Privacy policy
1. Who we are
This policy explains how KAP Health Beauty (ABN 85 729 047 711), of Perth, Western Australia ("we", "us"), handles personal information in the KAP Portal (the "portal"). The portal is a private ordering system used by our invited trade customers and our own staff. It operates at portal.kaphealthbeauty.com.au and kaphealthbeauty.com.au. The portal is managed for us by our portal administrator, who is the contact for privacy enquiries.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We follow this policy whether or not the small business exemption in that Act applies to us.
2. What we collect
- Business contact details of our customers' staff
- Delivery details
- Account and sign-in data (passwords are stored only in securely hashed form)
- Orders, price-list acknowledgements and invoices
- Delivery pick-list photos, which may show names, delivery addresses and other details printed on the pick list
- Order emails, and their attachments, that you send us and that we forward into the portal
- Connection data for the accounting software we use to record invoices
- Technical and security logs
We do not collect payment card or bank account details through the portal. The portal is not designed to hold health information. Please don't include patient or personal health details in orders, emails or photos.
3. Why we collect it
- To set up and secure user accounts, and to provide the portal.
- To receive, check and fulfil orders, including placing the matching orders with our suppliers.
- To confirm deliveries by reading pick-list photos and matching them to orders.
- To prepare invoices, have them agreed and record them in our own account in the accounting software we use.
- To send service emails (account invitations, order and invoice notifications).
- To provide support, fix errors, prevent misuse and keep records required by law (for example tax records).
We don't use your information for marketing, we don't sell it, and we don't use it to train AI models.
4. Where your information is stored
- Main storage in Sydney, Australia: the portal's database, user sign-in service and file storage (including pick-list photos) are hosted by Supabase in its Sydney region (Amazon Web Services, ap-southeast-2), on Supabase's standard infrastructure. Data is encrypted in transit (TLS) and at rest.
- Cloudflare: the website is delivered through Cloudflare's global network, and our email addresses at kaphealthbeauty.com.au are routed by Cloudflare Email Routing. Cloudflare usually serves Australian visitors from Australian data centres, but traffic can pass through or be processed in Cloudflare data centres in other countries (for example in Asia or the United States), depending on internet routing.
5. Overseas processing
Some service providers process information outside Australia:
| Service | What it processes | Where |
|---|---|---|
| AI document reading service (our default reader) | Pick-list photos, which may show names and delivery addresses, and order emails or attachments that we forward into the portal. These are read to extract product codes and quantities. Prices and costs are never included. | Servers in the United States |
| Supplier cart assistant | Supplier order lines (product codes and quantities) so it can fill our supplier's online cart for us to review. It does not receive your staff's contact details. | Servers in the United States |
| Resend (transactional email) | Recipient email address, subject, content and delivery records of the portal's service emails | Japan (Resend's Tokyo region). Resend is a US company. |
| Google Gemini API (alternative reader, only if we turn it on) | The same documents as the default reader. We use only Google's paid tier, under which Google does not use the content to improve its products. | United States (Google may also process or cache it in other countries) |
| Cloudflare | Website traffic and email routing (see section 4) | Global network |
| Our accounting software provider (cloud accounting service) | The invoice, customer and item details we send to our own account in that software (see section 6) | The provider's cloud servers, mainly in the United States (the provider may also store or process data in other countries, as set out in its own privacy statement) |
We choose established providers with strong security commitments, send only the information each one needs, and take reasonable steps under APP 8 to make sure overseas recipients handle the information consistently with the APPs.
6. Data from connected business software (such as accounting software)
- How it is accessed: the portal connects to business software that we use (such as our accounting software) only through an authorised connection that our administrator approves with that software's provider. We never ask for or store passwords for that software. The portal connects only to our own accounts. Customers don't connect theirs.
- What it is used for: only to create and check our records for orders placed through the portal (such as sales invoices and the customer and product records they need), and to read the settings needed to do that (such as tax codes and payment terms). We don't use it for any other purpose.
- Where it is stored and for how long: what the portal keeps from the connection (mainly record numbers and the results of each update) is stored with the rest of the portal's data, as described in section 4, and kept as set out in section 8. Records created in the software stay there as our accounting records.
- No sale or sharing: we don't sell data obtained through the connection or share it with third parties, apart from the providers that host the portal for us. We don't use it for marketing or to train AI models.
- Security of the connection: the access keys (tokens) for the connection are encrypted and kept only on our servers. They are never sent to a web browser or shown to users.
- Disconnection and deletion: the connection can be ended at any time, from the portal or from the software provider. When it ends, the portal stops accessing the software and deletes the stored access keys straight away.
- Our role: we handle this data for our own business. We don't process it on behalf of the software provider.
7. Who we share it with
We share information only with the service providers in section 5; with our suppliers, to the extent needed to fill an order (for example the delivery address); with our professional advisers; or where the law requires it. We never sell personal information.
8. How long we keep it
- Orders, invoices and related records: at least 5 years, as needed for Australian tax records.
- Delivery pick-list photos and forwarded order emails: 12 months after the related invoice, unless they are needed for a dispute.
- User accounts: until access is no longer needed. The account is then deactivated, and its personal data is deleted 1 year after the account is removed, apart from what we must keep with order and invoice records.
- Access keys (tokens) for the accounting software connection: deleted immediately on disconnect.
- System records and logs (audit, technical, security and accounting software connection logs): 24 months.
9. How we protect it
We protect information with encryption in transit and at rest, row-level access rules so each user sees only their own business's data, invitation-only accounts, multi-factor authentication for administrators, secrets kept outside the code, least-privilege access, and audit logs of changes. If a data breach is likely to cause serious harm, we will notify the affected people and, where required, the Office of the Australian Information Commissioner (OAIC).
10. Access and correction
You can ask to see or correct the personal information we hold about you. Email [email protected]. We will respond within 30 days. If we refuse a request, we will tell you why, unless the law says we can't.
11. Complaints
If you have a privacy concern, contact us first at [email protected]. We will reply within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner: www.oaic.gov.au, phone 1300 363 992.
12. Changes
We may update this policy. The current version and its date are always shown on this page.