Draft for testing. Details still to be confirmed before launch are highlighted.

Privacy Policy

Last updated: date · Operator: Legal entity name (ABN ABN) ("Arys", "we", "us") · Privacy contact: privacy email | address

This policy explains how we collect, use, share and protect personal information. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We have written a shorter, child-friendly version at arys.com.au/legal/privacy-for-kids.

1. Who this policy covers

1.1 Athletes, parents and guardians, family account holders, guests, coaches and coaching staff, and referrers.

1.2 Coaches who use Arys also handle your information. They are responsible for how they use it outside the Platform.

2. What we collect

2.1 Account and contact details: name, email, phone number, date of birth, and parent or guardian email for 15–17 year olds.

2.2 Family details: child profiles linked to a parent or guardian account.

2.3 Safety information: emergency contact details.

2.4 Health information (optional): medical notes, such as allergies, injuries or conditions. This is sensitive information. We only collect it with your consent (or a parent's consent for a child).

2.5 Training data: training logs, levels, skill-test results, bookings and attendance.

2.6 Homework videos: videos you upload for coach feedback.

2.7 Photo consent: whether images of the athlete may be used by their coach.

2.8 Location: the suburb or postcode you search with, to find nearby coaches. We never collect your device's exact location. We keep a lookup of suburbs and postcodes (not who searched them) so later searches are faster. If you ask us to tell you when a coach joins near you, we keep that suburb and its approximate map point until we've told you or you cancel the alert. If you choose to share your suburb when you ask a coach a question, that coach sees it with your question.

2.9 Payment information: handled by Stripe (and Apple, Google or RevenueCat for in-app purchases). We do not store full card numbers. We receive limited details such as card type, last four digits and payment status.

2.10 Guest bookings: name, email and payment details.

2.11 Coach and staff information: identity verification results (through Stripe), Working with Children Check details, qualifications and insurance certificates.

2.12 Referrer information: referral links, earnings and payout details. Payout identity checks and bank or debit card details are collected by Stripe.

2.13 Messages and reports: messages sent on the Platform, reviews, and reports you make.

2.14 Technical information: device type, app version, IP address, log data and crash reports.

3. How we collect it

3.1 Mostly directly from you. We also receive information from coaches (for example attendance and skill-test results), from Stripe (verification and payment status), from Working with Children Check registries, and from a parent or guardian about their child.

3.2 If someone books as a guest using your email, we link that booking to your account when you sign up with that email.

4. Why we use it

We use personal information to:

(a) create and manage accounts and family profiles;

(b) let you find coaches, book, pay and join memberships;

(c) let coaches deliver coaching, track progress and give feedback;

(d) verify coaches and enforce child safety rules, including blocking bookings of minors with staff who lack a valid WWCC;

(e) process payments, refunds, failed-payment retries and referral payouts;

(f) send service, safety and (if you opt in) marketing notifications;

(g) show the "Found you on Arys" attribution to coaches;

(h) rank coaches in the directory;

(i) prevent fraud, self-referral and misuse;

(j) handle complaints and reports; and

(k) improve the Platform and meet our legal obligations.

5. Sharing with coaches

5.1 When you join or book with a coach, they see your name, contact details, booking history, and the training data needed to coach you.

5.2 Medical notes and emergency contacts are shared only with the coaching staff of the organisations you train with.

5.3 Training history sharing is your choice. You can switch it on for a coach and switch it off at any time.

5.4 Messages with a minor are visible to the child's parent or guardian.

5.5 Directory attribution: coaches see whether an athlete found them through the Arys directory.

6. Aggregated statistics

6.1 Coach profiles may show a "median improvement" figure based on skill-test results. This only uses results from athletes who have consented, is de-identified, and only appears once at least 10 athletes are included.

7. Service providers and overseas disclosure

7.1 We use service providers to run the Platform, including:

7.2 Some of these providers store or process information outside Australia. We take reasonable steps under APP 8 to make sure they handle it in line with the APPs, including contractual protections.

7.3 We do not sell personal information.

8. Marketing

8.1 Coach offers (marketing) are off by default. You can opt in by type in settings and opt out at any time.

8.2 Child profiles cannot opt in to coach offers or other marketing.

8.3 We comply with the Spam Act 2003 (Cth). Every marketing email or SMS has an unsubscribe option.

9. Children's privacy

9.1 We collect date of birth to apply age-appropriate settings.

9.2 Under 15: a parent or guardian must create and manage the account and give consent for the child's information to be collected and used.

9.3 Aged 15–17: the young person may hold a profile. A parent or guardian's email is collected for important notices.

9.4 For children, we apply privacy-protective defaults: no marketing, no public feed, messages visible to the parent, and no stored location.

9.5 We aim to comply with the Children's Online Privacy Code being developed by the OAIC. The OAIC published an exposure draft in 2026, and the final code must be registered by 10 December 2026. We will update this policy when it is final.

9.6 We consider the best interests of the child when deciding how to handle children's information.

10. Automated decisions

10.1 We use automated processes to rank coaches in the directory (rating, distance, verification, availability, reply speed), to attribute directory referrals, to retry failed payments and to flag possible fraud or self-referral.

11. How long we keep information

11.1 Homework videos are stored privately and deleted after 90 days.

11.2 Location: we don't store anyone's exact location. A suburb is kept only for coach-near-me alerts you ask for, or when you choose to share it with a coach (see 2.8).

11.3 Other information is kept while your account is active and for X years afterwards for legal, tax and dispute purposes. Payment and tax records are kept for at least 5 years. Child safety records may be kept longer.

11.4 When we no longer need information, we delete or de-identify it.

12. Security

12.1 We use reasonable security measures, including encryption in transit, access controls based on staff roles, and private storage for videos. No system is perfectly secure.

12.2 If a data breach is likely to cause serious harm, we will notify affected people and the OAIC under the Notifiable Data Breaches scheme.

13. Access and correction

13.1 You can view and update most of your information in the app. You can ask us for access to, or correction of, any information we hold by emailing privacy email. We will respond within 30 days.

13.2 A parent or guardian can request access for their child's profile.

13.3 You can ask us to delete your account and information. Some records may need to be kept by law.

14. Complaints

14.1 Email privacy email with details of your complaint. We will acknowledge it within 5 business days and aim to resolve it within 30 days.

14.2 If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.

15. Changes

15.1 We will post updates here and notify you of material changes.

References

• Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs 1–13), including APP 3 (sensitive information), APP 6, APP 8 (cross-border disclosure), APP 11 (security), APP 12–13 (access and correction).
• Privacy and Other Legislation Amendment Act 2024 (Cth) — Children's Online Privacy Code requirement and automated decision-making transparency.
• OAIC, Children's Online Privacy Code exposure draft (2026): oaic.gov.au/privacy/privacy-for-kids
• OAIC, Notifiable Data Breaches scheme: oaic.gov.au
• Spam Act 2003 (Cth).