Privacy Policy

Last updated 30 October 2026.

Who we are

Lemongrass Health is the business name of Anthea Read, a sole trader and health and wellness coach in Nirimba on the Sunshine Coast, Queensland. Anthea offers Q Frequency BodyScan scans, frequency sessions, ozone sauna, hydrogen and health coaching. Because we keep health information, we follow the Australian Privacy Principles in the Privacy Act 1988. In this policy "we" and "us" means Lemongrass Health.

You can contact us about privacy at info@lemongrasshealth.online or on +61 448 290 804.

What we collect

• Your name, mobile, email, date of birth, address, an emergency contact and who referred you.
• Your bookings: which session, where and when.
• What you tell us on your intake and check-in forms, including health information, and the consent choices you make.
• Scan pictures: the result screens from your scan, cropped so they don't show your name.
• Anthea's notes. After your visit she records a short voice note of her own observations, which we write out as text, and she may add written notes. We don't record your sessions.
• Your reports, and when they were sent and opened.
• Invoices and payments.

How we use it

To book and run your sessions, write your reports, keep a proper record of your care, send you booking confirmations, reminders and form links, take payment, keep our accounts and meet our legal duties. We don't sell your information or use it for anyone else's marketing, and nothing about your health goes back to the person who referred you.

You can ask us general questions without giving your name. For scans and reports we need to know who you are.

How we collect it

Mostly from you: on your forms, during your visit, by email or phone, and when you book. The scan pictures come from the scan machine during your visit. If someone referred you, we may get your name and contact details from them.

Where it is kept

• Your records are kept in a secure system hosted in Sydney, Australia (Supabase and Vercel, both US companies). Only Anthea, and Richard Read for technical support, can sign in to it, with Face ID.
• Anthea's voice notes are written out, and reports are put together, on our own encrypted computer in Queensland, which is used for nothing else.
• A read-only copy of finished reports and forms is kept on Anthea's encrypted work laptop so she can open them without internet.
• An encrypted backup copy is kept with Amazon Web Services in Sydney. It is locked before it leaves our computer, so Amazon can't read it.

Services that see part of your information

These services never see your health answers, notes or reports:

• Cal.com (bookings, USA): your name, mobile number, the session you booked, where and when. Not your email: our own booking system sends your confirmation.
• Google Calendar (USA): your first name, where your session is and the time.
• Zoho Books (invoices, stored in Australia): your name, contact details and what you paid for.
• Stripe (card payments, USA): your payment, and your name and email on card payments.
• ClickSend (text messages, Australia): your mobile number and the text we send you.
• Resend (emails, USA, sends through Japan): your email address and the email we send you. It keeps a copy of each email for its own retention period. Report emails hold a link, never the report itself.

Our email is Google Workspace (USA). Anything you email us, or send through our contact form, is kept there. Reminders on Anthea's phone (through Telegram) never include names or health details.

We may change providers from time to time and will update this page when we do.

Richard Read looks after our systems under a written confidentiality agreement. He can't change or send reports. If he ever needs to look at client records to fix a problem, it is logged or written in a register that Anthea can read.

AI drafting help (only if you agree)

If you tick "AI drafting help" on your form, Anthea uses Claude, an AI tool made by Anthropic in the USA, to help tidy her voice notes and draft your report.

• Before anything goes to the AI, your name, phone, email and date of birth are replaced with a code, and scan pictures are cropped so they don't show your name. Your health answers on your form may be included the same way. The code is new each time, so the AI service can't link one visit to another.
• It is still health information going overseas. When you tick the box, you agree that Australian Privacy Principle 8.1 will not apply to this disclosure. That means we will not be accountable under the Privacy Act for how Anthropic handles it, and you may not be able to seek redress under the Privacy Act.
• Anthropic usually deletes it within 30 days. Content flagged for a safety review can be kept longer.
• Names of other people or places you mention may not be removed.
• Anthea reads, edits and approves every report herself. Nothing goes to you without her approval.
• The AI makes no decisions about your care. We don't use automated decisions about you.

If you don't tick the box, Anthea writes your report herself and nothing goes to the AI. Saying no doesn't affect your care, and you can change your mind at any time.

How long we keep it

• Your records (forms, notes, pictures, reports and consent choices): 7 years after your last visit, or until you turn 25 if that is later. Then they are securely destroyed.
• Voice note audio: deleted from our system 30 days after your report is approved. The written-out text stays with your record. A copy also stays in the voice memo app on Anthea's phone (locked with Face ID) until she deletes it.
• Report links: stop working after 14 days. Anthea can send you a new one.
• Backup copies: kept for up to 35 days, then replaced.

Keeping it safe

• Every time someone views, downloads, sends or deletes a record in our system, it is logged. Any other access for set-up or repairs is written in a register Anthea can read.
• Report links are long, private and stop working after 14 days. The report email has no health details.
• If something goes wrong, we follow a written plan. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner.

Seeing or correcting your information

You can ask to see your records, ask for a copy of everything we keep about you, or ask us to correct anything that is wrong. Email info@lemongrasshealth.online or ask Anthea. We will reply within 30 days, and there is no charge. If we can't give you access to something, we will tell you why in writing.

Questions and complaints

Please talk to Anthea first. We will reply within 30 days. If you're not happy with our answer, you can contact:

• The Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992
• The Queensland Health Ombudsman: oho.qld.gov.au, 133 646

If you live in New Zealand

New Zealand's Privacy Act 2020 and the Health Information Privacy Code 2020 also apply to how we handle your health information. We don't offer AI drafting help or report links by email to New Zealand clients yet. You can contact the New Zealand Privacy Commissioner at privacy.org.nz.

This website

• We use Google Analytics to see which pages are viewed and how people found us. It uses cookies and collects your approximate location, device and browser. It doesn't tell us who you are. You can opt out with the Google Analytics opt-out browser add-on. It isn't used on the booking pages.
• Our forms use Cloudflare Turnstile to check that they come from real people rather than spam. Turnstile looks at technical information about your browser and connection for this purpose only.
• When you use the contact form or download our guide, we keep a record of it (your name, email, the time, your approximate location and how you found us) for up to 120 days, so we can make sure every enquiry reaches us and to block spam. This record is kept by Upstash, a US company.
• When you book online, the website keeps only whether the booking went through, not your name or contact details. To stop misuse it counts bookings per mobile number for two days, using a scrambled code it can't turn back into your number. Your booking itself goes into your client record, and your name, mobile and booking time to Cal.com.
• Messages from the contact form are emailed to us.
• When you download our guide, we email it to you and add your email address to our mailing list, kept by Resend. You can ask us to take you off it at any time.
• Our client system uses no analytics and no tracking.

Changes

If we change how we look after your information, we'll update this page and the date at the top.