The Maia Method Privacy Policy

• What we collect: Your email, optional demographic details, and wellness information you choose to share (e.g., stress, sleep, health goals). We also collect limited system data (e.g., device type, error logs) to keep the app running smoothly.
• Why we collect it: To provide personalised health insights, track your progress, and improve The Maia Method's services. Without your email, you can't create an account. Without wellness information, The Maia Method can't provide tailored recommendations.
• Your rights: You can access, correct, or delete your data at any time. You can withdraw consent for optional uses like analytics or model evaluation.
• How we protect it: Data is encrypted in transit and at rest, with strict access controls, regular security testing, and breach response procedures.
• Who we share with: Trusted service providers who host or process data (e.g., Supabase, Pinecone, Vercel). We don't sell your personal information.
• Overseas transfers: Your data may be stored in the US, Germany, or Singapore. We remain accountable under Australian law for their handling.
• Contact us: If you have any privacy questions or complaints, you can contact our Privacy Officer at privacy@maiamethod.ai.

This Privacy Policy explains how The Maia Method ("we", "our", "us") manages personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We have implemented practices, procedures, and systems to ensure compliance with the APPs, including:

• Internal governance frameworks and staff training on privacy obligations.
• Procedures for handling privacy inquiries and complaints.
• Security and risk management programs aligned with OAIC guidance.

Where we are bound by any registered APP codes, we comply with those codes.

Where lawful and practicable, you may interact with us anonymously or using a pseudonym. However, services such as creating a wellness profile and receiving personalised insights require identifiable information.

At or before the time we collect your information (or as soon as practicable afterwards), we will notify you of:

• The purposes of collection.
• Whether collection is required or authorised by law (not currently applicable).
• The consequences if you do not provide information (see examples above).
• Whether we are likely to disclose information to law enforcement or regulators (only where legally required).
• That we disclose information to overseas recipients (see Section 8).
• How you may access, correct, or complain about our handling of your information.

We treat your wellness data as sensitive information under the Privacy Act. We will only collect and use this information with your express consent, or where otherwise permitted by law.

You may withdraw consent at any time through your account settings.

The Maia Method uses automated processing to provide recommendations. We take steps to ensure accuracy, fairness, and transparency, including:

• Regular testing for bias and accuracy.
• Evaluation processes before changes are deployed.
• AI models trained on de-identified data sets that do not include your personal conversations unless you have specifically consented.
• Transparency features ("Why this suggestion?").
• Human oversight over significant changes.

We do not make legally binding or high-risk decisions about you.

Your information may be disclosed to service providers located in the United States (Supabase, Pinecone, Vercel) and Germany and Singapore (where our cloud providers operate).

If we transfer data to additional countries in the future, we will update this policy or notify you.

We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, including contractual safeguards.

We retain your information only as long as necessary:

You can export or delete your data at any time.

We implement technical and organisational measures to protect your information, including:

• Encryption in transit and at rest.
• Role-based access controls.
• Staff training and background checks.
• Regular security assessments and penetration testing.
• Incident response procedures.
• Access logging and monitoring.
• Data loss prevention measures.

If an eligible data breach occurs:

• We will immediately conduct an assessment.
• If serious harm is likely, we will notify affected individuals and the OAIC within 30 days of becoming aware that the breach is likely to result in serious harm.
• We will provide recommendations to reduce risk.

You have the right to access and correct your personal information.

• We will respond within 30 days, extendable by a further 30 days in complex cases.
• Access may be refused where it would:
  • pose a serious threat to safety,
  • interfere with law enforcement activities,
  • breach legal professional privilege, or
  • reveal commercially sensitive information about our AI systems.
• Access is free unless significant administrative costs apply.
• Where access is refused, we will provide written reasons.

If you believe we have breached the APPs:

• Contact our Privacy Officer.
• We will acknowledge your complaint within 7 days.
• We will aim to resolve it within 30 days.
• If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC).

• The Maia Method is not directed to children under 18.
• We implement age verification checks at sign-up.
• If we discover a user is under 18, we will delete their information.
• If children's information is inadvertently collected, we may contact their parent/guardian to confirm consent or arrange deletion.

• Where we use data for analytics or AI improvement, we apply de-identification standards consistent with OAIC guidance.
• You may request a portable copy of your data in a structured, commonly used format.

The Maia Method uses AI to provide insights and recommendations. While these are automated, they are not binding decisions. We provide:

• Information about the logic used.
• Explanations for why a suggestion was made.
• The ability to opt out of automated analysis by deleting your account.

We monitor regulatory developments and may update our practices to reflect new requirements, including upcoming changes to children's privacy protections and AI governance standards.

As privacy laws evolve, we may implement additional rights and protections consistent with regulatory guidance and best practice.

We may update this Privacy Policy to reflect changes in law, technology, or our practices. Updates will be posted here, and material changes will be notified to you directly.

If you have questions about this privacy policy, please contact: