1. Privacy Policy

RELUXA — Privacy Policy · Last updated: 6 August 2026

1.1 Our commitment

RELUXA sells a medical device. That means people sometimes tell us things about their health when they contact us — about a back that has been a problem for years, about a medication they are taking, about a condition they are managing. We treat that information with the seriousness it deserves.

This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with, where it goes, and what you can do about it. It is written to comply with the Privacy Act 1988 (Cth), the thirteen Australian Privacy Principles (APPs), and the Spam Act 2003 (Cth).

RELUXA is a sole trader business. Some small businesses are exempt from the Privacy Act 1988. We do not rely on that exemption. We have chosen to comply with the Australian Privacy Principles in full, and we hold ourselves accountable to them as if we were bound by them. Where this policy describes a right, you have that right with us.

1.2 Who we are

RELUXA (ABN 24 862 415 799) is an Australian business operated from Queensland. Our full contact details are in the Contact Information section of this framework.

For privacy enquiries: hello@reluxa.com.au

That address is read by the founder personally. It is not a ticket queue.

1.3 What personal information we collect

We collect only what we need to sell you a device, get it to you, support you afterwards, and run a lawful business. We do not collect information “just in case”.

Information you give us directly

Information collected automatically

Full detail on the cookies, pixels and tracking technologies we use is in our Cookie Policy.

Information from third parties

We may receive information about you from:

• Shopify, our eCommerce platform, including fraud-analysis signals and order data

• Payment providers (Shopify Payments, PayPal, Apple Pay, Google Pay, Shop Pay, UnionPay), including transaction outcomes and fraud indicators

• Delivery partners, including delivery status, delivery exceptions and address corrections

• Advertising platforms (Meta, Google), including aggregated campaign and audience data

• Publicly available sources, where we need to verify an address or investigate a suspected fraudulent order

1.4 Sensitive information and health information

This section matters more than any other in this policy, so we have set it out separately.

Under the Privacy Act 1988, health information is sensitive information and attracts a higher standard of protection.

We do not ask you for health information. Nothing in our checkout, our account creation, our newsletter signup or our website forms requests information about your health, your medical history, your medications or your conditions.

Sometimes you tell us anyway — because you are asking whether the device is suitable for you, because you have a pacemaker and want to check, because you are describing why the wrap has or has not worked for you. That is a completely reasonable thing to do, and we would rather you asked.

When you volunteer health information to us:

• We treat it as sensitive information under APP 3 and APP 6.

• We use it only to answer your specific question and to handle your order or guarantee claim. We do not use it for anything else.

• We never use health information for advertising, audience targeting, lookalike audiences, or segmentation. We do not upload it to Meta, Google, or any other advertising platform. Not in any form, including hashed or anonymised form.

• We never share it with any third party except where you have asked us to, or where we are required by law.

• We do not add it to your marketing profile. If you tell us about your condition in a support email, that does not affect what marketing you receive.

• We keep it separate and we keep it minimal. Where we no longer need it, we delete it from our correspondence records.

We cannot give you medical advice. If you ask us a clinical question, we will tell you honestly that we are not qualified to answer it and direct you to a healthcare professional. Please see our Medical Disclaimer.

If you would prefer not to give us health information at all, you do not have to. You can ask a general question without identifying your condition, and we will do our best to help.

1.5 Why we use your personal information

We use personal information for the following purposes and no others:

To sell and deliver

• Process your order, take payment, and issue a tax invoice

• Arrange manufacture, dispatch and delivery of your device

• Send transactional messages: order confirmation, dispatch notification, tracking, delivery confirmation

• Communicate with you about a delay, a stock issue, or an address problem

To support you

• Answer your enquiries and provide customer support

• Assess and process returns, refunds, guarantee claims and warranty claims

• Investigate a fault, a damaged delivery, or a lost parcel

• Maintain a record of what was said, so that we can be held to it

To run the business lawfully

• Verify orders and detect, prevent and investigate fraud, chargebacks and payment disputes

• Meet obligations under Australian taxation law, the Corporations Act, consumer law and therapeutic goods law

• Maintain records required for post-market surveillance and adverse event reporting in relation to a medical device

• Establish, exercise or defend a legal claim

• Respond to a lawful request from a regulator, court or law enforcement agency

To improve

• Understand how our website is used and improve it

• Analyse aggregated sales and product performance data

• Improve the product, the instructions for use, and our support

To market — only with your consent

• Send you our email newsletter, where you have subscribed

• Show you advertising on Meta and Google platforms

• Measure whether our advertising is working

Our marketing practices are set out in full in section 1.8.

1.6 Who we share your information with

We do not sell your personal information. We have never done so and we will not do so. We do not trade, rent, or licence customer lists.

We share personal information only with the following categories of recipient, and only to the extent they need it:

Where we engage a service provider, we require them to use your information only for the purpose we engaged them for, to keep it secure, and not to disclose it further.

1.7 Overseas disclosure (APP 8)

Some of the recipients listed above are located outside Australia. This is unavoidable for a modern eCommerce business: our platform, our email system, and our advertising platforms are all operated by overseas companies.

The countries in which your personal information is likely to be held or accessed are:

• United States — Shopify, Klaviyo, Meta, Google, PayPal, Apple

• Canada — Shopify

• Ireland and the European Union — Meta

• Singapore — PayPal

• People’s Republic of China — our manufacturing partner, for the limited purpose of manufacturing and dispatch

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, including by:

• selecting established providers with published privacy and security commitments;

• relying on the contractual data protection terms those providers offer, including standard contractual clauses and data processing addenda where available; and

• limiting what we disclose to what the recipient actually needs.

What you should understand: once information is held overseas, Australian privacy law may not apply to it in the same way, and you may not be able to seek redress under the Privacy Act 1988 against that overseas recipient. By placing an order or using our website, you acknowledge this. We have set it out plainly rather than burying it, because you are entitled to know.

We do not disclose health information overseas. Health information that you volunteer to us stays in our correspondence records and is not transferred to advertising or marketing platforms in any jurisdiction.

1.8 Direct marketing and the Spam Act

We take the Spam Act 2003 (Cth) seriously, and our marketing is deliberately restrained.

Consent. We send marketing email only where you have given us express consent — by subscribing to our email list, or by ticking a marketing opt-in at checkout. We keep a record of when and how you consented.

Inferred consent. Where you have purchased from us, we may treat you as having inferred consent to receive occasional email about your product, related products and important updates, as permitted by the Spam Act. You can opt out at any time and we will stop.

What we send. Approximately one email per month, and only when something has actually changed. We do not run countdown timers, fabricated scarcity, or artificial urgency in our email marketing.

Identification. Every commercial electronic message we send clearly identifies RELUXA as the sender and includes our contact details.

Unsubscribe. Every marketing email contains a functional unsubscribe link. Unsubscribing is free, takes effect within five business days at the outside (usually immediately), and requires nothing of you beyond one click. You can also simply reply to any email and ask.

Transactional messages are different. Order confirmations, dispatch notifications, tracking updates, delivery notices, refund confirmations, safety notices and product recall notices are not marketing. We will continue to send these even if you have unsubscribed from marketing, because we are required to and because you need them.

Advertising. We advertise on Meta and Google platforms. This may involve showing advertisements to you based on your prior visits to our website, or to people with characteristics similar to our customers. You can control this through:

• Meta: Settings → Ads → Ad Preferences

• Google: myadcenter.google.com

• Your browser and device advertising settings

• Our Cookie Policy, which explains how to limit tracking on our site

We never use health information for advertising. See section 1.4.

1.9 Data security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

What we do:

• Our website runs over HTTPS with TLS encryption on every page, including checkout

• Payment card data is processed by PCI DSS compliant payment providers and is never stored on RELUXA’s own systems. We can see the card type and the last four digits. We cannot see the full number

• Access to customer data is limited to the founder and, where operationally necessary, our fulfilment contact — and then only to the data required for that task

• Accounts protecting customer data use strong, unique passwords and multi-factor authentication where available

• We keep only the personal information we still need, and we destroy or de-identify the rest

What we cannot promise: no method of electronic transmission or storage is completely secure. We cannot and do not guarantee absolute security, and we do not ask you to rely on such a guarantee. What we can promise is that we take security seriously and that we will tell you promptly if something goes wrong.

If your account is compromised, tell us immediately at hello@reluxa.com.au. You are responsible for keeping your account password confidential — see our Terms of Service.

1.10 Data breach notification

We comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988.

If we become aware of an actual or suspected data breach, we will:

1. Contain it immediately and take steps to prevent further compromise

2. Assess it within 30 days to determine whether it is likely to result in serious harm

3. Notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable if serious harm is likely, telling you what happened, what information was involved, and what you should do

4. Review what went wrong and change what needs changing

We will notify you directly by email. We will not quietly bury a breach in a website update.

1.11 How long we keep your information

We keep personal information only as long as we need it:

When a retention period ends, we securely destroy or de-identify the information.

1.12 Your rights

Access (APP 12). You can ask us for a copy of the personal information we hold about you. We will respond within 30 days. We do not charge for a reasonable request. In the rare case where a request is complex or repetitive and involves real cost, we will tell you the cost before we do the work — and it will never be a fee simply for making the request.

Correction (APP 13). If information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will correct it. If we disagree, we will tell you why in writing, and you can ask us to attach a statement noting your position.

Deletion. You can ask us to delete your personal information. We will do so unless we are legally required to keep it — for example, transaction records we must retain for tax purposes, or medical device traceability records. We will tell you exactly what we have deleted and what we must keep, and why.

Opting out of marketing. Immediate, one click, no questions.

Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. This does not affect anything we lawfully did before you withdrew it.

Anonymity and pseudonymity (APP 2). You can browse our website without identifying yourself. You can make a general enquiry without giving us your real name. You cannot, realistically, buy and receive a physical device anonymously — we need a name and an address to deliver it.

Complaints. See section 1.13.

To exercise any of these rights, email hello@reluxa.com.au. We may need to verify your identity before we act, to make sure we are not disclosing your information to someone else.

1.13 Complaints

If you think we have mishandled your personal information or breached the Australian Privacy Principles, we want to hear about it directly first.

Step 1 — Tell us. Email hello@reluxa.com.au with “Privacy Complaint” in the subject line and describe what happened. We will acknowledge within 5 business days and give you a substantive response within 30 days.

Step 2 — If you are not satisfied, you can complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au

• Phone: 1300 363 992

• Post: GPO Box 5218, Sydney NSW 2001

You can also contact the Queensland Office of Fair Trading regarding consumer matters, or the ACCC. Nothing in this policy prevents you from doing so, and you do not need our permission.

1.14 Children

Our products and website are intended for adults. We do not knowingly collect personal information from anyone under 18. If you are under 18, please do not create an account or purchase from us without a parent or guardian.

If we become aware that we hold personal information about a person under 18 collected without appropriate consent, we will delete it. If you believe this has happened, contact us.

1.15 Third-party websites

Our website may link to third-party sites, including social media platforms, payment providers and the Australian Register of Therapeutic Goods. Those sites have their own privacy policies and we are not responsible for their practices. We encourage you to read them.

1.16 Changes to this policy

We may update this policy as our business, our systems or the law changes. The “Last updated” date at the top will always tell you when it last changed.

If we make a change that materially affects how we handle your personal information, we will notify you by email (if you are a subscriber or customer) or by prominent notice on our website before the change takes effect. Continuing to use our website or purchase from us after that point means you accept the updated policy.

We keep prior versions and will provide one on request.

Pages visited, time spent on site, clicks and interactions

• Cookies and similar tracking technologies

Information from third parties:

• Payment processors (Shopify Payments, PayPal)

• Marketing platforms (Meta/Facebook, Klaviyo)

• Shipping and fulfilment partners

How We Use Your Information

We use your personal information to:

• Process and fulfil your orders

• Send order confirmation, shipping and tracking notifications

• Provide customer support

• Send marketing emails (you can unsubscribe at any time)

• Show you relevant advertising on Meta and other platforms

• Detect and prevent fraud

• Improve our website and products

• Comply with legal obligations

We will never sell your personal information to third parties.

Who We Share Your Information With

• Shopify — our store platform, which processes payments and hosts our website

• PayPal — for payment processing

• Klaviyo — for email marketing

• Meta (Facebook/Instagram) — for advertising

• Fulfilment and shipping partners — to deliver your order

• Law enforcement or regulators — where required by Australian law

All third parties we work with are required to handle your information securely and in accordance with applicable privacy laws.

Cookies

Our website uses cookies to improve your browsing experience, remember your preferences, and show you relevant advertising. You can control cookies through your browser settings. Disabling cookies may affect some features of our website.

Marketing Communications

If you opt in to marketing, we may send you emails about new products, promotions and recovery tips. You can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us at hello@reluxa.com.au.

Your Rights Under Australian Privacy Law

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you

• Request correction of inaccurate information

• Request deletion of your personal information (subject to legal obligations)

• Opt out of marketing communications at any time

• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, contact us at hello@reluxa.com.au and we will respond within a reasonable timeframe.

Data Security

We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification or disclosure. Our store is hosted by Shopify, which maintains industry-standard security measures including SSL encryption.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability.

Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, comply with legal obligations, resolve disputes and enforce our agreements. If you would like your data deleted, contact us at hello@reluxa.com.au.

International Data Transfers

As we use platforms including Shopify, Klaviyo and Meta, your data may be processed and stored outside Australia. We only use services that maintain appropriate data protection standards.

Children's Privacy

Our store is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with their information, contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Your continued use of our website after changes are posted constitutes acceptance of the updated policy.

Contact Us

RELUXA Email: hello@reluxa.com.au ABN: 24 862 415 799 Parcel Locker 1016033362, Shop 4, 3732–3744 Mount Lindesay Hwy, Park Ridge QLD 4125, Australia