Privacy Policy

1Information we may collect

Depending on how you use Coach Anaya, we may collect:

Account and contact information

This may include your name, email address, telephone number, account identifier, login information, communication preferences and other information needed to create and manage your account.

Health and wellness information

You may choose to provide information such as health goals, health conditions, dietary requirements, allergies or intolerances, food preferences, fasting information, medication and supplement records, mood information, wellness information and other information relevant to your use of Coach Anaya.

We treat health information as sensitive information and apply additional safeguards where required by law.

Food and nutrition information

This may include foods and meals you log, barcode scans, product information, ingredients, nutritional information, quantities, photographs, recipes, portions and related notes.

Voice, text and AI interactions

We ask for your permission before sending this information to OpenAI. Your choice is saved to your account. You can decline or withdraw permission through Account & Privacy → AI Processing. Withdrawal prevents future OpenAI requests until you give permission again; it does not itself delete your account information. Microphone, camera and photo-library permissions remain separate.

Coach Anaya may process:

• spoken requests and commands;
• transcripts of voice interactions;
• text messages and questions;
• information you provide during AI coaching interactions; and
• AI-generated responses associated with your use of the service.

We do not routinely retain raw voice recordings after they are no longer required for transcription or processing. Voice data may nevertheless be temporarily processed by our technology providers as necessary to provide the service.

Photos and camera information

If you use photo-based food features, we may process photographs you take or select for meal, food, product or nutrition analysis.

Medication and supplement information

You may choose to record medicines, supplements and related timing or reminder information.

Coach Anaya is not intended to determine medication dosage, initiate or discontinue medication, or make treatment decisions.

Care Circle and Knock Knock information

If you use Care Circle or Knock Knock, we may collect information about people you nominate as contacts, including their name and contact details.

A nominated Care Circle contact must complete the applicable acceptance process before routine health or wellness information or automatic escalation information is shared with them.

Purchases and subscription information

We may receive information relating to subscriptions, purchases, credits, entitlements, transaction status and purchase history.

Payment processing may be undertaken by Apple, Google, Stripe or another authorised payment provider, depending on where and how you purchase a service. We generally do not receive your complete payment-card details from those providers.

Device and technical information

We may collect technical information such as device type, operating system, app version, IP address, identifiers required for account or service operation, diagnostic information, security logs and service-usage information.

If you enable push notifications, we may collect and use a device-specific push notification token and your notification preferences to deliver reminders, check-ins, safety notifications and other app communications. We use this information for app functionality and not for advertising or cross-service tracking.

Support and correspondence

If you contact us, we may retain communications and information reasonably necessary to respond to your enquiry, resolve problems or maintain appropriate records.

2How we collect information

We may collect information directly from you when you create an account, complete onboarding, enter information, speak with Anaya, upload a photograph, scan a product, contact us, make a purchase or enable a feature.

We may also receive limited information from:

• Apple, Google or payment providers;
• authentication and communications providers;
• service providers supporting Coach Anaya;
• a Care Circle participant where relevant; and
• automated technical systems necessary to operate, secure and improve the service.

Where another person provides information about you, we will handle that information in accordance with applicable law.

3How we use personal information

We may use personal information to:

• create and administer your account;
• provide Coach Anaya’s food, nutrition, wellness, voice, logging and coaching features;
• personalise the service based on information you choose to provide;
• process food photographs, barcodes and product information;
• provide reminders, notifications and user-enabled nudges;
• maintain medication and supplement logs and reminders;
• operate Knock Knock and Care Circle where enabled;
• provide subscriptions, credits and purchased features;
• respond to support requests;
• protect users, accounts and our systems from misuse, fraud or security threats;
• diagnose technical problems and improve reliability;
• comply with legal and regulatory obligations; and
• improve Coach Anaya and our services.

We do not use Coach Anaya to make decisions about your eligibility for employment, insurance, credit or similar significant services.

4AI processing and service improvement

FoodRx currently uses OpenAI as Coach Anaya’s AI service provider. Depending on the feature you use, information you choose to share—including messages and relevant conversation history, relevant health and wellness profile details and food logs, voice/audio or transcripts, and food or label photographs—may be sent to OpenAI to generate written or spoken responses, transcribe speech, or analyse food and images.

Coach Anaya uses artificial intelligence and automated systems to provide responses and analyse information you choose to submit.

AI systems can make mistakes. Information supplied to Coach Anaya may therefore be processed by our authorised AI and cloud service providers for the purpose of providing the requested functionality.

We do not sell identifiable health information.

Unless we separately tell you and obtain any consent required by applicable law, we do not use identifiable health information to train general-purpose AI models for third parties.

We may create and retain de-identified or aggregated information that no longer identifies you. For example, we may retain de-identified barcode, product, ingredient and nutritional information to improve Coach Anaya’s shared food and product intelligence.

De-identified or aggregated information may be retained and used for research, analytics, product improvement and development where permitted by law.

5When we may disclose information

We may disclose personal information where reasonably necessary to provide Coach Anaya, including to authorised service providers supporting:

• cloud hosting and databases;
• artificial intelligence and transcription;
• communications and notifications;
• authentication and account services;
• payment processing;
• analytics and service reliability; and
• customer support and security.

We require service providers to handle information consistently with applicable contractual and legal requirements.

We may also disclose information:

• when you direct or authorise us to do so;
• to an accepted Care Circle contact where you have enabled the relevant functionality;
• where reasonably necessary to investigate unlawful or abusive conduct;
• where required or authorised by law; or
• where necessary to establish, exercise or defend legal rights.

Coach Anaya is not an emergency service. Nothing in this Privacy Policy guarantees that a communication, reminder or escalation will be received or acted upon.

6International processing

Coach Anaya uses cloud and technology services that may process or store information outside Australia.

Known processing or storage locations currently include Australia, Singapore and the United States, and information may also be processed in other countries by authorised service providers or their subprocessors.

Infrastructure, subprocessors and processing locations may change from time to time.

We maintain a public Service Providers & International Processing page describing material providers and known processing arrangements. We update that information where reasonably practicable.

Where personal information is disclosed overseas, we take reasonable steps required by applicable law in relation to that disclosure.

7WhatsApp, SMS and other communications

Where you choose to use SMS, telephone or WhatsApp-related functionality, relevant contact and communication information may be processed by the communications providers required to deliver that service.

If WhatsApp functionality is enabled for Knock Knock, Care Circle or other communications, relevant information may be processed through WhatsApp/Meta and our authorised WhatsApp service provider.

Using these features is subject to the applicable feature settings, consents and third-party service arrangements.

SMS verification and Care Circle requests

FoodRx uses Twilio to send phone-verification codes and supported Care Circle contact requests. These messages may include the member’s name, a request to contact them, an indication that urgent support may be needed, and their verified callback number when available.

When you reply, we receive your phone number, message content and delivery information to process the response. Eligible replies may be interpreted by OpenAI only with the replying person’s current AI-processing consent. STOP requests are handled without AI interpretation. A contact’s acknowledgement does not establish that the member is safe, and Anaya is not an emergency service.

Twilio currently makes message records accessible for 400 days. This is not a guaranteed deletion deadline: backup storage remains enabled and may retain records indefinitely. FoodRx also retains delivery, reply-processing and opt-out records. Deleting an Anaya account does not automatically delete every provider record or record not linked to that account.

8Marketing communications

We may send marketing or promotional communications where you have consented or where otherwise permitted by law.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided or by contacting us.

Operational communications required to administer your account, purchases, safety settings or requested services are not necessarily marketing communications and may continue while your account or relevant service remains active.

9Security

We use reasonable technical, organisational and administrative measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No internet, mobile or cloud-based system can be guaranteed to be completely secure.

You are responsible for protecting your login credentials and for telling us promptly if you believe your account has been compromised.

10Retention, deletion and de-identification

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to operate the service, or as required or permitted by law.

If you request deletion of your Coach Anaya account, we will close the account and delete or de-identify personal information that we are no longer required or permitted to retain.

Certain information may need to be retained for longer periods because of health-record, taxation, transaction, security, dispute-resolution or other legal requirements.

Where information must be retained after account closure, we will restrict its use and will not use it for ordinary account personalisation or marketing.

Deletion from backups and distributed systems may take additional time. Where deletion is legally permitted, backup deletion may take up to 90 days.

Properly de-identified or aggregated information may be retained after account deletion because it no longer identifies the individual.

You can learn more or request deletion at foodrx.com.au/coach-anaya-account-deletion.

11Your choices and privacy rights

Depending on where you live, you may have rights relating to access, correction, deletion, restriction, objection, portability, withdrawal of consent or complaints.

Australian users may request access to or correction of personal information we hold about them, subject to applicable law.

Additional regional rights are described on our Privacy Rights page.

To make a privacy request, contact privacy@foodrx.com.au.

We may need to verify your identity before fulfilling certain requests.

12Adults only

Coach Anaya is intended for people aged 18 years and over at launch.

We do not knowingly offer the service to children or intentionally collect personal information from people under 18 through Coach Anaya.

If we introduce a service specifically for younger users in the future, it will be subject to appropriate additional privacy, consent and safeguarding arrangements.

13Third-party services and links

Coach Anaya may contain links to or interact with third-party services.

Their privacy practices are governed by their own policies, except where they process information on our behalf under our contractual arrangements.

We are not responsible for independent third-party websites or services that you choose to access.

14Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, legal obligations or privacy practices.

When changes are material, we will provide appropriate notice where required by law.

The current version and its effective date will be available on this page.

15Contact us

For privacy questions, requests or complaints:

FoodRx Ventures Pty Ltd, trading as Coach Anaya
ABN 91 702 560 138; ACN 702 560 138
470 St Kilda Road
Melbourne VIC 3004
Australia

Email: privacy@foodrx.com.au
Telephone: 1800 880 081

If you are not satisfied with our response to a privacy complaint, you may also have the right to contact the relevant privacy or data-protection regulator in your jurisdiction.