Service Lead Pro Privacy Policy

1 About this Privacy Policy

Cost Comparison Pty Ltd (ABN 60 655 338 284), trading as Service Lead Pro (we, us or our), operates bondcleaners.au and uses Assistora for booking and marketplace administration. This policy explains how we collect, hold, use, disclose and protect personal information.

It applies to customers and prospective customers, Cleaners and other independent service providers, their representatives, applicants, website visitors and other people who interact with our websites, applications, portals, communications and services. Cleaner includes an independent carpet cleaning or licensed pest business where relevant.

We handle personal information in accordance with Australian privacy laws that apply to us, including the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs). This policy also explains the privacy commitments in our Customer Terms and Independent Provider Agreement.

This policy explains our practices; reading it, visiting our website or accepting general account terms is not, by itself, consent to biometric processing, marketing or another activity requiring separate consent. We provide collection notices and obtain consent where required. You can request a free copy of this policy in an accessible format using section 26.

2 Our marketplace

Service Lead Pro arranges bookings, payment and support as a marketplace. The identified independent provider supplies the cleaning, carpet or pest service. We share information reasonably needed to offer, perform, administer or resolve issues with a Job.

After a provider accepts a Job, information needed for that service may include the customer’s name, service address, relevant contact details, agreed date and time, property and service details, access instructions, extras and customer instructions. We release contact and access details sufficiently early to prepare for the Job, as explained in the applicable agreement and offer.

Before acceptance, prospective providers receive only limited service and general-location details reasonably needed to assess an offer. Providers give us service records such as photos, messages, arrival and completion information and other relevant evidence. Section 10 explains the limits on sharing and use.

3 Personal information we collect

Customers and prospective customers

• Name, telephone number, email address, billing details and account information.
• Service address, property size, rooms, condition, requested services, extras, access instructions and relevant safety information.
• Requested and agreed service dates, Quotes, Booking requests, confirmed Bookings, accepted versions of terms and records of approval or consent.
• Communications, customer instructions, complaints, damage reports, rectification requests, refund requests and dispute records.
• Photos, videos, inspection reports or other documents supplied for a service, including relevant embedded metadata.
• Payment references, transaction status, amounts, dates, refunds, limited payment-method information and feedback or reviews.

Cleaners and other independent providers

• Provider and representative names, business or trading names, telephone numbers, email addresses and relevant business or residential address details.
• ABN, legal entity, GST registration and business verification information.
• Insurance, licences, qualifications, experience, equipment and service capability information, and working-rights information where relevant and lawfully necessary.
• Identity verification results and the limited Stripe access described in section 13.
• Bank or payout details, invoices, transaction history, fees, adjustments and relevant tax reporting records.
• Declared service areas, travel radius, availability, and Jobs offered, accepted, declined or completed.
• Service history, customer feedback, quality and performance information, completion evidence, complaints, disputes and compliance records.
• Account activity, messages, accepted agreement versions and the date and time of acceptance.

We request information reasonably necessary for the relevant service or marketplace function. If sensitive information, such as biometric information used for automated identity verification, is needed, we explain the purpose and obtain the consent required by law unless a lawful exception applies. Avoid sending unrelated medical, identity or other sensitive information in service messages or photos.

4 Information collected during services

Service records may include before, after and completion photos; relevant video or documents; timestamps; status changes; arrival and completion information; staff, customer or provider notes; service reports; rectification records; and information about complaints, refunds, damage or disputes.

Cleaner-uploaded photos and files may contain embedded location, date and time information, which we retain with the service record and use where relevant to the service, quality checks or a dispute. This may reveal where a photo was taken. We do not install trackers or actively track Cleaner devices or movements. Service addresses and declared service areas are used for arranging and matching Jobs.

Photos and other evidence should focus on the relevant property condition or work. Customers and providers should avoid including people, identity documents, payment details, security codes or other unnecessary personal or sensitive information. Tell us if an upload includes such information so we can assess appropriate restriction, redaction or deletion.

5 Communications

We retain relevant communications made through email, telephone, SMS, online chat, forms, customer and Cleaner portals, support systems, messaging applications and other channels we make available. Communications may be associated with an account, Quote, Booking, Job or dispute so that we can maintain an accurate service history.

We use Google for email and Dialpad for SMS, telephone communications, audio recording and AI-assisted call transcription. We save call audio and AI transcripts, and callers receive a notice before recording or transcription starts. Relevant messages, call information, recordings and transcripts are retained for service administration, staff training, quality assurance and dispute resolution, subject to section 19. We obtain consent where required by law. If you do not want your call recorded or transcribed, tell us or contact us by email to discuss another way to communicate.

AI-generated transcripts and summaries may contain errors. They assist our staff and are not conclusive evidence of what was agreed. Tell us if a record is inaccurate so we can review it against the available information. Access, retention and overseas handling are subject to sections 17 to 20.

We have turned off Dialpad's optional setting that allows conversations to be used to improve its AI features.

Mobile phone contact information is collected only to arrange and manage your Quote, Booking and Job, and to send service-related messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will not be shared with any third parties. We send SMS marketing only with your consent. You can opt out of SMS messages at any time by replying STOP to a message or by contacting us using section 26, and we will action your opt-out promptly and without charge. Opting out of marketing does not prevent necessary operational messages about an existing Quote, Booking, payment or dispute.

6 How we collect information and your choices

We generally collect information directly when you request a Quote, submit a Booking request, create or use an account, apply as a provider, accept or perform a Job, make or receive a payment, contact support, upload evidence, seek rectification or a refund, make a complaint or otherwise use our services.

We may also receive relevant information from customers, providers, property managers or real estate agents acting in relation to a service; advertising, marketing or lead partners through which you enquired; recruitment or referral sources through which you applied; payment or verification services; insurers; professional advisers; regulators; government authorities; public registers; and technology or communication providers.

Where we collect information from someone else, we take the notification steps required by law. If you give us another person’s information, have a lawful basis to do so and tell them about the relevant disclosure and this policy where appropriate. A representative cannot provide someone else’s personal biometric consent.

You can make a general enquiry anonymously or using a pseudonym where lawful and practicable. We normally need identifying, contact, property or payment information to arrange a service, verify a provider, administer a payout or resolve an account-specific request. If you do not provide necessary information, we explain the effect; we may be unable to provide the relevant service or approve the application.

If we receive personal information we did not request, we assess whether we could lawfully have collected it. Where required, and lawful and reasonable to do so, we destroy or de-identify it.

7 Information collected automatically

Our websites and systems may collect technical information such as IP address, browser and device type, operating system, access dates and times, pages viewed, referring website, session information, cookie identifiers, login activity and technical or security logs.

An IP address may indicate an approximate location. That is different from continuous GPS or device-movement tracking. We use relevant technical information for account security, fraud prevention, troubleshooting, website operation and the analytics described in section 8.

8 Cookies and similar technologies

Our websites and applications use, or may use, cookies, pixels, local storage and similar technologies for functions such as sign-in, preferences, booking progress, security and website performance. Information may include device and browser details, online identifiers, page views, referring pages and interactions with forms or links.

We use Google Analytics 4 (GA4) to understand website use, Google Ads conversion tracking and Meta Pixel to measure advertising results, and TrafficGuard to detect and help prevent invalid advertising traffic and click fraud. These tools may process online identifiers, cookie information, IP addresses, device and browser details, referring pages, pages visited and event information such as whether an enquiry or booking action occurred. The information processed varies by tool and its configuration.

Our website analytics and advertising integrations do not send customer names, email addresses, telephone numbers or street addresses to Google or Meta, either in readable form or as hashed contact details. We do not use email or telephone matching through Google enhanced conversions or Meta advanced matching. This statement concerns those website integrations; Google separately processes email communications as our email provider, as explained in section 5.

Technical identifiers and browsing or event information can still be personal information if they identify someone or can be linked to other information about them. Not sending contact details does not make all tracking information anonymous or remove applicable privacy obligations.

Information you enter into the booking widget is processed directly by Assistora for Quotes, Bookings and marketplace administration, using its platform security controls. Section 17 explains Sydney hosting and overseas access. Assistora processing does not remove our responsibilities for information handled in operating the marketplace; the security limitations in section 18 still apply.

Google's Analytics opt-out browser add-on is available at https://tools.google.com/dlpage/gaoptout. Its scope is limited to the Analytics collection it supports; it does not disable all cookies or advertising tracking. You can manage Google advertising preferences at https://myadcenter.google.com and Meta advertising preferences in your Facebook or Instagram settings. Google and Meta explain their handling at https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/. TrafficGuard's privacy information is available at https://dash.trafficguard.ai/terms/privacy-policy.

Our cookie controls use automated geographic rules to block technologies that require prior consent in the relevant region until that consent is given. For Australian visitors, we provide privacy and collection notices about the tools and their purposes. A notice is not a substitute for consent where consent is required under applicable Australian law. Geographic settings do not reduce your applicable privacy rights.

You can manage cookies through your browser settings. Blocking essential cookies may affect sign-in, booking progress or other functions. Where a particular use requires consent, we obtain it before that use; using the website or reading this policy is not blanket consent to all tracking. Unsubscribing from email or SMS marketing does not automatically change browser cookie settings.

9 How we use information and automated processes

We use personal information as reasonably needed to provide Quotes; arrange and administer Bookings and Jobs; manage accounts; verify providers; communicate with customers and providers; process payments, refunds and payouts; issue invoices; provide support and rectification; investigate complaints and damage; resolve disputes; maintain records; prevent fraud and misuse; meet legal and tax obligations; enforce lawful agreement obligations; and establish, exercise or defend claims.

We also use relevant information for internal reporting, troubleshooting and improving our services, consistently with applicable privacy requirements. Marketing is subject to section 16. We do not treat these purposes as permission to use information for an unrelated purpose without the consent or other lawful basis required for that use.

Decisions made or assisted by computer systems

Assistora and services we use perform automated steps that can affect the price offered to a customer, the Jobs offered to a provider, payment administration or a provider’s application and account. The relevant uses include:

Contact us if information used for a Quote, offer, verification result or account decision is incorrect, or if you need an explanation or staff review. We assess the issue and explain the next step under the applicable agreement. These processes do not actively track Cleaner movements. This policy does not waive a right to challenge a decision or seek an external remedy.

10 Sharing information between customers and providers

We limit disclosure to information reasonably needed for the offer, Booking, service, safety, invoicing, communication, rectification or dispute. Before acceptance, prospective providers receive limited service and general-location details. The assigned provider receives the information needed to perform the accepted work, as explained in section 2.

Customers receive the assigned provider’s name and relevant business details, including legal business name and ABN for the service and invoice, together with necessary service communications. Provider identity documents, selfies, bank account details and internal verification records are not shared with customers as ordinary booking information.

Where reasonably needed, relevant details may also be shared with authorised workers, subcontractors, property managers, representatives or replacement providers involved in the service or its resolution. An authorised representative should receive only the information relevant to their role.

Providers must protect customer information and use it only for the authorised Job and related rectification or resolution, consistently with their agreement and applicable law. Customer details obtained through a Job are not permission for unrelated marketing. Customers must similarly use provider information responsibly.

11 Disclosure to other parties

We disclose personal information only where reasonably necessary for an identified purpose and permitted or required by law. Depending on the circumstances, recipients include:

• Assistora and the hosting, database, software, security and support services used to operate the marketplace.
• Stripe for payments, payouts where applicable, and identity verification; banks, card networks and other financial institutions involved in a transaction or payment dispute.
• Google for email; Dialpad for SMS, telephone communications, audio recording, AI-assisted transcription; and authorised customer support personnel in India, with access limited to information reasonably needed for their role.
• Google, Meta and TrafficGuard for the analytics, advertising measurement and fraud-prevention activities described in section 8, subject to the stated limits, choices and any required consent.
• Identity and business verification services and official government registers used for legitimate checks.
• Accountants, auditors, insurers, lawyers and other professional advisers involved in the relevant matter.
• Debt-recovery providers, limited to information needed for lawful recovery of an amount properly owing.
• Regulators, courts, tribunals, police and government authorities where disclosure is required or authorised by law.
• An actual or proposed buyer in a business sale or restructure, limited to reasonably necessary information, with appropriate confidentiality safeguards and subject to applicable law.

We do not sell personal information.

ATO reporting

Where required by tax reporting law, including the Sharing Economy Reporting Regime where it applies, we report relevant provider identity, ABN, contact, payment-account and transaction information to the Australian Taxation Office. Reported financial information may include gross payments, GST, fees and adjustments. We collect the fields reasonably required for the applicable report; a net payout does not represent all reportable transaction information.

12 Payment information

Stripe handles full payment-card details. We do not store full card details in Assistora and do not ask you to send them by email or SMS. Saving a payment method and making a payment are governed by the applicable Customer Terms and Stripe payment screens.

We keep transaction information needed for administration and records, such as payment references, status, dates, amounts, refunds, chargebacks, provider payouts and limited payment-method information supplied by Stripe. Relevant provider bank or payout details are handled for verification and payment administration.

Stripe also processes information under its own privacy policy and legal obligations. You can read Stripe’s privacy policy at https://stripe.com/au/privacy. Contact us about a transaction or information we hold; Stripe’s privacy channels are also available for information it handles directly.

13 Provider identity and business verification

We verify relevant identity, ABN, business and contact details, GST status, insurance, licences, payout information and other eligibility details where reasonably needed. Working-rights checks are used only where relevant and lawful. Business details may be checked against official registers or manually. Verification is not a guarantee of a provider’s future conduct or performance.

Stripe Identity and biometric consent

Stripe Identity collects the individual’s identity document and selfie and performs the automated face match. This involves biometric information. Stripe stores the ID document and selfie; we do not store those images in Assistora. Assistora records only the verification result from that check. Other business and contact details are collected separately as described in this policy.

A small number of authorised staff can view verification details in Stripe only when needed to resolve a verification problem or suspected fraud. We do not use ordinary property photos for identity matching or provide the identity images to customers.

Before the check starts, the individual being verified receives a collection notice and gives separate, informed, express biometric consent. The notice explains the information, purposes, access, disclosure, retention, deletion and withdrawal choices. It may be provided through Stripe’s verification screens together with this policy. Accepting the Provider Agreement alone is not biometric consent, and a business representative cannot consent for another individual.

If you decline, contact us to discuss a reasonable alternative verification method. We explain any effect on approval while the required checks are resolved. A pending or review-required result is not itself a finding of fraud; staff make the final approval decision.

Retention and your choices for identity information

Stripe’s retention rules distinguish ID images and other verification records from biometric information. The applicable Stripe notice, privacy policy and Identity FAQ explain its current retention and processing arrangements. Its Identity FAQ is at https://support.stripe.com/questions/stripe-identity-faq.

Contact our Privacy Officer about access, correction or deletion of verification information and withdrawal of consent for future processing. We handle requests concerning our records and the controls available to us in Stripe. For Stripe’s own processing, you can also contact privacy@stripe.com; its guidance is at https://support.stripe.com/questions/managing-your-id-verification-information.

We explain relevant retention requirements and the effect of a request on an outstanding check. Withdrawal does not undo processing already lawfully completed, and records needed for a lawful retention purpose may remain. Optional consent requested by Stripe for its own additional purposes is governed by the separate notice Stripe provides.

14 Photographs, videos and service evidence

We use relevant photos, videos, documents and metadata for service records, completion evidence, quality checks, rectification, complaints, damage assessment, refunds, fraud prevention, payment disputes, chargebacks and legal claims. We do not use property photos for marketing. Other uploaded content is used for marketing only with separate express permission.

Relevant evidence may be shared with the other party to a dispute, an insurer, adviser, payment provider or authority where reasonably necessary and lawful. We limit disclosure and consider redaction or restricted access where evidence contains unrelated personal information. Section 4 explains embedded location information and avoiding unnecessary material.

15 Complaints, disputes and legal proceedings

We collect and retain relevant information needed to investigate and respond to a complaint, rectification request, payment dispute, damage report or legal matter. This may include the accepted Quote and terms, service records, communications, evidence, payment history and the parties’ responses.

We may disclose relevant information to the customer, provider, authorised representatives, insurers, advisers, payment providers, consumer protection agencies, dispute-resolution bodies, regulators, courts, tribunals or police where reasonably necessary and lawful. A complaint alone does not establish wrongdoing.

Records may be retained after a service or account ends where needed for accounting, tax, insurance, dispute resolution, fraud prevention or legal obligations. The retention principles in section 19 apply; information is not kept indefinitely merely because a dispute could hypothetically arise.

16 Marketing communications

We send marketing only with your consent and in accordance with applicable law, including the Spam Act 2003 (Cth). Where consent is needed for another marketing use of personal information, we obtain it for that use. An enquiry, Booking, provider application or acceptance of general terms is not treated as blanket permission for unrelated marketing.

You can unsubscribe using the facility in an electronic marketing message or by contacting us. We action unsubscribe requests within the time required by law and do not charge for unsubscribing. Contact us if you want to know the source of information used for direct marketing; we respond as required by law.

Unsubscribing does not prevent necessary operational communications about an existing application, account, Booking, payment, complaint or dispute. We distinguish these from promotional messages. Cookie and advertising controls are described in section 8.

17 Overseas processing and disclosure

Assistora's primary portal records are hosted on servers in Sydney, Australia. Our staff and support operations access information in Australia and India. Australian hosting does not mean all information handled by other services remains in Australia. Payment, verification, communication and advertising services may process information overseas, including in the United States as described below.

• Stripe, for payments and identity verification: its published privacy information identifies international processing including in the United States and India. See https://stripe.com/au/privacy.
• Google, for email and the activities described in section 8, and Meta, for the activities described in section 8: they process information internationally, including in the United States. Their privacy policies describe their global processing arrangements at https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/.
• Dialpad, for SMS, telephone communications and AI-assisted transcription: its published privacy policy says permanent records, including call records, recordings and transcripts, are stored in the United States unless the account administrator selects another region. Other processing may occur outside the selected storage region. See https://www.dialpad.com/legal/.
• TrafficGuard, an Australian provider of advertising measurement and fraud-prevention services: its published subprocessor list identifies United States infrastructure and other processing in the United States, Asia-Pacific and European Economic Area. Its published list provides regions rather than individual countries for some services. See https://dash.trafficguard.ai/terms/privacy-policy and https://dash.trafficguard.ai/terms/subprocessors for its arrangements and current list.
• Our customer support team in India accesses relevant customer, provider, booking and communication records to provide support. Access is limited to what is reasonably needed for the role and is subject to confidentiality and security requirements. This overseas access can occur even where the underlying Assistora records are hosted in Sydney.

These locations describe our operations and the providers' published arrangements; selecting a storage region may not restrict all support access or other processing to that region. Contact us for further information about a particular service or overseas disclosure. We update this policy as relevant arrangements change and identify additional likely recipient countries where practicable.

For overseas disclosures covered by Australian privacy law, we take the steps required by that law, including reasonable steps to ensure the recipient handles the information consistently with the APPs where required. Safeguards may include checking the provider’s practices, contractual protections and restricting access to what is needed. A provider’s own privacy policy does not remove our responsibilities.

This policy does not ask you to waive protections for overseas disclosure. If a particular arrangement requires separate informed consent, we explain that arrangement and seek that consent separately.

18 Data security

We take reasonable technical and organisational steps to protect information from misuse, interference, loss, unauthorised access, modification and disclosure. Depending on the system and information, safeguards include appropriate access controls, authentication, role-based permissions, encryption, secure hosting, audit logs, backups, restricted administrative access and staff or contractor security procedures.

Staff and service providers receive access only as reasonably needed for their role. ID-image access through Stripe is restricted as described in section 13. We review access and security arrangements in light of the information and risks involved.

No internet or electronic storage system is completely secure. Keep your account credentials confidential, use a strong password and tell us promptly if you suspect unauthorised access or misuse. This does not reduce our own security responsibilities.

19 Retention and deletion

We retain information for as long as reasonably needed for an authorised purpose or a legal requirement. Relevant factors include an active application or account; accepted work; transaction and tax records; insurance requirements; actual complaints or claims; applicable limitation periods; fraud prevention needs; and legal holds.

We distinguish routine service and account records from more sensitive information. ID documents and selfies are held by Stripe as described in section 13. Information uploaded for one service is not retained for unrelated future uses merely because storage is available.

When information is no longer needed for a permitted purpose and no law, court order or other applicable requirement requires retention, we take reasonable steps to securely destroy or de-identify it. This includes considering copies and backups and the deletion controls available through our service providers.

You can ask us to close your account or delete information. We assess the request, remove information where appropriate and explain any relevant reason records must remain. Closing an account does not automatically erase records needed for existing Jobs, payments, disputes or legal requirements. Australian privacy law does not provide an unconditional right to immediate deletion of every record.

20 Access and correction

Contact the Privacy Officer using section 26 to request access to personal information we hold about you or correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. You can also raise errors through support. Tell us what information or account is involved and how you would like us to respond; you do not have to use a particular form.

We may take reasonable steps to verify your identity or an authorised representative’s authority. We request only information reasonably needed for that check and seek a proportionate method; an access request does not automatically require a biometric identity check.

We respond within a reasonable period, generally aiming for 30 calendar days. If more time is needed, we explain why and provide an expected response date. We do not charge for making an access request or for correcting information. If a lawful, reasonable and non-excessive charge is proposed for providing access, we explain it in advance.

Where the law permits or requires refusal, we give written reasons where required and explain complaint options. We consider whether partial access or another format is possible. If we decline a correction, you may ask us to associate a statement of your concern with the information as provided by law. Where required, we take reasonable steps to notify relevant recipients of a correction.

21 Privacy complaints

Contact our Privacy Officer with the concern and enough information to identify the relevant account, service or handling practice. We may ask for clarification, examine records and speak with relevant staff or service providers. We handle the complaint fairly and explain our response and any corrective action.

We aim to acknowledge a privacy complaint promptly and provide a substantive response within 30 calendar days. If it needs longer, we explain the reason and expected response date. These privacy complaint arrangements do not reduce a faster service complaint acknowledgement or assessment commitment in the applicable Customer Terms or Provider Agreement.

If you are dissatisfied with our response, or we have not responded within a reasonable period, you may complain to the Office of the Australian Information Commissioner where it has jurisdiction. The OAIC generally asks that you first raise the concern with the organisation and allow 30 days for a response. Visit https://www.oaic.gov.au/privacy/privacy-complaints or call 1300 363 992. Other available legal or regulatory remedies remain available.

22 Data breaches

We assess suspected unauthorised access, disclosure or loss, take steps to contain it and consider action to reduce harm. Where the Notifiable Data Breaches scheme applies, we assess suspected eligible breaches within the applicable requirements and notify the OAIC and affected people when required.

A breach may be notifiable where it is likely to cause serious harm and effective remedial action has not removed that likelihood. Where notification is required, we provide the information required by law, including recommended steps individuals can take. Contact us promptly if you suspect an incident involving our services.

23 Children’s privacy

Our marketplace is intended for people legally capable of entering the relevant transaction or acting with appropriate authority. We do not knowingly seek unnecessary information about children. Property evidence should avoid identifying children or showing their personal documents or belongings where not relevant to the service.

If we learn that a child’s information has been collected where it should not have been, we assess the circumstances and take reasonable steps to restrict, remove or otherwise address it consistently with applicable law. Contact the Privacy Officer about such information.

24 Links and third-party services

Our websites and platform may link to other websites, payment services or applications. Those services may have their own privacy practices and choices. Read the relevant notice before providing information directly to another service.

We do not control unrelated external websites. That does not remove our responsibilities for information we collect, hold or disclose, or for service-provider arrangements to which Australian privacy law applies.

25 Changes to this policy

We may update this policy when our services, systems, providers, practices or legal requirements change. We publish the current version with its effective date on our website or platform. We provide appropriate notice of material changes through email, Assistora or another suitable channel, and any further notice required by law.

An update does not itself authorise a new use or disclosure requiring consent, or retrospectively change consent already given. We obtain fresh consent or provide a new collection notice where required. Publishing a privacy update does not replace the agreed terms for an existing Booking or Job.

26 Contact us

Privacy Officer
Cost Comparison Pty Ltd
Trading as Service Lead Pro
ABN 60 655 338 284

Email: hello@bondcleaners.au
Phone: 0485 985 772
Postal address: 1/16 McDougall St, Milton QLD 4064, Australia
Customer website: https://bondcleaners.au

Please include enough information to help us identify your request. Do not email full card details, ID documents or selfies; contact us first if secure verification is needed. If you need help making a request or an accessible copy of this policy, tell us.

27 Applicable law and your rights

This policy is intended to operate consistently with applicable Australian privacy law, including Commonwealth law and relevant Queensland law. It does not exclude a privacy right, limit access to the OAIC or another regulator with jurisdiction, or require you to bring a complaint only in Queensland. Any applicable court or tribunal rights remain available.