Privacy Policy and Consumer Health Data Privacy Notice

Privacy Policy and Consumer Health Data Privacy Notice

Effective date: 2 August 2026
Last updated: 2 August 2026

1. About This Policy

This Privacy Policy explains how James Buckley, trading as Non-Monogamy Co, ABN 59 510 492 837 (“I,” “me” or “my”), collects, uses, stores, protects and discloses personal information.

I am based in Sydney, New South Wales, Australia, and provide sex and relationship coaching services in person and online.
This Policy applies to:

visitors to my website;

people who make enquiries;

people who join my mailing list;

prospective and current coaching clients;

people participating in couples or multi-participant coaching;

former clients; and

other people whose information I may lawfully receive in connection with my services.

My coaching services are available only to adults aged 18 years and over.

Because my work concerns sexuality, relationships and personal wellbeing, some of the information I handle may be considered sensitive information, health information, sensitive personal information or consumer health data under applicable privacy laws.

This Policy is intended to address applicable Australian privacy laws, including the Privacy Act 1988, the Australian Privacy Principles and the New South Wales Health Records and Information Privacy Act 2002 where applicable, as well as applicable United States privacy and consumer-protection laws.

My services are coaching services rather than licensed healthcare or mental-health services. I do not represent that my practice or website is covered by the United States Health Insurance Portability and Accountability Act, commonly known as HIPAA.

2. Information I Collect

Depending on how you interact with me, I may collect the categories of information described below.

Identity and contact information

This may include your:

name;

pronouns;

age or date of birth;

email address;

telephone number;

residential or billing location;

country and state;

emergency-contact information; and

preferred communication method.

Booking and payment information

This may include:

appointment dates and attendance;

services booked;

invoices, receipts and payment status;

billing details;

payment-provider transaction identifiers; and

cancellation or rescheduling information.

Payments are processed through Stripe. I do not ordinarily receive or store your complete credit or debit card number.

Coaching and sensitive information

To assess whether coaching is suitable and provide the services you request, I may collect information relating to:

your relationships and relationship structures;

sexuality, sex life, sexual activity or sexual orientation;

gender identity or expression;

intimate experiences and preferences;

communication, intimacy and relationship concerns;

physical or mental health and emotional wellbeing;

medical conditions or medication where relevant to safe participation;

family, social and personal history;

trauma or significant life experiences you choose to disclose;

coaching goals, challenges and progress;

safety concerns;

information contained in intake forms;

coaching-session notes; and

communications between you and me.

You are not required to provide information unrelated to your coaching needs. However, I may be unable to assess whether coaching is suitable or provide some services if reasonably necessary information is not provided.

Information about other people

You may discuss partners, family members or other people during coaching. I ask that you avoid providing unnecessary identifying information about another person.

Where two or more people participate in coaching, I may collect information directly from each participant. Information disclosed during a joint session will ordinarily be available to the other participants in that session.

Website and technical information

When you use my website or online services, Go Modern CRM and associated systems may automatically collect information such as:

internet protocol address;

browser and device type;

operating system;

referring website;

approximate location derived from an internet protocol address;

pages viewed;

dates and times of visits;

website interactions;

cookie identifiers; and

security and diagnostic information.

Communications and marketing information

I may collect:

emails, messages and enquiry-form submissions;

communication preferences;

mailing-list subscription status;

records of consent;

event or workshop registrations;

survey or feedback responses; and

testimonials where you have expressly agreed to their use.

3. How I Collect Information

I generally collect information:

directly from you;

through my website, contact forms and intake forms;

during coaching sessions;

through email, telephone, video call or messaging;

through booking, payment and practice-management systems;

from another participant in joint coaching;

from a person referring you, where you have authorised the referral;

through cookies and similar website technologies; and

from service providers acting on my behalf.

I do not intentionally collect sensitive information from public social-media profiles or unrelated third-party sources for the purpose of creating a profile about you.

4. Why I Collect and Use Information

I may collect, hold and use personal information to:

respond to enquiries;

assess whether coaching is suitable and within my scope;

provide and personalise coaching services;

understand your coaching goals;

schedule and conduct appointments;

communicate with you about your services;

process payments and issue receipts;

maintain appropriate business and coaching records;

support the safety of participants;

contact an emergency contact or appropriate service where legally permitted and reasonably necessary;

provide couples or multi-participant coaching;

obtain professional supervision or consultation;

make referrals where appropriate;

manage complaints, disputes or insurance matters;

meet legal, tax, accounting, insurance and professional obligations;

prevent fraud, misuse and security incidents;

maintain and improve my website and services;

administer events, programs or workshops;

send marketing communications where you have consented; and

establish, exercise or defend legal claims.

I will not use sensitive coaching information for purposes unrelated to providing or administering my services unless you have given additional consent or the use is otherwise authorised or required by law.

5. Consent to Sensitive Information

I generally seek your express consent before collecting sensitive information, including information relating to your health, sexuality, sex life, sexual orientation or intimate relationships.

Consent will normally be requested through my intake process before coaching begins. Your consent must be voluntary, informed, current and specific.

You may withdraw consent to future collection or use by contacting me. Withdrawal will not affect information handling that occurred before consent was withdrawn.

Because sensitive information is central to sex and relationship coaching, withdrawing consent may mean that I can no longer provide some or all coaching services.

Withdrawal of consent does not require me to delete information that I am legally required or reasonably permitted to retain.

6. When I Disclose Information

I may disclose information where reasonably necessary to the following categories of recipients.

Service providers

I use third-party providers to help operate my business and provide services.
These include:

Splose for practice management, client records, cloud file storage and electronic signatures;

Zoom for video conferencing;

Stripe for payment processing;

Google Workspace for business email and communications;

Go Modern CRM for customer relationship management, email communications, mailing-list management, website hosting and website analytics; and

Hnry for accounting, tax and financial administration.

These organisations may receive only the information reasonably necessary to perform their services.

Their handling of information may also be governed by their own privacy policies and terms.

Professional supervision and consultation

I may discuss coaching work with a suitably qualified supervisor or consultant for professional development, ethical support or quality assurance.

Where reasonably practicable, I will remove or minimise information that could identify you. Supervisors and consultants are expected to keep the information confidential.

Professional advisers

Information may be provided where reasonably necessary to my:

lawyer;

accountant or tax adviser;

insurer;

insurance broker;

information-security adviser; or

other professional adviser.

Emergencies and safety concerns

Where I reasonably believe there is a serious and imminent threat to the life, health or safety of you or another person, I may disclose information to an appropriate emergency service, crisis service, emergency contact or other person able to assist, where disclosure is permitted or required by law.

Legal requirements and proceedings

I may disclose information where required or authorised by:

Australian law;

an applicable United States law;

a court order, subpoena or other binding legal process;

a regulatory or law-enforcement authority;

an insurance claim;

a professional investigation; or

the establishment, exercise or defence of a legal claim.

A request made under foreign law will be assessed before information is disclosed. I will seek to disclose only information reasonably necessary in the circumstances.

Business changes

If my business is sold, restructured or transferred, personal information may be disclosed to professional advisers and a proposed purchaser where reasonably necessary and subject to appropriate confidentiality and privacy safeguards.

I do not sell personal information or consumer health data.

I do not disclose sensitive coaching information to data brokers or third-party advertisers.

7. Advertising and Tracking Technologies

My website is hosted through Go Modern CRM and may use cookies and similar technologies that are reasonably necessary for:

website operation;

security;

appointment or enquiry functions;

remembering user preferences;

measuring general website performance; and

understanding aggregated website usage.

Where required by applicable law, you will be given an opportunity to accept or reject non-essential cookies.

I do not knowingly use information from intake forms, coaching records, booking details or client-portal activity for targeted advertising.

I do not use sensitive coaching information to build advertising audiences, create similar audiences or target advertisements based on a person’s sexuality, relationship concerns, health information or use of coaching services.

Advertising pixels and retargeting technologies should not be placed on intake forms, booking-confirmation pages, client portals or other pages containing or revealing sensitive coaching information.

You can control cookies through your browser settings and, where available, through the cookie controls on my website. Blocking some cookies may affect the operation of website features.

8. Artificial Intelligence and Automated Tools

I do not knowingly submit identifiable session content, intake responses or coaching notes to publicly accessible generative artificial-intelligence systems for training or unrelated purposes.

I may use technology-assisted tools for limited administrative purposes where appropriate privacy and security safeguards are in place.

A coaching session will not be recorded, automatically transcribed or attended by an artificial-intelligence meeting assistant without prior notice and the express agreement of every participant.

I do not use automated decision-making to diagnose you, determine eligibility for healthcare or make decisions that produce legal or similarly significant effects.

9. Marketing Communications

Administrative communications—including appointment confirmations, reminders, receipts and changes to services—are necessary to provide coaching and are not marketing communications.

I will only use sensitive information for direct marketing where the required consent has been obtained.

Where you have chosen to receive marketing communications, I may send information about:

educational resources;

events and workshops;

programs or courses;

practice news;

new services; and

other relevant offers.

You may unsubscribe at any time by using the unsubscribe link or contacting me.

Unsubscribing from marketing will not prevent necessary administrative communications relating to services you have requested.

I will not use overtly sexual or unnecessarily revealing wording in email subject lines.

10. International Processing and Storage

I operate from Australia, but some of my service providers may process, store or access information overseas.

My providers include:

Splose for practice management, client records, cloud file storage and electronic signatures;

Zoom for video conferencing;

Stripe for payments;

Google Workspace for email and business communications;

Go Modern CRM for customer relationship management, email, mailing lists, website hosting and analytics; and

Hnry for accounting and tax administration.

Depending on each provider’s infrastructure and support arrangements, information may be processed, stored or accessed in:

Australia;

the United States;

countries within the European Economic Area; and

other countries in which these providers or their contracted subprocessors operate.

Privacy protections in another country may differ from those available in Australia or in your US state.

Where Australian privacy law applies, I take reasonable steps appropriate to the circumstances to assess service-provider privacy and security practices and comply with applicable cross-border disclosure requirements.

This provider list may change as my systems change. I will update this Policy where a change materially affects how personal or sensitive information is handled.

11. Security

I take reasonable administrative, technical and physical measures to protect information against:

misuse;

interference;

loss;

unauthorised access;

unauthorised disclosure;

alteration; and

destruction.

These measures may include:

passwords and multi-factor authentication;

access restrictions;

encrypted connections;

reputable specialist service providers;

device and software updates;

secure backups;

confidentiality arrangements;

data minimisation;

account monitoring; and

procedures for responding to privacy and security incidents.

No electronic system is completely secure. I cannot guarantee that information transmitted through the internet will never be intercepted, lost or accessed without authorisation.

You are responsible for taking reasonable precautions to protect your own devices, accounts, passwords, internet connection and physical surroundings.

12. Data Breaches

I maintain procedures for assessing and responding to suspected privacy and security incidents.

Where a data breach is likely to result in serious harm or otherwise meets an applicable legal notification threshold, I will notify affected individuals and relevant regulators as required by law.

Depending on the circumstances, this may include notification under the Australian Notifiable Data Breaches scheme or applicable United States federal or state breach-notification laws.

13. Retention and Deletion

I retain information only for as long as reasonably necessary for the purposes described in this Policy and to meet legal, tax, insurance and professional obligations.

As my services are restricted to adults, coaching and health-related records will generally be retained for at least seven years from the last occasion on which services were provided where the New South Wales health-record retention requirement applies.

Other information may be retained as follows:

financial and transaction records for the period required by tax and accounting law;

complaint, insurance and legal records for as long as reasonably necessary;

marketing information until you unsubscribe or withdraw consent;

a limited suppression record after unsubscribing so that your preference can be honoured; and

website and security logs for the period reasonably required for operation and security.

Information may be retained for longer where required by law, an insurer, a legal hold or actual or anticipated legal proceedings.

When information is no longer required, I will take reasonable steps to securely delete, destroy or de-identify it.

A request for deletion may be limited where retention is required or permitted by law.

14. Your Privacy Rights

Depending on your location and the law that applies, you may have the right to:

know whether I hold information about you;

request access to your information;

receive a copy of certain information;

request correction of inaccurate or incomplete information;

request deletion;

withdraw consent to future collection or processing;

object to or restrict certain uses;

request information about third parties with whom information has been shared;

opt out of the sale or sharing of information;

opt out of targeted advertising;

limit certain uses of sensitive personal information;

request data portability;

appeal a refusal to act on a request; and

exercise your rights without unlawful discrimination.

Not every right applies in every jurisdiction or circumstance. Some rights are subject to exceptions, including legal record-retention requirements.

To exercise a privacy right, contact me using the details at the end of this Policy. I may need to verify your identity before providing access or making changes.

You may use an authorised agent where applicable law permits. I may ask for evidence of the agent’s authority and may verify your identity directly.

I will respond within the period required by applicable law. Where no specific period applies, I aim to provide a substantive response within 30 days.

15. Additional Information for Washington Consumers

This section applies where the Washington My Health My Data Act applies to my handling of your consumer health data.

Categories of consumer health data collected

I may collect information relating to:

physical or mental health;

sexuality, sex life, sexual activity or sexual orientation;

intimate and relationship experiences;

medication or medical conditions voluntarily disclosed as relevant;

coaching goals and concerns;

safety and emergency information;

services requested or received; and

inferences that could identify a person’s health, sexuality or relationship-related needs.

Sources

This information is generally collected:

directly from you;

through intake and booking forms;

during coaching sessions;

through communications with you;

from another participant in joint coaching; and

through service providers acting on my instructions.

Purposes

Consumer health data is collected and used to:

provide services you request;

assess coaching suitability;

personalise coaching;

maintain coaching records;

administer appointments and payments;

communicate with you;

support safety;

obtain confidential professional supervision;

comply with legal and insurance obligations; and

manage complaints or disputes.

Categories of information disclosed

Consumer health data may be disclosed only as described in this Policy, including information reasonably necessary for:

practice management;

secure data storage;

video conferencing;

payment and administration;

confidential professional supervision;

legal or insurance advice;

emergency responses; and

compliance with law.

Categories of recipients

Recipients may include:

contracted technology and practice-management providers;

professional supervisors;

lawyers, insurers and professional advisers;

emergency or crisis services;

authorised government bodies; and

other recipients you specifically direct or authorise.

I do not sell consumer health data.

Washington consumers may request confirmation of whether their consumer health data is being collected, shared or sold; request access; obtain information about certain recipients; withdraw consent; and request deletion, subject to applicable exceptions and identity-verification requirements.

Requests may be submitted using the contact details at the end of this Policy.

You may appeal a refusal by replying to my decision and stating that you wish to appeal.

16. California and Other US State Rights

Where an applicable US state privacy law gives you additional rights, I will honour those rights to the extent that the law applies to my business and the information concerned.

These rights may include access, correction, deletion, portability, limitation of sensitive-information use, and opting out of sale, sharing, targeted advertising or profiling.

I do not sell personal information.

I will not unlawfully discriminate against you for exercising an applicable privacy right.

17. Children’s Information

My coaching services are not offered to people under 18 years of age.

I do not knowingly collect sensitive coaching information from children through my website or coaching services.

If I become aware that information has been collected from a person under 18 in circumstances inconsistent with this Policy, I will take reasonable steps to delete it, subject to any applicable legal obligation.

18. Links and Third-Party Services

My website may contain links to websites or services operated by other organisations.

I am not responsible for the privacy practices of an external website or service that I do not control.

You should review the relevant provider’s privacy information before providing personal information.

19. Privacy Complaints

You may make a privacy complaint by contacting me using the details below.

Please describe:

what happened;

the information concerned;

when it occurred; and

the outcome you are seeking.

I will acknowledge and investigate the complaint within a reasonable period and aim to provide a substantive response within 30 days.

If you are dissatisfied with my response, you may be entitled to contact:

the Office of the Australian Information Commissioner;

the Information and Privacy Commission New South Wales;

the United States Federal Trade Commission;

the attorney general or privacy regulator in your US state; or

another regulator with jurisdiction over the matter.

20. Changes to This Policy

I may update this Policy to reflect changes to my services, systems, providers or legal obligations.

The current version will be published on my website with its effective date.

If I propose a material change that would allow sensitive information previously collected to be used or disclosed for a substantially different purpose, I will provide appropriate notice and obtain additional consent where required.

21. Contact Details

Privacy contact: James Buckley
Business name: Non-Monogamy Co
ABN: 59 510 492 837
Email: [email protected]
Business location: Sydney, New South Wales, Australia
Website: www.nonmonogamy.co

Please do not send highly sensitive coaching information through an ordinary website contact form unless the form is specifically identified as secure.