Privacy policy

1. Who we are

This website is operated by Oxivity Wellness Pty Ltd, ACN 703 162 985, ABN 35 703 162 985, trading as Oxivity ("Oxivity", "we", "us"), from Australia. In this policy, "personal information" has the meaning given to it in the Privacy Act 1988 (Cth), and should be read as including "personal data" under United Arab Emirates law and "personal information" as defined by the applicable United States state privacy laws.

Contact for privacy matters: hello@oxivitywellness.com.au.

2. What we collect

• Information you give us. Your name, email address, phone number, business or clinic name, the setting you operate in, the chamber you're interested in, details about your room or space, and anything else you write in a message or booking note.
• Booking details. The date and time you select, and any notes for the call.
• Marketing preference. Whether you opted in to receive updates.
• Technical information. Your IP address, browser user-agent string and the page you submitted from. We keep this to detect and block spam and abuse.

We do not ask for, and ask that you do not send us, health information, medical history or details of any medical condition. If you send it anyway we will delete it once your enquiry is resolved.

We do not collect payment card details through this website.

3. Why we collect it

• To answer your enquiry and give you a useful recommendation.
• To arrange, confirm and reschedule walkthroughs.
• To quote, supply, deliver, install and support equipment if you go ahead.
• To keep records of enquiries and bookings for our own business administration.
• To send you marketing updates, but only if you opted in.
• To protect the site from spam, abuse and fraud.

If you don't give us your name and email we can't respond to you, which is the only consequence of not providing it.

4. Collection notice

Each of our forms carries a short notice at the point of collection telling you what we're collecting and why, and linking here. Submitting a form is how you consent to that collection.

5. How we hold it

Enquiry and booking records are stored on our website hosting in a database that is not publicly accessible, and are also emailed to our own oxivitywellness.com.au mailbox. Access to the administration area is restricted to authorised Oxivity personnel and protected by a password.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure — including HTTPS on every page, restricted file permissions and rate limiting on forms. No system is perfectly secure, and we cannot guarantee the security of information transmitted over the internet.

6. Who we disclose it to

• Our hosting provider, which stores the site and its database on our behalf.
• Our email provider, which delivers notification and confirmation emails.
• Our customer relationship management system. We use HubSpot to manage enquiries. Where enabled, your name, contact details and what you told us are transferred to HubSpot, which stores data on servers that may be located in the United States or the European Union.
• Freight, delivery and installation partners, but only where you have ordered equipment and only to the extent needed to deliver and install it.
• Professional advisers, insurers and regulators, where we are required or permitted by law.

We do not sell, rent or trade personal information, and we do not disclose it to third parties for their own marketing.

7. Overseas disclosure and cross-border transfer

Some of the service providers above store data outside Australia — principally the United States and the European Union. Where we disclose personal information overseas we take reasonable steps to ensure the recipient handles it consistently with this policy and with Australian Privacy Principle 8.

Transfers into Australia. Oxivity is operated from Australia. If you contact us from the United States or the United Arab Emirates, your information is transferred to and stored in Australia, and is handled under this policy and Australian law. Australia is not the subject of an adequacy decision under every overseas regime, so where a transfer mechanism or your explicit consent is required by the law that applies to you, submitting a form to us is how you provide it. You can withdraw that consent at any time by emailing us, though we may then be unable to continue dealing with your enquiry.

8. Marketing and the Spam Act

We only send marketing emails to people who have opted in. Every marketing email identifies Oxivity, gives our contact details and includes a functional unsubscribe link. Unsubscribe requests are actioned within five business days, and the unsubscribe link keeps working for at least thirty days after the message is sent. This is required by the Spam Act 2003 (Cth) and we treat it as a floor, not a target.

Answering your enquiry is not marketing — we will always reply to you even if you don't opt in.

Marketing email to recipients in the United States is also sent in line with the CAN-SPAM Act: accurate sender and subject lines, a valid physical postal address in every commercial message, a working opt-out, and opt-outs actioned within ten business days. Marketing to recipients in the United Arab Emirates is sent on an opt-in basis only.

9. Cookies and analytics

This site uses one session cookie, which exists to protect our forms against cross-site request forgery. It is essential to the operation of the site and carries no tracking identifier.

We do not currently run third-party advertising or analytics cookies. If that changes we will update this policy and add a consent mechanism before any non-essential cookie is set.

10. How long we keep it

We keep enquiry and booking records for as long as needed to answer you, supply and support equipment, and meet our legal and tax record-keeping obligations — generally seven years for transaction records. Records that don't lead anywhere are deleted or de-identified when they are no longer needed.

11. Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@oxivitywellness.com.au. We will respond within a reasonable period — normally within thirty days — and we may need to verify your identity first. There is no charge to make a request.

12. Complaints

If you think we have mishandled your personal information, email hello@oxivitywellness.com.au with the details. We will acknowledge your complaint and aim to resolve it within thirty days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the United States, you may complain to your state Attorney General, or in California to the California Privacy Protection Agency. In the United Arab Emirates, you may complain to the UAE Data Office. In New Zealand, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

13. New Zealand visitors

Where the Privacy Act 2020 (NZ) applies to our handling of your information, we comply with the Information Privacy Principles. In particular we collect only what we need for a lawful purpose connected with our business, tell you at the point of collection why we're collecting it and who will hold it, keep it secure, and use and disclose it only for the purpose we collected it for. You have the same rights of access and correction described in section 11.

14. United States visitors

Oxivity supplies equipment in the United States from Miami. This site is operated from Australia and your information is transferred to Australia as described in section 7.

Which US privacy laws apply to us. The state privacy laws — including the California Consumer Privacy Act as amended by the CPRA, and the equivalent laws in Virginia, Colorado, Connecticut, Utah, Texas, Florida and other states — apply to businesses that meet revenue or volume thresholds, typically annual revenue in the tens of millions of dollars or the personal information of 100,000 or more consumers in that state. Oxivity does not currently meet those thresholds. We re-test that position as the US business grows, and we will update this policy and add the required mechanisms before we cross any of them.

The rights we give you anyway. Whether or not a statute compels us, if you are in the United States you may ask us to:

• tell you what personal information we hold about you and where we got it;
• give you a copy of it in a portable format;
• correct anything that is wrong;
• delete it, subject to records we must keep for tax, warranty and legal reasons;
• stop sending you marketing.

Email hello@oxivitywellness.com.au and we will respond within 45 days. We will not discriminate against you for exercising any of these rights.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We do not knowingly collect personal information from anyone under 16.

Sensitive information. We do not ask for health information (see section 2). If you send it anyway we delete it once your enquiry is resolved, and we never use it to infer characteristics about you.

15. United Arab Emirates and DIFC visitors

Oxivity's United Arab Emirates operation is established in the Dubai International Financial Centre (DIFC). The DIFC is a free zone with its own legal system, so the data protection law that applies there is DIFC Data Protection Law No. 5 of 2020 and its regulations, administered by the DIFC Commissioner of Data Protection — not the UAE federal regime. Where you deal with us through the DIFC entity, that law governs. Where you deal with us elsewhere in the UAE, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data may apply instead. Tell us which entity you are contracting with if you are unsure, and we will confirm it in writing.

• Lawful basis. We process your data with your consent, given when you submit a form, and where processing is necessary to take steps at your request before entering a contract and to perform that contract.
• Purpose limitation and minimisation. We use it only for the purposes in section 3, and we collect only what those purposes need.
• Your rights. Access to your data, a copy in a portable form, correction of inaccurate data, erasure, restriction of processing, objection to processing, withdrawal of consent at any time, and rights in relation to automated decision-making. We do not make automated decisions that produce legal or similarly significant effects. Email hello@oxivitywellness.com.au.
• Cross-border transfer. Your data is transferred to and stored in Australia, as described in section 7. The DIFC Commissioner maintains a list of jurisdictions recognised as providing an adequate level of protection. Where Australia is not covered by that recognition for your transfer, we rely on appropriate contractual safeguards or on your explicit consent, which you give by submitting a form and may withdraw at any time.
• Breach notification. Where a personal data breach compromises your confidentiality, security or privacy, we will notify the Commissioner without undue delay and notify you where the breach is likely to result in a high risk to your rights.

The Abu Dhabi Global Market (ADGM) operates under its own separate regulations again. If you are contracting through an ADGM entity, tell us and we will confirm which regime governs before you provide any personal data.

16. Changes to this policy

We may update this policy from time to time. The current version is always the one on this page, with the last-updated date shown above. Material changes will be flagged on the site.