This privacy policy applies to the collection, storage, use and disclosure of personal information by or on behalf of Viva Leisure Limited (ABN 76 607 079 792), Viva Leisure Operations Pty Ltd (ABN 20 609 536 665), Viva Leisure Property Pty Ltd (ABN 22 609 536 674), Viva Leisure People Pty Ltd (ABN 12 609 536 629) and Viva Leisure Memberships Pty Ltd (ABN 13 618 752 819) (referred to in this policy as “Viva”, “our”, “we” or “us”). Please read it carefully.

We are committed to protecting your personal information, and ensuring its privacy, accuracy and security. We handle your personal information in a responsible manner in accordance with the Privacy Act 1988 (Act), the Australian Privacy Principles (APPs) and any State or Territory privacy legislation enacted in your jurisdiction (see oaic.gov.au for more information).

You do not have to provide us with your personal information. However, if you do not, we may not be able to conduct business with you.

By using any of our products or services, visiting any Viva Leisure website (including but not limited to Club Lime, Hiit Republic, GroundUp, and any other Viva Leisure brands), or giving us your personal information, you agree to your information being collected, stored, used and disclosed as set out in this Privacy Policy.

1. What do we mean by 'personal information'?

References to 'personal information' or 'sensitive information' in this Privacy Policy have the same meaning as in the Act. In summary:

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether or not recorded in a material form.

Sensitive information (a type of personal information) means information or an opinion about an individual's race or ethnic origins, political opinions and associations, religious beliefs or affiliations, philosophical beliefs, sexual preferences or practices, trade or professional associations and memberships, union membership, criminal record, health or genetic information or biometric information.

2. Collection of personal information

(a) Whose personal information do we collect?

We may collect your personal information from a range of sources, including from you, recruitment agencies, contractors, business partners and government agencies. For example, we may collect your personal information when you:

1. request or acquire a product or service from us;
2. provide a service or product to us;
3. apply for employment with us;
4. communicate with us via our website, by e-mail, telephone or in writing;
5. subscribe to or use any of our mobile applications or digital membership services.

Wherever reasonable and practicable, we collect personal information from the individual to whom the information relates. If you provide personal information about someone other than yourself, you agree that you have that person's consent to provide the information for the purpose for which you provide it to us. You also agree that you have told the person about this Privacy Policy and where to find it.

(b) What types of personal information do we collect and hold?

The personal information we may collect includes:

1. Name, address, email address, phone number, payment details, and other contact or membership-related information.
2. Membership details, user preferences, profile settings, goals, and other information you choose to provide to personalise your experience.
3. Activity data such as workout history, exercise sessions (type, duration, intensity), step count, walking/running distance, total active minutes, sedentary time, and general movement trends.
4. Physiological data such as heart rate (including resting and during activity), heart rate variability (HRV), respiratory rate, blood oxygen saturation (SpO₂), skin temperature changes, and device-estimated stress indicators.
5. Sleep data such as bedtime and wake-up time, total sleep duration, sleep stages (light, deep, REM), sleep interruptions, and sleep consistency patterns.
6. Other biometric and wearable device data, including measurements inferred from connected devices.
7. Personalised workout plans, health scores, recovery and performance metrics, summaries and recommendations generated by AI or cloud services, and any contextual information used to produce these outputs.
8. Device details including usage data, patterns and app access and performance.

We will only collect your sensitive information:

1. if you have consented to us doing so — for example, as part of information collected about directors and employees for company and human resource management purposes, or health and fitness data for Club Lime Coach services; or
2. where required or permitted by law.

(c) How do we collect personal information?

We only collect personal information by lawful and fair means. We usually collect personal information from:

1. you attending our fitness, health, swimming and aquatic, indoor sports, and day spa facilities;
2. face-to-face meetings, interviews and telephone calls;
3. business cards;
4. electronic communications — for example, e-mails and attachments;
5. forms filled out by people, including as part of acquiring a product or service from us;
6. third parties — for example, from recruitment agencies and your representatives or agents;
7. our website, including if you use it to contact us;
8. connected wearable devices, mobile applications, and fitness tracking equipment with your consent;
9. facial images, including the use of AI facial recognition technology; and
10. our websites and mobile applications, including through cookies, pixels, and analytics tools.

(d) Why do we collect personal information?

We collect the personal information:

1. necessary for us to provide you with the products and services you have requested from us;
2. for marketing purposes and to provide you with information about products and services that may be of interest to you;
3. to improve the products and services we provide;
4. to enable us to conduct our business, including meeting our legal and regulatory obligations;
5. to provide personalized AI-powered fitness insights and summaries, workout recommendations, equipment analysis, and health tracking features.

If you do not provide your personal information, we may not be able to supply the requested product or service, employ you or otherwise deal with you.

(e) How we deal with unsolicited personal information?

If we receive personal information about you that we have not requested, and we determine that we could not have lawfully collected that information under the APPs had we asked for it, we will destroy or de-identify the information if it is lawful and reasonable to do so.

(f) Do you have to disclose your identity when dealing with us?

Where lawful and practicable, we will give you the option of interacting with us anonymously or using a pseudonym. However, this would usually only apply for general enquiries.

3. Use and disclosure of personal information

(a) Use of personal information

We only use your personal information for the purpose for which it was provided to us, for related purposes or as required or permitted by law. Such purposes include:

1. in the ordinary course of conducting our business. For example, supplying or acquiring products and services, responding to your enquiries and feedback, and providing information about our events, news, publications and products and services that may be of interest to you;
2. market research and product and service development, so that we are able to better understand our customers' needs and tailor our future products and services accordingly;
3. performing general administration, reporting and management functions. For example, invoicing and account management, payment processing, risk management, training, quality assurance and managing suppliers;
4. employment-related purposes, such as recruiting and providing services to staff;
5. as part of a sale (or proposed sale) of all or part of our business;
6. other purposes related to or in connection with our business, including meeting our legal and contractual obligations to third parties and for internal corporate governance purposes;
7. for Club Lime Coach: generating personalized fitness recommendations, analysing workout patterns, providing AI-powered fitness insights and summaries, and improving our digital fitness services.

(b) Disclosure of personal information

We may disclose, and you consent to us disclosing, your personal information to third parties:

1. engaged by us to provide products or services, or to undertake functions or activities, on our behalf. For example, processing payment information, managing databases, marketing, research and advertising including: Apple SwiftData (SQLite), Apple CloudKit, Vertex AI (Google Gemini), Sahha and Firebase Analytics;
2. that are authorised by you to receive information we hold;
3. that are our business partners, joint venturers, partners or agents;
4. as part of a sale (or proposed sale) of all or part of our business. For example, we may disclose information to our external advisers, to potential and actual bidders and to their external advisors; such as our external advisers, and government agencies. For example, where disclosure is reasonably required to obtain advice, prepare legal proceedings or investigate suspected unlawful activity or serious misconduct;
5. as required or permitted by law;
6. for Club Lime Coach subscribers: to Sahha Pty Ltd for biometric data processing and storage, Google Cloud Platform for AI inference services, and Apple iCloud for workout history storage; or
7. for Fling users: we may disclose limited personal information (such as account details, pass purchase history, and Partner Gym access validation) to Partner Gyms and technology providers as necessary to facilitate entry, verify pass validity, process payments, prevent fraud, and ensure compliance with conditions of entry.

We may disclose, and you consent to us disclosing, your personal information among the entities that comprise Viva and to any of our related bodies corporate whether located in Australia or overseas. If we disclose your personal information to a related body corporate, your information will be collected, stored, used and disclosed in accordance with this Privacy Policy and the APPs.

You may decline to share certain information or disconnect third-party integrations (e.g. Sahha, Google, Apple). However, this may limit use of the applicable services.

(c) Marketing use and disclosure

We may use and disclose your personal information (other than sensitive information) to provide you with information about our products and services (including affiliated Viva brands such as Supp Society) that we consider may be of interest to you.

You may opt out at any time if you do not, or no longer, wish to receive marketing and promotional material. You may do this by:

1. contacting us via e-mail or in writing at the address below and requesting that we no longer send you marketing or promotional material; or
2. where applicable, clicking the “Unsubscribe” button.

Where you participate in promotions, we may collect information necessary to verify eligibility and prevent misuse.

(d) Use or disclosure of sensitive information

We will only use or disclose your sensitive information for the purpose for which it was initially collected or for a directly related purpose, as required or permitted by law, or where you consent to the use or disclosure.

4. Disclosure of personal information overseas

We generally do not disclose personal information to third parties outside Australia, unless required or permitted by law. However, some of our services require the transfer and storage of your personal and sensitive information to overseas service providers. Your data may be processed and stored by:

• Sahha Pty Ltd — Data may be stored in Australia and via international cloud infrastructure with servers located in the United States, Asia-Pacific, and Europe.
• Apple Inc. (Apple iCloud) — Stores account data, preferences, history, and related information. Data may be stored in the United States, Asia-Pacific, and Europe.
• Google LLC (Google Cloud Platform and Vertex AI) — Data may be processed on servers located globally, including the United States, Asia-Pacific, and Europe.
• Google LLC (Firebase Analytics) — Data may be stored in the United States, Asia-Pacific, and Europe.

By using our products or services, you consent to the disclosure of your personal and sensitive information to these overseas providers. We take reasonable steps to ensure that overseas providers comply with the Australian Privacy Principles (APPs), but we cannot guarantee their adherence. By continuing to use our services, you acknowledge and consent to this overseas disclosure.

5. How is my personal information kept secure?

(a) Security

We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access, modification and disclosure. Such steps include:

1. physical security over paper-based and electronic data storage and premises;
2. computer and network security measures, including use of firewalls, password access and secure servers;
3. restricting access to your personal information to employees and those acting on our behalf who are authorised and on a 'need to know' basis;
4. retaining your personal information for no longer than it is reasonably required, unless we are required by law to retain it for longer;
5. entering into confidentiality agreements with staff and third parties;
6. encryption of sensitive information (including biometric and health data) both in transit and at rest;
7. secure API connections and authentication protocols when transmitting data to or from third-party services; and
8. regular security assessments and audits of our systems and service providers to identify and address potential vulnerabilities.

(b) Destruction and de-identification of personal information

Where we no longer require your personal information, including where we are no longer required by law to keep records relating to you, we will ensure that it is de-identified or destroyed.

6. Data quality, access and correction

(a) Quality

We take reasonable steps to ensure that your personal information is accurate, complete and up-to-date. However, we rely on you to advise us of any changes or corrections to the information we hold about you. If you consider that the information we hold about you is not accurate, complete or up-to-date, or if your information has changed, please let us know as soon as possible.

(b) Access to personal information

You may request access to the personal information we hold about you by contacting us. We will respond to your request within a reasonable time. We will provide you with access to the information we hold about you unless otherwise permitted or required by law. If we deny you access to the information, we will notify you of the basis for the denial unless an exception applies. Where reasonable and practicable, we will provide access to the information we hold about you in the manner you request. No fee applies for requesting access to information we hold about you. However, we reserve the right to charge a reasonable fee where we do provide access.

(c) Correction of personal information

If you believe that personal information we hold about you is incorrect, incomplete or not current, you may request that we update or correct your information by contacting us. We will deal with your request within a reasonable time. If we do not agree with the corrections you have requested (for example, because we consider that the information is already accurate, up-to-date, complete, relevant and not misleading), we are not required to make the corrections. However, where we refuse to do so, we will give you a written notice setting out the reasons.

Identifiers. We do not adopt, use or disclose government related identifiers except as required or permitted by law.

7. Complaints

If you have a complaint in relation to the collection, storage, use or disclosure of your personal information, please contact our Privacy Officer using the details below. You will need to provide us with details of your complaint, as well as any supporting evidence and information. We will review all complaints received and our Privacy Officer will respond to you. If you are not satisfied with our response, you may discuss your concerns with or complain to the Australian Privacy Commissioner via oaic.gov.au.

8. Changes to this Privacy Policy

We reserve the right to revise this Privacy Policy or any part of it from time to time. Please review this Policy periodically for changes. Any revised policy will be placed on our website at vivaleisure.com.au. Your continued use of our website, products or services, requesting our assistance, or the provision of further personal information to us after this Privacy Policy has been revised, constitutes your acceptance of the revised Privacy Policy.

9. How to contact us

If you have any questions about this Privacy Policy, please contact Viva's Privacy Officer:

• by email to privacy@vivaleisure.group
• by writing to: Privacy Officer, Viva Leisure, PO Box 1 Mitchell ACT 2911

Effective date: 09 September 2025