Privacy Policy

Who we are

We are a massage studio at 363 Belgrave-Gembrook Road, Emerald VIC 3782. For privacy questions, email hello@befinethaimassage.com.au or call (03) 5968 4490. Ask for the person looking after customer records.

What we collect

We only collect what we need to run bookings and look after you in the studio:

• Identity and contact details — name, date of birth, email, and mobile or landline
• Booking details — treatment, date, time, and notes you leave for the therapist
• Waitlist details — the time and treatment you asked us to watch
• Gift vouchers and treatment packs — the code, remaining value or visits, and who it is held for
• Health information you choose to share — medications, pregnancy, injuries, allergies, areas to avoid, pressure preference, treatment goals, and a body map of discomfort, including on a form you complete at the studio or when you create a profile
• Your signature on that form, and the date and time you signed, for each visit
• Emergency contact name, relationship, and number, if you add them
• Health fund name, card number, member number, patient number if the card has one, and your address, only if you tell us you will claim a rebate, so we can issue a receipt. You still need to bring the card to the studio. We do not send the claim to your fund.
• A couples visit — each person's name, treatment, goals, and discomfort. The second person can use their own mobile or email, or the same one as the person who booked. Each person still has their own record.
• For anyone under 18 who visits with a parent or guardian — the parent or guardian's name and signature on that visit's form
• Account details — password (stored as a hash), email and SMS marketing choices, login history, and social sign-in if you choose it
• Messages — SMS replies about a booking, emails you send us, and reminder replies such as CANCEL
• Studio notes about a visit, including if we need to take extra care next time

Health information is sensitive information under the Privacy Act. A business that collects it must follow the Australian Privacy Principles, including a small business. We only collect it with your consent, usually when you complete the health form or tell a therapist. You do not have to provide health notes to book online, but we do ask for a signed form before treatment in the studio so we can treat you safely. We do not use those notes to market to you, and we do not send a health-fund claim.

How we collect it

• When you book online, join a waitlist, register, or update your profile
• When you phone or walk in and we take a booking
• When you complete the health form in the studio — including if you search the email on your profile so we can fill in your last answers, and you sign again for today
• When a parent or guardian and a child both visit: each person completes their own form. The child's form includes the parent or guardian's name and signature
• When you buy or use a gift voucher or treatment pack, including when you apply one at the studio
• When you reply to a reminder SMS or email us
• When you open a booking card in the studio — the card takes you to the booking page. We count that open so we know the card is being used. It does not add your name.
• When you use the public first-visit, health-funds, availability, or reviews pages — those pages do not add a new form; they only show studio information
• From Google or Facebook if you choose to sign in that way
• From Google's address lookup, only if you start typing an address for a health-fund receipt — we send what you type so we can suggest an Australian address

We do not buy mailing lists. We do not collect payment card numbers on this website.

Why we hold it

We use personal information to:

• Confirm, change, and remind you about bookings (email and SMS), including a private manage link
• Offer you a waitlist place if a time is full
• Issue and apply gift vouchers and treatment packs — including when you book online or at the studio — and return unused value or a visit to your card if that booking is cancelled
• Match a phone or walk-in booking to your profile when you use the same mobile or email later
• Keep a signed health form for each studio visit, and show you your last answers next time
• Keep a child's visit as their own record, linked to the parent or guardian who is with them, so the parent's profile is not overwritten
• Take account of health notes so a treatment is appropriate
• Issue a health-fund receipt with the address and fund you gave us, and keep a public list of funds we can receipt (fund names and logos only — not your membership)
• Contact you if a therapist is unwell or hours change
• Send marketing emails or marketing SMS only if you have opted in to that channel — booking reminders are not marketing. You can opt out of marketing any time
• Handle complaints, no-shows, and safety issues
• Meet legal obligations, including health and safety and tax record-keeping

We do not sell your information. We do not use it for automated decisions that affect you beyond offering available booking times.

How we hold and protect it

Customer records are stored in Australia, on Amazon Web Services in the Asia Pacific (Sydney) region. Names, phone numbers, addresses, health notes, signatures, and similar fields are encrypted at rest. Phone numbers used to find a booking are stored as a one-way hash so look-ups do not search the raw number. Passwords are hashed. Booking manage links use a random token that is stored only as a hash.

We keep a copy of each signed studio form, not only the latest one, so we have a record of what you confirmed on that visit. A child who shares a parent's mobile or email still has a separate record; the parent keeps the main contact look-up.

The public website may be cached on a global content network so pages load quickly. Booking records, profiles, vouchers, health forms, and waitlist details are not stored on those public caches. Therapists and studio staff only see what they need for your appointment. The site is only opened over HTTPS, with a firewall in front of it. How that works is on the security page.

Who we disclose it to

We share information only as needed to run the studio:

• Therapists and studio staff who need it for your appointment
• Amazon Web Services in Australia for hosting, email (SES), and SMS (SNS)
• Our email and calendar tools so the studio sees new, changed, or cancelled bookings
• Google, if you use address suggestions for a health-fund receipt, or if you sign in with Google
• Facebook, if you choose to sign in that way
• A health fund or insurer, only if you ask us to help with a rebate query
• Police, regulators, or a court if Australian law requires it

Our public reviews page shows quotes Google already publishes about the studio. We do not send your booking or health details to Google for that page. Photos on the website are of the studio. We do not publish a guest photo unless that guest has agreed.

Health-fund names and logos on the public list belong to those funds. We show them so you can see which extras cards we can receipt. That list is not your personal information.

Some support systems (for example email delivery or address suggestions) may process a short piece of information outside Australia. We take reasonable steps so those providers handle it consistently with the APPs. We do not disclose personal information overseas for marketing or advertising.

How long we keep it

We keep booking, profile, voucher, and signed health-form records while you remain a customer and for a reasonable period afterwards so we can manage follow-up visits, complaints, and legal obligations. You can ask us to delete your online account from your profile. A warning asks you to confirm. We then email you to confirm the deletion. Deleting the account stops sign-in, marketing email, and texts, and removes your personal information from our records. Bookings stay on the studio calendar, health-fund audit, and exports labelled “Account deleted”.

Access, correction, and complaints

You can view and update most of your details in your profile. You can also ask us for a copy of the personal information we hold, or ask us to correct it. Email hello@befinethaimassage.com.au. We will respond within a reasonable time.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. A complaint about health information in Victoria can also go to the Health Complaints Commissioner.

Data breaches

If we have reasonable grounds to believe an eligible data breach has occurred, we follow the Notifiable Data Breaches scheme. Where the scheme requires us to, we tell you and the Office of the Australian Information Commissioner.

Cookies and this website

We use a session cookie so you stay signed in while you book. A booking manage link uses a random token stored only as a hash. We do not run advertising trackers or sell browsing data. The public availability board never shows customer names. If we close a day for unforeseen circumstances, the board may still show that date as closed during usual hours, without any guest names.

Booking reminders and receipts are service messages. A marketing email or text is only sent if you opted in, names Be Fine Thai Massage, and includes a way to stop those messages. That is the Spam Act 2003 (Cth).

Children

You must be 18 or over to create a profile or book online. A person under 18 cannot join on this website by themselves. They are welcome as a walk-in or phone customer when a parent or guardian is with them. That parent or guardian completes their own form first if they are also having a treatment, then the child completes a form in their own name. The parent or guardian signs the child's form. We keep a separate record for the child so the parent's details are not replaced. We may store the parent's phone or email on the child's record so we can reach the family about that visit.

Changes

We may update this policy when our systems or the law change. The new version will be posted on this page with a new “last updated” date. Related pages are the terms of use, the disclaimer, and security.