1. About this policy
This policy explains how Massage Suwen collects, uses, stores and discloses personal information. It covers our clinics, our websites, our phone lines (including our AI receptionist), our in-store tablets, website chat, and the messages we send you.
Massage Suwen ("Massage Suwen", "we", "us", "our") is operated through the businesses listed below. Each clinic issues receipts under its own ABN. We provide massage, remedial massage and related treatments from these clinics in Brisbane:
| Clinic | Address | ABN |
|---|---|---|
| Capalaba | Shop 79A, 45 Redland Bay Rd, Capalaba QLD 4157 | 25 673 979 505 |
| Footcare (Upper Mount Gravatt) | Shop 2090A, 2049 Logan Rd, Upper Mount Gravatt QLD 4122 | 94 644 808 426 |
| Garden City | Shop 2004, 2049 Logan Rd, Upper Mount Gravatt QLD 4122 | 86 663 209 970 |
| Wynnum Plaza | Shop 10, 2021 Wynnum Rd, Wynnum West QLD 4178 | 72 656 772 422 |
| West Village | Shop 1.03, 45 Molison St, West End QLD 4101 | 25 673 979 505 |
Because we provide a health service, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), whatever our size.
Related business. Massage Suwen and Elements Head-Spa (Westfield Mt Gravatt) are related businesses. They use the same booking system and share a back-office team, but they keep separate client records (see section 9). Elements Head-Spa has its own privacy policy.
2. Information we collect
We collect only the information we need to provide our services and run our business. Depending on how you deal with us, this may include the following.
2.1 Contact and identity details
- Name, mobile number (and any other numbers you give us), email address.
- Date of birth, gender, postal address, preferred language, occupation, and how you heard about us.
- An emergency contact's name and phone number.
- If you tell us, a WeChat ID or other contact handle.
2.2 Bookings and visits
- The clinic, treatment, date, time, duration, therapist and any preference about the therapist, oils and add-ons.
- Notes you or our staff add to a booking.
- Arrival, attendance, cancellation and no-show history.
- Payments and refunds for each visit.
- Any feedback or complaints.
- For group bookings, the names of the other people in your party and the treatment each one is having, if you give them to us.
2.3 Health information (sensitive information)
To treat you safely, and to issue health-fund receipts, we ask about your health. This may include:
- Intake form:
- Your reasons for the visit, areas of pain or concern, pain level, and whether lying down is difficult.
- Medical conditions, medications, injuries, allergies, pregnancy and related history.
- Other health conditions listed on the form.
- Your signature.
- Treatment records: what our therapist assessed, treated, observed and recommended at each visit, and any changes made to those notes later.
- Health information you mention elsewhere: for example in a booking note, a phone call or a chat message.
We collect health information only with your consent, and only where it is reasonably necessary to provide our services or to process a health-fund claim. You do not have to answer every question, but if you leave out information that matters for your safety, we may be unable to provide a particular treatment.
2.4 Health fund details and claims
If you claim from your private health insurer, we collect:
- Your health fund, membership number and card number.
- The details needed to make the claim: your name, date of birth, mobile number, the service, the date, the price, and our provider number.
We also keep the result of the claim (the benefit paid and your gap amount).
2.5 Payment information
Card payments are processed by our payment providers (see section 8).
- Cards: you enter your card details into the provider's own secure payment field or terminal. We do not see or store your full card number.
- What we keep: a record of each transaction, such as the amount, date, method, reference and outcome.
- Bank transfers: if you pay by bank transfer and send us proof of payment (for example a screenshot), we keep that image with the order.
2.6 Gift vouchers, membership and stored credit
- Gift vouchers: the purchaser's and recipient's names and contact details, the voucher code, the value, the balance, the expiry date and the redemption history.
- Membership: your member number, status, start and expiry dates, and any discount.
2.7 Online accounts
If we offer online accounts and you create one, we collect:
- Your name, email address and mobile number, and whether each one has been verified.
- How you sign in: a one-time code sent by SMS or email, Google, or Apple. If you use Google or Apple, we receive the account identifier and the email address that provider shares with us.
- Your contact preferences, and a record of your sign-in sessions (IP address, device/browser type).
We do not receive or store your Google or Apple password.
2.8 Calls, messages and website chat
- Phone calls. Our phone system records the number you call from, the number you called, and the time and length of the call. We may also note what the call was about. If a call is audio-recorded, you will be told at the start of the call.
- Calls answered by our AI receptionist. Some calls are answered by an automated (AI) virtual receptionist that can answer questions and take booking requests. These calls are transcribed (converted to text) so that we can act on them. For those calls we keep:
- your caller number;
- a written transcript of the conversation;
- a short summary;
- the outcome (for example, the booking request it created).
We do not currently keep an audio recording of calls answered by the AI receptionist. If we start recording them, we will tell you at the start of the call and update this policy.
- SMS and email.
- We keep a copy of the messages we send you (such as booking reminders, confirmation requests, payment links, gift vouchers, receipts and sign-in codes).
- We also keep any replies you send.
- Website chat.
- Our virtual assistant (AI) answers first. In some cases (for example, if you ask for a person) our staff may read and take over the conversation during our clinics' opening hours.
- Before the conversation continues, we ask for your name and phone number.
- Chat is available in English and Chinese.
- We keep:
- the conversation;
- any images or text files you send (we remove location and other hidden data from images);
- your name and phone number, and, if you are a client, a link to your client record;
- basic technical information (see 2.9).
- Phone numbers, email addresses and long numbers (such as card numbers) that you type into a message are replaced with placeholders before the text is sent to the AI model. Files you send are seen by our staff; their contents are not sent to the AI model.
- Please do not send card numbers or detailed health information in chat.
- If you send a message when no staff member is available, it is emailed to the staff members we have nominated to follow up.
- To protect the service from spam and abuse, we may block a device or connection from using chat, first for a few hours and for longer periods (up to permanently) if it continues.
- In-store tablet chat. The tablet at the front desk may offer a chat or call button provided by our phone system (3CX). Messages and calls made through it are handled like other calls and messages.
2.9 Website, device and location information
When you use our websites or online forms, we and our providers may collect:
- your IP address, browser type and the page you came from;
- the time of your request.
We use this to keep the service secure and working, for example to limit repeated or abusive requests. Section 15 explains cookies.
- Location. If you choose "Use my current location" on our booking page, your device gives your location to the page so it can show the nearest clinic. The calculation is done in your browser and we do not store your location.
- Help me choose. Answers you give in the "Help me choose" step (such as areas of discomfort or pregnancy) are used in your browser to suggest a treatment. Only the treatment you choose is sent to us with your booking.
3. How we collect information
We collect personal information:
- Directly from you:
- in person;
- on our intake forms and in-store tablets;
- over the phone (including through our AI receptionist);
- by SMS, email and website chat;
- through our online booking, shop and account pages.
- From people acting for you: for example, someone who books a group appointment or buys a gift voucher for you, or a parent or guardian.
- From third parties:
- your health fund and our claims provider (the outcome of a claim);
- payment providers (whether a payment succeeded);
- Google or Apple, if you sign in with them;
- partner booking platforms, if you book a mobile or at-home treatment through one of them;
- BookRelax, the third-party booking system some of our clinics use (see section 8).
If we receive personal information we did not ask for, we will keep it only if we could have collected it ourselves for the purposes in this policy. Otherwise we will destroy or de-identify it when it is lawful and reasonable to do so.
4. Why we collect, use and disclose your information
We use your information to:
- Bookings:
- take, confirm, change and manage bookings, and assign a therapist and room;
- send booking confirmations, reminders and requests to confirm by SMS or email;
- send payment links and receipts.
- Treatment:
- assess whether a treatment is suitable and safe for you;
- provide the treatment;
- keep treatment records.
- Health-fund claims: process claims and issue health-fund receipts.
- Vouchers, membership and credit: sell, deliver and redeem gift vouchers, membership and stored credit, including digital passes for Apple Wallet or Google Wallet if you ask for one.
- Enquiries and complaints: answer enquiries by phone, chat, SMS and email, and handle complaints and feedback.
- Running our business: accounting, staffing and rostering, quality checks, training and improving our services.
- Security: protect our clients, staff and systems, for example by detecting spam and abuse, limiting repeated requests, and keeping logs of system activity.
- Law and claims: comply with the law and deal with legal claims.
- Marketing: send you offers and news, but only if you have opted in (see section 7).
We will not use or disclose your information for any other purpose unless you consent, you would reasonably expect it and the purpose is related (for health information, directly related), or the law permits or requires it.
5. Dealing with us anonymously
You can make a general enquiry without telling us who you are, for example about prices or opening hours. To book, treat you, take payment, claim from your health fund or keep you safe during treatment, we need to know who you are and how to contact you.
6. Health information and consent
- Consent. We ask for your consent when we collect health information, usually on the intake form. If you are not able to consent, we will ask a parent, guardian or other person who can consent for you.
- Who uses it. We use health information to provide your treatment, keep you safe and process your health-fund claims.
- Who can see it. Within Massage Suwen, only staff whose role requires it can see your intake forms and treatment records.
- Who receives it outside Massage Suwen. We disclose health information outside Massage Suwen only:
- to your health fund, through our claims provider, when you claim;
- to a person you nominate;
- as the law requires or allows (for example, in a serious emergency).
7. Direct marketing
We send you marketing (for example offers, new treatments or membership updates) only if you have opted in, for example by ticking the marketing box when you book or by turning on marketing in your account.
- Opting out. You can opt out at any time by:
- replying STOP or following the unsubscribe instructions in the message;
- turning off the preference in your account;
- contacting us.
- What still comes. We will still send messages that are part of providing our services, such as booking reminders, confirmations, receipts and voucher deliveries.
- No selling or renting. We do not sell or rent your personal information.
8. Who we disclose information to
We disclose personal information to our service providers, which use it only to provide their services to us. They include:
| Provider | What they do for us | Information involved |
|---|---|---|
| BookRelax | Third-party booking and client-record system used by some of our clinics | Name, mobile, gender, bookings, payments; for some clients, health questionnaire answers and signatures given through BookRelax |
| Twilio and any other SMS provider we engage | Sending and receiving SMS; our phone lines | Your mobile number and the message text |
| 3CX | Our business phone system and in-store tablet chat | Caller numbers, call routing information, chat messages |
| OpenAI | AI model behind our phone receptionist (understands and replies to callers, and transcribes the call) | What you say on the call, and information the AI looks up to answer you (such as available times or your upcoming bookings) |
| AI model provider for chat (such as Anthropic or OpenAI) | AI model behind our website chat and the assistant our staff use inside our booking system | Chat messages (with phone numbers, email addresses and long numbers replaced by placeholders); booking and client details a staff member asks the assistant about |
| Email service provider | Sending receipts, gift vouchers, sign-in codes and other emails | Your email address and the email content |
| Tyro Payments | In-store card terminals and online card payments | Payment amount and order reference; your card details go directly to Tyro |
| Stripe | Back-up online card payments | Payment amount and order reference; your card details go directly to Stripe |
| Tyro Health (formerly Medipass) | Health-fund claims | Your name, date of birth, mobile, health fund, membership and card numbers, service, date, price and our provider number |
| Your private health fund | Assessing and paying your claim | As above |
| Passcreator | Creating Apple Wallet and Google Wallet passes for gift vouchers and membership | The name, voucher code or member number, balance, status and expiry shown on the pass. Phone, email, address and health information are not sent. |
| Google and Apple | Sign-in with Google or Apple; Apple Wallet and Google Wallet | Sign-in identifiers; the pass you add to your wallet |
| Where we use them: estimating travel times for mobile or at-home treatments, and map and address search on our booking page | The treatment address; the search you type | |
| Partner booking platforms | Bookings for mobile or at-home treatments made through their platforms, if you book through one | Booking status updates about the job they referred to us |
| IT, hosting and backup providers | Storing our systems and backup copies | All information in our systems, in backup form |
| Professional advisers | Accountants, lawyers, insurers | Only what they need |
We may also disclose information:
- to a person you have authorised;
- to protect someone's life, health or safety;
- to law-enforcement agencies, regulators or courts, where the law requires or permits it;
- to a buyer of all or part of our business, under confidentiality obligations.
9. Massage Suwen and Elements Head-Spa keep separate client records
Massage Suwen and Elements Head-Spa use the same booking system, but each keeps its own client records.
- Not shared. Your client profile with Massage Suwen (contact details, visit history, membership, VIP status, stored credit, intake forms and treatment records) is not shared with Elements Head-Spa, and Elements Head-Spa's records are not shared with us. If you visit both, each business keeps a separate record of you.
- Shared team. A back-office team that works for both businesses may answer calls, chats and messages for Massage Suwen. When they do, they act for Massage Suwen and use Massage Suwen's records.
- Gift vouchers. Where we allow it, a Massage Suwen gift voucher may be redeemed at Elements Head-Spa. The redemption is recorded against the voucher.
- Future changes. We will not combine the two businesses' client records unless we first tell you and, where the law requires it, obtain your consent.
We do not use your health information for the other business's marketing.
10. Overseas disclosure
Most of our records are stored on servers we control in Australia. Some of our service providers are located, or process information, outside Australia:
| Provider | Countries where information may be processed |
|---|---|
| OpenAI (AI phone receptionist) | United States |
| AI model provider for chat and our staff assistant (such as Anthropic or OpenAI) | United States |
| Twilio (SMS and phone lines) | United States |
| 3CX (phone system) | May be outside Australia (the countries where its hosting provider operates) |
| Google (sign-in, Wallet, maps and, where we use them, email and file-storage services) | United States and other countries where Google operates |
| Apple (sign-in, Wallet) | United States |
| Stripe (back-up card payments) | United States |
| Passcreator (wallet passes) | European Union |
| BookRelax | May be outside Australia |
| Our email service provider | May be outside Australia, including the United States |
| unpkg (icon files our website loads; the browser's IP address is visible to it) | United States and other countries |
Tyro Payments and Tyro Health are Australian. We understand your health fund processes claims in Australia.
We take reasonable steps to ensure overseas providers handle your information consistently with the APPs. For example, we use providers that contractually commit to protecting it. Where available, we choose settings that stop providers keeping or using our data to train their models, and we limit what we send to what they need.
11. How we protect your information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:
- Accounts and access:
- individual staff accounts;
- role-based access, so that, for example, intake forms and full phone numbers are visible only to staff whose role requires them;
- in-store devices that need a staff sign-in or a clinic device password.
- Encryption and secrets:
- encrypted (HTTPS) connections to our websites and systems;
- payment card details handled only by our payment providers;
- sign-in codes and session tokens stored as one-way hashes rather than in readable form.
- Logs: audit logs of changes made by staff.
- Backups: regular backups, kept for disaster recovery.
No system is completely secure. If we have a data breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
12. How long we keep your information
We keep personal information only as long as we need it for the purposes in this policy or as the law requires. Then we delete or de-identify it.
| Information | How long we keep it |
|---|---|
| Intake forms and treatment records (health information) | For at least 7 years after your last treatment, or until you turn 25 if you were under 18 — longer if required by law or our insurers |
| Client profile and booking history | While you remain a client, and afterwards for as long as we need it for the purposes in this policy, including keeping the health and financial records in this table |
| Payments, receipts, gift vouchers, membership and stored credit | At least 5 years after the transaction (tax law), and for as long as a voucher, membership or credit is still usable |
| Health-fund claim records | At least 7 years after the claim |
| AI receptionist call transcripts and summaries | As long as we need them to handle your enquiry or booking, and for quality and record-keeping purposes |
| Website chat | Spam or blocked conversations: 30 days. Anonymous conversations with no follow-up: 12 months. Conversations where you left contact details, or that are linked to your client record: 24 months. Files you sent are deleted with the conversation. |
| Chat IP addresses | Kept only in a scrambled (salted hash) form for anti-abuse purposes; cleared after 90 days |
| SMS and email message logs | As long as we need them to provide our services and to show what we sent you |
| One-time sign-in codes | Stored only as one-way hashes; they expire after 10 minutes |
| System and security logs | Technical request logs: 14 days. Staff audit logs: 90 days. |
| Backup copies | A limited number of recent copies, overwritten on a rolling basis |
13. Accessing and correcting your information
- Access. You can ask for access to the personal information we hold about you, including your intake forms and treatment records.
- Correction. You can ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
- How to ask. Contact us using the details in section 19.
- Our response. We will:
- confirm your identity before giving you access or making changes;
- respond within 30 days.
- Fees. There is no fee for making a request. We may charge a reasonable fee for providing a copy if it takes significant work. We will tell you before we charge.
- Refusals. If we refuse access or correction, we will tell you why in writing, and how to complain. If we do not correct information, you can ask us to attach a statement saying you believe it is wrong.
- Online accounts. If you have an online account, you can update your contact details and preferences there.
- Closing an account. To close the account, contact us.
14. Complaints
If you think we have breached the Privacy Act or the APPs:
- Contact our Privacy Officer (section 19) and tell us what happened.
- We investigate. We will acknowledge your complaint, investigate it and respond in writing within 30 days.
- If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC):
- www.oaic.gov.au
- 1300 363 992
- GPO Box 5288, Sydney NSW 2001
15. Cookies and similar technologies
- No tracking. Our website does not use advertising or analytics cookies, and we do not use tracking pixels.
- Shopping cart. Your cart is stored in your browser's local storage so it is still there when you come back. It is not sent to us until you check out.
- Payment pages. Our payment providers' scripts (Stripe and Tyro) load on our booking, shop and payment pages. They may set their own cookies or collect device information to process payments and prevent fraud. This is covered by their privacy policies.
- Icons and maps.
- Our website loads icon files from a public content network (unpkg). Your browser's IP address is visible to that network.
- If our booking page shows a Google map or address search, Google receives the information your browser sends to display the map and search addresses.
- Website chat. The chat window keeps a random identifier in your browser so that you can return to your conversation and so that blocks against abuse work.
- Staff and in-store devices. Our booking system sets a session cookie only when someone signs in, such as staff or an in-store device. It is not set when you simply visit our public pages.
You can block or delete cookies and local storage in your browser settings. Some features, such as your cart, payment or chat, may then not work.
16. Children
- Treating minors. We treat people under 18 only with the consent of a parent or guardian, who provides the intake information for them.
- Online. Our online booking, accounts and chat are intended for adults. We do not knowingly collect personal information online from children under 16 without a parent's or guardian's involvement.
17. Links to other sites
Our websites may link to other sites, such as payment pages, maps or social media. We are not responsible for their privacy practices.
18. Changes to this policy
We may update this policy from time to time, for example when we add a new service or provider. The current version will always be on our website with the date it was last updated. If a change significantly affects how we use information we already hold, we will tell you.
19. Contact us
Privacy Officer, Massage Suwen
Email: info@massagesuwen.com
You can also contact us in person or by post at any of our clinics listed in section 1.
You can ask for this policy in Chinese, or in another format, free of charge. A Chinese version is available on our website. If the English and Chinese versions differ, the English version prevails.