Privacy Policy & Disclaimer

Definitions

• Administrator — any person with login credentials to a Wellbeing Matters @ Series Customer account, able to manage accounts, create surveys, and review depersonalized results.
• The Good Foundry / we / us / our — The Good Foundry Pty Ltd (ACN 103 558 372), 1/31 Beach Street, VIC 3199, Australia, and any related entities.
• Customer / Company — the person or entity that has procured access to The Good Foundry’s Services; generally your employer or an identified subgroup within it.
• Respondent / Participant — any person who uses the Wellbeing Matters @ Series platform (wholly or partially) through a Customer.
• Services — all products, services, and websites offered by The Good Foundry, including the Wellbeing Matters @ Series platform and related mobile applications.
• Visitor — any person who visits our website(s).
• Websites — www.permahsurvey.com, www.perma4plus.com, www.the-good-foundry.com, and any other The Good Foundry websites linking to this Policy.
• You / your — an Administrator, Respondent/Participant, or Visitor as applicable.

We may update this Privacy Policy from time to time. Questions? Contact our Privacy Officer at privacy@the-good-foundry.com.

A Note About Children

Unless permitted by applicable law, you must not provide any child under the age of 16 with the Wellbeing Matters @ Series Platform (except editions designed specifically for Kids and Youth). We do not intentionally gather personal information from minors outside those dedicated editions.

If a minor submits personal information through an adult version of the platform and we become aware of it, we will attempt to delete that information promptly. To report a concern, contact privacy@the-good-foundry.com.

What Information Do We Collect?

We collect information about you and your use of our Services from a variety of sources. The information we collect depends on how you use our Services — whether as an Administrator, Respondent, or Visitor.

(a) Information We Generally Collect

• Contact information. Your name and email address when provided through account creation, forms, or interactions with our sales or support team.
• Usage information. Data about how you interact with our Services, including pages visited, clicks, and activity timing.
• Device and browser data. IP address, operating system, browser details, and time of visit — which may also indicate your location.
• Log data. Log files recording each server access, including originating IP address, to maintain an audit trail and improve our Services.
• Referral data. Information about the source that referred you to our websites.
• Other submitted data. Personal information provided in testimonials, events, downloads, purchases, or social media interactions.

(b) Information Specific to Administrators & Respondents

• Personal information. Company, name, phone number, encrypted password, and email address upon account creation.
• Sensitive information. Demographic information (such as ethnicity) collected during evaluations. You may always select “Prefer Not To Answer.”
• Your content. All responses submitted through the Wellbeing Matters @ Series platform, unless you request removal at privacy@the-good-foundry.com.

(c) Information Specific to Administrators

• Registration details. Name, company name, email address, password, and related information.
• Survey data. Survey questions and related information created and launched through the Services.
• Billing details. Cardholder name, billing address, email, card number, expiry date, and security code (collected by our card processor).
• Account settings. Name, email, default language, time zone, and other preferences on your account or profile page.

Who Is the Data Controller or Processor?

• For Administrators and Respondents: your company (our Customer) is the controller; The Good Foundry is the processor.
• For Visitors: The Good Foundry is generally the controller of your personal information.

How Do We Hold the Information We Collect?

(a) Security

All data is private and confidential. We take reasonable steps to ensure it is handled securely and follow generally accepted security standards for both transmission and storage. We recommend using a sophisticated password and keeping it secret. To report unauthorized access, contact privacy@the-good-foundry.com.

(b) Data Location

Your data is stored at the location closest to your country. Our servers are located in: Sydney (Australia), Singapore, Iowa (USA), London (UK), Eemshaven (Netherlands), and Frankfurt (Germany). Personal data and response data are always stored separately across different servers. Servers are protected by 24×7 human security, biometrics, access control, and video surveillance.

(c) European Union & Swiss Users

The Good Foundry offers the EU Standard Contractual Clauses (EU SCCs) to meet adequacy and security requirements for Customers operating in the European Union and for other international data transfers.

How Do We Use the Information We Collect?

(a) EU Users

We process your personal information either with your consent, to fulfill our contractual responsibility to deliver Services, or to pursue The Good Foundry’s legitimate interests of improving our Services or developing new features.

(b) Administrators

• To provide our Services. Providing platform access, customer support, and technical assistance.
• To manage our Services. Monitoring, maintaining, and improving features; personalizing your experience; enforcing contracts; preventing illegal activities.
• To contact you. Notifying you of changes to Services, terms, or policies.
• For marketing purposes. Sending news and product information you’ve requested or that may interest you.
• To respond to legal requests. Inspecting personal information if required by law or to prevent potential harm.

(c) Respondents

• Account management. Creating and maintaining your account.
• Service management. Monitoring and improving features; personalizing your experience; responding to legal requests; publishing research.
• De-identified reporting. Using survey data in de-identified aggregated form to generate organizational results, improve Services, and create population scores.

(d) Visitors

• Marketing communications. Sending news and product information you’ve requested or that may interest you.
• Service management. Personalizing your experience; monitoring and improving Services; enforcing contracts; responding to legal requests.

Anonymity and Pseudonyms

In most cases, we will have difficulty providing our Services if you do not provide your real name and contact details — particularly as an Administrator or Respondent. Where lawful and practicable, you may use a pseudonym or not identify yourself (for example, for general queries or complaints). In some cases, not providing information may limit our ability to provide Services or respond to you adequately.

Who Has Access to Your Personal Information?

We share your personal information with third parties only as described in this Policy. We may disclose it to staff and service providers (including hosting, project management, email, monitoring, customer support, and analytics services) solely as necessary to provide our Services.

• To provide Services. Filling orders, processing payments, storing documents, providing professional advice, sending service emails, and providing technical support.
• Actions you consent to. Disclosures you specifically authorize, or to integrate third-party services.
• Business transactions. In connection with mergers, acquisitions, or asset sales. You will be notified of any change in ownership affecting your personal information.

We sign confidentiality and data processing agreements with all third-party service providers to ensure appropriate privacy and security standards. Every provider we use is named, with its purpose, its region and the data it can access, on our sub-processors page.

What Are Your Rights to Your Personal Information?

If you live in certain countries (e.g., EU member states), you may have rights to access, correct, delete, port, limit, or stop use of your personal information.

• Update account details. Change information directly in your account settings, or contact privacy@the-good-foundry.com.
• Access, correction, and deletion. Request review, correction, or deletion by contacting privacy@the-good-foundry.com.
• Data exports. Request a CSV export of your data by contacting privacy@the-good-foundry.com.
• Limiting or stopping use. Contact privacy@the-good-foundry.com — note this may limit Services available to you.
• Unsubscribe. Use the unsubscribe link in our emails or contact privacy@the-good-foundry.com.

How Long Do We Retain Your Personal Information?

Administrators & Respondents

We retain your personal information indefinitely.

Visitors

We retain your personal information for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce our legal rights.

How Do You Make a Complaint?

(a) Privacy Officer

Contact our Privacy Officer for any complaints about compliance with this Privacy Policy or relevant privacy laws: privacy@the-good-foundry.com.

(b) European Union Complaints

If dissatisfied with our handling of a complaint, contact the relevant EU Data Protection Authority in your country. Please contact our Privacy Officer first at privacy@the-good-foundry.com.

(c) Australian Privacy Act Complaints

If dissatisfied with our handling of a complaint, contact the Office of the Australian Information Commissioner at www.oaic.gov.au/about-us/contact-us. Please contact our Privacy Officer first at privacy@the-good-foundry.com.

Additional Information

(a) Sensitive Personal Data

By submitting sensitive personal information (e.g., racial or ethnic origin, sex life, physical or mental health conditions) when using the Services, you consent to our processing of such data as necessary to provide the Services. You may withdraw consent in accordance with applicable laws and Section 8 of this Policy.

(b) Cookies and Tracking Technologies

We use technologies such as cookies, beacons, tags, and scripts to analyze trends, administer the website, and gather demographic information. We use cookies for session management and user preferences. You can control cookie use at the browser level, though some features may be limited if cookies are disabled.

(c) Links to Other Websites

Our websites may link to third-party websites. Their privacy practices may differ from ours. Personal information submitted to those sites is governed by their own privacy policies. We encourage you to review each site’s privacy policy.

(d) Testimonials

We may post testimonials with your consent. To update or delete your testimonial, contact privacy@the-good-foundry.com.

Google User Data

When you choose to connect Google Fit to your Wellbeing Vault, Wellbeing Matters @ Work requests permission to read the following data from your Google account:

• Activity data — daily step counts, active minutes, distance covered (fitness.activity.read)
• Heart rate — daily average resting heart rate (fitness.heart_rate.read)
• Heart-rate variability — daily HRV, derived from the same heart-rate permission (fitness.heart_rate.read)
• Sleep — nightly sleep duration and stages (fitness.sleep.read)

How We Use This Data

• To populate your personal wellness trend charts in your Wellbeing Vault, correlating objective data with your self-reported PERMA+H evaluation scores.
• To generate aggregated, anonymised cohort averages (groups of 10+ respondents) for organisational reporting — with no individual identifiability.

How We Do Not Use This Data

• We do not sell your Google Fit data to any third party.
• We do not share your Google Fit data with your employer in identifiable form.
• We do not use it for advertising.
• We do not use it to make decisions about your employment.

Storage and Retention

• Data is stored encrypted at rest on our SiteGround infrastructure (Sydney, Australia region), and is included in our encrypted off-site backups, which are held in Australia. See our sub-processors page.
• Deletion below is immediate in the live system. The thirty-day window covers the backup cycle, after which no copy remains.
• Daily figures (steps, resting heart rate, HRV, sleep duration and sleep score) are retained while your account is active, together with the raw daily response returned by the Google API for the same dates.
• On disconnection from your Wellbeing Vault settings, all stored Google Fit data is deleted within 30 days.
• On account closure, all data is deleted within 30 days.

If Your Organisation Runs Wearable Rewards

Some organisations enable Wearable Rewards, where meeting a daily goal (for example a step target) earns points that may carry a monetary value. Where that is switched on:

• When a goal is met, we send your email address, which goal you met, and your subscription reference to our Rewards Foundry service so the points can be credited to you.
• We do not send your underlying measurements — your step count, heart rate, HRV or sleep figures stay on this platform.
• If your organisation does not run Wearable Rewards, nothing is sent.

Your Control

• You can disconnect Google Fit at any time from Vault → Settings → Integrations.
• You can revoke our access from your Google Account → Security → Third-party apps.
• You can request deletion of all stored data by emailing privacy@the-good-foundry.com.

Compliance

Wellbeing Matters @ Work's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Zoom User Data

When a practitioner chooses to connect their Zoom account in the Wellbeing Matters practitioner portal, we request permission to read the following from Zoom:

• Your Zoom profile — Zoom user ID, account ID, email address and display name (user:read:user)
• Your Zoom Scheduler schedules — each schedule's name, ID, status and public scheduling link (scheduler:read:list_schedule)

How We Use This Data

• To show you which Zoom account is connected.
• To let you choose which of your Zoom schedulers clients book through, and to show that scheduler's public link on your booking page.
• To check once a day that the scheduler you chose still exists and that the connection still works.

How We Do Not Use This Data

• We do not create, change or cancel meetings, schedules or bookings.
• We do not read meeting content, recordings, chat or attendee details.
• We do not sell this data or use it for advertising.

When a visitor books with you, they book directly on Zoom's own scheduling page, under Zoom's privacy policy. No booking details pass through our servers.

Storage and Retention

• Your Zoom access and refresh tokens are encrypted (AES-256) before they are stored, using a key held separately from the database. Your Zoom profile details and your chosen scheduler are stored in our database on SiteGround infrastructure (Sydney, Australia region).
• We keep this data while your Zoom account is connected.
• When you disconnect, or remove the app from your Zoom account, your tokens and chosen scheduler are deleted from the live system straight away, and from our backups within 30 days.

Your Control

• You can disconnect at any time from the practitioner portal: My profile → Your Zoom booking link → Disconnect Zoom.
• You can remove the app from your Zoom account in the Zoom App Marketplace → Manage → Added Apps.
• You can request deletion of all stored data by emailing privacy@the-good-foundry.com.

Artificial Intelligence in Our Services

Some parts of our Services are powered by third-party AI models. We name every AI provider, what it is used for and where it processes data on our sub-processors page, which forms Schedule A of our Data Processing Agreement.

What AI Is Used For

Generating written explanations of wellbeing results; generating coaching suggestions and action plans; answering questions you ask our wellbeing assistant in writing, by voice or by telephone; and generating cohort-level summaries and infographics for organisations.

What an AI Provider Receives

This depends on which part of the Services you are using.

• Your own results and reflections. Where you ask our assistant about your own results, your scores and the open answers you wrote are sent to the AI provider so it can answer about them specifically. Your name and email address are not sent.
• Your organisation’s results. Where an administrator at your organisation asks our assistant about their people, only whole-group figures are sent. Individual answers, names, email addresses and anything written in a person’s own words are never available to that conversation, and a figure is withheld entirely unless enough people stand behind it.
• Voice. Where you telephone our wellbeing assistant, your speech is converted to text by a speech provider and the text is answered by an AI model. Where you use the on-screen assistant with its video presenter, the words the presenter speaks are sent to the video provider; your microphone is not. A written record of the conversation is kept in your own account.
• Translation and read-aloud. Where you choose a language other than English, interface text and question text are sent to a translation provider, and may be read aloud by a cloud voice. Your own answers and anything you have written are not sent for translation.

What AI Is Never Used For

We do not use AI to make or assist any decision about your employment, pay, performance or conduct. No AI output is shared with your employer in a form that identifies you. We do not permit any AI provider to train its models on your information.

Safety

Every message you send our assistant about your own results is checked for signs that you may be at risk before it reaches the AI model. If that check is triggered, the assistant responds directly with support information, including crisis lines, and the AI model is not called for that message. That event is recorded in your own record and is not reported to your employer.

Your Control

You can use the Services without using any AI feature. Where you have asked our assistant something, you can ask us to delete that conversation by emailing remove@the-good-foundry.com.

Our Contact Details

For any questions, concerns, or complaints about this Privacy Policy, our data collection or processing practices, or to report data privacy or security concerns, please contact us at: