Privacy Policy

Effective Date: 20 August 2026
Last Updated: 20 August 2026
Business Name: Katie Louise Henderson
Website: www.katiehenderson.com.au

Katie Louise Henderson (“we”, “us”, “our”) respects your privacy and is committed to protecting the personal and sensitive information entrusted to us.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), the Notifiable Data Breaches Schem, and other applicable Australian privacy laws and requirements, as amended from time to time.

As we provide health, nutrition, fitness and related services and may collect health information, certain information we collect is classified as sensitive information under Australian privacy law and receives additional protection.

This Privacy Policy explains what information we collect, why we collect it, how we use and disclose it, how we protect it, and your rights in relation to your information.

Depending on how you interact with us and which services you use, we may collect information including:

• your name, date of birth and contact details;
• email address, telephone number and residential or postal address;
• emergency contact details;
• booking, appointment and attendance information;
• information provided in enquiries, emails, messages and other communications;
• service history and information relating to programs, consultations or coaching;
• photographs, exercise videos or other information voluntarily submitted for coaching, assessment or technique feedback;
• feedback, reviews or comments you provide about our services;
• nutrition, dietary, lifestyle and training information;
• payment, billing and transaction information;
• records of consent, including consent to receive marketing communications or consent to use a testimonial, photograph or video;
• website usage information, device information, IP address and information collected through cookies or analytics technologies; and
• any other information you voluntarily provide to us.

In providing personal training, fitness, nutrition, naturopathy, coaching and other health-related services, we may collect health information and other sensitive information.

This may include information relating to:

• medical conditions and medical history;
• injuries, pain or physical limitations;
• medications or supplements;
• pregnancy or reproductive health where relevant;
• allergies or intolerances;
• nutrition and dietary history;
• physical activity and training history;
• physical or psychological wellbeing where relevant to the service being provided;
• symptoms or health concerns;
• treatment history;
• health goals;
• information contained in health waivers, screening questionnaires or intake forms; and
• other health information you choose to disclose during consultations or coaching.

We will only collect sensitive information where it is reasonably necessary for our services and where we have the consent required by law, or where another lawful exception applies.

Health information is primarily collected to enable us to provide services appropriately and safely, assess your needs, identify relevant risks or limitations, provide appropriate recommendations and coaching, and maintain appropriate client records.

We do not use information about your medical conditions, injuries, symptoms or other health information to specifically target you with marketing unless you have expressly consented to that particular use.

We may collect information directly from you when you:

• complete a health waiver, pre-exercise screening form, intake form or questionnaire;
• undertake a consultation or assessment;
• register for personal training, coaching, nutrition, naturopathy or another service;
• register for a workshop, event or class;
• make an enquiry through our website, email, telephone, social media or another communication channel;
• subscribe to our newsletter;
• make a booking;
• make or authorise a payment;
• use an online coaching, training or booking platform;
• submit photographs, exercise videos, food diaries, training information or other materials for assessment or feedback;
• provide feedback, comments, reviews or information about your experience with our services; or
• otherwise communicate or interact with us.

Where reasonable and practicable, we collect health information directly from you.

In limited circumstances, we may receive information from another person or organisation, such as a parent, guardian, healthcare practitioner, referral source, payment provider or service provider, where you have authorised this, where it is reasonably necessary, or where collection is otherwise permitted or required by law.

We may collect, hold, use and disclose personal information for purposes including:

• providing personal training, nutrition, naturopathy, coaching and related services;
• assessing your health, training history, goals, risks and suitability for particular activities;
• developing, reviewing and adjusting programs or recommendations;
• reviewing exercise technique and providing coaching feedback;
• communicating with you about your appointments, services and progress;
• responding to enquiries;
• administering bookings, workshops and events;
• maintaining client records;
• processing and administering payments;
• managing recurring payments and outstanding accounts;
• providing customer service;
• operating and improving our website and services;
• maintaining the safety and security of our business and systems;
• meeting legal, professional, insurance, accounting and record-keeping obligations;
• managing complaints or disputes;
• sending newsletters, educational material, offers and other marketing communications where we have the necessary consent or are otherwise permitted by law;
• using testimonials, feedback, photographs or videos for promotional purposes where separate permission has been obtained; and
• other purposes which are reasonably necessary for our business and which you would reasonably expect, or to which you have consented.

We will not use or disclose personal information for an unrelated purpose unless you have consented or the use or disclosure is otherwise permitted or required by law.

Our health waiver or associated registration form may include a separate, optional consent to receive our newsletter and marketing communications.

Agreeing to receive marketing communications is not a condition of receiving our services.

Where you expressly agree to receive our newsletter or marketing communications through the health waiver, registration form, website or another method, we may use your name and contact details to send newsletters, educational information, business updates, promotions, event information and information about our services.

Consent to receive marketing communications can be withdrawn at any time.

Withdrawing marketing consent does not prevent you from continuing to receive necessary administrative or service-related communications, such as appointment information, payment notices, changes to services or other communications reasonably necessary to provide services to you.

Commercial electronic marketing communications will provide an appropriate method of unsubscribing, and unsubscribe requests will be actioned in accordance with applicable Australian law.

We may maintain records of marketing consent where reasonably necessary to demonstrate when and how consent was provided.

We do not sell client contact details or health information to third parties for their own marketing purposes.

We may use PaySmart, an Xplor Technologies service, to administer direct debit, recurring payments and other payment arrangements.

Where you provide bank account, debit card, credit card or other payment information directly through PaySmart, that information is transmitted to and handled by PaySmart/Xplor for payment processing and related purposes.

We do not ordinarily store your complete bank account or card credentials ourselves when those details are provided directly through PaySmart.

We may, however, receive or retain information relating to your payment arrangement, transaction history, payment status, failed or successful payments and other billing information reasonably necessary to administer your account.

PaySmart/Xplor may independently collect, use, store and disclose payment and personal information in accordance with its own legal obligations, terms and privacy practices. This may include use of information for payment processing, account administration, fraud prevention, security, regulatory compliance, customer support and related purposes.

You should review PaySmart/Xplor’s privacy information when providing information through its services.

We use PaySmart, an Xplor Technologies service as a third-party platform to deliver exercise programming, training plans, coaching and related online training services.

Clients who use TrainHeroic are required to create and manage their own individual TrainHeroic account.

Information required to establish or operate that account is provided directly by the client to TrainHeroic and is collected, stored and processed by TrainHeroic in accordance with its own terms, privacy policy and data-handling practices.

We do not directly collect or store clients’ TrainHeroic account passwords or other account credentials.

Through our coach access to TrainHeroic, we may be able to view or use certain information that clients enter into or submit through the platform where this is necessary to provide coaching services.

This may include:

• training sessions and completed workouts;
• exercise performance and training metrics;
• progress information;
• comments and messages;
• photographs or exercise videos;
• training goals;
• feedback about coaching or services; and
• other information voluntarily entered or submitted by the client through TrainHeroic.

Information made available to us through TrainHeroic is used primarily for purposes reasonably connected with providing training, programming, coaching, reviewing exercise technique, monitoring progress, communicating with the client and administering our services.

Exercise videos, photographs and other client-submitted media provided for coaching or technique review will not be published, shared with other clients, displayed publicly or used for advertising, social media, promotional or testimonial purposes without the client’s separate permission, except where disclosure is otherwise required or permitted by law.

TrainHeroic independently determines how information provided directly to its platform is collected, stored, processed, retained and disclosed in accordance with its own privacy practices.

Clients should review TrainHeroic’s privacy policy and terms before creating or using a TrainHeroic account.

Clients should avoid entering detailed medical records, clinical records or other sensitive health information into TrainHeroic unless it is reasonably necessary for their training or coaching and they are comfortable providing that information through the platform.

Exercise videos, photographs, messages, comments and feedback may be provided by clients as part of Personal Training or Coaching services.

Where an exercise video, photograph or other material is provided for coaching, assessment or technique feedback, it will be used for that purpose and for other purposes reasonably necessary to provide or administer the client’s service.

Providing an exercise video, photograph, comment or piece of feedback does not by itself constitute permission for us to publish, share or use that material for advertising, social media, promotional or testimonial purposes.

If we would like to use a client’s:

• exercise video or photograph;
• written or verbal feedback;
• TrainHeroic message or comment;
• review or testimonial;
• name;
• image; or
• other identifying information

for marketing, advertising, social media, website content, newsletters or other promotional purposes, separate permission will be obtained before that material is used.

Permission may specify whether the material can be used:

• anonymously;
• using a first name only;
• using a full name;
• together with a photograph or video; or
• in another specifically agreed form.

Consent to receive newsletters or marketing communications does not constitute consent for your image, videos, feedback or comments to be used as a testimonial or promotional material.

Likewise, providing positive feedback through TrainHeroic, text message, email, verbally or through another communication channel does not automatically give us permission to publish that feedback.

Where feedback or a testimonial is used with permission, we will not knowingly alter it in a way that materially changes the meaning of the client’s genuine comments or creates a false or misleading impression.

Where reasonably practicable, a client may withdraw permission for future use of their testimonial, photograph or video by contacting us. We will cease future use within our reasonable control after receiving the request. Material that has already been lawfully published, printed, distributed or independently copied or shared by third parties may not always be capable of being completely withdrawn or recovered.

We may disclose personal information where reasonably necessary to third parties that assist us in operating our business or delivering services, including:

• PaySmart/Xplor and other payment processors or financial institutions;
• TrainHeroic and other training, programming, coaching or client-management platforms;
• accounting and bookkeeping providers;
• website hosting and technology providers;
• cloud storage and IT providers;
• email and newsletter platforms;
• booking and scheduling platforms;
• professional advisers, including accountants, lawyers and insurers;
• contractors or service providers who assist with our business operations;
• healthcare or emergency services where disclosure is necessary and permitted by law;
• regulatory authorities, courts, law enforcement agencies or government bodies where required or authorised by law; and
• another person or organisation where you have consented to the disclosure.

We seek to disclose only the information reasonably necessary for the relevant purpose.

Service providers may have their own privacy policies and may independently collect or process information provided directly to them.

Some technology, cloud, payment, email, website, coaching and other service providers used by us may store or process information outside Australia.

TrainHeroic is operated by Train Heroic, LLC, which is based in the United States. Information provided through TrainHeroic may therefore be processed or handled outside Australia in accordance with TrainHeroic’s privacy practices and applicable laws.

PaySmart/Xplor and other technology providers may also operate or store information in Australia and overseas.

Where personal information is disclosed to an overseas recipient, we will take reasonable steps required under the Australian Privacy Principles to protect that information, unless an exception under the Privacy Act applies.

Where practicable, we will provide information about relevant overseas locations through this Privacy Policy, collection notices or information supplied at the time of collection.

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the nature and sensitivity of the information, these measures may include:

• password protection and access controls;
• limiting access to personal and health information to those who reasonably require it;
• secure or reputable third-party technology platforms;
• appropriate device and account security;
• multi-factor authentication where appropriate and available;
• secure handling and storage of records;
• appropriate physical security for paper records;
• maintaining procedures for responding to suspected privacy or data-security incidents;
• reviewing third-party providers where appropriate; and
• securely destroying or de-identifying information when it is no longer required.

No internet transmission, electronic storage method or information system can be guaranteed to be completely secure.

However, we take reasonable steps appropriate to the sensitivity of the information we hold.

We retain personal and health information only for as long as reasonably necessary for the purposes for which it was collected, or where retention is necessary to comply with legal, professional, taxation, insurance, dispute-resolution or record-keeping obligations.

When personal information is no longer reasonably required and we are not legally required to retain it, we will take reasonable steps to destroy it or permanently de-identify it.

Information contained in system backups may remain for a limited period until those backups are securely overwritten or deleted in accordance with applicable systems and retention processes.

We maintain procedures for responding to suspected loss of, unauthorised access to, or unauthorised disclosure of personal information.

Where a suspected data breach occurs, we will assess the incident and take appropriate steps to contain and manage it.

Where the Notifiable Data Breaches Scheme or another applicable law requires notification, we will notify the Office of the Australian Information Commissioner and affected individuals as required.

We may send marketing communications where you have consented to receive them or where we are otherwise permitted to do so by law.

We comply with applicable requirements concerning electronic marketing communications, including identification of the sender, contact information and unsubscribe facilities.

You can withdraw your consent to direct marketing at any time by:

• using the unsubscribe function contained in an email;
• replying to a communication where an unsubscribe facility is provided; or
• contacting us at hello@katiehenderson.com.au.

We will not charge you for unsubscribing.

Opting out of marketing will not prevent us from sending communications that are reasonably necessary to administer or provide services you have requested.

Consent to receive direct marketing communications is separate from any consent to use your photograph, video, feedback, name or testimonial in promotional material.

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests can be made by contacting:

Email: hello@katiehenderson.com.au

We may need to verify your identity before providing access to sensitive information.

In some circumstances, Australian law permits or requires us to refuse access to particular information.

If we refuse a request, we will provide an explanation where required by law and information about available complaint mechanisms.

We will respond to access and correction requests within a reasonable period.

Where lawful and practicable, you may interact with us anonymously or using a pseudonym.

However, we may need to know your identity where it is reasonably necessary to provide a health or fitness service safely, maintain appropriate records, process payments, verify an account, make a booking or comply with legal or professional obligations.

Our website may use cookies, analytics tools and similar technologies to:

• operate the website;
• understand how visitors use the website;
• improve functionality and user experience;
• measure website performance; and
• support marketing or advertising activities where applicable.

Information collected may include IP address, browser or device information, pages visited, dates and times of visits and interaction with website content.

You can generally manage or disable cookies through your browser or device settings, although doing so may affect some website functionality.

Third-party analytics or technology providers may process information according to their own privacy policies.

Our website, communications or services may contain links to or integrate with websites, payment systems, apps or platforms operated by third parties.

Those third parties may collect personal information directly from you and are responsible for their own privacy practices.

This Privacy Policy does not govern information independently collected by a third party under its own privacy policy.

This includes platforms such as PaySmart/Xplor and TrainHeroic, where clients may provide information directly to those services.

Australian privacy law introduces additional privacy-policy transparency requirements relating to certain forms of automated decision-making from 10 December 2026.

If we arrange for a computer program to use personal information to make, or substantially assist in making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, we will provide the information required by applicable privacy law and update this Privacy Policy where required.

Ordinary administrative automation, such as appointment reminders, payment processing, workout delivery or newsletter delivery, does not necessarily constitute the type of significant automated decision-making contemplated by these requirements.

If you believe we have mishandled your personal information or breached your privacy rights, please contact us in the first instance.

Please provide sufficient information for us to understand and investigate your concern.

We will take privacy complaints seriously, investigate them appropriately and respond within a reasonable period.

If you are not satisfied with our response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

We may review and update this Privacy Policy from time to time to reflect:

• changes to our services or business practices;
• changes to the technology or third parties we use;
• changes to the way we collect or handle personal information; or
• amendments to applicable privacy laws and regulatory requirements.

The current version will be published on our website and will state the date it was last updated.

Where a change materially affects how we use information already collected, we will take additional steps where required by law, including seeking further consent where necessary.

For questions, requests, concerns or complaints relating to privacy or your personal information, please contact:

Katie Louise Henderson
Email: hello@katiehenderson.com.au
Website: www.katiehenderson.com.au
Address: 9 Padbury Street, Hemmant QLD 4174