Privacy Policy

The Holland Clinic Pty Ltd (ABN 47 660 358 163) (“we”, “our”, “us”, “The Holland Clinic”) complies with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles in the Privacy Act when handling personal information, together with the Health Records Act 2001 (Vic) (“Health Records Act”) and the applicable Health Privacy Principles in the Health Records Act when handling personal information which is health information together with the General Data Protection Regulation (GDPR) and UK GDPR to the extent they apply to clients located in the European Union or United Kingdom. The Holland Clinic Pty Ltd provides our clinical services (including consultations, testing and Vitality Plans) and our education programs (including the Vitality Clinic and Vitality Academy).

We take the protection of your personal information seriously. Personal information includes personal data (as defined in the GDPR) and means any information or opinion, whether true or not, about a person who is identified or whose identity can reasonably be established or any information relating to an identified or identifiable natural person (“Personal Information”).

Collection:

We collect Personal Information for the purposes of arranging and delivering consultations, functional testing, education programs (including the Vitality Clinic) and products (“Services”) as well as communicating with you. We may collect information through our website at www.drkirsteyholland.com, www.thehollandclinic.com, any of their subdomains, and any other website we operate that links to this Privacy Policy (together, the “Website”) or in the course of providing Services via the Website, email, in person, verbally or via any other means available from time to time.

We collect Personal Information: from clients – when they register an enquiry, book a discovery call or consultation, enrol in a program, purchase any associated services or products, attend a consultation (in person or online), message us on social media, access our Website, subscribe to our newsletter, and/or at any other time from time-to-time in the course of providing Services. from third party service providers – when they are engaged to supply services to us (such as but not limited to Services and professional services), provide information to us or invoice us for the provision of services;
when we receive enquiries through the Website, and when the Website is otherwise accessed or used;
when we receive enquiries via email or telephone.

The kind of Personal Information we may collect will depend on who you are (e.g. a client or third party service provider) and the nature of your interaction with us, and may include your full name, address, email address, date of birth, billing and payment information, health and medical history, symptoms, medications and supplements, pathology and functional test results, information you provide in intake forms and questionnaires, recordings and transcripts of consultations and calls (where you have agreed), and other Personal Information. If you do not provide us with all the information we request, we may not be able to provide the Services to you or enable you to participate in requested Services. Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym (for example, when making a general enquiry), but we will need to identify you to provide clinical Services. Our Services are intended for adults aged 18 and over. If you contact us through social media (such as Instagram), your messages are also handled by that platform under its own privacy policy, so please do not share health details there; we can continue the conversation by email or through our practice software instead.

Your billing information is stored by our third-party payment providers (Stripe and PayPal), and we use it only to charge you for Services you have agreed to purchase. Card details are processed directly by Stripe or PayPal in line with the Payment Card Industry Data Security Standard (PCI-DSS); we do not see or store your full card number.

Some Personal Information we collect may include health information. Health information includes any information collected about your health or disability and any information collected in relation to a health service you have received (“Health Information”). We may collect Health Information from clients when they attend a consultation (in person or online), complete intake forms or questionnaires, or participate in Services, and when entering into agreements with us regarding enrolments and participation in our Services. We collect Health Information in order to assist you to safely participate in Services and where required, make appropriate modifications. How we handle your Health Information is set out in greater detail below.

The Health Information we collect enables us to arrange for the provision of Services and for the safe, appropriate and accurate provision of Services, to assess the needs of clients in the provision of Services, and for us to generally assist in optimising the quality of our service. With your separate, explicit consent, we may also use your questionnaire responses and program results in de-identified, aggregated form for research, publications, or to show overall program outcomes. We will never publish this information in a way that identifies you, and saying no will not affect your care. We may also be required to collect Health Information in order to comply with our legal obligations.

Consent:

By engaging us or registering your details on our Website or by email or telephone, and/or using the Website or completing an enrolment form, book into or arrange any Services or otherwise engaging in our Services, you acknowledge that we and our practitioners will collect, use and disclose your Personal Information for the purposes specified in this Privacy Policy. We will ask for your express consent before we collect your Health Information (for example, through our intake forms) and before we record or transcribe any consultation or call. You may withdraw your consent at any time by contacting us, although this may affect our ability to provide some Services.

Use:

We may use any Personal Information collected (excluding Health Information) to provide our Services, operate the Website, send you our newsletter if you have subscribed, respond to feedback and complaints, communicate with third party service providers or if needed to enforce our Client agreement with you. If you are a third party service provider, we will use your Personal Information to communicate with you including to accept your offer to provide services, correspond with you in relation to the provision of services and to pay your invoices. We use Health Information to allow Dr Kirstey Holland to understand your health and formulate your treatment strategy, to coordinate your care (including sharing it with laboratories and practitioners as described in this Privacy Policy), and to comply with our legal obligations. We also review symptom information across our client group in de-identified, aggregated form to understand common symptom patterns and choose coaching topics for our education programs; this never identifies you individually. We do not use Health Information for direct marketing, and we will never publish your name, image, story or testimonial without your written consent.

We will only use your Personal Information (excluding Health Information) for direct marketing where you have subscribed to our newsletter or otherwise agreed to hear from us, and only to tell you about our own Services. We send our newsletter using Kit (formerly ConvertKit). We may contact you by mail, telephone, email or SMS to market our products and Services. We will always give you the opportunity to opt out of receiving any future direct marketing correspondence. We do not sell your Personal Information.

AI tools and call recordings:

With your consent, we may record and transcribe discovery calls and consultations held by video call (such as Zoom). We use these recordings and transcripts to prepare accurate notes, briefs and follow-up documents for your care. You can ask us not to record a call at any time.

Group calls in the Vitality Academy (such as Vitality Conversations) are recorded as part of the group coaching and learning. This includes questions members ask and the discussion that follows. These recordings are shared only within the Vitality Academy and are available to registered members for 4 weeks. After that, recordings are removed from the Vitality Academy and kept privately by our clinical team for internal learning, quality review and to help choose future teaching and coaching topics. Recordings are deleted 6 months after the call. Every group call starts with your microphone muted and your camera off, and you choose whether to turn them on. The chat is visible to everyone on the call, is saved as part of the recording, and is shared, kept and deleted in the same way as the recording. Other members may see or hear what you share, so please only share what you are comfortable with. You can use your first name only, or raise a question with us privately by email instead. We ask all members to keep what others share confidential. Where we use excerpts of group calls for promotion, we use only footage of our practitioners unless you have given separate written consent.

We use artificial intelligence (AI) tools to help our practitioners review your intake forms, questionnaires, test results and call transcripts, and to prepare draft documents such as your Vitality Plan. AI tools assist our practitioners; they do not make decisions about your care. Because these tools may substantially assist us in preparing recommendations that affect you, we confirm that the kinds of Personal Information they use are your intake and questionnaire responses, Health Information, test results and consultation transcripts. Every recommendation is reviewed and approved by Dr Kirstey Holland or another qualified practitioner before it is shared with you. We choose AI providers whose terms prevent them from using your information to train their models, and we share only the information needed for the task. The AI and transcription providers we currently use include Anthropic (Claude) and Zoom.

Health Information

To the extent that it is collected, we and our practitioners comply with the Health Privacy Principles (and the GDPR, where it applies) in the collection, use and disclosure of all Health Information and to ensure that all Health Information is kept confidential.

We collect your Health Information when you book a discovery call or consultation, complete any intake forms or questionnaires, attend a consultation (in person or online) and/or at any other time from time-to-time in the course of arranging the provision of Services.

We may collect your Health Information: as necessary for the safe provision of Services, including recording personal information and Health Information which is relevant to your current situation;
from clients when they request an assessment for the purposes of advice, and/or purchase any associated products or Services;
only as necessary for the provision of our Services, or as otherwise in accordance with your consent, or as may be required by law including Court order;
from you (or from someone authorised by you, including your caregiver if you have one), and, with your consent, from other health practitioners and from pathology and testing laboratories that process tests we order for you;
with care, taking reasonable steps to ensure your information remains confidential and that any persons we disclose it to in accordance with this Privacy Policy are also required to keep it confidential;
with accuracy, on the basis that you may at any time request a copy of the health information that we hold by emailing us at hello@thehollandclinic.com. In the event our records are found to be inaccurate, we will rectify any inaccuracies on the basis of the further information you provide.

Disclosure and sharing:

We may disclose Personal Information to third parties who help us provide our Services, including: pathology and functional testing laboratories that process tests we order for you; other health practitioners involved in your care, with your consent; our practice management, telehealth, online course, email, payment and cloud storage providers; and our professional advisers. We may also disclose Personal Information where you consent or where we are required or authorised to do so by law. We agree only to use data processors who provide sufficient guarantees and that they will implement appropriate technical and organisational measures that ensure compliance with the GDPR and protect the rights of the data subject, and we take reasonable steps to ensure that other third parties who handle Personal Information for us protect it appropriately.

Overseas disclosure:

Some of the third parties we work with are located, or store data, outside Australia. For example, some functional tests (such as DUTCH and GI360 tests) are processed by laboratories in the United States, and some of our software and AI providers store data in the United States, Canada and other countries where those providers or their service providers operate. Before we disclose Personal Information overseas, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the Australian Privacy Principles.

You may ask us to stop processing your Personal Information at any time, subject to our legal obligations (including our obligation to retain health records).

Data security, protection and quality:

We take reasonable steps to protect the Personal Information we collect and hold from misuse, loss and interference and from unauthorised access, modification and disclosure, and to make sure it is accurate, complete and up-to-date when we collect, use or disclose it. These steps include secure, access-controlled practice software and limiting access to those who need it. No method of storing or sending information online is completely secure, so we cannot guarantee absolute security.

We have procedures for monitoring the security and safety of data as well as procedures in place for dealing with any data breaches, and the associated requirements of notifying you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme where a data breach is likely to result in serious harm.

To assist us, please ensure you provide us with your correct details, and let us know if you believe the information we have about you is inaccurate, incomplete, out of date or misleading (and we will take reasonable steps to correct the information). We may take steps to destroy or permanently de-identify information when it is no longer needed for any purpose for which it may be used or disclosed.

Deleting your information:

You can ask us to delete your Personal Information in certain circumstances, subject to applicable law, and/or to return it to you including, but not limited to, where your Personal Information is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and there is no other legal ground for processing your data. If you wish to have your Personal Information erased and/or returned to you please notify us at hello@thehollandclinic.com. Please note that we are required by law to keep health records for a minimum period (generally seven years after your last consultation, or until a child turns 25), so we may not be able to erase Health Information during that period.

Clients in the European Union or United Kingdom:

If the GDPR or UK GDPR applies to you, we process your personal data on the basis of performing our contract with you, your explicit consent (for health data and marketing), our legitimate interests in running our business, and compliance with our legal obligations. You have the right to access, correct, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with your local data protection authority. Your personal data is stored in Australia and the other countries described in this Privacy Policy.

Our Website and cookies:

Our Website may use “cookies”; technology to store data on your computer using the functionality of your browser. Many websites do this because cookies allow the website publisher to do useful things like find out whether the computer has visited the site before. You can modify your browser to prevent cookie use – but if you do this our service (and our Website) may not work properly. Cookies help us recognise your browser when you return. This enables us to operate an efficient service and to track the patterns of behaviour of visitors to the Website.

We use Google Analytics to understand how visitors use the Website, and the Meta Pixel to measure and improve our advertising on Facebook and Instagram. These tools collect information such as pages visited, device and browser details and IP address, and Google and Meta may place or recognise cookies on your browser. We do not place these tools on pages where you enter Health Information, such as intake forms, and we do not send Health Information to advertising platforms. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout and manage your ad preferences in your Facebook or Instagram settings. The use of cookies by such third party advertisers or ad servers is not subject to this Privacy Policy, but is subject to their own respective privacy policies. Our Website also includes videos embedded from Cloudinary, YouTube and Vimeo. When you view embedded content, these providers may collect information such as your IP address and viewing activity, set their own cookies, and, if you are logged in to their service, link your viewing to your account. Where these providers offer privacy-enhanced settings (such as YouTube's privacy-enhanced mode), we aim to use them.

Access, correction and complaints:

You can request, and we will provide you with access to, and a copy of any Personal Information we hold about you (including any Health Information) (subject to any applicable legal exceptions). We will respond to access requests within 30 days. We do not charge for making a request, but may charge a reasonable fee for providing copies where the law allows. To protect your privacy, we will verify your identity before releasing any information. Please also let us know if you have any concerns or complaints about the way we are handling your personal information so we can address them. Requests can be made by email to hello@thehollandclinic.com, by post or by phone using the contact details below. Where our records are found to be inaccurate, or if you wish to modify the Personal Information we hold about you, we will promptly make these changes on the basis of the further information you provide. We will acknowledge your complaint within 2 business days and aim to respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (www.oaic.gov.au, 1300 363 992) or, for Health Information, the Health Complaints Commissioner Victoria (www.hcc.vic.gov.au, 1300 582 113).

Transfer in certain circumstances:

If there is a sale, merger, consolidation, change in control, transfer of substantial assets, reorganisation or liquidation of us then we may transfer Personal Information to the new owner or operator as part of that transaction, and it will remain subject to this Privacy Policy. We do not otherwise transfer or sell Personal Information. Health Information will only be transferred in accordance with the Health Records Act, including by giving you notice and the opportunity to request that your health records be transferred to another health service provider of your choice.

Changes to this Privacy Policy:

We may, from time to time, amend this Privacy Policy, in whole or part, in our sole discretion. Any changes to this Privacy Policy will be effective immediately upon the posting of the revised Privacy Policy on the Website. Depending on the nature of the change, we may announce the change on our Website or by email (if we have your email address). If we make a significant change to how we handle your Health Information, we will notify you by email and, where required, ask for your consent. If you do not agree with the terms of this Privacy Policy, as amended from time to time, in whole or part, please let us know and stop using the Website and our Services. This Privacy Policy was last updated on 1 November 2026.

Contact us:

If you have any questions about this Privacy Policy, or if you wish to request access to your Personal Information, correct or update your details or raise any privacy concerns you may have, please contact our Privacy Officer at hello@thehollandclinic.com. You can also ask us for a free copy of this Privacy Policy in another format.

Postal address: B308/460 Victoria Street, Brunswick VIC 3056, Australia. Phone: +61 423 483 154.

For further information on your privacy rights go to: www.privacy.gov.au

For further information on the Health Records Act, go to: www.hcc.vic.gov.au

For further information on the GDPR, go to: https://ec.europa.eu/info/law/law-topic/data-protection_en