Privacy Policy

Effective date: 16 August 2026 · Last updated: 12 October 2026

Zestara Health Pty Ltd (ACN 697 355 454) ("Zestara Health", "we", "us", "our") provides the Zestara Health mobile application, a women's health and coaching app (the "App"). This Privacy Policy explains how we collect, use, disclose and protect your personal information when you use the App.

We are an Australian business and we handle your information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Because the App is a health and fitness service, some of the information we handle is sensitive information (in particular, health information), which we only collect with your consent and only to provide the service to you.

By creating an account and using the App, you consent to the handling of your information as described in this Policy.

This website

This website does not collect personal information through its own forms. If you book an enquiry call, you are taken to a Google Calendar booking page, where you enter your name, email and anything else you choose to share so that Brooke can speak with you. Google handles that information under its own privacy policy, and we use what we receive only to prepare for and hold your call. If you choose to start coaching, you pay securely through Newie, our payment provider. Newie passes your name, email address, the plan you chose and a subscription reference to us through Zapier, an automation service we use, so that we can reserve your start date, prepare your account invitation and send your welcome email automatically. This website sets no advertising cookies and runs no analytics trackers. The website is hosted by Vercel, and its domain name is managed through Cloudflare. Like most websites, these providers process technical information such as your IP address and browser type to deliver pages and keep the site secure. We do not use that information to identify you or to advertise to you.

1. Information we collect

Account and profile. Your name and preferred name, email address, role (client or coach), time zone, and display preferences (such as your units and energy unit). Your password is stored in hashed form by our authentication provider and we cannot see it.

Health and wellbeing information you choose to log. Depending on the features you use, this can include your date of birth and biological sex, life stage and contraception details, menstrual cycle information, pregnancy or postpartum information, perimenopause and menopause information (including any hormone therapy you record), symptoms and mood, sleep, body measurements, nutrition and food logs, training and workout data, goals, check-ins, notes, and any photos, videos or voice notes you upload as part of a check-in. You choose what to provide, and providing health information is always optional.

Information from apps and devices you connect (optional). If you choose to connect Apple Health or a wearable account such as an Oura ring, we import the metrics you authorise, for example steps, sleep, heart rate, heart rate variability, recovery, body temperature, and activity. The metrics you import are uploaded to our secure backend (Supabase, in the Sydney, Australia region), stored alongside the rest of your health logs under the same access controls, and made available to your coach so they can support you. This is off until you turn it on, we never see your wearable account password, and you can disconnect at any time. Apple Health access is controlled by you in your iPhone settings. If you turn them on, the App can also write some of the data you record in Zestara (such as weight, workouts and period days) back to Apple Health, and add your bookings to your phone's calendar. These are one-way conveniences that stay on your device and send nothing new to us. Any health data obtained through Apple Health is used only to provide the App's features to you. We never use Apple Health data for advertising or marketing, we never sell it, and we never share it with third parties for those purposes.

Sign up details. When you start coaching through our website, your name, email address, the plan you chose, a subscription reference from our billing provider, and the start date we allocate to you. We also keep the details from any enquiry call you book in our client records, so we can follow up with you and prepare for your call. We use your email address to link your App account to your coach and to send your welcome email.

Messages and support. Messages you exchange with your coach in the App, and any support requests you send us.

Technical information. A push notification token if you enable notifications, and basic technical information needed to operate and secure the App.

We do not collect your payment card or bank details in the App. Payment for coaching is handled by our external billing provider (see section 5).

2. How we use your information

We use your information to create and manage your account, provide the coaching service (including allowing your assigned coach to review your logs and tailor your guidance), generate the summaries and trends you and your coach see, send you notifications you have opted into, respond to your enquiries, and keep the App secure and working. We send you service emails, such as your welcome email, account confirmations and password resets. We will only send you marketing emails if you have agreed to receive them, and every marketing email will let you unsubscribe.

We do not sell your personal information, we do not use it for third-party advertising, and we do not allow third parties to track you across other apps or websites.

3. When we disclose your information

• To your assigned coach. The App is coach-mediated: your assigned coach can see the information you log so they can support you. Other clients cannot see your information, and this is enforced technically by row-level security.
• To service providers who help us run the App, under contracts that require them to protect your information (see section 4).
• Where required or authorised by law, or to protect the safety of a person.
• In connection with a business sale or restructure, in which case your information stays subject to protections consistent with this Policy.

4. Where your information is stored and who processes it

Your account, health logs, messages and uploaded files are stored using Supabase, in the Sydney, Australia region. Some limited handling occurs overseas:

This means some of your information may be handled outside Australia, mainly in the United States. Zapier keeps a record of each sign up it processes for a limited time, up to about 69 days in its history and up to four months in its backups. We take reasonable steps to ensure these providers handle your information consistently with the Australian Privacy Principles.

5. Payments

Payment for coaching is processed outside the App by our billing provider. You provide your payment details directly to that provider, subject to their terms and privacy policy. We do not receive or store your full card details. When you subscribe, our billing provider sends the sign up details described in section 1 to us through Zapier so that your account can be set up automatically. Zapier does not receive your payment card details from us.

6. Security

We take reasonable steps to protect your information, including encryption in transit, access controls and row-level security so your data is reachable only by you and your assigned coach, and authentication safeguards on accounts. No method of transmission or storage is completely secure. If we become aware of a data breach likely to cause you serious harm, we will act in accordance with the Notifiable Data Breaches scheme.

7. How long we keep your information

We keep your information for as long as your account is active and as needed to provide the service. If you close your account or ask us to delete your information, we will delete or de-identify it within a reasonable period, unless we are required to keep it to meet a legal obligation.

8. Your rights and choices

You may access the information we hold about you, correct it, ask us to delete it and close your account, withdraw consent to the collection of sensitive information (noting some features will no longer work), disconnect a connected app or device at any time, turn off notifications in your device settings, and make a complaint. Much of your information can be viewed and edited directly in the App. You can delete your account and download a copy of your data yourself at any time in the App under Settings; deleting your account removes your personal information as described in section 7. For anything else, contact us using the details below. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Children

The App is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect information from anyone under 18.

10. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will take reasonable steps to notify you. The "Last updated" date above shows when the Policy was last revised.

11. Contact us

If you have any questions, requests or complaints about your privacy, contact:

Zestara Health Pty Ltd Email: hello@zestarahealth.com.au

This Policy is governed by the laws of Victoria, Australia.