1. ABOUT US

respiri™ Limited ACN 009 234 173 (respiri™) is committed to managing personal information in accordance with the Australian Privacy Principles (APPs) as set out in the Privacy Act 1988 (Cth) (the Privacy Act), applicable health records legislation, the General Data Protection Regulation 2016/679 (GDPR) of the European Union (EU) and in accordance with other applicable privacy laws (Privacy Laws).

We aim to collect, use and disclose personal information only in accordance with the Privacy Laws and this Policy.

In this Policy, “we”, “us” and “our” means respiri™.

We take privacy seriously and we aim to ensure the protection of your personal information, no matter where you are located.

2. YOUR PRIVACY IS IMPORTANT

We understand that the privacy and confidentiality of your personal information is important.

This Policy describes how we collect, hold, use and may disclose your personal information through our websites (including www.respiri.co, www.wheezo.com), the respiri™ app, the wheezo™ Digital Wheeze Monitor and other interactions (e.g. customer service enquiries, interactions through online stores, etc.) you may have with respiri™ (collectively, the Services). If you do not agree with this Policy, do not access or use respiri™ products or Services.

Our aim is to ensure the quality, integrity and security of your personal information.

3. WHAT IS PERSONAL INFORMATION?

In this Policy, “personal information” has the meaning set out in the Privacy Act. Under the Privacy Act, “personal information” is information or an opinion about an identified individual or an individual who is reasonably identifiable. Common examples include a person’s name, address, telephone number and date of birth.

Some types of personal information are designated as “sensitive information”. Sensitive information is subject to additional protection under the Privacy Act. For example, this can include information about a person’s health.

4. WHAT INFORMATION DO WE COLLECT?

The personal information that we collect about you will depend on the products or Services we provide you, or that you may enquire about.

Some examples of personal information we collect may include (but are not limited to):

• your name, date of birth and gender;
• your physical traits, such as height and weight;
• contact details such as telephone number, email address or delivery address;
• payment or banking information (including related payment verification information);
• information about your interest in or use of our products or Services;
• health (sensitive) information, for example your wheeze rate;
• your geographic location when you use the respiri™ app;
• information about your treating medical practitioners;
• if you are an individual contractor to respiri™ or are seeking employment by respiri™, information relevant to your engagement including qualifications, resume, pay rate and salary, bank details, feedback from referees and training records;
• in the case of suppliers of products and services (and their staff), your name, position, street address, email address, and telephone number; and
• any other information you choose to provide us with.

5. WHY RESPIRI COLLECTS PERSONAL INFORMATION

The type of personal information that we collect and the purposes for which we use that personal information will depend upon the circumstances. We collect personal information about you when it is reasonably necessary in the course of our business.

Reasons we may collect personal information include:

• communicating with you, including by email, telephone and mail;
• providing goods or Services to you or receiving goods or services from you;
• answering your questions and comments and providing you with information or advice;
• verifying your identity;
• coordinating your care with health care providers and health plans;
• obtaining payment for our products and Services;
• interacting with you via digital marketing;
• providing your personal information to third parties that assist us in providing products and services you have requested;
• analysing and improving the products and Services we provide;
• delivering marketing communications, promotional health materials, or advertisements that may be of interest to you;
• considering you for a job with us (whether as an employee or contractor) or another relationship with us; and
• complying with laws or regulations or with any directions given by regulators or government authorities.

In addition, we may use de-identified health information to contribute to public health efforts (particularly, research) regarding respiratory disease and for other related medical uses.

We may contact you regarding the above, including by electronic messaging such as SMS and email, through the respiri™ app, by mail, by phone or in any other lawful manner.

We may also use or disclose your personal information for other purposes to which you have consented, or as otherwise permitted or required by law.

Please note: If we are not able to collect your personal information about you, we may not be able to provide you with the products, services or assistance you require.

6. HOW DO WE COLLECT PERSONAL INFORMATION?

We collect your personal information in a number of ways, including:

1. You give it to us when you interact with us. For example this may happen when you contact us, sign up to our newsletter, create an account on the respiri™ app, purchase our products online, or use one of our products or services. If you do not provide us with this information, we may not be able to provide certain products or services to you.
2. We collect information when you use our websites, products and Services. Such information may include, for example:
   • information from our websites including the number of visits, dates of visits, pages viewed and navigation of the site;
   • your device information including the hardware model, device IP address, operating system and version, software, file names and versions, preferred language, unique device identifiers, advertising identifiers, serial numbers, device motion information and mobile network information; and
   • transaction information including the type of products or services you requested or provided, the order details, delivery information, date and time the products or services were provided, amount charged and payment method.
3. We obtain information from outside sources  like marketing mailing lists, public information (including public posts to social networking sites) and commercially available personal, geographic and demographic information.

We may also collect your personal information to comply with legal requirements or obligations, for law enforcement purposes and for public safety purposes.

If you provide personal information about another person to us, we require that you:

• inform that person that you are doing so and provide them with a copy of or a link to this policy; and
• before providing us with sensitive information about that person, obtain that person’s consent to provide the information for the purpose specified,

unless that person is under 18 years of age and you are their parent or legal guardian acting on their behalf.

If we receive unsolicited personal information about you that we could not have collected in accordance with this Privacy Policy and the Privacy Laws, we will destroy or de-identify such information unless otherwise required by law.

7. HOW DO WE USE YOUR INFORMATION?

We will only use and disclose your personal information:

• for the purposes outlined in Section 5;
• for any other purpose to which you consent; or
• as otherwise required or permitted by law.

The legal basis for our processing of your personal information may include processing:

• with your consent;
• where necessary for the performance of a contract to which you are party;
• where necessary for compliance with an EU legal obligation; or
• where necessary for the purposes of respiri™’s legitimate interests (except where such interests are overridden by your interests or fundamental rights and freedoms). These legitimate interests may include:
  • processing data entered in the respiri™ app;
  • processing data about respiri™’s employees and contractors;
  • marketing activities;
  • fraud prevention activities;
  • IT security activities;
  • disclosing information about possible criminal acts or security threats to relevant authorities; and
  • respiri™’s other legitimate commercial interests.

In any case where respiri™ relies on your consent to process your personal information you can withdraw that consent by contacting our Privacy Officer, although we may have other legal grounds under which we can continue to process your personal information, such as those set out above.

8. DIRECT MARKETING COMMUNICATIONS

We may use and disclose your personal information for the purpose of direct marketing to you, via direct mail, email, SMS, MMS, targeted digital advertising or phone calls (or any other means of marketing communication), where:

• you have consented to us doing so; or
• it is otherwise permitted by law.

You may opt-out of receiving marketing information from respiri™ at any time by:

• clicking on a link in the direct marketing communications sent to you;
• changing your communication settings in the respiri™ app; or
• contacting our Privacy Officer.

Please allow a reasonable period for your request to be actioned. We will keep a record of the fact that you have asked us not to send you direct marketing indefinitely so that we can respect your request in future.

9. COOKIES

Cookies are small text files that can be stored on your browser or device by websites, apps, online media and advertisements. respiri™ uses cookies for purposes such as:

• authenticating users;
• remembering user preferences and settings;
• personalising content and ads;
• determining the popularity of content;
• delivering and measuring the effectiveness of advertising campaigns; and
• analysing website traffic and trends, and generally understanding the online behaviours and interests of people who interact with our Services.

You may adjust your browser to refuse to accept cookies, remove cookies or notify you when a cookie is set by editing your web browser preferences or options. Each browser is different, so check the “Help” menu on your browser to learn how to change your cookie preferences. You do not have to accept all cookies sent to you by our websites. However, depending on the particular cookie you reject, you may not be able to use some features of our websites.

For more information, please visit our  Cookie Policy.

10. SHARING YOUR PERSONAL INFORMATION

To ensure that we can meet your specific needs, we may share your personal information with others in a variety of ways.

We may share your personal information with respiri™’s related entities. The purposes for this sharing include, among other things, to provide the services you have requested or authorised; to manage risk; and to provide us with a more complete understanding of your needs.

We may also share your information with third parties, including:

• third parties engaged by us to perform functions or provide products or services such as IT service providers, insurers and providers of mail outs, marketing or advertising services;
• third parties that sponsor or promote us;
• credit reporting bodies and credit providers;
• our professional advisors, including our accountants, auditors and lawyers;
• persons authorised by you to receive information held by us;
• third parties with whom we have arrangements for the purpose of promoting our business, for example companies who may use your personal information to tailor electronic advertising to you (e.g. on a webpage or social media platform) in relation to our products and services;
• in the unlikely event that we or our assets may be acquired or considered for acquisition by a third party, that third party and its advisors;
• third parties that require the information for law enforcement or to prevent a serious threat to public safety;
• as reasonably necessary to enforce our rights; and
• any other person as required or permitted by any law.

If we disclose your personal information to our service providers, we will use reasonable commercial efforts to ensure that such third parties only use your personal information as reasonably required for the purpose of disclosure and in a manner consistent with applicable laws. For example where commercially practical we will include suitable privacy and confidentiality clauses in our agreement with a third party service provider.

respiri™ may also disclose to third parties aggregated or de-identified data that is not personally identifiable. Aggregated data is created by pooling information about individuals and describing the data in the aggregate (e.g. 20% of customers who clicked on the X promotion participated in the promotion).

11. CHILDREN

Protecting children is a very important priority for respiri™.

We recognise the need to provide further privacy protections with respect to personal information we may collect from children in relation to any of our products and Services.

We do not knowingly collect personal information from, or send information about our products and Services directly to, children who lack legal capacity, without the consent of a parent or legal guardian. Generally this means we do not knowingly collect personal information from, or send information about our products and Services directly to, persons under 18 years of age without the consent of a parent or legal guardian.

A parent or legal guardian may request access to personal information that we have collected about their child and may request that the personal information be changed (see Section 13 below).

If you become aware that your child has provided us with personal information without the consent of a parent or legal guardian, please contact our Privacy Officer immediately.

If we become aware that a child has provided us with personal information without the consent of a parent or legal guardian, we will take reasonable steps to delete the information unless otherwise required by law.

Consent to respiri™’s Collection, Use and Disclosure of your Child’s Information

By providing us with personal information about your child in connection with our Services, you consent to respiri™’s collection, use and disclosure of your child’s personal information as set out in this Privacy Policy.

12. FAMILY SHARING

Family Sharing Services allows you to monitor the activity (i.e. analysis of breathing sounds for the presence of wheezing when using the respiri™ product) for each device on your account.

You are able to control what personal information you share and with whom you share it with.

We encourage you to adjust the sharing settings to best meet your objectives.

When setting up Family Sharing services, parents must first provide consent for the collection, use and disclosure of their child’s information for the purpose of providing the services. At any time, parents may provide such consent. However, without such consent, Family Sharing services will not be available for your use of the product and/or Service.

13. ACCESS TO AND CORRECTION OF PERSONAL INFORMATION

You may request access to any personal information we hold about you at any time by contacting us. We will provide access to that information in accordance with Privacy Laws, subject to any exemptions that may apply. If you would like to seek access to your personal information, please contact our Privacy Officer.

We reserve the right to charge you reasonable expenses for providing access to your personal information.

respiri™ endeavours to ensure that the personal information it holds is accurate, complete and up-to-date. Please contact our Privacy Officer if you believe the information respiri™ holds about you is inaccurate, incomplete or out-of-date.

Under applicable law, you may also be entitled to ask respiri™ to:

• delete or restrict processing of your personal information;
• transmit your personal information to another entity; or
• object to the processing of your personal information in certain circumstances.

To make such a request, please contact our Privacy Officer.

14. STORAGE AND SECURITY OF YOUR PERSONAL INFORMATION

Data retention

Generally, respiri™ will retain your personal information for the period necessary to fulfil the purposes for which we collected it (as outlined in this Policy) unless a longer period is legally required.

We will retain your personal information for as long as you maintain an account or as otherwise necessary to provide you the Services. We will also retain your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our rights.

Where we no longer need to process your personal information for the purposes set out in this Policy, we will take reasonable steps to delete your personal information from our systems or de-identify it (unless otherwise required by law).

Security

We hold your personal information in a combination of hard copy and electronic files.

respiri™ takes reasonable measures to protect the personal information it holds from loss, misuse or interference or unauthorised alteration, disclosure or access.

However:

• as the internet is inherently insecure, we cannot guarantee the security of transmission of any information you send to us using online communication. You transmit information to us online at your own risk; and
• except to the extent liability cannot be excluded due to the operation of statute, we exclude all liability (including in negligence) for the consequences of any unauthorised access to, alterations of, disclosure of, misuse of or loss or corruption of your personal information.

Nothing in this Policy restricts, excludes or modifies or purports to restrict, exclude or modify any statutory consumer rights (except to the extent they may lawfully be restricted, excluded or modified) under any applicable law including the Competition and Consumer Act 2010 (Cth).

Please notify us immediately if you become aware of any breach of security.

Sending your personal information overseas

We may send your personal information overseas, including to:

• our service providers or third parties who store data or operate outside Australia; or
• comply with laws, and assist government or law enforcement agencies.

Electronic files are stored in servers that are operated and maintained by respiri™ and third parties under contract with respiri™ and they are located in Australia or overseas countries such as the USA, Israel and Singapore.

Except where an exception applies under the Privacy Act or other relevant legislation, we will take commercially reasonable steps to ensure that overseas recipients to whom we disclose personal information do not breach the Australian Privacy Principles stated in the Privacy Act in relation to such information.

If we transfer personal information about individuals in the EU to a recipient located outside the EU, we will ensure safeguards are in place to protect the personal information. These may include:

• the European Commission having decided that the recipient country has an adequate level of protection; or
• putting in place standard data protection clauses adopted by the European Commission, between respiri™ and the recipient of the personal information.

Please contact our Privacy Officer if you would like more details about these safeguards.

Links to other websites

Our Services may provide a link or otherwise provide access to third party websites. We provide these links because we believe you may find them useful and informative. Please be aware, however, that we have no control over, do not review, and are not responsible for third party websites, their content, or any goods or services available through the third party websites.

This Policy does not apply to third party websites, and any information that you provide to third party websites, you provide at your own risk. We encourage you to review the privacy policies of any third party websites that you may interact with.

15. PRIVACY COMPLAINTS

If you have a complaint about how we collect, use, disclose, manage or protect your personal information, or otherwise consider there may be a breach of any Privacy Law, please contact our Privacy Officer in writing. You will need to provide us with sufficient details regarding your complaint as well as any supporting evidence and information.

The Privacy Officer will investigate the issue and determine the steps (if any) that we will undertake to resolve your complaint. We will contact you if we require any additional information and will notify you in writing of the outcome of the investigation.

If you are not satisfied with our determination, you can contact us to discuss your concerns or complain to the Office of the Australian Information Commissioner via www.oaic.gov.au or if you are located in the EU, you can complain to a supervisory authority responsible for monitoring the application of the GDPR.

16. HOW TO CONTACT US

If you have any questions about respiri™ and privacy, wish to provide feedback about this Policy, would like to access or correct information held by respiri™ about you, or wish to make a privacy related complaint, please contact our Privacy Officer at:

17. EXEMPTIONS

Where applicable, we will rely on the employee records exemption in the Privacy Act and any other applicable exemptions in applicable Privacy Laws.

18. CHANGES TO THIS POLICY

Please note that sometimes we update our Privacy Policy. You can always find the most up-to-date version on our website  www.respiri.co.

This Privacy Policy was last updated on 11 April 2022.