Privacy Policy

This Privacy Policy explains how N1Labz Pty Ltd (ABN 28 702 164 154), postal address PO Box 1193, Osborne Park DC WA 6916, Australia, the operator of the N1Labz platform ("we", "us", "our", the "Platform"), collects, uses, discloses, and protects your personal information, including sensitive health information. We are committed to handling your information in accordance with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles ("APPs"), and applicable State and Territory health records legislation. By using the Platform, you consent to the practices described in this Policy.

Our purpose is to help you understand your own health data. We exist to improve your life, not to invade it. We do not sell your personal information or your health information, and we do not use your health information for third-party advertising.

This Policy does not cover the practices of organizations we do not own or control. Third-Party Providers (such as clinicians, pharmacies, and laboratories) and connected device or app providers handle your information under their own privacy policies, and we are not responsible for their practices.

1. How We Collect Personal Information

We collect personal information:

• From you directly — when you register, complete an intake or questionnaire, upload results or photos, place an order, book a consultation, or contact support;
• From devices and services you connect — wearables, continuous glucose monitors, blood pressure monitors, health data aggregators, and similar Connected Services you authorize (see section 5);
• Automatically as you use the Platform — through cookies, local storage, and similar technologies, and through server and application logs;
• From Third-Party Providers involved in your care — such as laboratories returning results, clinicians recording consultation notes, and pharmacies recording dispensing, where you have consented or where permitted by law;
• From our AI and analysis features — including the content of your interactions with any assistant or coaching feature;
• From linked sign-in accounts — where you sign in using Google or Apple, we receive basic account identifiers from them;
• From payment providers — transaction status and limited billing details, though we never receive your full card number.

2. Information We Collect

• Identity and contact data: name, email address, phone number, postal and delivery address, and date of birth.
• Account data: login credentials, authentication identifiers (including via Google or Apple sign-in), roles and permissions, and account status.
• Profile and physiological profile data: sex at birth, reproductive life stage, height, weight, BMI, time zone, activity level, and areas of health interest.
• Sensitive health information: intake responses, medical history and diagnosed conditions, medications and supplements, allergies and adverse reactions, family history, lab and pathology results, biomarker values, genomic/DNA data, microbiome results, imaging and scan records, body and skin imagery, and clinical notes from consultations.
• Wellness and wearable data: physiological metrics such as resting heart rate, heart rate variability, respiratory rate, blood oxygen saturation, skin temperature, blood pressure, and glucose; sleep stages and duration; workout and activity metadata; strain, recovery, and readiness indicators; steps and energy expenditure.
• Diet and lifestyle data: food and beverage logs, nutrient intake, alcohol and smoking status, and meal plan selections.
• Identity verification data: verification status and session identifiers where a regulated service requires you to verify your identity (verification is performed by a specialist provider, not by us).
• Transactional data: orders, subscriptions, bookings, invoices, fulfilment and delivery records, and payment status (payments are processed by third-party providers).
• Communications: emails, support messages, in-app messages, and consultation correspondence exchanged with us.
• AI interaction data: the prompts, questions, and conversations you have with any assistant, coaching, or analysis feature, and the outputs generated.
• Marketing data: your communication preferences and how you engage with our messages (for example whether an email was opened or a link clicked).
• Device and technical data: device type, operating system, browser, IP address, unique identifiers, language settings, and approximate location derived from IP address (such as city or region).
• Usage data: pages and screens viewed, features used, access times, navigation paths, and error and diagnostic logs.

Some information is optional. If you choose not to provide it, some features may be unavailable — for example, a clinician may be unable to assess a request without a completed intake.

3. Why We Collect and Use Your Information

We collect, hold, use, and disclose your information to:

• provide, operate, personalize, secure, and improve the Platform and its features;
• facilitate connections with Third-Party Providers and enable the services you request, including consultations, prescriptions, dispensing, pathology, and deliveries;
• generate analyses, metrics, trends, and recommendations (which are informational only);
• ingest, normalize, and reconcile data from Connected Services and laboratories;
• process payments, orders, subscriptions, bookings, and fulfilment, and issue invoices and refunds;
• communicate with you, including service messages, appointment and medication reminders, and responses to your enquiries;
• verify identity and eligibility where a regulated product or service requires it;
• maintain safety and security, detect and prevent fraud, misuse, and abuse, and enforce our terms;
• comply with legal, regulatory, professional, and record-keeping obligations, including health-records retention;
• conduct internal quality assurance and product development, using de-identified or aggregated information wherever practicable.

We collect sensitive health information only where you have consented or where the collection is otherwise permitted or required by law, and we use it only for the purposes for which it was collected or directly related purposes you would reasonably expect. We will obtain your consent before using health information for marketing, and you can withdraw that consent at any time.

4. Automated Analysis and AI Features

We use algorithms, statistical models, and artificial intelligence to organize your data and generate summaries, insights, and suggestions, and to power conversational features. To do this, relevant portions of your data may be processed by our AI service providers under contractual confidentiality and security obligations. We do not permit those providers to use your information to train their own general-purpose models. Outputs are generated automatically, may be incorrect, and are informational only — they are not medical advice or a diagnosis. No decision that affects your access to care is made solely by automated means without a person involved.

5. Connected Devices and Apps

If you connect a device or app, such as Garmin, WHOOP, Oura, Apple Health, Google Health Connect, Fitbit, or Withings, we receive data from that account after you authorize the connection on the provider's own consent screen. Depending on the permissions you grant, this may include activity and workouts, steps, heart rate and heart rate variability, stress and recovery, sleep, body composition, blood oxygen, respiration, temperature, nutrition logs, and menstrual cycle tracking data.

We treat data from every connected device and app the same way, and use it only to:

• show you your own data and trends in the Platform;
• combine it with your test results and other information in your health record to personalize your nutrition, sleep, training and supplement suggestions;
• select the reference ranges that apply to you;
• share it with a clinician involved in your care, where you choose to do so.

We do not sell data from connected devices and apps, disclose it to advertisers or data brokers, or use it to train artificial intelligence models. We do not disclose it to anyone other than you, clinicians you choose to share it with, and service providers who process it on our behalf under section 6.

Where we display data from a connected device or app, or insights derived from it, we identify the provider it came from.

You can disconnect a device or app at any time in the Platform or in that provider's own account settings, and we then stop receiving new data from it. Each provider handles your data in its own service under its own privacy policy.

6. Disclosure of Information

We may disclose your information to:

• Third-Party Providers — clinicians, pharmacies, pathology and compounding services, meal and supplement suppliers, delivery partners amongst others — to deliver the services you request, limited to what they need;
• Service providers and contractors who support the Platform, including hosting and infrastructure, database and storage, email and messaging, video consultation, analytics, AI processing, identity verification, and payment processing, under appropriate confidentiality and security obligations;
• Connected Service providers, to the extent needed to establish and maintain a connection you have authorized;
• Professional advisers, insurers, and auditors, where reasonably necessary;
• Authorities, regulators, courts, or other parties where required or authorized by law, or to establish, exercise, or defend legal rights, or to protect the safety of any person;
• A successor entity in connection with a merger, acquisition, reorganization, or sale of assets, subject to this Policy continuing to apply.

We do not sell your personal information or health information, and we do not disclose it to advertising networks or data brokers. Third-Party Providers act as independent controllers of the information they receive and handle it under their own privacy obligations.

7. De-identified and Aggregated Information

We may create de-identified and aggregated information from your data — for example population statistics, reference distributions, and cohort comparisons — and use or disclose it for benchmarking, safety, and product improvement. We take reasonable steps to ensure such information cannot reasonably be re-identified, and we do not attempt to re-identify it.

8. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to operate, secure, and analyze the Platform. These fall into the following categories:

• Essential — required to sign you in, keep your session secure, and deliver core features. These cannot be switched off in the Platform.
• Functional — remember your settings and preferences, such as your selected view or region.
• Performance and analytics — help us understand how the Platform is used so we can fix problems and improve it.
• Marketing — used only where we run campaigns, to measure their effectiveness. We do not use health information for this purpose.

You can control cookies through your browser settings, though disabling them may affect functionality. Some browsers offer a "Do Not Track" signal; there is no common standard for responding to it, so we do not currently respond to it.

9. Overseas Disclosure

Some of our service providers store or process information outside Australia, including in the United States and the European Union. Where this occurs, we take reasonable steps to ensure recipients handle your information consistently with the APPs, including through contractual protections, recognizing that overseas recipients may be subject to different legal regimes and that we may not be able to control their acts in every case.

10. Data Security

We take reasonable technical and organizational measures to protect your information from misuse, interference, loss, and unauthorized access, modification, or disclosure. These include encryption of data in transit, encryption of sensitive credentials at rest, role-based access controls and row-level access rules so members can only see their own records, authentication controls, audit logging of sensitive actions, and restricting staff and contractor access to those who need it. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. To the maximum extent permitted by law, you acknowledge that you provide your information at your own risk.

Data breaches. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

11. Retention and Deletion

We retain your information for as long as necessary to provide the Platform, to comply with our legal and record-keeping obligations, to resolve disputes, and to enforce our agreements. Health records connected to clinical care, prescriptions, dispensing, and pathology are subject to minimum retention periods under Australian law — generally at least seven years from the last entry, or until a young person turns 25 — and cannot be deleted on request before that period ends. Financial and tax records are retained as required by law.

You may close your account by contacting hello@n1labz.com. When information is no longer required and no retention obligation applies, we take reasonable steps to de-identify or securely destroy it. Backups are cycled on a rolling basis, so residual copies may persist for a limited period after deletion.

12. Access, Correction and Your Choices

You may request access to, or correction of, the personal information we hold about you, and we will respond within a reasonable period in accordance with the APPs. Some information may be subject to exceptions or retention requirements, and we will explain our reasons if we refuse a request. You may also:

• update your profile, intake, and contact details in the Platform at any time;
• disconnect any Connected Service, stopping further data collection from it;
• opt out of marketing communications at any time using the unsubscribe link or by contacting us — you will still receive essential service messages such as order, appointment, and security notices;
• withdraw a consent you have given, noting this may limit your ability to use parts of the Platform.

We may need to verify your identity before acting on a request. There is no charge for making a request, though we may charge a reasonable cost-based fee for providing access in some circumstances.

13. Third-Party Links and Services

The Platform may link to or integrate third-party services, including wearable providers, laboratories, payment providers, and video consultation tools. We are not responsible for the privacy practices of those third parties, and their handling of your information is governed by their own policies. We encourage you to review them before connecting an account. See also section 3 of our Terms of Service.

14. Children

The Platform is intended for users aged 18 and over. We do not knowingly collect information from minors. If you believe a minor has provided information, please contact us so we can take appropriate action.

15. Changes to this Policy

We may update this Policy from time to time. The updated version is effective when posted, and we will update the "last updated" date above. Where a change is material, we will take reasonable steps to notify you, for example by email or an in-app notice. Your continued use of the Platform constitutes acceptance of the changes.

16. Complaints and Contact

If you have a question or wish to make a privacy complaint, contact us at hello@n1labz.com or by post to N1Labz Pty Ltd, PO Box 1193, Osborne Park DC WA 6916, Australia. We will acknowledge your complaint promptly, investigate it, and respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992, or the health complaints body in your State or Territory.