Little Farm of Calm

Privacy Policy

We collect the least we can get away with, we tell you why, and we don't sell it to anyone. Here is the detail, in plain English.

Last updated: 21 July 2026  ·  Health & Fitness Workshop Pty Ltd, trading as Little Farm of Calm  ·  ABN 13 121 959 984

Who this policy covers

This policy applies to Health & Fitness Workshop Pty Ltd, trading as Little Farm of Calm, at 121 Grant Drive, Benalla, Victoria 3672. It covers this website, our booking system, our retreats and the health services we provide on them.

Because we deliver physiotherapy and exercise physiology services, we handle health information. That means we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles regardless of our size, and by the Health Records Act 2001 (Vic) and its Health Privacy Principles. We take that seriously.

What we collect

When you book a retreat

• Your name, email address, phone number and postal address
• Emergency contact details
• Your retreat, dates, cabin type and any preferences
• Dietary requirements, allergies and intolerances
• Payment details — these go directly to our payment providers and we never see or store your full card number

Health information

Before and during a retreat we ask about your health so we can deliver the programme safely. Depending on what you book, that can include:

• Current and past injuries, conditions, surgeries and medications
• Symptoms you're experiencing, and how long you've had them
• Mobility, movement restrictions and exercise history
• Sleep, stress and fatigue information relevant to the programme
• Practitioners you're already seeing, and anything they've advised
• Clinical notes made by Jill or Darren during your stay

If you're booking through NDIS

Our NDIS enquiry form asks for participant details, plan management type, funding categories, plan goals, mobility and support requirements, and support coordinator or plan manager contact details. This is sensitive information and we only use it to assess whether we can meet the participant's needs and to invoice correctly.

If you download the Burnout Recovery Handbook

We ask for your email address to send it to you. We then ask some optional research questions about symptoms, how long you've felt this way, who you've seen about it, what you've tried, and your age, industry and sex.

Every one of those questions is optional and has a skip button. You can download the handbook without answering any of them. We use the answers in aggregate to understand who is reading and to write better material — not to target you.

The free burnout assessment

The assessment runs entirely in your browser. We don't collect your answers and we don't require an email address. Your score is calculated on your device and we never see it.

When you contact us or subscribe

Your name, email, phone number and whatever you choose to tell us in your message, plus a record of our correspondence.

Automatically, when you visit the site

Your IP address, browser and device type, pages viewed, time on page, and how you arrived. See Cookies and analytics below.

Why we collect it, and what we do with it

What	Why
Contact and booking details	To take your booking, confirm it, send pre-arrival information and get hold of you if something changes
Health information	To build your programme, deliver it safely, and meet our professional obligations as registered health practitioners
Dietary requirements	To feed you without hurting you
Payment information	To process payment and issue receipts and invoices
NDIS information	To assess suitability, deliver supports and invoice your plan manager or the NDIA correctly
Website analytics	To understand which pages are useful and fix the ones that aren't
Email address, if you opt in	To send you things you asked for

We do not sell your personal information. Ever. To anyone.

Consent, and taking it back

By giving us health information you consent to us collecting and using it for the purposes above. You can withdraw that consent at any time by emailing us — though if you withdraw it before or during a retreat, we may not be able to deliver the programme safely, and in some cases not at all.

Who we share it with

Only where we have to, and only the minimum needed:

• Our team. Jill, Darren and any practitioner or contractor delivering your programme. They're bound by the same confidentiality obligations we are.
• Payment providers. Stripe, Afterpay and PayPal process payments directly. They receive what they need to take the payment; we don't receive or store your card details.
• Our booking and website systems. Squarespace hosts this site. We use Google Workspace to store booking records.
• Your NDIS plan manager, support coordinator or the NDIA, where you've booked through NDIS and asked us to invoice them.
• Medicare and private health insurers, only where you ask us to provide documentation for a rebate. We give the paperwork to you; you make the claim.
• Your GP or other treating practitioners, only with your explicit consent, or where we reasonably believe it's necessary to prevent a serious threat to your life, health or safety.
• Emergency services and your emergency contact, if there's a medical emergency on site.
• Professional advisers, insurers and regulators, where we're legally required to disclose — including AHPRA in the event of a notification.

Information sent overseas

Some of the services we use store data outside Australia, mostly in the United States. That includes Squarespace, Google, Stripe, PayPal, Afterpay and Substack. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.

Cookies and analytics

We use cookies and similar technologies to make the site work and to understand how it's used:

• Essential cookies — required for the booking system and cart to function. Can't be turned off without breaking the site.
• Google Analytics 4, via Google Tag Manager, to see which pages are used and where people get stuck.
• Google Ads conversion and remarketing tags, so we can tell whether our advertising works.

You can opt out of Google Analytics entirely using Google's official browser add-on at tools.google.com/dlpage/gaoptout, and you can block or delete cookies in your browser settings. Neither will stop you booking a retreat.

Marketing emails

We only email you marketing if you've asked us to, or if you've booked with us and it's relevant to your stay. Every marketing email has an unsubscribe link and we action unsubscribes promptly, as required by the Spam Act 2003 (Cth). Unsubscribing from marketing doesn't stop us sending information about a retreat you've actually booked.

How we keep it safe

We use reputable hosting and payment providers, restrict access to the people who need it, use multi-factor authentication on our accounts, and keep paper records secured on site. No system is perfectly secure, and we won't pretend otherwise — but if there is a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

How long we keep it

• Health and clinical records: at least 7 years from the date we last provided you with a health service. If you were under 18 when we last saw you, until you turn 25. This is required of us under Health Privacy Principle 4.2 of the Health Records Act 2001 (Vic) — we can't delete these records earlier even if you ask us to.
• Booking and financial records: at least 5 years, as required by the ATO.
• Marketing contact details: until you unsubscribe or ask us to delete them.
• Handbook research answers: kept in aggregate; identifying details removed once collated.

Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct anything that's wrong. Email us and we'll respond within 30 days.

We can normally provide this free of charge. If a request is complex we may charge a reasonable cost, and we'll tell you what that is before we do anything. There are limited situations where we may refuse — for example where giving you access would unreasonably affect someone else's privacy. If we refuse, we'll tell you why in writing and how to complain about it.

Complaints

If you think we've mishandled your information, tell us first. Email [email protected] with "Privacy complaint" in the subject line. We'll acknowledge it within 5 business days and give you a written response within 30 days.

If you're not satisfied with how we handle it, you can escalate to:

• Office of the Australian Information Commissioner — oaic.gov.au or 1300 363 992
• Health Complaints Commissioner (Victoria), for health information — hcc.vic.gov.au or 1300 582 113

Children

Our retreats are for adults and this site isn't directed at children. We don't knowingly collect personal information from anyone under 18 without a parent or guardian's involvement. If you believe we have, contact us and we'll delete it.

Changes to this policy

If we change how we handle your information we'll update this page and change the date at the top. If the change is significant and affects people who've already booked, we'll email you rather than expecting you to notice.