PRIVACY POLICY

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and any other privacy laws that apply to us. Some parts of the Privacy Act may apply differently depending on our size, activities, health information handling, related entities, overseas dealings and services. We aim to manage personal information in an open, transparent and secure way.

You may browse our public website, read our blog and use our public assessment tools without telling us who you are. Where it is lawful and practicable, you may also deal with us anonymously or under a pseudonym — for example when making a general enquiry.

For most of our Services this is not practicable. We need to identify you to create and secure an account, take payment, issue invoices and receipts, record CPD and issue certificates, verify eligibility and practice ownership, deliver programs, and meet our tax and record-keeping obligations. In those cases we will ask for the information we need and tell you why.

The types of personal information we collect may include:

• identity and contact details, including name, email, phone number, address, professional title, practice name, business name and ABN
• account details, login details, user IDs, order IDs, passwords, access permissions and learning platform activity
• professional details, including role, profession, registration status, CPD requirements, practice ownership interests, course preferences and program suitability information
• transaction and payment details, including invoices, receipts, purchase history, payment plan details and payment status — we generally do not store full card details where payments are processed by third-party payment providers
• attendance, completion, support and learning information, including event attendance, module completion, assessment information, CPD records, survey responses, quiz results, support requests and communications
• communications, including emails, SMS, calls, messages, social media messages, community posts, forms, feedback, testimonials and complaints
• media and event information, including photographs, video, audio, livestream, recordings and screenshots captured at events or online sessions
• technical information, including IP address, device ID, browser, operating system, cookies, analytics, access logs, timestamps, download logs, watermark identifiers, security logs and website usage data
• marketing preferences and engagement information, including opt-ins, opt-outs, email opens, link clicks, segmentation, interests and campaign performance
• assessment and profiling results, including 4ID, partner, team and recruitment assessment responses and scores, core value scores and quiz results
• community content, including posts, comments, votes, accepted answers, reports you make about other content, and moderation records
• rewards and activity information, including Points balances and Points history, badges, streaks, login activity, referral records and reward redemptions
• practice and business performance information you choose to enter, including production, revenue, patient numbers, targets, planner entries and similar practice metrics
• device and notification information, including push notification endpoints where you enable notifications, and stored preferences on your device
• information you provide about staff, associates, patients, clients, cases or third parties, where relevant to program delivery or support
• information about candidates and people you invite, including their name, email address and phone number, and their assessment responses and results

We may collect personal information directly from you when you use our website, purchase, enrol, register, attend an event, create an account, download content, complete forms, contact us, join a community, provide feedback, participate in surveys, submit case examples, communicate with our team or interact with our marketing.

We may also collect information from payment processors, finance providers, CRM systems, learning platforms, email providers, analytics providers, social media platforms, referral partners, presenters, suppliers, supporters, professional advisers and publicly available sources where lawful and reasonably necessary.

We collect, use and disclose personal information for purposes including:

• providing, administering, improving and personalising the Services
• processing enrolments, payments, refunds, payment plans, invoices, receipts and finance arrangements
• verifying identity, eligibility, attendance, CPD records, access rights and compliance
• delivering programs, events, workshops, online resources, communities, support, coaching, communications, certificates and participant benefits
• sharing relevant details with suppliers, supporters, presenters, coaches, venue providers, accommodation or event providers, support partners, sponsors, product suppliers, IT providers and other people reasonably involved in delivering, supporting or improving the program
• managing accounts, passwords, security, watermarking, traceability, IP protection, fraud prevention and breach investigation
• responding to enquiries, requests, complaints, disputes, chargebacks, support matters and legal issues
• marketing our products, services, events, courses, offers, content and updates, including by email, SMS, social media, retargeting, online advertising and similar channels, subject to your opt-out rights
• using testimonials, photos, videos, event recordings and feedback where we have consent or another lawful basis
• complying with legal, tax, accounting, reporting, insurance, regulatory, professional and record-keeping obligations
• protecting our rights, Content, Confidential Information, business, participants, suppliers and the public

Some features ask you to give us another person's details; for example inviting a colleague through a referral link, or inviting a candidate to complete a recruitment assessment.

If you give us someone else's personal information, you must have their consent to do so, and you must tell them that their details are being given to us and why. You must not submit details of a person who has asked not to be contacted.

If you are a candidate or invitee: we collected your name and contact details from the member who invited you, who is usually a practice owner or employer. We use them only to send you the invitation or assessment link, to run the assessment, to make your result available to the person who invited you, and to keep records of that process. Your result is disclosed to the member who invited you. We do not use your details for our own marketing unless you separately sign up. Assessment invitations expire, and unclaimed records are removed after they expire. You can ask us what we hold about you, ask us to correct it, or ask us to delete it, by emailing powerup@drtiv.com.

The Services include assessment and profiling tools whose responses are scored automatically. Results are stored in your account, are used to personalise content, recommendations and program suitability, and are visible to our team and to coaches supporting your program. Where you invite a candidate or partner to complete an assessment, their result is made available to you.

These tools are educational. They are not clinical, diagnostic or psychometric instruments, and a result is not an assessment of a person's competence or suitability for a role. If you use a result in connection with a recruitment or employment decision, you are responsible for how it is used and for your own privacy and employment obligations.

We also use automated processes to protect the platform and the rewards economy — for example rate limits, daily earning caps and anomaly detection that can withhold, reverse or adjust Points, restrict earning, or flag an account for review. These processes can affect your Points balance and your access to features. A person reviews any decision to suspend or terminate an account. If an automated process has affected you and you think it is wrong, contact us at powerup@drtiv.com and we will have a person review it and explain the outcome.

Parts of the platform are shared spaces. The following is visible to other signed-in members:

• Leaderboards an abbreviated form of your name (first name and last initial), your practice role, and your home state or region and country, alongside your activity count or rank. You can turn leaderboard visibility off in your account settings or by contacting us.
• Community posts and comments — what you post, your display name and the time you posted it, to other members who can see that section. Moderators and our team can see reports, moderation history and retracted content.
• Wins and celebrations — where you share a win or celebrate another member, that activity is visible to members.

We do not display your email address, phone number, street address, purchase history, practice performance figures or assessment results to other members. Community content is private to the platform — it is not published on the open internet or indexed by search engines — but you should assume other members can read, quote or screenshot what you post, and you should not post anything you would not want shared.

You acknowledge that program delivery may involve people and organisations outside Dr Tiv Academy. We may disclose relevant personal information to suppliers and supporters of the program where reasonably necessary for program delivery, administration, support, participant experience, benefits, troubleshooting, venue access, communications, product demonstrations, offers, networking, continuing support, safety, compliance or related purposes.

These recipients may include presenters, coaches, mentors, guest speakers, venue providers, event managers, caterers, merchandise providers, sponsors, technology suppliers, payment processors, finance providers, CRM providers, email platforms, learning platforms, community platforms, analytics providers, professional advisers, insurers, accountants, lawyers, debt collectors, security providers and IT support providers.

Technology providers we rely on. The platform itself is built on services provided by the following organisations, which store or process personal information on our behalf:

• Clerk — account sign-in and authentication (United States)
• Supabase — database, file storage and application functions (Australia and United States)
• Stripe — payment processing, subscriptions and refunds (United States, Australia and Ireland)
• Cloudflare — website hosting, content delivery and security (global network)
• Resend — transactional and program email delivery (United States)
• Gumlet — video hosting, streaming and live sessions (Singapore, India and United States)
• Google — Google Analytics website measurement, and Google Drive for encrypted offsite backups (United States)
• YouTube — where a video is embedded from YouTube, viewing it involves Google (United States)

These providers act on our instructions and are permitted to use the information only to provide their service to us. This list may change as we change providers; the current list is maintained here, and you can ask us for details at any time.

We may send you marketing communications about our courses, events, programs, resources, offers, updates and related products or services where permitted by law. You may opt out of marketing at any time by using the unsubscribe link, replying STOP to SMS where available, or contacting us. We may still send non-marketing administrative, transactional, safety, legal or program communications.

We use cookies and similar technologies, including browser storage, to operate the website, keep you signed in, remember your preferences, secure accounts, analyse traffic, improve the Services and detect misuse of Content.

Essential cookies and storage are needed for the platform to work — signing you in, keeping your session secure, remembering your theme and display preferences, and holding your cookie choice. These cannot be turned off within the platform, because the Services will not function without them.

Analytics cookies are used only if you agree. We use Google Analytics to understand how the site is used. When you first visit, a banner asks whether you accept analytics cookies. Analytics is switched off by default and no analytics cookies are set unless you select Accept. If you decline, we record only that choice so we do not ask you again.

You can change your mind at any time using the Cookie Preferences link in the footer of the website. You can also block or delete cookies through your browser settings, though some parts of the Services may not work properly if you block essential cookies.

We do not currently use advertising or retargeting cookies on the platform. If that changes, we will update this policy and ask for your consent where required.

We may collect and use technical and account-linked information such as user IDs, order IDs, email addresses, watermarks, file identifiers, metadata, download logs, access logs, IP addresses, device data, timestamps, session details and security events to protect Content, prevent account sharing, detect unauthorised distribution, investigate misuse and enforce our Terms.

Our Services are designed for education and professional development. You should not provide identifiable patient, client, staff or third-party information unless it is lawful, necessary, relevant and appropriately authorised. You are responsible for obtaining any required patient consent, de-identifying case material where possible, and complying with professional, privacy and health records obligations.

If you provide identifiable patient or third-party information, you warrant that you have authority to do so and that our handling of that information for program delivery, support, assessment, administration and legal compliance is permitted.

Some suppliers, platforms, cloud services, payment processors, email tools, analytics providers, support providers, presenters, contractors or professional advisers may be located outside Australia or may store, process or access information from overseas. Countries may include the United States, United Kingdom, New Zealand, Singapore, Canada, member states of the European Union and other countries where our providers operate.

Where we disclose personal information overseas, we will take reasonable steps required by applicable law to protect the information or otherwise rely on a lawful basis for the disclosure.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Measures may include access controls, passwords, secure providers, restricted permissions, monitoring, backups, encryption where appropriate, staff training and security reviews. No system is completely secure, and we cannot guarantee absolute security.

You also play a part: use a strong and unique password, do not share your login, and tell us promptly if you think your account has been accessed by someone else.

Notifiable data breaches. We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). If there is unauthorised access to, unauthorised disclosure of, or loss of personal information we hold, and we assess that this is likely to result in serious harm to any individual, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, as the scheme requires. We maintain a response plan for assessing and responding to suspected breaches, and we will act on a suspected breach promptly whether it occurs in our systems or those of a provider acting for us.

We keep personal information for as long as reasonably necessary for the purposes described in this policy, including delivery, support, CPD records, tax, accounting, legal, insurance, dispute resolution, IP enforcement, fraud prevention and business record purposes. When information is no longer needed, we will take reasonable steps to destroy or de-identify it where lawful and practicable.

You may request access to, or correction of, personal information we hold about you by contacting powerup@drtiv.com. We may need to verify your identity. We may refuse access or correction where permitted by law, and we will provide reasons where required.

Much of your information can be viewed and corrected directly in your account settings, including your name, contact details, professional details, location, notification preferences and leaderboard visibility.

Deleting your account. You can delete your account yourself from your account settings. Deletion is permanent and cannot be undone. It removes your profile, learning progress, Points balance and history, badges, certificates and CPD records, assessment results, wins, redemptions and referral records, and your sign-in credentials. Save anything you need first. You can instead deactivate your account, which disables sign-in but preserves your data. Deleting your account does not cancel a subscription or payment plan, and does not extinguish amounts you owe — see clause 24 of our Terms.

What we keep after deletion. Some records are retained because the law requires it or because we need them for a legitimate purpose we cannot meet otherwise. These include transaction, invoice, tax and accounting records, which we are required to keep for at least five years; records needed for insurance, complaints, disputes, chargebacks or legal claims; and security and audit logs. Where we keep these, we keep the minimum necessary, restrict access to them, and delete or de-identify them when the period ends. Community posts you made may remain visible to other members, shown as posted by a removed member; ask us before you delete if you want specific posts taken down.

If you ask us to delete information and we are not able to, we will tell you why.

The Services are intended for dental, medical, health and business professionals, and our Terms require account holders to be at least 18 years old. We do not knowingly collect personal information from anyone under 18, and the platform is not directed at children.

If you believe a person under 18 has provided us with personal information, contact us at powerup@drtiv.com and we will take reasonable steps to delete it.

If you have a privacy concern, please contact us first at powerup@drtiv.com with details of your complaint. We will consider your complaint and respond within a reasonable time. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner or another applicable regulator.

We may update this Privacy Policy from time to time. The updated version will be posted on our website with the updated date. Continued use of the Services after publication indicates acceptance of the updated policy to the extent permitted by law.