Sublime Pulse Privacy Policy

Sublime Pulse is operated by Sublime Studio Co Pty Ltd (ABN 38 690 513 181), which operates Sublime Studio. In this policy, "Sublime Studio", "we", "us" and "our" refer to Sublime Studio Co Pty Ltd.

Sublime Pulse is a private, invitation-only wellbeing check-in service that helps members and their practitioners stay connected between sessions. This Privacy Policy explains how we collect, use, store and disclose personal information through Sublime Pulse.

This policy should be read alongside any separate service agreement, informed consent or privacy notice that applies to your relationship with Sublime Studio or your practitioner.

1. The information we collect

The personal information we collect depends on how you use Sublime Pulse and whether you are a member, practitioner or administrator.

It may include: your name, email address, account identifiers and authentication information; invitations, account status, role and practitioner-member relationships; contact details and communications with us; wellbeing domains you select, check-in responses, ratings, reflections and other information you choose to provide; session-related summaries, commitments, released results and associated records; information about scheduled sessions; and technical information such as browser type, device information, IP address, security events and service logs.

Some information provided through Sublime Pulse may be health information or other sensitive information under Australian privacy law. We collect sensitive information with your consent, where it is reasonably necessary to provide the service, or where otherwise permitted or required by law.

2. Google account and Calendar information

Practitioners and authorised users may choose to connect a Google account to Sublime Pulse. When they do, Sublime Pulse may access:

• the Google account's name and email address;
• the list of Google calendars available to that account; and
• read-only event information needed to identify and maintain relevant Sublime Pulse sessions, such as event identifiers, titles, dates, times, status and calendar or organiser information.

Sublime Pulse requests read-only access. It does not create, edit or delete events in Google Calendar. We use Google Calendar information only to connect relevant scheduled sessions with Sublime Pulse and operate the related member and practitioner workflows. Sublime Pulse is not intended to create a general copy of a user's Calendar or retain unrelated Calendar events.

We store the OAuth connection information needed to maintain the connection, including encrypted access credentials, and the minimum event information needed to operate and audit relevant session workflows.

We do not sell Google user data, use it for advertising, use it to create credit or lending profiles, or use it to train general-purpose artificial intelligence models. We only disclose it to service providers when necessary to operate or secure Sublime Pulse, as described in this policy.

Sublime Pulse's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. You can withdraw Google Calendar access at any time by disconnecting the Calendar connection in Sublime Pulse, where that option is available, or by removing Sublime Pulse's access through your Google Account. This stops future access to Google Calendar. It does not automatically delete information already used to create a Sublime Pulse session or a record we are required to retain. You may contact us to request deletion as described below.

3. How we collect information

We may collect personal information:

• directly from you when you accept an invitation, create an account, complete a check-in, use the service or contact us;
• from your practitioner or an authorised Sublime Studio team member;
• from Google when an authorised user connects Google Calendar;
• automatically when you use the service; and
• from service providers that help us operate Sublime Pulse.

4. How we use personal information

We use personal information to:

• create and secure accounts;
• provide the invitation, check-in, session, review, results and follow-up features of Sublime Pulse;
• help practitioners support members within their authorised caseload;
• connect relevant Google Calendar events with Sublime Pulse sessions;
• send service communications, including invitations, check-ins, released results and permitted follow-ups;
• provide support and respond to requests;
• monitor, maintain and secure the service;
• investigate suspected misuse, faults or security incidents;
• improve the reliability and usability of Sublime Pulse; and
• comply with legal and professional obligations.

We will not use sensitive information for direct marketing without the consent or other authority required by law.

5. Who can see personal information in Sublime Pulse

Access is limited according to a person's role:

Members can access their own information and released results.

Practitioners can access information for members in their own caseload where it is needed to provide the service.

Administrators can manage operational matters but are not intended to access member reflections, ratings or session content merely because they are administrators.

We apply these access boundaries through the service, not only through written procedures.

6. When we disclose personal information

We may disclose personal information:

• to the practitioner responsible for the relevant member;
• to authorised Sublime Studio personnel who need it to provide, support or secure the service;
• to service providers that support hosting, databases, authentication, email delivery, monitoring and related operations;
• where you direct or authorise us to do so;
• when required or authorised by law; or
• when reasonably necessary to prevent or respond to a serious threat, suspected fraud, misuse or a security incident.

Our service providers include Replit for application hosting, Clerk for authentication, Resend for transactional email, and Google for account authorisation and Calendar access. These providers handle information under their own terms and privacy obligations as well as our arrangements with them.

Some providers may process or store information outside Australia. Where Australian privacy law applies, we take reasonable steps to ensure overseas handling is consistent with applicable requirements.

We do not sell personal information.

7. Storage and security

We use reasonable technical and organisational safeguards to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These measures include role-based access controls, server-side permission checks, encrypted Google OAuth credentials and controlled production access. No online service is completely secure. Please protect your login details and tell us promptly if you believe your account or information has been compromised.

8. Retention and deletion

We retain personal information only for as long as reasonably necessary to provide Sublime Pulse, maintain appropriate service and professional records, resolve disputes, meet security and audit needs, and comply with legal obligations.

When information is no longer required, we take reasonable steps to delete it or de-identify it, unless we are permitted or required to retain it.

You may request deletion of your Sublime Pulse account or personal information by contacting us. We will assess the request and explain if any information must be retained for legal, professional, safety, security or record-keeping reasons.

9. Access and correction

You may ask to access personal information we hold about you or request that inaccurate, out-of-date, incomplete, irrelevant or misleading information be corrected.

We may need to verify your identity before completing a request.

In some circumstances, the law permits us to refuse access or correction. If that happens, we will explain the reason where we are legally able to do so.

10. Complaints

If you have a privacy concern or complaint, please contact us using the details below.

Please describe the issue and include enough information for us to investigate it. We will acknowledge and respond to the complaint within a reasonable period.

If you are not satisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner or another relevant regulator.

11. Cookies and technical data

Sublime Pulse may use cookies and similar technologies that are necessary for authentication, security and core service functionality. We may also use service logs and limited usage information to maintain and improve the service.

You can control some cookies through your browser, but blocking essential cookies may prevent Sublime Pulse from working correctly.

12. Third-party links and services

Sublime Pulse may link to third-party services. Their privacy practices are governed by their own policies. We are not responsible for third-party services that are outside our control.

13. Changes to this policy

We may update this policy when our practices, the service or legal requirements change. We will publish the updated version and revise the effective date. If a change materially affects how we use sensitive information or Google user data, we will provide additional notice or seek consent where required.

14. Contact us

For privacy questions, access or correction requests, deletion requests or complaints, contact:

Sublime Studio Co Pty Ltd ABN 38 690 513 181 Email: hello@sublimestudio.com.au Victoria, Australia