ZION Functional Health School Privacy Policy

Done. Effective date set to 15 May 2025.

Updated draft below.

Strength Of Saad — Privacy Policy

Issued by: Strength Of Saad Pty Ltd ABN: 48 659 828 903 Privacy contact: niobe@strengthofsaad.com

Effective date: 15 May 2025

1. About This Policy

Strength Of Saad Pty Ltd ("we," "us," "our," "the Provider") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, hold, disclose, and protect personal information, including health information, in connection with our coaching, mentorship, and education programs, including Trinity, ZION, our 1:1 health coaching, our business mentorship services, and our online content and marketing.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Because we provide health services and hold health information, we are a covered entity under the Privacy Act regardless of our business size or annual turnover. Where applicable, we are also bound by the Health Records Act 2001 (Vic).

By using our services, websites, applications, or programs, you consent to the collection and handling of your personal information in accordance with this Policy.

2. What Information We Collect

We collect the following categories of information:

Identification and contact information Name, email address, phone number, billing address, country of residence, social media handles where provided.

Account and program information Login credentials, program enrolment status, payment history, attendance records, progress through educational modules.

Health information (sensitive information under the Privacy Act) Where you are a 1:1 coaching client, a Trinity participant, or a ZION student sharing case studies, we may collect:

• Health history and medical background

• Symptoms and presenting concerns

• Current medications and supplements

• Blood work, pathology results, and other diagnostic information

• Body composition data, measurements, and progress photographs

• Sleep, training, nutrition, and lifestyle data

• Information about prior diagnoses

• Where relevant to retreats: dietary requirements, allergies, emergency contact details, and medical declarations

Audio and visual content Recordings of group coaching calls, masterclasses, retreats, and video content where you appear or contribute. Photographs taken at retreats and events.

Marketing and engagement information Email open and click activity, website browsing behaviour, ad engagement, content interactions.

Payment information We do not store full payment card details. Payment information is processed and held by our payment processor (see Section 6).

Technical information IP address, browser type, device information, and analytics data collected through cookies and tracking technologies on our websites and community.

3. How We Collect Information

We collect information directly from you when you:

• Complete an application form (via Typeform)

• Enrol in or pay for a Program

• Participate in coaching calls, group calls, retreats, or video content

• Submit health information, intake forms, blood work, or case studies

• Subscribe to our email list

• Interact with our website, community, or content

We also collect information automatically through:

• Cookies and analytics on our websites (Google Analytics, Meta Pixel)

• Engagement data from our email platform

• Platform analytics from Circle (community), YouTube, and social media platforms

In limited cases we collect information from third parties, such as when a referral or testimonial is provided about you by another participant. Where this occurs and the information is identifiable, we will take reasonable steps to inform you.

4. Why We Collect Information

We collect and use your personal information for the following purposes:

a) To deliver the Program you have enrolled in, including coaching, mentorship, education, retreats, and community access;

b) To process payments and manage your account;

c) To communicate with you about your enrolment, schedule changes, content updates, and operational matters;

d) To improve the quality of our content and programs;

e) To send you marketing communications about our products, content, and offers, where you have consented or where permitted by law;

f) To produce educational, training, and marketing content, including the use of recordings, photographs, and case studies (with appropriate consent where required);

g) To comply with our legal, regulatory, and insurance obligations;

h) To respond to enquiries and resolve disputes.

Sensitive information consent. Under Australian Privacy Principle 3.3, we will only collect sensitive information (including health information) with your consent. By providing health information through our intake forms, coaching applications, or community submissions, you consent to its collection and use for the purposes set out in this Policy. You may withdraw this consent at any time by contacting us, although withdrawal may affect our ability to continue providing services to you.

5. How We Hold and Protect Information

We hold personal information on secure cloud-based systems operated by third-party providers (see Section 6). We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. These steps include:

• Access controls and password protection on all systems holding personal information;

• Two-factor authentication on accounts that hold sensitive data where available;

• Limiting access to personal information to team members who require it for their role;

• Training team members on privacy and confidentiality obligations;

• Reviewing third-party providers for their data security practices;

• Secure deletion or de-identification of information no longer required.

No data system is completely secure. Where we become aware of a data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act and notify affected individuals and the Office of the Australian Information Commissioner.

6. Third Parties Who Receive Your Information

We share personal information with the following categories of third-party service providers in order to operate our business. Each provider is bound by their own privacy obligations, and we take reasonable steps to ensure they handle personal information consistently with this Policy and Australian privacy law.

Provider Purpose Location Circle.so Community hosting and education platform United States Newie Payment processing Australia Typeform Application and intake forms Spain / European Union Klaviyo Email marketing and automation United States Zoom Video coaching calls and group sessions United States Google Workspace (Calendar, Drive, Gmail) Scheduling, file storage, email United States Notion Internal knowledge management and content development United States YouTube Public video content hosting United States Meta (Facebook, Instagram, Meta Pixel, Meta Ads) Marketing, advertising, analytics United States Google Analytics Website analytics United States OpenAI (ChatGPT) and Anthropic (Claude) AI-assisted content development and internal operations United States

We also disclose personal information to:

• Internal team members including our health educator, video editor, retreat support staff, and any administrative or technical contractors, on a need-to-know basis for the performance of their role.

• Professional advisers including our solicitor, accountant, and insurer, where disclosure is required for legal, financial, or risk management purposes.

• Law enforcement, regulators, and courts where required by law or where we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell your personal information to any third party.

7. Use of AI Tools

We use artificial intelligence tools, including OpenAI's ChatGPT and Anthropic's Claude, to support content development, internal analysis, customer communications, and operational tasks.

Where personal information is provided to these tools, we take reasonable steps to de-identify it before submission. Health information about identifiable individuals is not submitted to AI tools without consent. We use these tools on the basis that the providers do not retain inputs for model training under their applicable enterprise or API terms.

8. Overseas Disclosure

Many of our service providers store data outside Australia, primarily in the United States and the European Union. By using our services, you consent to your personal information being stored and processed outside Australia.

We take reasonable steps to ensure overseas recipients handle your personal information consistently with the Australian Privacy Principles. Australian Privacy Principle 8.1 limits the circumstances in which we are accountable for overseas recipients. Where we disclose information overseas, we rely on the provider's published privacy and security commitments and, where applicable, standard contractual protections.

9. Marketing Communications

We send marketing communications to you where you have subscribed to our email list, enrolled in a Program, or otherwise provided your contact details in a marketing context. We comply with the Spam Act 2003 (Cth) and the Australian Privacy Principles.

You can unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email; or

• Contacting us at niobe@strengthofsaad.com.

Operational and transactional communications (such as enrolment confirmations, schedule changes, and account notices) will continue regardless of marketing preferences.

10. Use of Recordings, Photographs, and Case Studies

By participating in our Programs, you acknowledge that calls, retreats, and group sessions may be recorded, and that photographs and video may be taken. We may use this content for educational, training, and marketing purposes in accordance with the terms agreed at the point of enrolment.

We use participant case studies, transformations, and testimonials in our marketing only with the participant's consent. Where a case study identifies a participant or contains health information, we obtain written consent before use. Participants may withdraw consent for future use by contacting us, although we may not be able to remove content already published in third-party platforms or printed materials.

Where you wish to remain anonymous or to opt out of being recorded or photographed, it is your responsibility to inform us in writing before the relevant session.

11. Cookies and Tracking

Our websites use cookies and similar technologies to operate the site, analyse traffic, deliver marketing, and improve user experience. The tracking tools we use include Google Analytics and the Meta Pixel.

You can control cookies through your browser settings. Blocking cookies may affect your ability to use certain features of our websites.

12. Retention of Information

We retain personal information for as long as it is needed for the purposes set out in this Policy, or as required by law.

Information type Retention period Health information from 1:1 coaching clients and Trinity participants 7 years after the end of the coaching relationship Health information shared in ZION case studies 7 years after submission General Program enrolment and payment records 7 years (consistent with Australian tax and record-keeping obligations) Email marketing subscribers Until unsubscribe, then archived for 12 months before deletion Marketing and analytics data 2 years from collection unless subject to a longer period Recordings used in marketing Indefinitely, subject to your right to request removal under Section 14

After the retention period, we will securely delete or de-identify the information unless we are required to retain it by law.

13. International Users

Our services are primarily directed at participants in Australia. We accept participants from other countries on a case-by-case basis.

If you are located in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR may apply to your information. You have the following rights:

• Access to your personal data

• Correction of inaccurate data

• Erasure ("right to be forgotten") in certain circumstances

• Restriction of processing

• Data portability

• Objection to processing, including direct marketing

• The right to lodge a complaint with your local supervisory authority

To exercise these rights, contact niobe@strengthofsaad.com. We will respond within one month.

We do not have an EU-based representative as we are not established in the EU and our offering is not targeted at EU consumers.

14. Access, Correction, and Complaints

Access and correction. Under Australian Privacy Principles 12 and 13, you have the right to request access to the personal information we hold about you, and to request correction of any information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

To request access or correction, contact niobe@strengthofsaad.com. We will respond within a reasonable period, generally within 30 days. We may charge a reasonable cost-recovery fee for providing access in some circumstances. We will not charge for correction requests.

Complaints. If you believe we have breached the Privacy Act or this Policy, please contact us first at niobe@strengthofsaad.com. We will investigate and respond to you within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:

• Website: oaic.gov.au

• Phone: 1300 363 992

If your complaint relates to a health service we have provided, you may also contact the Health Complaints Commissioner of Victoria:

• Website: hcc.vic.gov.au

• Phone: 1300 582 113

15. Children

Our Programs and services are not directed at children. We do not knowingly collect personal information from anyone under the age of 18. If you are a parent or guardian and believe we hold information about a child, contact niobe@strengthofsaad.com and we will delete it.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, services, or legal obligations. The current version is always available at strengthofsaad.com/privacy. Material changes will be communicated by email to active Program participants and by notice on our website.

17. Contact

For any privacy-related enquiry, request, or complaint:

Strength Of Saad Pty Ltd ABN: 48 659 828 903 Privacy contact: niobe@strengthofsaad.com