given to them where they first appear, and the following defined terms apply:

APPs: means the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.
Client: means a user of the Platform who engages, or seeks to engage, a Practitioner through the Platform.
Cookies and Similar Technologies: has the meaning given in clause 6.1.
Health Information: has the meaning given in section 6FA of the Privacy Act.
InnerHub, we, us, our: means INNERHUB PTY LTD (ACN 695 719 165) and its related bodies corporate.
OAIC: means the Office of the Australian Information Commissioner.
Personal Information: has the meaning given in section 6 of the Privacy Act.
Platform: means the InnerHub website, applications and online platform available at www.innerhub.com.au and any related domains, applications and services.
Practitioner: means an independent wellness practitioner who is engaged by Clients through the Platform.
Practitioner Services: means the non-clinical wellness, counselling-style and wellbeing services provided by Practitioners to Clients through the Platform.
Privacy Act: means the Privacy Act 1988 (Cth), including the APPs and any regulations and registered codes made under that Act.
Sensitive Information: has the meaning given in section 6 of the Privacy Act and includes Health Information.
Services: means the services provided by InnerHub through the Platform, as described in clause 1.
Spam Act: means the Spam Act 2003 (Cth).

15.1 Interpretation

Headings are for convenience only and do not affect interpretation. References to legislation include any amendment, replacement or re-enactment of it. The singular includes the plural and vice versa. References to a person include a body corporate. Examples introduced by including or such as are not limited to those examples.

16. Governing Law

16.1 Governing law

This Privacy Policy is governed by the laws of New South Wales, Australia. You and InnerHub submit to the exclusive jurisdiction of the courts of New South Wales and the courts competent to hear appeals from those courts in respect of any dispute arising out of or in connection with this Privacy Policy.