Prospero Health

Privacy Policy

Privacy Policy for Prospero Health

Effective Date: 14 October 2026 Version: 2.0

Change Log

Version 2.0 — 14 October 2026

Substantially revised and expanded, including changes relating to the information we collect, how we use and disclose information, analytics and advertising technologies, data retention, research, and users’ privacy rights.

This is not a complete summary of the changes. We recommend that you read this Privacy Policy in full.

Version 1.1 — 12 September 2025

Updated the account information collected to include email; added mood tracking data; and made minor wording and administrative updates.

Version 1.0 — 13 December 2024

Initial version.

Terms of Use

1. About Us and this Privacy Policy

Impact Obesity Ltd (ABN 65 649 953 891) (“we”, “us”, “our”) owns and operates the Prospero Health mobile application ('the App') and the associated prospero.health website (‘the website’).

The App helps users track symptoms, appetite, and mood, provides insights into user health, and supports user connection with healthcare.

This Privacy Policy (this Policy) explains how we collect, use, store, share, and protect your personal information when you use the App, and it applies to users in Australia.

We will handle your personal information in accordance with applicable privacy and health records laws, including the Privacy Act 1988 (Cth) (the Privacy Act) and its Australian Privacy Principles (APPs), and the following state and territory legislation:

the Health Records Act 2001 (Vic) and its ‘Health Privacy Principles’ in Victoria;
the Health Records and Information Privacy Act 2002 (NSW) and its ‘Health Privacy Principles’ in New South Wales; and
the Health Records (Privacy and Access) Act 1997 (ACT) and its ‘Privacy Principles’ in the Australian Capital Territory.

The above state and territory Health Privacy Principles and Privacy Principles are referred to in this Policy as the ‘HPPs’.

1.1 What Is Personal Information?

This Policy applies to our handling of personal information. ‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not.

Personal information includes ‘sensitive information’, which is a particular type of personal information. Sensitive information includes identifying health information about you, such as details of your health and medical history, and health services you have sought or received. Sensitive information also includes information about racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, and sexual orientation or practices.

1.2 Summary of this Policy

The below provides a summary of this Policy. You should read this Policy in full for complete details.

1.2.1 Information we collect

Account information (name, email), health information (health and tracking information you enter), device/usage data, subscription information, support messages, and optionally connected third-party health services.

1.2.2 Purpose of collection

To provide and personalise the App, respond to support messages, improve the App using de-identified information (including aggregated de-identified information), provide marketing communications where you have opted in, and comply with legal obligations.

1.2.3 Disclosure

We do not sell your personal information. We share your personal information only with third parties such as service providers under strict agreements, or if required by law.

1.2.4 Storage

Industry-standard encryption of your personal information in transit and at rest. An external security audit to assess vulnerabilities and ensure the App and storage of personal information is secure has been conducted.

1.2.5 Data retention

1.2.6 Your rights

You have rights in relation to access and correction of your personal information, consent withdrawal, and making complaints about a breach of your privacy.

2. Information We Collect and How We Collect it

Information We Collect

We collect personal and health information, and other information which does not identify you, to provide you with the App and for the other purposes set out in section 3 of this Policy.

The types of information we collect are set out below:

2.1 Account and Identity Information

Personal information required to create and maintain your account:

Name
Email

2.2 Health and Tracking Data

Health information you choose to enter into the App:

Height, Weight (highest and current)
Waist measurement
Symptoms and severity logged by users
Appetite and severity logged by users
Nutrition Intake, including images uploaded by users in respect of their nutrition intake
Care team details
Mood and severity logged by users
Notes entered by users (e.g., notes about symptoms or feelings)

2.3 Device and Usage Data

Information collected automatically when you use the App:

Device type, operating system, and App version
Crash reports and error logs (used for stability and bug-fixing)
App usage patterns, such as features used and session frequency, which may be collected for analytics, App improvement and advertising measurement purposes. We do not use health tracking information for behavioural advertising.

2.4 Subscription and Billing Data

When you subscribe to the App through digital storefronts such as the Apple App Store or Google Play, billing and payment are handled directly by those storefronts. We receive only a subscription entitlement token or receipt confirmation, and we do not receive or store your payment card details.

2.5 Support Communications

If you contact our support team, we collect the content of your messages and any information you provide to help resolve your enquiry.

2.6 Optional Connected Data

With your separate consent, you may choose to connect third-party services such as Apple Health or Google Fit. You can revoke this permission at any time in your device or App settings.

How We Collect Your Personal Information

We will collect your personal information in a lawful and fair way and in a manner that is not unreasonably intrusive.

We will only collect your sensitive information (including health information) where you have consented, or otherwise in accordance with the law.

If you are a user of the App, we will generally collect your personal information directly from you, for example when you access the App and enter information, or use email or other electronic communication with us.

We may collect personal information about you from a third party. This may include, but is not limited to, collection from family members, healthcare providers or other persons you have authorised to provide your information to us. We will only do this with your consent, or where it is not practical to obtain this information from you and this is otherwise permitted by the privacy laws.

Other Persons

If you are person other than a user of the App, such as service providers, contractors and third parties we engage with, we will generally collect your personal information directly from you, and we may collect your personal information from third parties. For example, if you are a service provider we may collect information from your referees.

Notice of Collection

When we collect your personal information, we will as soon as is practicable take reasonable steps to notify you of the details of the collection (including notifying you through this Policy), such as the purposes for which the information was collected, the organisations (if any) to which the information will be disclosed, and also notify you that this Policy contains details on how you may access or correct your information, or raise any complaints.

Do You Have to Provide Your Information?

You are not required to disclose your personal information to us. However, if you do not provide the information requested, you may not be able to use the App or receive our services, or engage with us effectively.

3. How We Use Your Information

How we use your personal information will depend on why you are dealing or engaging with us and in what capacity.

We will generally only use your personal information for the main purposes for which you have provided it to us.

If you are a user of the App, we generally use your personal information for the following purposes:

3.1 To Provide You With the App

We use your information for the following purposes which are necessary to operate the App:

To provide and personalise your experience with the App
To enable you to track information such as symptoms and appetite
To process uploaded images relating to nutrition intake, including by using image moderation tools where necessary to provide that feature
Account creation, authentication, and security
Storing and syncing your health tracking data across devices
Generating personalised insights, charts, and reports within the App
To respond to support requests or inquiries
Verifying subscription entitlement
To comply with legal obligations

3.2 App Improvement and Research

We may use de-identified information (including aggregated de-identified information) for the following purposes:

To analyse how the App is used and improve its functionality, performance and user experience
To identify trends and areas for product or service improvement
To contribute to product improvement, evaluation or research projects

De-identified information is information that has been processed so that it can no longer reasonably identify you.

We will not use identifiable health information for research purposes without your express consent. Where a research project requires identifiable information or your active participation, we will provide you with further information and obtain separate consent before including you.

3.3 Analytics, Advertising and Marketing

When you use the App or our website, we may collect limited personal information through Google Analytics, Meta Pixel, Amplitude Analytics and similar technologies. (Amplitude Analytics is used for website analytics only.) This may include technical and usage information such as your device type, whether you visited our website or opened the App, and certain actions such as creating an account or starting a subscription.

We may use this information to:

understand how people use the App and website;
measure the effectiveness of our advertising; and
deliver or measure advertisements on third-party platforms, including Meta and Google.

We use de-identified information, including aggregated de-identified information, for App improvement, product analytics, service analytics and research purposes wherever reasonably practicable.

We do not provide health tracking information, such as your symptoms, weight, appetite, mood, waist measurements or notes, to advertising platforms, and we do not use this information for behavioural advertising.

Marketing communications are further discussed in section 11 of this Policy.

We do not sell your personal information or health information to third parties.

3.4 Automated Decision Making and Use of Artificial Intelligence (AI)

We do not make decisions which could reasonably be expected to significantly affect the rights or interests of users of the App or other individuals solely by means of automated decision making or the use of AI.

We will inform you through this Policy if in future we use any other computer programs or AI systems that use personal information to make automated decisions that could reasonably be expected to significantly affect the rights or interests of an individual. This will include information about the kinds of personal information used in, and types of decisions made by, such computer programs or AI systems that use personal information to make such decisions.

4. How We Store and Protect Your Information

Your information is stored in the cloud and is encrypted at rest. We take reasonable steps in the circumstances to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. However, no method of data transmission over the internet is completely secure, and we cannot guarantee absolute security.

The reasonable steps we take include periodic review and refinement of our security practices/controls to provide reasonable security levels, but we cannot fully eliminate security risk.

Additional security measures include:

Encryption of data in transit (TLS) and at rest
Access controls and administrator multi-factor authentication

In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act

5. Who Do We Disclose Your Information To?

We do not share your health information (including symptoms, weight, mood data, or notes) with third parties for advertising or marketing purposes.

We take reasonable steps to ensure your personal information is handled by the third-party providers detailed below in accordance with the APPs.

5.1 Analytics Providers

We use third-party analytics providers to analyse aggregated, de-identified data for App improvement, product analytics, service analytics and research purposes. We do not share identifiable health tracking information with these providers for these specific App improvement, product analytics, service analytics or research purposes.

We share limited personal information in the form of technical and/or usage information (not health tracking information) with some analytics and advertising technology providers for measurement of advertising effectiveness and remarketing, as described in sections 3.3, 5.4, 8 and 11.3 of this Policy

5.2 Cloud Storage Providers

We store your information with third-party cloud storage providers in Australia. These providers are bound by agreements to ensure your information is handled securely and in accordance with the APPs.

5.3 Third-Party Service Providers

To provide you with the App and related services, we may engage third-party service providers who provide the following functions and services:

Secure cloud hosting and storage in Australia
Authentication services and account management
Crash and technical error reporting, system health and App stability monitoring
Image moderation services for uploaded nutrition intake images
Subscription management and entitlement verification (including via App Store / Google Play)
Customer support tooling
Analytics and advertising technologies (as discussed further in section 5.4 of this Policy)

We may provide your personal information to these third-party service providers to the limited extent necessary for them to provide such functions and services.

These third-party service providers are bound by agreements to ensure your information is handled securely and in accordance with the APPs.

We do not permit any of these providers to use your health information for their own advertising, data-brokering, or other independent purposes.

5.4 Analytics and Advertising Technology Providers

We share limited personal information in the form of technical and/or usage information as explained below (not health tracking information) with Meta Platforms Inc. (Meta Pixel and/or Meta SDK) and Google LLC (Google Ads, Google Analytics 4, and/or Google SDK), and Amplitude Inc. (Amplitude Analytics, which is used for website analytics only) (each primarily located in the United States) for the purposes of analytics, ad delivery, advertising effectiveness measurement, conversion measurement, and audience matching, as applicable. This occurs where those platforms are able to match that information to a user or device. Whether these platforms are able to match that information or serve advertising to you will depend on information available to that platform, including whether you hold an account with that platform or are otherwise identifiable to it through its technologies.

This involves the following:

Website tracking:
Our website (prospero.health) uses the Meta Pixel and Google Ads/GA4 tags and Amplitude Analytics. These tools record whether you visited our website and, depending on the tool, certain interactions with our website, such as if you clicked an ad, and whether you subsequently created an account.
In-app software development kits (SDKs):
The App may include Meta and/or Google mobile SDKs that collect your device advertising identifier (IDFA on iOS or GAID on Android) and record non-health in-app events (such as "opened app" or "completed onboarding") to measure advertising effectiveness.

These providers are subject to their own privacy policies:

Meta: facebook.com/privacy/policy
Google: policies.google.com/privacy

We configure these integrations to not share any information that would identify you as a person with a specific health condition. We have also implemented technical controls to prevent health tracking data (including symptoms, weight, mood, notes, and waist measurements) from being transmitted to any advertising platform. Behavioural events passed to ad platforms are limited to non-health actions such as app install, account creation, subscription start, and subscription cancellation.

You can opt out of certain advertising and tracking functions through your browser settings, device settings, and the privacy or advertising settings made available by Meta and Google (as applicable if you hold an account with that platform or are otherwise identifiable to it through its technologies). Some analytics technology providers may not provide a separate opt-out option. Where we make a cookie or analytics preference tool available on our website, you can use that tool to accept or reject non-essential analytics cookies and similar non-essential technologies.

5.5 Sharing of Information

You may choose to generate and share an ‘insights’ report containing your personal and health information (including up to 60 days of your symptoms, mood, appetite and nutrition intake tracking) using your device’s native sharing function. You select the sharing platform and recipient. Once the report is shared outside of the App to a recipient outside of the App, we cannot control, delete or revoke it, and that recipient may handle it under their own privacy and security obligations and practices, which are outside of our control.

5.6 Legal Disclosure

We do not disclose your personal or health information for reasons outside those described in this Policy unless we are otherwise permitted or required to do so by law. This may include circumstances where:

you have provided your consent;
for purposes which are directly related to these main purposes for which your information was collected, in circumstances where you would reasonably expect us to disclose your information for these purposes; or
where we are otherwise required or authorised by law to do so, for example:
where disclosure is necessary under law, such as where we need to comply with a subpoena or Court order; or
where it is unreasonable or impracticable to obtain your consent and we reasonably believe disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

Where reasonably practicable, we will only disclose the minimum amount of information necessary to fulfil the relevant lawful purpose.

5.7 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred to the acquiring entity.

Where the relevant transaction involves a change in ownership or control of our business, the same entity will continue to hold and use your personal information, and it will remain subject to this Policy (as updated from time to time) and the Privacy Act.

Where the relevant transaction involves the transfer of personal information to a different entity and the relevant acquirer maintains operation of the App, we will:

notify you and seek your consent, or give you a reasonable opportunity to object before the transfer occurs; and
take reasonable steps to ensure that the acquirer will only use and disclose personal information in a manner that is consistent with this Policy and the Privacy Act.

Where the relevant transaction involves the transfer of personal information to a different entity for other purposes, we will only make this transfer with your express consent.

5.8 No Sale of Data

We do not sell, rent, or trade your personal information or health information to any third party for their own commercial purposes.

6. Data Retention

We keep your personal information for the time periods required by law. When your personal information is no longer required (and in the case of your health information, the information has been retained for the required periods under the HPPs or otherwise under law) we will take steps to securely destroy the information or to ensure that the information is permanently de-identified. The minimum required retention period for health information under the HPPs is usually 7 years from the date of last service for adults, or for health information collected from a child it must be retained until they are 25 years of age. Other laws may require retention of health information for longer periods, in which case we will retain the health information for that period.

Specific retention periods by data type (non-health information):

Crash and error logs: retained for up to 12 months.
De-identified analytics data: may be retained indefinitely, as it can no longer reasonably be linked to you.

If your account is inactive for an extended period, we may contact you before taking any action on your data.

7. User Rights

You have the following rights regarding your personal information:

Access: You can request access to the personal information we hold about you.

Correction: You can request correction of the personal information we hold about you if you believe it is inaccurate out of date, incomplete, irrelevant, or misleading.

Export: You can request a copy of your tracking data in a portable format.

Withdraw consent: You may withdraw consent where our handling of your information is based on your consent, including consent to receive marketing communications or participate in identifiable research. You may do this by using an unsubscribe option included in a communication or by contacting us.

To exercise any of these rights, submit a request via our Support page or contact us using the details in section 15.

We will respond within 30 days. Any cancellation of active subscriptions for the App can be managed through the App Store or Google Play, but that does not displace our information retention requirements under section 6 of this Policy.

8. Cookies, Pixels and Tags

Our website (prospero.health) may use cookies, pixels, tags and similar technologies for site analytics and tracking.

Cookies are small files that are stored on your device by a website, which may collect statistical information about your visit to our website (such as the pages you visit on the website) in order to remember your preferences and allow you to navigate the website more easily.

Pixels and tags are similar technologies that may help record interactions with a website, such as whether a page was viewed or whether a person who clicked an advertisement later created an account.

These technologies may collect or generate limited technical information and usage information about your device, browser, website visits, referral source and interactions with our website. In some cases, this information may be your personal information because it may identify or reasonably identify you, for example if it was combined with other information held by us or by third-party technology providers.

We do not use cookies, pixels, tags or similar website technologies to collect or disclose your health tracking information for behavioural advertising, audience matching or remarketing.

Health tracking information includes symptoms, weight, appetite, mood, waist measurements, care team details, nutrition intake and notes. The default setting of most internet browsers is to accept cookies automatically, but you can choose whether to allow cookies through your browser settings. Depending on your browser, device and platform settings, those settings may also limit or affect the operation of related pixels, tags and similar tracking technologies.

Where we make a cookie or analytics preference tool available on our website, you can use that tool to accept or reject non-essential analytics cookies and similar non-essential technologies.

9. Age Restrictions

The App is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from users under 18. If you are under 18, please do not use the App.

10. Cross-Border Disclosure of Personal Information

We will only disclose your personal information interstate or overseas if we would be lawfully permitted to disclose it to a recipient in Australia, and:

we have taken reasonable steps to ensure that the interstate or overseas recipient of your personal information does not breach the APPs or HPPs; or
the interstate or overseas recipient is subject to a law, binding scheme or binding contract that provides substantially similar protection to the APPs and HPPs which you can access and enforce; or
the disclosure interstate or overseas is otherwise required or authorised by law.

Your personal information may be disclosed and stored or processed outside of Australia if our cloud hosting or other service providers operate international infrastructure and/or are located overseas. Certain personal information will be disclosed to Meta Platforms Inc., Google LLC, and Amplitude Inc., Clerk, Sentry and RevenueCat (each located in or processing information in the United States).

The services provided by Meta Platforms Inc., Google LLC, and Amplitude Inc. are discussed in section 5 of this Policy. Clerk processes essential account, authentication and consent information. Sentry processes technical identifiers, device and App information, approximate location and error information. RevenueCat processes technical identifiers and subscription information (not credit card details).

We take reasonable steps to ensure that these recipients of your personal information do not breach the APPs or HPPs, including through contractual data-protection terms with these providers.

11. Marketing and Notifications

11.1 Service Notifications

We may send you notifications that are necessary for the operation of the App (e.g. account security alerts, subscription renewal reminders). These cannot be opted out of while you hold an active account.

11.2 Marketing Communications

We will only send you marketing emails, other commercial electronic communications or marketing push notifications where you have expressly opted in. This does not include communications necessary to operate the App or provide its features and services in accordance with section 11.1 of this Policy. You may withdraw your consent at any time by using the unsubscribe option included in the communication or by contacting us.

11.3 Paid Advertising and Remarketing

We may use your account email address and non-health behavioural information (such as whether you have previously visited our website or opened the App or started a subscription) to serve you advertisements or improve advertising delivered to you on third-party platforms including Meta and Google, where those platforms are able to match that information to a user or device. Whether a third-party platform is able to match that information or serve advertising to you will depend on information available to that platform, including whether you hold an account with that platform or are otherwise identifiable to it through its technologies.

We do not use or disclose your health tracking information for paid advertising, behavioural advertising, audience matching, lookalike audiences or remarketing. Health tracking information includes symptoms, weight, appetite, mood, waist measurements, care team details, nutrition intake and notes.

Paid advertising and remarketing includes:

Remarketing: showing ads to people who have previously used the App or visited our website.
Lookalike audiences: identifying new potential users with similar characteristics to existing users (your data is used to build the model; you are not individually targeted in prospecting campaigns).
Conversion measurement: measuring whether advertising resulted in non-health actions, such as website visits, account creation, onboarding completion or subscription activity.
Audience matching: matching limited information, such as email addresses or device identifiers, to users of third-party advertising platforms.

You can opt out of certain advertising and tracking functions through your browser settings, device settings, and the privacy or advertising settings made available by Meta, Google and other third-party platforms (as applicable if you hold an account with that platform or are otherwise identifiable to it through its technologies).

12. Research and De-identification

We may use de-identified, aggregated data, being information that has been processed so it can no longer reasonably identify you, for product improvement, service analytics, or research purposes. Participation in any identifiable research is strictly opt-in and governed by separate consent. We will never share identifiable health data for research without your express consent.

13. Age and Location Restriction

The App must not be used by users who are under 18 years of age or who are not located in Australia. We may suspend access to the App in our absolute discretion should there be non-compliance with these age and location requirements and take reasonable steps to delete or de-identify any personal information associated with the account, subject to any applicable retention periods of that information under law.

14. Changes to this Policy

We may update this Policy from time to time. When we make changes, we will post the updated policy on this page and update the “Effective Date” at the top of the Policy.

If we make material changes to this Policy, we will take reasonable steps to notify you, which may include notice through the App, on the website, or by other electronic communication by us. Where a change involves a new or materially different collection, use or disclosure of your personal information for which consent is required by law, we will seek your consent before applying that change to you.

15. Complaints

If you believe we have not handled your personal information appropriately, please contact us at hello@prospero.health and we will work to resolve your concern as soon as possible and no later than 30 days from receipt of your complaint. If you remain unsatisfied, or if you do not wish to raise a question or complaint with us directly, you may wish to contact the Office of the Australian Information Commissioner (OAIC):

Website: oaic.gov.au

Phone: 1300 363 992

16. Contact Us

If you have any questions or concerns about this Policy or our privacy practices, please contact us using the following details:

Impact Obesity Ltd

ABN 65 649 953 891

Address: Cremorne House, 601/6 Adolph Street, Cremorne, Victoria 3121

Email: hello@prospero.health

Support: www.prospero.health/support

3437-0913-0066, v. 1

Privacy Policy

Privacy Policy for Prospero Health

Terms of Use

Legal Stuff