Privacy Policy

1. Who We Are

2. What Data We Collect

We collect information in three ways:

2.1 Information You Provide

• Account information: Full name, email address, phone number
• Health intake assessments: Responses to the Perceived Stress Scale (PSS), Multidimensional Assessment of Interoceptive Awareness (MAIA), and BOLT breathing assessment
• Program information: Your program start date, current week, package type, and practitioner notes

2.2 Garmin Wearable Data (via Garmin Health API)

When you connect your Garmin account to Royal Regulation, we access and store the following biometric data from your Garmin device:

This data is retrieved via the Garmin Health API using OAuth 2.0 authorisation, which you control. We only access data you explicitly authorise during the Garmin connection flow.

2.3 Automatically Collected Information

• App usage and login activity (for security and troubleshooting purposes only)

3. Sensitive Information and Your Consent

4. How We Use Your Data

We use your data exclusively to deliver the Royal Regulation program:

• Display your weekly biometric summaries in the client dashboard
• Enable your practitioner (Nasim van Veenendaal) to write personalised weekly reports based on your data
• Track your progress across the 8-week program arc
• Provide context for breathwork, meditation, and yoga nidra practice recommendations
• Send transactional emails (e.g., welcome email, report published notifications) via Resend

We do not use your data for advertising, and we do not sell your data to third parties.

5. Garmin Data — Third-Party Disclosure

6. How and Where We Store Your Data

7. Who Can See Your Data

• You: You can view your own data through the Royal Regulation client dashboard
• Your practitioner (Nasim van Veenendaal): Has access to your biometric data and assessment results in order to write your weekly reports and deliver your program
• No one else: Access is enforced at the database level. Other clients cannot see your data

We do not share your personal or health data with any third party except as described in this policy (Garmin Health API integration, AWS/Supabase infrastructure in Byron Bay, NSW, Australia, Resend for email delivery).

8. Your Rights and Data Deletion

Under the Australian Privacy Principles, you have the right to:

• Access your personal information — contact us to request a copy
• Correct inaccurate information — contact us or update it in your dashboard
• Delete your data — see below
• Withdraw consent for Garmin data access — disconnect your Garmin account via your dashboard or Garmin Connect settings
• Complain to the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with how we handle your personal information — see Section 11

Requesting Data Deletion

To request deletion of your Royal Regulation account and all associated data (including biometric data retrieved from Garmin):

We will process your request within 30 days and confirm when deletion is complete. Note that disconnecting your Garmin account does not automatically delete data already stored by Royal Regulation — you must submit a deletion request as above.

9. Data Retention

We retain your data for the duration of your program and for up to 12 months after program completion, unless you request earlier deletion. After this period, your data is deleted or de-identified.

10. Data Breaches

We take the security of your personal information seriously. In the event of an eligible data breach under the Privacy Act 1988 (Cth) Notifiable Data Breaches (NDB) scheme — that is, a breach likely to result in serious harm to you — we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by law.

11. Children's Privacy

Royal Regulation is intended for adults aged 18 and over. We do not knowingly collect data from minors.

12. Complaints

13. Changes to This Policy

We may update this policy from time to time. We will notify you by email if we make material changes. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact