Get Scanned Privacy & Terms

PRIVACY POLICY

Version 2026.09.1
Effective Date: 28-09-2026
First Published: 24-04-2026

Amendment history:

24-04-2026, Version 2026.04: This policy was first published.

30-05-2026, Version 2026.05: This policy was amended to add a new Section 5 covering biometric data collected by the InBody 970 scanner, including fingerprint capture, storage, consent, and withdrawal. Section 2 was updated to reference this new section. The remaining sections were renumbered accordingly.

10-06-2026, Version 2026.06: Section 5 was updated to incorporate manufacturer-confirmed technical detail regarding fingerprint data storage, encryption, and deletion procedures on the InBody 970, following formal written confirmation received from InBody Korea and supporting technical documentation from Suprema Inc., the manufacturer of the fingerprint module. Section 12 was updated to reflect the finalised wording of the biometric consent checkbox in our booking system.

21-09-2026, Version 2026.09: Section 6 was updated to identify LookinBody Web, the scanner manufacturer’s online results platform, as a service that holds scan results, to clarify that FluentCRM runs on our own website, to identify the email delivery service we use, and to add a new part covering disclosure of information outside Australia. Section 7 was updated to state where our website data is hosted, to describe encryption of our database backups, and to state the retention period for records of clients who were under 18 at their last appointment. Section 1 was updated to describe version numbering. Version numbers were introduced and all dates were changed to DD-MM-YYYY format. No other section was changed in substance.

28-09-2026, Version 2026.09.1: Amended for the launch of Unlocked, our member portal. Section 1 now points to the Unlocked section at the foot of this page. Section 2 lists the additional information collected in Unlocked. Section 3 adds providing Unlocked as a purpose. Section 6 states that our email is sent from within Australia, and adds the clinic finder, password breach checking, and software development tools to the list of disclosures outside Australia. Section 7 adds the security measures and retention that apply to Unlocked. No other section was changed in substance.

1. ABOUT THIS POLICY

Get Scanned is a mobile health service provider operating in Victoria, Australia. We conduct InBody 970 body composition scans and ECAL metabolic tests at client venues, host locations, and scheduled clinics across Melbourne metro and Regional Victoria.

This privacy policy explains how we collect, use, disclose, and manage your personal and health information. It applies whenever you book an appointment, attend a scan, or interact with us through our website, scheduling system, or communications.

We are committed to handling your information lawfully, fairly, and transparently in accordance with:

• The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• The Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs)
• The Australian Consumer Law

By booking an appointment with Get Scanned, you agree to the collection and use of your information in accordance with this policy. We will update this policy when our practices change. The most current version is always available on our website at getscanned.com.au. Each version of this policy carries a version number and effective date, and every amendment is recorded in the amendment history at the top of this policy.

If you use Unlocked, our member portal, the Unlocked section at the foot of this page applies in addition to this policy.

2. WHAT PERSONAL AND HEALTH INFORMATION DO WE COLLECT?

We collect information that you provide directly when you:

• Book an appointment through our Acuity Scheduling system
• Attend a scan appointment at one of our clinics or venues
• Request a Scan-Van visit to your location
• Contact us by email, phone, or through our website
• Subscribe to our mailing list

Personal information we collect includes:

• Your full name
• Email address
• Phone number
• Residential suburb and postcode
• Date of birth
• Gender
• Referral source (if applicable, including personal trainer, coach, gym, medical practitioner, allied health provider, or employer)

Health information we collect includes:

• Body composition measurements from your InBody 970 scan (body fat percentage, lean muscle mass, muscle balance, water weight, and metabolic data)
• ECAL metabolic test results (resting metabolic rate and other metabolic parameters), if you purchase this add-on
• Any health conditions or medications you disclose to us that are relevant to your scan safety
• Your fitness goals or health objectives, if you provide them

Biometric information we collect includes:

• An encrypted mathematical template of your fingerprint, captured by the InBody 970 scanner at your first appointment if you consent to biometric enrolment. The template is used by the scanner to recognise you at subsequent appointments. Biometric data is treated as a separate category of sensitive information and is subject to its own collection, consent, and handling provisions, set out in Section 5 of this policy.

If you use Unlocked, our member portal, we also collect:

• Progress photos you choose to take, and the notes you choose to write
• Your account details and sign-in security information, including any devices you mark as trusted, passkeys, and authenticator setup
• A record of activity in your account, including the IP address and browser used

The Unlocked section at the foot of this page explains all of this in detail.

We also automatically collect certain information when you visit our website:

• Your IP address
• Browser type and version
• Pages you visit
• Links you click
• Access times and duration

3. WHY DO WE COLLECT THIS INFORMATION?

We collect your information for the following primary purposes:

To deliver our scanning service:

• To schedule and conduct your InBody and ECAL appointments
• To process payment for services (if applicable)
• To communicate appointment details, reminders, and results
• To assess your eligibility and safety for scanning

To provide health feedback:

• To generate your scan results and body composition analysis
• To provide you with your personal health data in a format you can use
• To provide Unlocked, our member portal, where you can see your own results and history

To improve our service:

• To understand which regions have demand for our services
• To evaluate our service quality and client satisfaction

To comply with legal obligations:

• To maintain records as required by Australian privacy and health legislation
• To respond to legitimate requests from regulatory bodies

4. HOW WE USE AND DISCLOSE YOUR INFORMATION

Secondary Uses and Consent

Under the Health Records Act 2001 (Vic), we may only use or disclose your health information for purposes other than those for which it was collected if those purposes are directly related and reasonably expected by you, or if you have given us your explicit consent.

When you book an appointment with Get Scanned, you provide consent to secondary uses of your information as described below. You can modify or withdraw consent to any of these uses by contacting us.

Mailing List and Regional Clinic Notifications

When you book an appointment, you are automatically enrolled in our regional mailing list. We use your contact information to notify you of future scheduled clinics in your region. This is a secondary use of your contact information that we consider directly related to your primary booking. You attend clinics in your area, and we inform you when we return to that area.

If you do not wish to receive these notifications, you may unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us directly.

Data Sharing with Referrers and Referring Practitioners

If your appointment was referred to us by a personal trainer, coach, nutritionist, dietitian, allied health provider, or medical practitioner, we may share your scan results with that referring person or organisation if:

• You have consented to this disclosure (as indicated by checkbox in your booking)
• The referrer requests access to your results to provide you with ongoing care or advice
• You explicitly ask us to send your results to them

This sharing is not automatic. We do not routinely disclose your data to referrers. Sharing only occurs when the referrer requests it, when you ask us to share it, or when it is necessary for the service they are providing to you.

Data Sharing with Employers, Gyms, and Challenge Organisers

If your appointment or scan series was organised or paid for by your employer, gym, personal trainer, or as part of a defined challenge or program, we may share your scan results with that organisation only if you are an active participant or member in that specific challenge or program.

If you attend one of our clinics at a gym venue but are not a member of that gym or enrolled in a specific challenge or program there, we do not share your data with the gym simply because you were scanned at their location.

When your results are shared with a gym or challenge organiser, that sharing may include:

• Your name and scan results (not deidentified)
• Performance metrics relevant to the challenge (body fat percentage, weight, muscle mass changes, or other parameters)
• Reporting that allows comparison of results across participants (rankings, progress summaries)

If your scan is part of a defined challenge or program that you have explicitly enrolled in, you are consenting to this sharing by ticking the relevant checkbox at booking. If you wish to withdraw this consent for a specific challenge, contact us before your scan.

Data We Do Not Share Routinely

We do not:

• Share your health information with third parties for marketing purposes
• Sell or trade your personal information
• Disclose your data to organisations simply because you were scanned at their venue (unless you are enrolled in a specific challenge or program there)
• Share your information with external data brokers, research organisations, or advertisers without your explicit consent

5. BIOMETRIC DATA COLLECTED BY THE INBODY 970 SCANNER

Get Scanned uses the InBody 970, a medical-grade body composition analyser manufactured by InBody Co., Ltd. The InBody 970 includes a fingerprint reader integrated into the thumb electrode of the device. At your first appointment with Get Scanned, if you have consented to biometric enrolment, a fingerprint is captured from your thumb when you place your hand on the electrode in accordance with the operator’s instructions. The fingerprint is linked to your mobile number, which serves as your unique identifier within the scanner, and is used to recognise you at subsequent appointments, allowing your previous scans to be retrieved and compared automatically.

Biometric data is treated as a distinct and more sensitive category of personal information than other information described in this policy, and is handled in accordance with the provisions of this Section 5.

How biometric data is stored

Get Scanned has received formal written confirmation from InBody Korea, supported by manufacturer documentation from Suprema Inc. (the manufacturer of the fingerprint module installed in the InBody 970), regarding the technical handling of fingerprint data on the InBody 970. The following technical facts have been confirmed by both manufacturers.

The fingerprint module within the InBody 970 stores fingerprint templates only. It does not store actual fingerprint images. A fingerprint template is binary data consisting of geometric features only, approximately 400 bytes in size. Suprema has confirmed in writing that it is theoretically impossible to reconstruct a fingerprint image from a template.

The structure of a fingerprint template is proprietary information held by Suprema and is not disclosed to any individual or company. A template stored in the device cannot, on its own, be interpreted or used by any party who is not in possession of Suprema’s proprietary template format.

No personally identifying information is stored within the fingerprint module itself. Each template is associated only with a numerical user ID assigned by the device.

Fingerprint templates on the InBody 970 are encrypted using AES 256-bit encryption. InBody Korea has confirmed in writing that this encryption is enabled by default at the factory on all InBody 970 units, is implemented as a fixed default, and cannot be switched off by the operator.

Fingerprint data is stored locally within the fingerprint module of the device itself. It is not transmitted to any external server, to InBody, to Suprema, or to any cloud service.

Your consent to biometric collection

At the time of your first appointment with Get Scanned, the operator will verbally explain the use of the fingerprint reader before any scan is conducted. The verbal explanation will describe what is captured, why it is captured, where the data is held, and how it is protected. By placing your thumb on the electrode and proceeding with the scan, you provide your consent to the collection of your fingerprint for the purposes described in this section.

Your consent to biometric data collection is also captured in writing at the time of booking, by way of a dedicated checkbox in our Acuity Scheduling system. The checkbox confirms that you have read and understood this section of the privacy policy and that you consent to the collection of your fingerprint for the purposes described.

If you do not consent to biometric data collection

You may decline to have your fingerprint captured. If you decline, please advise the operator before the scan commences, or contact Get Scanned in advance of your appointment. A scan can be conducted without fingerprint capture, and Get Scanned is able to identify and record your scan results using your mobile number as your identifier on the device, without enrolling your fingerprint.

Withdrawal of consent and deletion of biometric data

You may withdraw your consent to the ongoing retention of your fingerprint data at any time by contacting Get Scanned using the details in Section 10 of this policy. Upon receipt of a written deletion request, Get Scanned will arrange for your fingerprint data to be removed from the scanner within 7 days, and will provide written confirmation of deletion once complete.

The manufacturer-confirmed deletion procedure removes the specific fingerprint record associated with your mobile number from the fingerprint module of the device. Deletion of your fingerprint record does not affect your scan history, your booking history, your contact details, or your mailing list subscription, unless you specifically request that those records also be deleted. Any deletion of additional categories of information is actioned separately on direct request.

Sharing of biometric data

Get Scanned does not share, sell, or disclose your fingerprint data with any third party under any circumstances. This includes referring trainers, host venues, employers, gyms, allied health providers, medical practitioners, and challenge organisers. The data sharing arrangements described in Section 4 of this policy do not apply to biometric data. Biometric data is retained within the scanner hardware and is used only for the recognition purposes described in this section.

6. INFORMATION HELD BY THIRD PARTIES AND OVERSEAS DISCLOSURE

Your appointment is booked through Acuity Scheduling, a third-party scheduling platform operated by Squarespace, Inc. Your personal information (name, email, phone, appointment details) and any answers you give in our booking forms are held by Acuity Scheduling on our behalf. Acuity’s privacy practices are governed by their privacy policy, which you can review at acuityscheduling.com.

Your InBody 970 scan results are also recorded in LookinBody Web, the online results platform provided by the scanner’s manufacturer, InBody Co., Ltd. of South Korea. This is how your scan history is stored and compared from one appointment to the next. LookinBody Web is governed by InBody’s own privacy policy. If you choose to use the InBody mobile app, your account in that app is your own arrangement with InBody, and we cannot access, change, or delete information held in it.

Your email address may be held in FluentCRM, our customer relationship management system, when you are enrolled in our regional mailing list. FluentCRM runs on our own website rather than as a separate outside service, so this information stays within our own systems. We use it to send you clinic notifications and other service-related communications. Emails we send you are delivered through Amazon Simple Email Service, from that service’s Sydney, Australia region. You can unsubscribe from these communications at any time.

If payment is processed, payment information may be held by our payment processor. We do not store your credit card details directly.

Apart from LookinBody Web, our off-site backups described in Section 7, and the sharing described in Section 4 (referrers, challenge organisers, or at your explicit request), health information you disclose to us is stored by Get Scanned and is not transferred to external third parties.

Biometric data is not held by any third party and is not transferred to any third party. See Section 5 for further detail.

Disclosure outside Australia

Our website and its database, including your scan records, are hosted on servers in Australia, and our email is sent from within Australia. Some of the services described above store or receive information overseas:

• LookinBody Web (scan results): InBody states in its published privacy policy that information may be transferred to or stored in Singapore and South Korea.
• Acuity Scheduling (booking details and booking form answers): United States.
• Off-site backups of our website (see Section 7): stored with Google, which may hold data in data centres outside Australia. Database backups, which contain client records, are encrypted before they leave our server.
• Finding a clinic: when you search for clinics near a suburb, our server asks Google for travel times between that suburb and our clinic addresses. We send the suburb and the clinic addresses, and nothing about you.
• Password checking: when you set or change a password for Unlocked, we send a short, partial fingerprint of that password to a public breach-checking service so we can warn you if it is known to have been exposed. Your password itself never leaves our server and cannot be worked out from what is sent.
• Software development: our website systems are built and maintained in-house, and that work may involve AI-assisted development tools operated by Anthropic in the United States. We work from sample and de-identified data for development wherever practical.

7. DATA QUALITY AND SECURITY

We take reasonable steps to ensure your personal and health information is:

• Accurate, complete, up-to-date, and relevant to our functions
• Kept secure and protected against misuse, loss, unauthorised access, and disclosure
• Retained only for as long as necessary to fulfil the purposes for which it was collected

How we secure your information:

• Our website and its database, including your scan records, are hosted on secure servers in Australia
• Your health information (scan results) is kept in secure, access-restricted records
• Database backups are encrypted before being stored off-site
• Progress photos uploaded to Unlocked are encrypted on our server
• Unlocked accounts require a password and a second step to sign in, and opening a client record or a scan is recorded in an activity log
• Staff access to personal and health information is limited to those who need it to provide you with our service
• We use secure communication channels when sharing information with referrers or third parties

How long we keep your information:

• Appointment records and scan results are retained for at least 7 years after your last appointment, as required by the Health Records Act 2001 (Vic). If you were under 18 at your last appointment, they are retained at least until you turn 25
• Mailing list information is retained while you are subscribed. Unsubscribe to have your email removed
• Information held in Unlocked, including progress photos, notes, and activity records, is kept as set out in the Unlocked section at the foot of this page
• If you request deletion of your records, we will comply unless we are legally required to retain them, including under the retention periods above
• Biometric data retention is addressed in Section 5

8. YOUR RIGHTS: ACCESS AND CORRECTION

Under the Health Records Act 2001 (Vic) and the Privacy Act 1988 (Cth), you have the right to:

Access your information: You may request access to the personal and health information we hold about you. This includes your scan results, appointment history, and any notes we have recorded. To request access, contact us with your name and email address. We will provide your information within 30 days or advise you of any reasons we cannot.

Correct your information: If you believe your personal or health information is inaccurate, incomplete, or out-of-date, you may request that we correct it. We will take reasonable steps to update your records.

Withdraw consent: You may withdraw your consent to any secondary use of your information (mailing list, data sharing with referrers, challenge participation, biometric collection) by contacting us. Withdrawal will not affect the lawfulness of any disclosure made before we received your request.

To exercise any of these rights, contact us using the details in Section 10 below.

9. NOTIFIABLE DATA BREACHES

Under the Privacy Act 1988 (Cth), if we become aware of a data breach involving your personal information that is likely to result in serious harm to you, we are required to notify you and the Office of the Australian Information Commissioner (OAIC) without unreasonable delay.

A data breach notification will include:

• A statement that we have become aware of the breach
• Identification of the type of information involved
• Likely consequences of the breach
• Recommended steps you can take in response
• Details of our response to the breach
• Our contact details

We maintain security measures designed to prevent unauthorised access or disclosure, but we cannot guarantee absolute security. If you believe your information may have been compromised, contact us immediately.

10. HOW TO CONTACT US

If you have questions about this privacy policy, wish to access or correct your information, withdraw consent, unsubscribe from our mailing list, or report a data breach, please contact us:

Get Scanned
Phone: 0401 070 759
Email: info@getscanned.com.au
Website: getscanned.com.au
Address: 33 Vista Way, South Morang, VIC 3752, Victoria

11. COMPLAINTS AND FURTHER ASSISTANCE

If you believe we have breached your privacy rights under the Privacy Act 1988 (Cth) or the Health Records Act 2001 (Vic), you may lodge a complaint with us. We will acknowledge your complaint within 24 hours and investigate within a reasonable timeframe.

If you are not satisfied with our response, or wish to lodge a complaint independently, you may contact:

Office of the Australian Information Commissioner (OAIC)
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Website: oaic.gov.au

Health Complaints Commissioner (for health information breaches)
Phone: 1300 582 113
Website: hcc.vic.gov.au

The OAIC and Health Complaints Commissioner can investigate privacy complaints at no cost to you.

12. ABOUT THIS POLICY AND ACUITY BOOKING CHECKBOXES

When you book an appointment with Get Scanned through our Acuity Scheduling system, you will see checkboxes confirming:

• Privacy Policy Agreement: You have read, understood, and agree to the terms of this privacy policy. A link to the full policy is provided at booking.
• Mailing List Consent: You consent to being added to our regional mailing list to receive notifications about future clinics in your area.
• Biometric Data Consent (optional): You consent to fingerprint capture by the InBody 970 scanner at your first appointment. The scanner captures an encrypted mathematical template of your fingerprint, linked to your mobile number, so the device can recognise you at future appointments. The template is stored only on the device itself, is not transmitted to any external server, and cannot be used to reconstruct your fingerprint. By ticking this box, you confirm that you have read and understood Section 5 of this privacy policy and consent to fingerprint capture. If you leave this box unticked, you can still complete your booking, and your operator will identify you using your mobile number alone, without enrolling your fingerprint.
• Data Sharing Consent (if applicable): If your appointment has been organised or paid for by an employer, gym, personal trainer, or as part of a defined challenge or program, you consent to your scan results being shared with that organisation for the purposes of that challenge or program. This checkbox will only appear if applicable to your booking.
• Referrer Consent (if applicable): If your appointment was referred by a health or fitness professional, you consent to us sharing your results with that referrer if they request it or if sharing is necessary to support the care or coaching they are providing to you. This checkbox will only appear if a referrer is listed on your booking.

These checkboxes ensure your consent is recorded at the point of booking and correlates directly with the terms of this privacy policy.

END OF PRIVACY POLICY