Privacy Policy

The Platform is used by swimming organisations ("Organisations") to manage their members. Understanding who is responsible for your information depends on which of two roles is in play:

• Your Organisation collects your information. When you or your family join a swim school, enrol in classes, register for a camp, or complete a form, that information is collected by and for your Organisation. The Organisation decides what to collect and how to use it within the Platform's functions. For that information, we act as the Organisation's service provider (processor): we store and process it on their behalf, under their instructions, and we do not use it for our own purposes.
• We collect some information directly. Account credentials, login and security records, technical logs, and communications you send to us are collected by us to operate the Platform itself. For that information we act in our own right.

If you have questions about why particular information was requested (for example, why a camp form asks a particular question), your Organisation is the right first contact. Questions about the Platform's handling of information belong to us (Section 13).

About adults (parents, guardians, staff)

• Name, email address, mobile number, and account credentials
• Family relationships within an Organisation (which students you are the guardian of)
• Emergency contact people you nominate for your family: their name, mobile number and relationship to your students
• Payment records for purchases you make through an Organisation (see Section 6; we do not hold card numbers)
• Communications with your Organisation and with us

About children and students

Student information is provided by a parent or guardian (or by an Organisation's staff on their behalf):

• Name, date of birth, gender, and any student identifier your Organisation uses
• Enrolment, attendance, class placement, results and progress records
• Photographs, if your Organisation uses profile photos

Sensitive information (health)

Some Platform features collect health information, which the Privacy Act treats as sensitive information requiring consent and a higher standard of care:

• Whether a student has medical conditions or allergies, and the details of those conditions, allergies and medications
• Family doctor details (practice, doctor's name, phone)
• Health insurance details (Medicare number and reference, ambulance cover, private fund and member number)
• Answers to medical questions on camp permission forms
• Incident and first-aid reports your Organisation's staff record, which can describe an injury and the care given

We collect health information only with the consent of the parent or guardian who provides it (or, for incident reports, as your Organisation's duty of care requires), only for the purposes described in Section 4, and we protect it with the safeguards in Section 7.

Collected automatically

• Sign-in records, IP addresses, device and browser information
• Usage and error logs needed to operate and secure the Platform

We do not collect information from children directly: the family portal is operated by parents and guardians, and student records are created and maintained by adults.

Most students on the Platform are children. Their information is:

• provided and controlled by their parent or guardian (or Organisation staff);
• used only for the purposes in Section 4, never for advertising, profiling or sale;
• protected by the safeguards in Section 7, with health information given the strongest protections on the Platform.

We are following the development of the Children's Online Privacy Code and will update the Platform and this policy to comply with it when it takes effect.

Information on the Platform is used to:

• operate memberships, class bookings, enrolments, attendance and billing for your Organisation;
• run camps and events, including permission and medical forms, so that the people supervising a student know what they need to know to keep that student safe;
• keep emergency contact information reachable in an emergency;
• record consent: when you agree to a declaration or policy, we record the exact wording you agreed to at that moment;
• pre-fill forms you have already answered. Health and emergency information you have saved is offered back to you on later forms so you do not have to retype it. It is always shown to you for confirmation before it forms part of a new submission, and pre-filling never submits anything on your behalf;
• communicate with you about your bookings, registrations and account;
• secure, maintain and improve the Platform.

We do not sell personal information. We do not use it for third-party advertising, and we do not transmit personal information to advertising or social media platforms in any form, hashed or otherwise. We do not use health information for any purpose other than the care, safety and administration functions above.

A medical record on the Platform belongs to the relationship between your family and one specific Organisation. If your student is a member of more than one Organisation on the Platform:

• what you disclose to one Organisation is not shown to another;
• each Organisation asks you afresh, and each holds only what you chose to tell it;
• if the Platform ever offers to carry your own information across for your convenience, it will show you your own information and let you decide to provide it; it will never move between Organisations silently.

• Your Organisation's staff, according to their roles. Medical, doctor and insurance details are further restricted: they are visible only through screens that record who viewed them (Section 7).
• Service providers we use to run the Platform:
• Supabase (database and authentication, running on Amazon Web Services) and Vercel (application hosting). Our database and application servers are in Sydney, Australia.
• Stripe and Square (payment processing for your Organisation; card details are entered directly with, and held by, the payment provider; the Platform stores tokens and transaction records, never card numbers). Payment providers may store information outside Australia, including in the United States, under their own privacy policies.
• Microsoft 365 (delivery of Platform emails)
• No one else, except where the law requires or authorises disclosure (for example, to respond to a lawful request by an enforcement body, or in a medical emergency where disclosure is necessary to lessen or prevent a serious threat to life, health or safety).

Emails sent by the Platform never contain medical details. Staff notifications about submitted forms name the student and the event only, and direct staff to view details inside the Platform, where access is controlled and recorded.

• Encryption in transit. All Platform traffic uses TLS.
• Encryption at rest for health and insurance information. Medical details, doctor details, insurance details (including Medicare numbers) and answers to medical form questions are encrypted at the application level with AES-256-GCM before they are stored. Database-level access, including by our own infrastructure tooling, a stolen backup, or a compromised database credential, yields ciphertext, not health information. Decryption keys are held separately from the database.
• Access control. Every record is partitioned by Organisation and protected by row-level security. Staff access is role-based; guardian access is limited to their own family.
• Audited access to health information. Medical, doctor and insurance details are only readable through controlled pathways that write an audit record of who viewed which student's information and when. Audit records never contain the health information itself.
• Point-in-time attestations. A submitted camp form is frozen as it stood at submission; later edits to records or form wording cannot rewrite what was submitted or agreed.
• Deliberate exception: emergency contacts. Emergency contact names and phone numbers are stored ready-to-read rather than encrypted, because their purpose is to be reachable in a crisis, including on printed event rosters. They are still protected by access controls.
• Exports of member lists exclude medical form information by design.

No system is perfectly secure, and we cannot guarantee absolute security; the measures above reflect the sensitivity of what families entrust to the Platform.

We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we become aware of a breach likely to result in serious harm, we will:

• act immediately to contain and assess it;
• notify the affected Organisations, affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable;
• be clear about what happened, what information was involved, and what we and you can do in response.

Where a suspected breach requires investigation, we complete our assessment promptly and within 30 days at the latest.

• Your Organisation decides how long its records are kept on the Platform, within what the law requires. That includes membership records, camp registrations with their medical snapshots and consent records, incident reports, and the records of who viewed health information.
• Information we collect directly (account and security records, technical logs) is kept while your account is active and for as long afterwards as we need it to secure the Platform or meet legal obligations.
• When information is no longer required, it is deleted or de-identified in accordance with APP 11.2.

You may ask your Organisation, or us, to delete information earlier; we will comply unless the law or a genuine record-keeping obligation requires retention, and we will tell you which applies.

Under APPs 12 and 13 you may request access to, and correction of, personal information held about you or your children. In most cases the fastest path is the Platform itself: profile, medical, and emergency contact information is directly editable by the guardian who maintains it. For anything else, contact your Organisation or us (Section 13). We respond to access requests within 30 days. There is no charge for making a request.

We may only refuse access or correction on the limited grounds the Privacy Act allows (for example, where access would unreasonably interfere with another person's privacy). If we refuse, we will tell you why in writing and how to complain about the refusal.

The Platform sends transactional email (bookings, registrations, confirmations, account matters) on behalf of your Organisation. Organisations may also send you news and marketing through the Platform; every such email includes an unsubscribe mechanism, and we honour unsubscribes in accordance with the Spam Act 2003 (Cth).

We record whether a Platform email was sent and delivered. We do not track whether emails are opened or whether links in them are clicked.

The Platform uses cookies necessary for sign-in and session security. The staff applications use Vercel Web Analytics, which counts page visits without cookies and without identifying you; the family portal uses no analytics. The Platform does not use advertising cookies or third-party tracking.

Privacy questions, requests and complaints:

• Email: admin@lane4enterprises.com.au

We will acknowledge a complaint within 14 days and respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• oaic.gov.au | 1300 363 992 | GPO Box 5288, Sydney NSW 2001

We will update this policy as the Platform and the law evolve. Material changes, especially any change to how health or children's information is handled, will be notified to Organisations and account holders before they take effect, and never applied retrospectively to consent already given.