Privacy policy

Casa Feranis Privacy Policy

Last updated: 5 August 2026

1. Who we are

B Feranis Pty Ltd, trading as Casa Feranis, is an Australian family-owned creative, educational and wellbeing business.

Casa Feranis provides a digital home through which people may explore educational and inspirational content, receive free resources, subscribe to communications, contact us, purchase products or digital materials, participate in programmes and experiences, and access selected services offered through the different rooms of Casa Feranis.

In this Privacy Policy, “Casa Feranis,” “we,” “us” and “our” refer to B Feranis Pty Ltd trading as Casa Feranis.

Our website is hosted through Shopify, which provides the ecommerce and digital infrastructure that allows us to make parts of Casa Feranis available online.

Our Privacy Officer may be contacted at:

privacy@bferanis.com.au

We do not intend to publish the private residential address or personal telephone numbers of our family unless disclosure is legally required.

2. Scope of this Privacy Policy

This Privacy Policy explains how Casa Feranis collects, uses, stores, protects and discloses personal information when a person:

visits or interacts with our website;
joins the Casa Feranis mailing list;
requests or downloads a free resource;
contacts us through a form or by email;
creates a customer account;
purchases a physical or digital product;
registers for a course, workshop, programme or event;
participates in a membership or community feature;
submits a review, testimonial or other content;
makes a privacy request or complaint; or
uses another Casa Feranis service to which this Privacy Policy applies.

Not every part of this policy will apply to every visitor. The information we collect depends on how a person chooses to interact with Casa Feranis and which services are active at the time.

Certain services may also have an additional privacy notice, consent form, agreement or set of terms. In particular, B Vital nutrition and wellbeing services will use a separate Privacy Collection Notice and informed-consent process whenever health or other sensitive information is collected.

3. Our privacy commitments

Casa Feranis aims to handle personal information with care, transparency and respect.

Our privacy commitments are to:

collect only information that is reasonably needed for a clear purpose;
explain why information is being collected before or when it is collected;
avoid collecting personal or sensitive information merely because it may be interesting or useful later;
keep health and wellbeing records separate from general ecommerce and marketing systems;
never use health information for marketing segmentation or personalised advertising;
provide meaningful choices about newsletters, SMS messages and other optional communications;
protect personal information through appropriate technical and organisational safeguards;
limit access to people who genuinely need the information to perform their authorised role;
allow people to request access to, correction of or deletion of their information where applicable;
review and securely delete or de-identify information when it is no longer required, subject to legal retention obligations.

Casa Feranis will not require a person to agree to marketing as a condition of receiving customer support, purchasing a product or accessing a B Vital service.

4. Meaning of personal and sensitive information

Personal information is information or an opinion about an identified individual, or an individual who can reasonably be identified.

Depending on the circumstances, this may include a person’s name, email address, telephone number, postal address, order history, communications, account information or online identifiers.

Sensitive information requires greater protection. In the context of B Vital, this may include health information and information relating to:

physical or mental health;
medical conditions;
medicines and supplements;
allergies or intolerances;
symptoms;
dietary history;
weight or body measurements;
pathology or test results;
disability;
wellbeing;
family health circumstances; or
other information provided for the purpose of receiving a health or nutrition-related service.

Casa Feranis will only collect sensitive information through an appropriate protected process and where it is reasonably necessary for the relevant service.

5. Personal information we may collect

5.1 Website and device information

When a person visits our website, Shopify and approved technology providers may automatically process information such as:

IP address;
device and browser type;
operating system;
pages viewed;
links selected;
approximate location derived from an IP address;
referring website;
date and time of access;
cookie or similar technology identifiers; and
information about how the website is used.

This information may be used to operate, secure, understand and improve the website, subject to applicable privacy choices and cookie-consent requirements.

5.2 Newsletter and free-resource information

When a person chooses to join Casa Feranis or request a resource, we may collect:

name, when requested;
email address;
language or content preferences;
the resource requested;
subscription status;
the date, time and method of consent;
confirmation of double opt-in where used;
interactions with communications, where permitted; and
unsubscribe or communication-preference records.

Joining the mailing list is voluntary.

Marketing consent is separate from consent to receive an ordered product, requested resource, customer-service reply or other necessary service communication.

5.3 Contact and enquiry information

When a person contacts Casa Feranis, we may collect:

name;
email address;
an optional telephone number;
preferred contact method;
the subject and content of the enquiry;
attachments voluntarily provided;
previous communications relating to the enquiry; and
information needed to respond or resolve the matter.

Providing a telephone number does not authorise Casa Feranis to make an unsolicited telephone call.

Our normal contact method is email. We will use SMS only where the person has specifically requested or agreed to it, such as for an appointment reminder or another clearly stated purpose.

People should not send medical records, test results, medication lists or other sensitive health information through the general Ask Us form or ordinary email.

5.4 Purchases, accounts and transactions

When a person purchases something or creates a customer account, we may collect or receive:

name;
email address;
billing and delivery address;
telephone number where necessary for delivery or service;
products or services ordered;
transaction date and value;
payment status and payment method;
delivery and tracking information;
returns, refunds, cancellations or exchanges;
account settings and preferences; and
communications relating to the transaction.

Payment-card details are collected and processed directly by Shopify or the relevant payment provider. Casa Feranis does not intend to manually collect or store complete payment-card numbers.

Health conditions, symptoms, diagnoses and other sensitive information must not be entered into Shopify checkout fields, customer notes, order notes or payment descriptions.

Any payment for B Vital services will use a neutral description, such as:

B Vital Coaching Session

Payment and health-information collection will remain separate processes.

5.5 Courses, workshops, programmes and memberships

When these services become available, Casa Feranis may collect information reasonably needed to:

register participants;
confirm eligibility;
process payment;
provide access;
communicate schedules and service information;
record attendance or completion;
accommodate relevant accessibility requirements;
administer a membership or community;
moderate submitted content; and
provide certificates or other agreed outcomes.

We will update this Privacy Policy and provide any additional collection notice required before activating a service that collects materially different information.

5.6 B Vital health and wellbeing information

B Vital may collect sensitive health and wellbeing information where it is necessary to provide a requested nutrition or wellbeing service safely and appropriately.

This information will:

be collected through a dedicated protected process;
not be stored in Shopify;
not be placed in marketing systems;
not be submitted through general website contact forms;
not be used for advertising or customer profiling;
be accessible only to authorised people who genuinely require it;
be governed by a separate B Vital Privacy Collection Notice; and
be retained and disposed of according to applicable health-record requirements.

Casa Feranis will not launch a health questionnaire until an appropriate health-practice system has been selected, assessed and securely configured.

5.7 Information concerning people under 18

Casa Feranis will not provide personalised B Vital services to a person under 18 without the involvement of a parent or legal guardian.

For an under-18 client:

the parent or guardian will ordinarily be the contracting, payment and administrative contact;
appropriate guardian consent will be obtained;
the young person will receive an age-appropriate privacy explanation;
the young person’s views and assent will be sought in a manner suited to their age and understanding;
administrative information will remain separate from the young person’s protected health record;
the parent or guardian—not the young person—will be used as the marketing contact; and
privacy expectations, information-sharing boundaries and safety exceptions will be explained before services begin.

Guardian involvement does not mean that every piece of information should automatically be shared without considering the young person’s age, capacity, safety, privacy and applicable law. This more detailed boundary will be addressed in the B Vital Guardian Consent and Young Person Assent documents.

6. Information we deliberately avoid collecting

Unless it becomes genuinely necessary and legally appropriate, Casa Feranis does not intend to collect:

Tax File Numbers;
passport or driver-licence copies;
Medicare numbers;
Individual Healthcare Identifiers;
complete medical records;
complete payment-card details;
unnecessary information about relatives;
precise location information unrelated to a requested service;
children’s personal email addresses for marketing;
health information through general contact forms; or
information that is excessive for the purpose explained to the individual.

Where identity verification is required for a privacy request, we will seek the least intrusive evidence reasonably sufficient for that purpose.

6.1 Anonymity and pseudonymity

Where lawful and practicable, a person may browse Casa Feranis’ public content, make a general enquiry or provide general feedback without identifying themselves, or by using a pseudonym.

Identification may be necessary where Casa Feranis needs to:

deliver a purchase or requested service;
process a payment or refund;
provide account-specific customer support;
verify a privacy, access or correction request;
comply with a legal obligation;
investigate a complaint or security concern; or
safely provide a personalised B Vital service.

Where identification is required, Casa Feranis will seek only the information reasonably necessary for the relevant purpose.

7. How we collect personal information

Casa Feranis may collect personal information:

directly from an individual when they use our website, complete a form, subscribe, communicate with us, register, make a purchase or participate in a service;
automatically when an individual interacts with our website, emails or approved digital services;
through Shopify and other approved service providers that help us operate Casa Feranis;
from a parent, guardian or authorised representative where appropriate;
from payment, delivery, event or technology providers involved in fulfilling a person’s request;
from publicly available sources where collection is lawful, fair and reasonably necessary; or
where collection is required or authorised by law.

We aim to collect personal information directly from the individual concerned wherever this is reasonable and practicable.

Where information is provided about another person, the person providing it should have appropriate authority to do so and should ensure that the other person understands how their information will be handled.

Where we receive personal information that we did not request, we will consider whether we could lawfully have collected it. If the information is unnecessary and we are not required to retain it, we will take reasonable steps to delete or de-identify it.

Casa Feranis will provide an appropriate collection notice at or before information is collected whenever the circumstances require additional explanation. This may include a brief notice beside a website form linked to this Privacy Policy.

7.1 How and where we hold personal information

Casa Feranis primarily holds personal information electronically through Shopify, Microsoft 365 and other approved service providers used to operate our website, communicate with individuals and provide requested products or services.

Depending on the interaction, personal information may be held in:

Shopify customer, order, subscription and website systems;
Casa Feranis business email and restricted Microsoft 365 storage;
systems operated by approved payment, delivery and technology providers;
secure backups maintained by Casa Feranis or its service providers; and
limited paper records where these are reasonably necessary.

Payment-card information is processed by Shopify or the applicable payment provider. Casa Feranis does not intend to manually hold complete payment-card numbers.

Casa Feranis does not currently collect or store B Vital health questionnaires or coaching records. Before that service begins collecting health information, an appropriate protected health-practice platform will be selected, assessed and securely configured. B Vital health information will not be stored in Shopify, general marketing systems or ordinary website enquiry records.

Access to personal information is restricted according to the person’s authorised role and genuine business need. Further information about overseas processing, security and retention appears in Sections 12, 15 and 16 of this Privacy Policy.

8. How we use personal information

Depending on the person’s interaction with Casa Feranis, we may use personal information to:

provide requested website features, resources, products or services;
process and fulfil purchases, refunds, returns and exchanges;
deliver digital products or provide access to programmes and memberships;
create and manage customer accounts;
respond to enquiries and provide customer support;
manage registrations, bookings and attendance;
send necessary confirmations, receipts, security messages and service updates;
administer newsletter subscriptions and communication preferences;
send marketing communications where appropriate consent exists;
personalise content or remember preferences where permitted;
improve our website, resources, products and customer experience;
understand website use and service performance;
maintain accurate business, accounting and transaction records;
prevent, detect and investigate fraud, misuse, security threats or unlawful activity;
protect Casa Feranis, its customers, visitors and systems;
manage complaints, privacy requests, disputes and insurance matters;
meet legal, regulatory, taxation and reporting obligations;
obtain professional legal, accounting, technical or insurance advice; and
establish, exercise or defend legal rights.

We will generally use personal information for the purpose for which it was collected. We may use it for another purpose where the person has consented, where the secondary purpose is appropriately connected to the original purpose and reasonably expected, or where the use is otherwise permitted or required by law. Sensitive information will receive stricter treatment.

B Vital health information

Health and wellbeing information collected through B Vital may be used only where reasonably necessary to:

assess whether the requested service is appropriate;
provide nutrition or wellbeing coaching within the practitioner’s professional scope;
identify relevant safety considerations;
prepare for and document sessions;
communicate agreed educational information or recommendations;
maintain appropriate service and health records;
coordinate with another provider where the individual has authorised this or where the law otherwise permits it;
manage a serious safety concern where disclosure is legally permitted or required; and
meet professional, insurance, legal and record-retention responsibilities.

B Vital health information will not be used to advertise products, build marketing profiles, personalise commercial offers or decide which promotional messages a person receives.

It will not be entered into Shopify, a general marketing platform or a public artificial-intelligence service.

8.1 Lawful bases for processing in the United Kingdom and European Economic Area

Where the UK General Data Protection Regulation, the European Union General Data Protection Regulation or another law requiring a lawful basis applies, Casa Feranis may rely on one or more of the following bases:

Contract: where processing is necessary to provide a product, digital resource, programme or service requested by the individual, manage a purchase or account, or take requested steps before entering into an agreement.
Consent: where the individual has made a voluntary and informed choice, including for email marketing, optional SMS communications, non-essential cookies or another clearly explained purpose. Consent may be withdrawn at any time without affecting processing that occurred lawfully before withdrawal.
Legal obligation: where processing is necessary to comply with accounting, taxation, regulatory, consumer-protection, privacy, security or other applicable legal requirements.
Legitimate interests: where processing is reasonably necessary to operate, secure and improve Casa Feranis, prevent fraud or misuse, respond to general enquiries, administer the business, understand service performance, or establish, exercise or defend legal rights, provided those interests are not overridden by the individual’s rights and interests.
Vital interests: in exceptional circumstances where processing is necessary to protect a person’s life or physical safety and another lawful basis is not appropriate.

Where we rely on legitimate interests, we will consider the necessity of the processing, its likely impact on the individual and whether appropriate safeguards or a less intrusive approach are available.

Health and other special-category information

Health information and certain other sensitive information may be treated as special-category personal information under UK and European privacy law.

Before B Vital collects health information from an individual to whom those laws apply, Casa Feranis will:

identify and document an appropriate ordinary lawful basis;
identify and document a separate special-category condition;
explain the relevant basis and condition through the B Vital Privacy Collection Notice;
obtain explicit consent where explicit consent is the condition relied upon;
ensure that consent is specific, affirmative and capable of being withdrawn; and
assess whether any additional safeguards, impact assessment, local representative or professional review is required.

General acceptance of this Privacy Policy will not, by itself, be treated as explicit consent to the collection or use of health information.

9. Marketing and communication choices

Casa Feranis distinguishes between:

communications necessary to provide something a person requested;
optional appointment or service reminders;
newsletters and promotional communications; and
individual telephone contact.

Email marketing

We will send promotional email only where we have an appropriate basis to do so, ordinarily express consent.

Casa Feranis uses a confirmation process, including double opt-in where configured, to help confirm subscription choices and maintain reliable consent records.

We will maintain records showing, where available:

who provided consent;
the date and time of consent;
how consent was obtained;
the wording or form through which it was obtained;
confirmation status; and
any later withdrawal or unsubscribe request.

Every commercial electronic message sent by or for Casa Feranis will clearly identify the sender, include accurate contact details and provide a simple method of unsubscribing.

Australian unsubscribe requests will be actioned within the period required by law, ordinarily no later than five working days. A minimal suppression record may be retained after unsubscribing so that the person’s choice continues to be respected.

Unsubscribing from marketing does not prevent Casa Feranis from sending necessary non-promotional communications, such as:

order confirmations;
receipts;
delivery information;
security notices;
responses to enquiries;
appointment information; or
communications required to provide an existing service.

Automated welcome journeys containing promotional material will be treated as marketing communications and will include a functioning unsubscribe option.

Casa Feranis does not intend to buy marketing databases or add people to its mailing list merely because their contact information is publicly available.

SMS

SMS messages will be used only where a person has specifically requested or separately agreed to them, such as for an appointment reminder or another clearly explained purpose.

Consent to receive email does not automatically constitute consent to receive marketing SMS messages.

Telephone calls

Providing a telephone number does not authorise Casa Feranis to make an unsolicited telephone call.

We will call only where the person has specifically requested or agreed to telephone contact, or where contact is otherwise reasonably necessary and legally permitted in exceptional circumstances.

Health information and marketing

Health information, questionnaire responses, coaching records and the fact that a person uses B Vital will not be used for direct marketing unless the person has provided a separate, specific and informed consent that is legally valid.

Participation in a B Vital service will never be conditional upon joining the Casa Feranis marketing list.

Casa Feranis does not currently use purchased advertising lists or third-party advertising pixels. Should advertising integrations be introduced later, marketing consent and cookie consent will be assessed separately. Consent to receive Casa Feranis email communications will not automatically constitute consent to behavioural advertising or cross-site tracking.

Australian commercial electronic messages must identify the sender, provide accurate contact information and include a clear unsubscribe method. Unsubscribe requests must generally be honoured within five working days.

10. When we may disclose personal information

Casa Feranis may disclose only the personal information reasonably necessary to trusted recipients such as:

Shopify, which hosts and supports the website and ecommerce services;
payment processors and financial institutions involved in completing transactions;
delivery, fulfilment and postal providers;
Microsoft 365 and approved email or communication providers;
secure booking, health-practice, learning, event or membership platforms selected in the future;
information-technology, cybersecurity, website maintenance and cloud-service providers;
accountants, lawyers, insurers, auditors and other professional advisers;
contractors or collaborators who require limited information to perform an authorised role;
government agencies, regulators, courts, tribunals or law-enforcement bodies where disclosure is required or authorised;
another health or service provider where the individual has consented or disclosure is otherwise legally permitted; or
a prospective purchaser, successor or adviser involved in a genuine business reorganisation, merger or transfer, subject to appropriate confidentiality and legal safeguards.

Current advertising and tracking connections

At the date this Privacy Policy is published, Casa Feranis does not have third-party advertising pixels or custom pixels configured through Shopify Customer Events.

Casa Feranis does not currently connect its Shopify store to TikTok, Pinterest, Google and YouTube, or Facebook and Instagram for advertising-pixel purposes.

If Casa Feranis introduces an advertising, analytics or social-commerce integration in the future, we will assess its privacy implications before activation. Where necessary, we will update this Privacy Policy, provide an appropriate collection notice, configure consent and opt-out controls, and disclose the relevant recipient or category of recipients.

Casa Feranis does not sell personal information in exchange for money.

Certain privacy laws use broader definitions of “sale,” “sharing” or “targeted advertising.” Where such laws apply, eligible visitors may use the Your Privacy Choices page or another control made available through the website.

11. Our relationship with Shopify

The Casa Feranis website and ecommerce environment are hosted by Shopify.

When a person visits, creates an account or purchases through a Shopify-powered Casa Feranis service, Shopify may process information such as:

contact and transaction information;
billing and delivery details;
device and browser information;
IP address;
website interaction information;
payment and fraud-prevention information; and
cookie or similar technology data.

For many activities, Shopify processes customer information in order to provide services to Casa Feranis and acts on the merchant’s instructions. Certain Shopify consumer services or enhanced features may involve Shopify processing information for its own stated purposes.

Individuals may review the Shopify Consumer Privacy Policy and use Shopify’s privacy portal for rights that relate directly to Shopify’s own processing.

Casa Feranis remains responsible for determining why customer information is collected and how Casa Feranis uses it. Shopify explains that merchants, rather than Shopify, ordinarily decide matters such as the merchant’s retention of customer information.

Shopify Network Intelligence

Casa Feranis currently has Shopify Network Intelligence enabled.

When this feature is enabled, Shopify may use customer information from interactions with Casa Feranis together with information from interactions with Shopify and other Shopify merchants to provide enhanced services such as improved fraud protection, product functionality, personalisation, performance and advertising-related insights.

Other Shopify merchants cannot directly access Casa Feranis customer information through this feature.

Where Shopify’s automated consent or data-sharing controls apply:

a visitor’s refusal of non-essential cookies is communicated to Shopify;
an eligible visitor’s data-sharing opt-out is respected for relevant advertising purposes;
supported Global Privacy Control signals may be recognised; and
deletion requests processed through Casa Feranis may also affect information used in Shopify Network Intelligence.

Visitors may also use Shopify’s consumer privacy portal to exercise rights relating to Shopify’s independent processing.

Shopify requires merchants using Network Intelligence to explain the feature and provide appropriate consent or opt-out mechanisms in relevant jurisdictions.

12. Overseas processing and international disclosures

Casa Feranis is based in Australia, but some technology and service providers operate internationally.

Personal information processed through Shopify may be transferred to or processed by Shopify entities and approved service providers in countries including Canada and Singapore, as well as other countries in which Shopify or its subprocessors operate. Shopify’s contracting entity for merchants in the Asia-Pacific region is ordinarily based in Singapore.

Other approved providers may also process information outside Australia. The particular countries may change as providers, infrastructure and services evolve.

Where reasonably practicable, Casa Feranis will:

assess the privacy and security practices of service providers before engagement;
use appropriate contractual and technical safeguards;
disclose only the information needed for the relevant service;
restrict access;
consider data-hosting and subprocessor locations;
maintain records of key service providers; and
take reasonable steps required by applicable Australian privacy law before disclosing information overseas.

Australian privacy guidance provides that an organisation may remain accountable in certain circumstances for information disclosed to an overseas recipient.

Where European Economic Area, United Kingdom or Swiss data-transfer requirements apply, relevant providers may rely on recognised safeguards, contractual clauses or adequacy mechanisms as appropriate.

Providing information through an international digital service may therefore result in the information being processed in countries whose privacy laws differ from those of the individual’s home jurisdiction.

Casa Feranis will identify additional countries in this policy or a collection notice where doing so is practicable and materially helpful.

B Vital records

Before B Vital health information is stored through an external provider, Casa Feranis will assess:

where the records are hosted and backed up;
who may access them;
applicable international transfers;
encryption and multifactor authentication;
subprocessor arrangements;
incident-notification obligations;
export and deletion capabilities; and
contractual privacy protections.

No health-practice platform has yet been approved for live health-information collection.

13. Cookies and similar technologies

Casa Feranis and Shopify use cookies, local storage and similar technologies to operate and protect the website.

These technologies may be used to:

provide essential storefront, account, cart and checkout functions;
remember language, market and other preferences;
maintain security and prevent fraud;
understand website performance and visitor interactions;
improve navigation and content;
provide personalisation where permitted; and
support marketing or advertising-related functionality where activated and legally permitted.

Cookies may be classified as:

Required: necessary for essential website functions;
Personalisation: used to remember choices and tailor aspects of the website;
Analytics: used to understand website activity and performance; and
Marketing: used to support promotional measurement or relevant advertising where activated.

Consent and regional controls

Casa Feranis uses Shopify’s automated customer-privacy settings.

Shopify may display a cookie-consent banner to visitors in configured regions based on the store’s active markets and Shopify’s current recommendations. In those regions, visitors may:

accept all optional cookies;
decline all optional cookies;
manage categories individually; and
change their choices later through the available cookie-preference control.

Required cookies cannot be disabled through the preference panel because they are necessary for the website to operate.

The absence of a cookie banner in a particular location does not necessarily mean that no cookies are used. It may mean that Shopify’s automated settings do not currently display a consent banner in that visitor’s region.

Casa Feranis will not deliberately use its cookie banner to make acceptance more prominent or difficult to refuse.

Pixels and independent tracking

Shopify’s native cookie banner governs Shopify-supported cookies and Shopify Pixels.

At the publication date of this policy, Casa Feranis has no app pixels or custom pixels configured within Shopify Customer Events.

Before introducing any independent third-party tracker, pixel or similar technology, Casa Feranis will assess whether it:

honours the visitor’s consent choices;
sends personal or sensitive information;
is necessary for a legitimate business purpose;
requires an updated privacy or cookie notice; and
requires additional consent or opt-out controls.

Shopify warns that manually installed third-party cookies or pixels may require separate configuration to ensure they respect consent choices.

14. Automation and artificial intelligence

Casa Feranis may use carefully selected automation to:

deliver requested resources;
send confirmations and permitted email journeys;
organise non-sensitive enquiries;
manage routine business workflows; and
support the operation of its 24/7 digital environment.

Automation will not remove the individual’s communication or privacy choices.

Casa Feranis will not use a solely automated process to make health-coaching decisions about a B Vital client.

Identifiable health information, coaching notes and confidential client communications will not be submitted to publicly accessible artificial-intelligence systems.

Before introducing an AI chatbot, automated recommendation tool or other system that collects or infers personal information, Casa Feranis will assess the privacy risks, update relevant notices and provide choices where required. The OAIC’s updated 2026 collection guidance expressly recognises that inferred or AI-generated information may itself constitute collected personal information.

15. How we protect personal information

Casa Feranis takes reasonable technical and organisational steps appropriate to the nature, sensitivity and volume of the personal information we hold.

Our safeguards may include:

individual user accounts rather than shared logins;
multifactor authentication;
strong passwords and an approved password manager;
access restrictions based on genuine business need;
encryption where available and appropriate;
secure and regularly updated devices;
malware protection, security updates and system monitoring;
secure backups and recovery procedures;
careful selection and review of service providers;
restricted access to health and wellbeing information;
confidentiality expectations for authorised workers and contractors;
secure disposal or de-identification procedures;
records of important privacy decisions, incidents and access permissions; and
periodic review of applications, integrations, users and data flows.

Access to B Vital health information will be limited to individuals who are specifically authorised and require that information to perform their role. A person’s family connection to the Casa Feranis owners does not automatically give them access to client information.

We do not permit identifiable client health information, confidential coaching communications or protected records to be placed in public artificial-intelligence services, social-media messages, general Shopify customer notes or unapproved storage locations.

Where a service provider stores or processes information on our behalf, we will consider matters such as:

the information the provider can access;
its security and privacy practices;
data-storage locations;
subcontractors or subprocessors;
access controls and multifactor authentication;
breach-notification arrangements;
data export, deletion and account-closure procedures; and
whether the provider is appropriate for sensitive information.

No electronic transmission or storage system can be guaranteed to be completely secure. Individuals should avoid sending health records, payment-card details or other highly sensitive information through ordinary email or the general Ask Us form.

Australian privacy requirements expect organisations to use both technical and organisational safeguards and to protect information against misuse, interference, loss and unauthorised access, modification or disclosure.

16. Retention, deletion and de-identification

Casa Feranis retains personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required for legal, regulatory, taxation, accounting, insurance, safety or dispute-resolution purposes.

The applicable period will depend on:

the type and sensitivity of the information;
the service or transaction involved;
whether an account, subscription or relationship remains active;
the reasonable expectations of the individual;
applicable legal or professional retention obligations;
the possibility of a complaint, insurance matter or dispute;
whether deletion would interfere with another person’s rights; and
whether a minimum record is needed to honour a communication preference.

Our anticipated retention approach includes the following:

Newsletter and marketing records

Subscription information may be retained while a person remains subscribed.

After unsubscribing, we may retain a minimal suppression record—such as the email address, unsubscribe status and date—so that we do not accidentally add the person back to marketing communications.

General enquiries

Routine enquiries may ordinarily be reviewed for deletion approximately 12 months after they are resolved, unless the correspondence becomes part of an ongoing customer relationship, agreement, complaint, transaction or legal record.

Customer accounts

Account information may be retained while the account remains active and for a reasonable period afterward. An individual may ask us to close an account, subject to information we must retain for lawful purposes.

Orders and financial transactions

Invoices, receipts, payments, refunds and other financial records will be retained for the legally required period. Australian companies generally must keep financial records for at least seven years.

Workshops, courses and memberships

Administrative records may be retained for the duration of the programme or membership and for an appropriate period afterward to manage access, certificates, enquiries, complaints, legal obligations and business records.

B Vital health records

Where B Vital is acting as a Victorian private health-service provider, an adult client’s health records will ordinarily be retained for at least seven years after the last health service.

Where the client was under 18 when the last health service was provided, the records will ordinarily be retained until that individual reaches 25 years of age.

Privacy requests, complaints and incidents

Records concerning privacy requests, complaints, consent decisions, investigations and data incidents may be retained for an appropriate period to document how the matter was handled and to meet regulatory, insurance or legal obligations.

When information is no longer required and no legal exception applies, Casa Feranis will take reasonable steps to destroy it securely or de-identify it.

Deletion from an active system may not immediately remove information from encrypted backups. Information remaining in backups will be protected, placed beyond ordinary use and removed through the provider’s normal secure backup-replacement cycle.

Australian privacy requirements generally require information that is no longer needed to be destroyed or de-identified unless an Australian law or court or tribunal order requires its retention. This expectation can extend to archived and backup copies that an organisation controls.

17. Privacy rights and choices

Depending on the person’s location and the law that applies, they may have rights concerning their personal information, including the right to:

ask whether Casa Feranis holds personal information about them;
request access to that information;
request correction of inaccurate, incomplete, irrelevant, outdated or misleading information;
request deletion where no lawful reason requires continued retention;
withdraw consent where processing is based on consent;
unsubscribe from direct marketing;
object to certain uses of personal information;
ask for processing to be restricted in particular circumstances;
receive certain information in a portable format;
opt out of certain data sharing or targeted-advertising activities;
complain about how personal information has been handled; and
avoid decisions based solely on automated processing where applicable law provides that protection.

These rights are not absolute. A request may be limited or refused where permitted or required by law—for example, where information must be retained, the request would affect another person’s privacy, legal privilege applies, identity cannot reasonably be verified or another lawful exception exists.

Australian law provides rights of access and correction. Where European or United Kingdom privacy laws apply, additional rights may include erasure, restriction, portability, objection and protection from certain solely automated decisions.

Making a request

A person may exercise a privacy right by contacting:

privacy@bferanis.com.au

The request should describe:

the name and contact details of the person making the request;
the information or processing activity concerned;
the right they wish to exercise; and
any information that may help us locate the relevant record.

We will not require more identity information than is reasonably necessary. Depending on the sensitivity of the information and the nature of the request, we may ask for proportionate evidence to verify identity or authority.

An authorised representative may make a request where they provide appropriate evidence of their authority.

Casa Feranis will not discriminate against a person because they have exercised a privacy right.

For ordinary access and correction requests, we will aim to respond without undue delay and, where reasonably practicable, within 30 calendar days. If additional time is needed because the request is complex or requires consultation, we will explain the delay and provide an updated timeframe. The OAIC regards 30 calendar days as a general guide for organisations responding to access or correction requests.

18. Access to and correction of B Vital health records

A B Vital client may request access to health information held about them, subject to applicable law.

Access may be provided through one or more appropriate methods, such as:

inspection of the record;
an electronic or paper copy;
a summary;
an explanation from an appropriate provider; or
access through an agreed intermediary where direct access would not be appropriate.

We may ask that a health-record request be made in writing and may require reasonable proof of identity or authority.

Victorian health-record access requests should be addressed as quickly as possible and no later than 45 days after receipt. Certain access fees may be permitted but are capped by Victorian law.

Access may be limited or refused only where permitted or required by applicable law. This could include circumstances involving:

a serious threat to a person’s life or health;
another person’s privacy;
information provided in confidence by another person;
legal professional privilege;
existing legal proceedings;
unlawful disclosure;
law-enforcement or security functions; or
an unreasonable repeated request.

Where full access cannot be provided, we will consider whether partial access, redaction, a summary or an intermediary could appropriately meet the request.

Correcting health information

A person may ask B Vital to correct health information they believe is inaccurate, incomplete, outdated or misleading.

Health records sometimes need to preserve the original clinical or service entry. In those circumstances, the record may be corrected through an amendment, annotation or associated statement rather than erasing the original entry.

Where a correction is refused, we will provide reasons where required and allow the person to provide an appropriate statement of disagreement to be kept with the record.

No fee will be charged for requesting or making a correction. Where Victorian health-record law applies, B Vital will respond to a correction request without unreasonable delay and no later than 30 days after receiving it.

Victorian guidance confirms that individuals may seek access and correction, that refusal grounds are limited, and that a statement of the requested correction must be kept with a record where appropriate.

19. Privacy questions and complaints

Questions, concerns and complaints about this Privacy Policy or Casa Feranis’ handling of personal information should first be directed to:

Privacy Officer B Feranis Pty Ltd trading as Casa Feranis privacy@bferanis.com.au

A complaint should, where possible, include:

the individual’s name and preferred contact method;
a description of what occurred;
relevant dates or communications;
the information or service concerned; and
the outcome the person is seeking.

We will:

acknowledge the complaint as soon as reasonably practicable;
review the concern fairly and confidentially;
request only the additional information needed to investigate it;
involve only people who genuinely need access;
explain our findings and proposed resolution; and
advise the person about relevant external complaint options where the matter remains unresolved.

We aim to provide a substantive response within 30 calendar days where reasonably practicable. Where a matter is complex, we will explain why more time is needed and provide an updated timeframe.

The OAIC recommends that privacy complaints generally be made to the organisation first and that the organisation usually be allowed approximately 30 days to respond.

External complaints

If an Australian privacy complaint has not been resolved after it has first been raised with Casa Feranis, the person may be able to complain to the Office of the Australian Information Commissioner.

For complaints concerning a Victorian health service or the handling of health information in Victoria, the person may also be able to contact the Victorian Health Complaints Commissioner. The HCC generally asks people to raise the concern with the provider first.

A person outside Australia may also have the right to complain to the privacy or data-protection authority responsible for their jurisdiction where that jurisdiction’s law applies.

20. Data breaches and privacy incidents

Casa Feranis will maintain a process for identifying, containing, assessing, documenting and responding to suspected privacy and security incidents.

Depending on the circumstances, our response may include:

securing affected accounts or systems;
changing passwords or access credentials;
suspending compromised integrations;
preserving relevant evidence and logs;
determining what information was involved;
identifying who may be affected;
assessing possible harm;
taking remedial action;
contacting service providers, cybersecurity advisers, insurers or legal advisers;
notifying affected individuals where appropriate;
notifying regulators where required; and
reviewing controls to reduce the risk of recurrence.

Under Australia’s Notifiable Data Breaches scheme, a covered organisation must notify affected individuals and the OAIC where an eligible breach is likely to cause serious harm and remedial action has not removed that likely risk. Private health-service providers covered by the Privacy Act are included in the scheme.

Where a breach involves Victorian health information, Casa Feranis will also consider its responsibilities under the Health Records Act and whether engagement with the Victorian Health Complaints Commissioner is appropriate.

When notification is appropriate or required, we will seek to communicate clearly, without unnecessary delay, and provide practical information about protective steps an affected person may take.

21. Children and young people

Casa Feranis may provide family-oriented educational content, products or experiences. However, a person under 18 should not independently enter into a paid personalised B Vital service.

For B Vital services involving a person under 18:

a parent or legal guardian must be involved;
the parent or guardian will ordinarily be the contracting, administrative and payment contact;
guardian consent will be obtained;
the young person will receive an age-appropriate privacy explanation;
their capacity, maturity and understanding will be considered;
the young person will be involved in decisions as far as reasonably practicable;
their assent will be sought;
privacy and safety boundaries will be explained before services begin; and
the parent or guardian—not the young person—will be the marketing contact.

The parent’s involvement does not automatically mean that every communication or disclosure by a mature young person will be shared without considering privacy, capacity, wellbeing, safety and applicable law.

Australian privacy law does not establish one universal age at which a young person can make every privacy decision. Capacity depends on whether they can understand the proposed decision and its consequences, although a person aged 15 or over may often be presumed capable unless circumstances suggest otherwise.

Casa Feranis does not intend to use a child’s personal information for behavioural advertising or marketing profiling.

If we discover that a young person’s personal information has been collected inappropriately, we will take reasonable steps to delete, de-identify or otherwise handle it lawfully, while preserving any information that must be retained for health, safety or legal reasons.

22. Third-party websites, services and public content

The Casa Feranis website may contain links to third-party websites, platforms, applications or social-media services.

Those third parties operate under their own terms and privacy practices. Casa Feranis does not control and is not responsible for how an independent third party collects, uses, secures or discloses information after a visitor leaves our website.

Visitors should review the privacy information of a third-party service before providing personal information to it.

Information voluntarily posted in a public or community area may be visible to other people. Before Casa Feranis introduces reviews, comments, community profiles or member posts, we will provide appropriate terms and privacy information explaining:

what will be public;
what will remain private;
available moderation controls;
how content may be removed; and
how long relevant records may be retained.

A private health or coaching disclosure should never be posted in a public review, comment or community area.

23. Changes to this Privacy Policy

Casa Feranis may update this Privacy Policy to reflect:

changes to our products, services or business model;
new platforms, applications or service providers;
changes to information-handling practices;
new legal or regulatory requirements;
security or risk-management developments; or
improvements to clarity and transparency.

The revised version will be published on the Casa Feranis website with an updated Last updated date.

Where a change is material and applicable law requires additional notice or consent, we will take reasonable steps to provide that notice or obtain that consent.

Previous versions may be retained internally for governance and record-keeping purposes.

24. Contact Casa Feranis

For privacy questions, access or correction requests, objections, consent withdrawals, complaints or other privacy matters, please contact:

Privacy Officer

B Feranis Pty Ltd trading as Casa Feranis

Email: privacy@bferanis.com.au

At present, Casa Feranis manages privacy enquiries and requests primarily by email. If you require an alternative communication method, including telephone or postal correspondence, please contact our Privacy Officer so that appropriate arrangements can be made.

Casa Feranis does not publish its owners’ private residential address or personal telephone numbers unless legally required.

For the purposes of applicable international data-protection laws, B Feranis Pty Ltd is the controller of personal information where it determines why and how that information is processed.

Questions about Shopify’s independent processing should be directed through the privacy mechanisms made available by Shopify.

Country/region