Thrive Privacy Policy

1. About this Privacy Policy

Thrive is a health and wellness technology platform operated by Optihealth Group.

This Privacy Policy explains how Optihealth Group collects, accesses, uses, stores, protects and discloses personal information when you use:

• the Thrive mobile application;
• the Thrive Health Band and other compatible connected devices;
• the Thrive My Health web portal;
• the Thrive website at thrivehealthband.com;
• Ask Thrive and other Thrive AI-powered features;
• Thrive support, communications and related services.

In this Privacy Policy, “Thrive”, “Optihealth”, “we”, “our” and “us” refer to Optihealth Group and the entities responsible for operating the Thrive services.

We are committed to handling personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Health information and location information can be sensitive. We take the privacy and security of this information seriously.

2. Information We Collect

The information we collect depends on which Thrive features you choose to use.

2.1 Account and profile information

When you create or use a Thrive account, we may collect information including:

• name;
• email address;
• account identifier;
• password or authentication information;
• date of birth or age;
• sex or gender information where provided;
• height and weight;
• profile information;
• preferences and settings;
• activation or organisation codes where applicable.

Some information is required to create and operate a Thrive account. Other information is optional.

2.2 Health and wellness information

When you use Thrive, compatible wearables or connected devices, we may collect, receive, calculate or store health and wellness information.

Depending on the features and devices you use, this may include:

• heart rate;
• heart rate variability;
• blood oxygen saturation;
• skin temperature and temperature trends;
• sleep information;
• steps;
• movement and physical activity;
• workout information;
• distance and pace;
• estimated energy expenditure;
• stress and recovery indicators;
• body composition information;
• weight and body measurements;
• blood pressure estimates or trends;
• respiratory information;
• fitness and recovery information;
• menstrual or women’s health information where entered;
• nutrition and food information;
• mood and wellbeing information;
• symptoms and health observations;
• personal health records;
• pathology or other documents you choose to upload;
• information imported from compatible health platforms, devices or services where you have authorised the connection;
• derived scores, trends, patterns, correlations and personalised baselines generated from your information.

Thrive may combine information collected at different times to provide trends and personalised insights.

You control whether you use optional features that require additional health or wellness information.

3. Location Data

Thrive may access your device’s approximate or precise location when location is required for a feature you choose to use.

GPS workouts and activity tracking

When you start a location-enabled activity or workout, Thrive may use location information to:

• record your workout route;
• calculate distance;
• calculate pace or speed;
• associate movement with workout information;
• display your activity history.

Where supported by your device and permitted by your operating system settings, location access may continue for the duration of an actively initiated GPS workout when the screen is locked or the Thrive app is running in the background. This allows the workout route and related activity information to continue being recorded.

Thrive does not use background location to continuously monitor your whereabouts when a location-enabled feature or workout is not active.

Bluetooth device discovery

Thrive uses Bluetooth to discover, connect to and communicate with compatible devices including the Thrive Health Band.

On some versions of Android, the operating system may require location permission to discover nearby Bluetooth devices.

Where location permission is required only for Bluetooth discovery, Thrive does not use Bluetooth scanning to determine or track your physical location.

On newer versions of Android, Thrive may use the operating system’s Nearby Devices or Bluetooth permissions instead of location permission where supported.

How location information is handled

Location information may be stored with a workout or activity where this is necessary to provide route and activity history.

We do not:

• sell precise location information;
• use precise location information for advertising;
• provide your workout location to advertisers;
• use Bluetooth scanning to create a history of your physical location.

You can control location permissions through your device settings. Some location-based features may not operate correctly if location access is disabled.

4. Connected Device and Bluetooth Information

When you connect a Thrive Health Band or another compatible device, we may collect technical information necessary to operate that connection, including:

• device identifier;
• Bluetooth connection information;
• device type and model;
• firmware version;
• battery information;
• synchronisation information;
• sensor readings;
• connection status;
• diagnostic information associated with the device.

This information is used to connect the device, synchronise data, diagnose connection problems, support firmware or software functionality and provide Thrive services.

5. Camera, Photos, Files and Uploaded Information

Some Thrive features may allow you to use your device camera, photo library or file storage.

This may include:

• photographing food or meals;
• scanning barcodes;
• uploading pathology results;
• uploading health records or documents;
• adding profile images;
• attaching information to your health record.

Thrive only accesses these resources when required for a feature you choose to use and subject to the permissions you provide through your device.

Information contained within documents, photographs or records that you upload may include sensitive health information.

You should only upload information that you are authorised to provide.

6. Nutrition Information

If you use Thrive’s nutrition features, we may collect information including:

• foods consumed;
• meal information;
• barcode information;
• food photographs;
• nutritional information;
• serving information;
• dietary preferences;
• nutrition goals.

This information may be combined with activity, sleep, recovery and other Thrive information to provide personalised trends and insights.

7. Ask Thrive and Artificial Intelligence

Thrive includes AI-powered functionality, including Ask Thrive.

When you use these features, we may process:

• questions or prompts you submit;
• relevant health and wellness information from your Thrive account;
• recent measurements;
• historical trends;
• personal baselines;
• activity information;
• sleep information;
• nutrition information;
• information contained in health records or pathology information where the feature supports it;
• previous interactions required to maintain conversational context.

Relevant information may be securely provided to third-party artificial intelligence or technology service providers where necessary to generate the requested response.

We require service providers handling personal information on our behalf to process that information for authorised purposes and subject to appropriate privacy and security obligations.

We do not provide your health information or precise location information to advertising services for targeted advertising.

Ask Thrive and other AI-generated information are intended to provide general health and wellness insights. AI-generated information can contain errors and should not be treated as a substitute for professional medical advice, diagnosis or treatment.

8. Automated Analysis and Personalised Insights

Thrive uses software and automated analysis to identify patterns within information collected through the platform.

This may include:

• personalised baselines;
• vitality or wellness scores;
• trends;
• changes from your usual patterns;
• correlations;
• recovery insights;
• sleep insights;
• activity insights;
• nutrition insights;
• estimated or derived measurements;
• AI-generated explanations or recommendations.

These automated features are designed to help you understand your own health and wellness information.

Thrive’s consumer wellness features are not used to automatically determine your eligibility for employment, insurance, healthcare access, credit or other legal rights.

9. Technical and Usage Information

When you use Thrive, we may automatically collect technical information such as:

• device type;
• operating system;
• app version;
• device identifiers;
• IP address;
• connection information;
• application events;
• crash information;
• diagnostic logs;
• performance information;
• feature usage;
• session information.

We use this information to operate, secure, troubleshoot and improve Thrive.

10. Website Information

When you visit thrivehealthband.com or another Thrive web service, we may collect information through cookies and similar technologies.

This may include:

• IP address;
• browser type;
• device information;
• pages visited;
• session information;
• interactions with website content;
• referring website;
• marketing campaign information;
• approximate geographic information derived from an IP address.

We may use analytics services to understand how our website is used and improve its performance.

Where advertising or marketing technologies are used on the Thrive website, they may receive website interaction or device information.

We do not provide health information collected through the Thrive app, wearable or My Health portal to advertising platforms for targeted advertising.

You can manage cookies and other website tracking through your browser and any cookie controls provided on the website.

11. Purchases and Payment Information

If you purchase a Thrive product or service, we may collect information necessary to process and fulfil the transaction, including:

• name;
• email address;
• telephone number;
• billing information;
• shipping address;
• order information;
• purchase history.

Payments may be processed by third-party payment service providers.

We generally do not receive or store your complete payment card number where payment information is processed directly by an authorised payment provider.

Payment providers handle payment information according to their own privacy and security requirements.

12. Communications and Support

If you contact us, we may collect:

• your name;
• email address;
• telephone number;
• the contents of your communication;
• support information;
• screenshots, diagnostic information or files you choose to provide;
• information required to investigate and resolve your request.

We may retain communications where reasonably necessary to provide support, maintain records and improve our services.

13. How We Use Your Information

We may use personal information to:

• create and manage your Thrive account;
• connect and synchronise compatible devices;
• display your health and wellness information;
• calculate personalised baselines;
• provide trends, correlations and insights;
• provide Ask Thrive functionality;
• record and display workouts;
• provide nutrition functionality;
• store records you choose to upload;
• operate the My Health portal;
• provide customer support;
• process orders and payments;
• communicate important service information;
• maintain security;
• prevent misuse or fraud;
• diagnose technical problems;
• improve app and device reliability;
• understand how Thrive features are used;
• develop and improve Thrive products and services;
• comply with legal obligations;
• protect our rights and the rights and safety of users;
• provide marketing communications where you have consented or where otherwise permitted by law.

We will not use sensitive health information or precise location information for unrelated advertising purposes.

14. Consent and Permissions

Some Thrive features require access to sensitive information or capabilities on your device.

Depending on the feature, we may ask for permission to access:

• Bluetooth or Nearby Devices;
• location;
• camera;
• photo library;
• files or documents;
• notifications;
• health platform information;
• motion or activity information.

The permission request presented by your operating system allows you to decide whether to provide that access.

You can change permissions through your device settings.

Disabling a permission may prevent the associated feature from functioning.

Where we collect sensitive health information, we do so with your consent or where otherwise permitted by applicable law.

15. When We Share Information

We may disclose personal information to service providers who assist us in operating Thrive.

These may include providers of:

• cloud infrastructure;
• database services;
• authentication services;
• app hosting;
• artificial intelligence processing;
• analytics;
• communications;
• customer support;
• application monitoring;
• payment processing;
• order fulfilment;
• website hosting;
• security services.

We require service providers to handle information only for authorised purposes and subject to appropriate confidentiality, privacy and security requirements.

We may also disclose information:

• where you request or authorise us to do so;
• to an organisation providing Thrive to you where you have expressly agreed to that sharing;
• to professional advisers such as lawyers, accountants or auditors;
• where required or authorised by law;
• to respond to lawful requests from government, regulatory or law enforcement authorities;
• where reasonably necessary to protect a person from a serious threat to health or safety where permitted by law;
• in connection with a corporate restructure, merger, acquisition, financing or sale, subject to appropriate confidentiality protections.

We do not sell health information or precise location information.

16. Employer, Gym, Clinic and Partner Programs

You may receive access to Thrive through an employer, gym, health provider, research organisation or other participating organisation.

Your personal Thrive information remains subject to this Privacy Policy.

We do not automatically provide an organisation with unrestricted access to your identifiable personal health information merely because that organisation supplied or funded your Thrive access.

Where a feature allows information to be shared with another organisation, coach, clinician or authorised person, the information available to that person will depend on the applicable program, permissions, consent and access controls.

Where aggregated or de-identified information is provided to an organisation, we take reasonable steps to prevent that information from identifying an individual.

Additional privacy notices or consent terms may apply to a specific program.

17. Third-Party Integrations

Thrive may allow you to connect third-party services, applications, devices or health platforms.

If you choose to connect another service, information may be transferred between Thrive and that service according to the permissions you provide.

Third-party services have their own privacy practices and policies.

We recommend reviewing their privacy information before authorising a connection.

You may disconnect supported integrations through Thrive or through the relevant third-party service.

18. International Processing and Overseas Recipients

Some technology and service providers used by Thrive may process or store information outside Australia.

Depending on the service being used, overseas processing may include the United States and other countries in which our service providers operate.

Where personal information is disclosed to an overseas recipient, we take reasonable steps appropriate to the circumstances to ensure that information is handled consistently with applicable Australian privacy requirements.

Privacy and data protection laws in another country may differ from Australian law.

19. Security

We use reasonable technical, administrative and organisational measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

These measures may include:

• encryption of information in transit;
• encryption of stored information where appropriate;
• authentication controls;
• role-based access;
• restricted administrative access;
• secure cloud infrastructure;
• logging and monitoring;
• software security controls;
• access management procedures;
• backup and recovery processes.

No internet-connected system can guarantee absolute security.

If we become aware of a data breach, we will investigate and respond in accordance with applicable law, including Australia’s Notifiable Data Breaches scheme where applicable.

20. Data Retention

We retain personal information only for as long as reasonably necessary for:

• providing Thrive services;
• maintaining your account;
• maintaining information you have chosen to store;
• providing support;
• meeting contractual obligations;
• maintaining appropriate business and transaction records;
• security and fraud prevention;
• resolving disputes;
• meeting legal, tax, accounting or regulatory requirements.

Health and wellness information associated with an active Thrive account may generally be retained while the account remains active so that historical trends, baselines and insights can be provided.

If you delete specific information, delete your account or request deletion, we will delete or de-identify information that is no longer required, subject to information we are required or permitted to retain.

Information may remain temporarily within secure backups after deletion from active systems until those backups are overwritten or expire through normal backup processes.

Transaction, financial or business records may be retained for longer periods where required by law.

21. Account and Data Deletion

You may request deletion of your Thrive account and associated personal information.

Where an account deletion function is available within Thrive, you can use that function to submit your request.

You may also request account or personal information deletion by contacting:

support@optihealthgroup.com

When an account deletion request is completed, we will delete or de-identify personal information associated with the account unless we are required or permitted to retain particular information by law or for legitimate legal, security, dispute-resolution or record-keeping purposes.

Deleting the Thrive application from your phone does not by itself delete your Thrive account or information stored in our systems.

Where technically possible, users may also delete individual records or information without deleting their entire account.

22. Accessing and Correcting Your Information

You may access much of your personal information directly through Thrive.

You may request access to other personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests can be sent to:

support@optihealthgroup.com

We may need to verify your identity before providing access to, correcting or deleting personal information.

In some circumstances, applicable law may allow or require us to refuse access or correction. If this occurs, we will provide an explanation where required.

23. Marketing Communications

We may send information about Thrive products, services, features or offers where you have agreed to receive those communications or where permitted by law.

You can unsubscribe from marketing emails using the unsubscribe link contained in the message or by contacting us.

Service communications, security notifications and important account information are not marketing communications and may still be sent where necessary to operate your account.

24. De-identified and Aggregated Information

We may create aggregated or de-identified information from information collected through Thrive.

Where information has been appropriately de-identified so that it is no longer reasonably capable of identifying you, we may use it for purposes including:

• product improvement;
• service analytics;
• research;
• system performance;
• development of health and wellness insights;
• understanding population-level trends.

We take reasonable steps designed to prevent de-identified information from being re-associated with an identifiable individual where it is used in this manner.

25. Research

From time to time, Optihealth may participate in research, validation or product evaluation activities.

Identifiable health information will not be provided for unrelated research merely because you use Thrive.

Where a research activity requires information beyond ordinary operation of the Thrive service, additional consent, participant information or ethics requirements may apply.

26. Links to Other Websites and Services

Thrive may contain links to third-party websites or services.

We are not responsible for the privacy practices of third-party websites or services that we do not control.

You should review the privacy policy of any external service before providing personal information.

27. Changes to this Privacy Policy

We may update this Privacy Policy as Thrive develops, when our information practices change or when legal or regulatory requirements change.

The current version will be published at:

https://www.thrivehealthband.com/privacy

The effective date shown at the top of this policy indicates when it was last materially updated.

Where a change materially affects how we handle sensitive personal information, we may provide additional notice through the Thrive app, website or other appropriate communication.

28. Privacy Questions and Complaints

If you have questions, concerns or complaints about privacy or the way we handle personal information, please contact:

Optihealth Group
Email: support@optihealthgroup.com
Website: https://www.thrivehealthband.com

Please include sufficient information for us to understand and investigate your request.

We will review privacy complaints and respond within a reasonable period.

If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner (OAIC) or another applicable privacy regulator.

29. Governing Privacy Framework

For users in Australia, this Privacy Policy is intended to operate consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Users outside Australia may also have rights under privacy and data protection laws applicable in their jurisdiction.

Nothing in this Privacy Policy limits rights that cannot lawfully be excluded.