Privacy

‍1. Who we are
‍Breathstate Pty Ltd (ABN 14 688 108 205, ACN 688 108 205) is the operator of the Breathstate platform, mobile and web application, and admin dashboard (together, the "Service").

Our registered office is c/- BBB Partners, Floor 8, 60 Albert Rd, South Melbourne VIC 3205, Australia. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Because we collect and handle health information, the small-business exemption in the Privacy Act does not apply to us — the full Privacy Act applies regardless of our annual turnover.

‍2. Scope of this policy
‍This policy applies to personal information we collect, hold, use and disclose in connection with the Service, including: employees of organisations that subscribe to the Service who use the Breathstate app; authorised representatives of those organisations who use the admin dashboard; prospects and visitors to our website; and anyone who contacts us directly. This policy does not apply to third-party services that link to or from the Service.

‍3. What personal information we collect
‍We collect only what is reasonably necessary to provide the Service.

Account information:
Your work email address (used for authentication), your organisation, and a system-generated user identifier. We do not require your full name, date of birth, residential address, government identifiers, or financial information.
‍
Health information:
Mood selections you make in the app (one of 8 categorical states such as Calm, Stressed, Focused), session activity (which sessions you started, completed, or skipped), and timestamp data. Mood and mental health information is sensitive information under the Privacy Act.

Technical information:
Device type, operating system, app version, IP address (for security and abuse prevention), and crash diagnostics.

Communications:
Any information you provide when you contact hello@breathstate.co, including the content of your message.

‍4. What we do not collect
‍We deliberately do not collect: free-text mood notes; voice recordings; biometric data; location data beyond country-level; employee-identifying personal information beyond your work email and organisation; data from any sensor or microphone on your device; or content from any other application on your device. The Service is designed so that the minimum necessary information is collected to deliver the breathwork experience and aggregate-level reporting.

‍5. How we collect personal information
‍We collect personal information directly from you when you create an account, use the app, contact us, or when your organisation provisions your account. We do not collect personal information from third parties unless authorised by you or required by law.

‍6. Why we collect and use personal information
‍We collect, hold, use and disclose personal information for the following purposes: to provide the Service to you and your organisation; to authenticate your account and maintain platform security; to generate aggregated, de-identified workforce mental health reporting; to improve the Service through diagnostics and product analytics; to communicate with you about your account, security matters, or material changes to the Service; and to comply with our legal obligations. We will not use your personal information for any secondary purpose unless that purpose is related to the primary purpose and you would reasonably expect us to do so, or you have consented.

‍7. What your employer sees — and does not see
‍Your employer will never see: your individual mood selections, your individual session activity, your name in connection with any mental health data, or any information that could reasonably identify you.Your employer will only ever see: aggregated, de-identified information across groups of 5 or more users — for example, the overall Mental Health Index score, total session minutes across the workforce, or the proportion of users selecting each mood state. If a team or cohort has fewer than 5 active users, that group's data is rolled up into a larger aggregate to prevent re-identification. This is what we mean by "de-identified by architecture" — the protection is built into the platform itself, not just policy.

‍8. Where we store your information and how we protect it
‍All personal information is stored on Google Cloud Platform infrastructure in the australia-southeast2 region (Melbourne, Australia). Personal information is not transferred outside Australia in the ordinary course of providing the Service. We protect personal information through: encryption in transit (TLS 1.2 or higher) and at rest (AES-256); role-based access controls limiting employee access on a need-to-know basis; multi-factor authentication for all administrative access; regular security reviews and patching; and logging of administrative actions. No method of internet transmission or electronic storage is 100% secure, but we comply with our obligations to take reasonable steps.

‍9. Who we share your information with
‍We disclose personal information only to: Google LLC (our cloud hosting provider, with data held in Australia); authorised Breathstate employees and contractors under confidentiality obligations; your employer, but only in the de-identified, aggregated form described in section 7; regulators, law enforcement, or courts where required by law; and any successor entity in connection with a sale, merger, or change of control of Breathstate, subject to that entity agreeing to be bound by this policy. We do not sell your personal information. We do not use your personal information for advertising or marketing to other organisations.

‍10. Cross-border data flows
‍Your personal information is held in Australia. Google LLC, the parent company of our cloud provider, is headquartered in the United States. Although we do not transfer personal information to the United States, Google staff outside Australia may in limited circumstances have access to systems on which personal information is stored — for example, for emergency support or to comply with valid legal process. We have taken reasonable steps to ensure such access is consistent with the Australian Privacy Principles.

‍11. Automated decisions
‍Breathstate computes a workforce-level Mental Health Index score from aggregated mood, engagement, and session data. This score operates only at the workforce-aggregate level. It does not make decisions about individual employees, and the Service does not use personal information to make or directly support a decision that could significantly affect an individual's rights or interests.

‍12. How long we keep your information
‍We retain personal information only for as long as is necessary to provide the Service or comply with legal obligations. When you delete your account, or when your organisation's subscription ends, we will delete or de-identify your personal information within 90 days, except where we are required to retain certain records under Australian law. Aggregated, de-identified data may be retained indefinitely as it is no longer personal information once de-identification is complete.

‍13. Your rights
‍Under the Privacy Act, you have the right to:

Access — request a copy of the personal information we hold about you.
Correction — request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading.
Deletion — delete your account and have associated personal information deleted within the timeframe in section 12.
Anonymity — use the Service pseudonymously where practicable.
Complaint — make a complaint about how we handle your personal information.

To exercise any of these rights, email hello@breathstate.co. We will respond within 30 days at no charge. We may need to verify your identity before actioning your request.

‍14. Data breach notification
‍We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we experience a data breach likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable.

‍15. How to make a complaint
‍If you believe we have mishandled your personal information, please email hello@breathstate.co with details of your concern. We will acknowledge your complaint within 7 days and respond substantively within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

Phone 1300 363 992 · Web oaic.gov.au · Mail GPO Box 5288, Sydney NSW 2001.

‍16. Contact us
‍hello@breathstate.co
breathstate.co

Breathstate Pty Ltd
c/- BBB Partners
Floor 8, 60 Albert Rd,
South Melbourne VIC 3205,
Australia.

‍17. Changes to this policy
‍We may update this policy from time to time. Material changes will be communicated to active users by email and posted at breathstate.co/privacy.

Continued use of the Service after a change indicates acceptance of the updated policy.

Version 1.0 · April 2026