Alex is Sprintlaw’s co-founder and principal lawyer. Alex previously worked at a top-tier firm as a lawyer specialising in technology and media contracts, and founded a digital agency which he sold in 2015.
Contents
- Do Health And Wellness Apps Need A Privacy Policy In Australia?
- What Counts As Health Information Or Sensitive Information?
- How Do You Get Consent For Sensitive Information?
- What Should Your Policy Say About Overseas Storage And Third Party Tools?
- What Happens If Something Goes Wrong With User Data?
- Key Takeaways
Are you wondering whether a standard privacy policy template is enough for your health, fitness or wellbeing app? Usually, no - not if your app collects health information, wellness data, location data, device data or user behaviour analytics.
The reassuring part is that your privacy policy doesn't need to be full of legal jargon. It just needs to clearly explain what your app collects, why you collect it, who you share it with, where it's stored and what choices your users have.
For Australian app businesses, privacy is a trust issue as much as a legal one. If users are sharing details about their body, habits, mood, symptoms, workouts or health goals, they want to know you're handling that information carefully from day one.
Do Health And Wellness Apps Need A Privacy Policy In Australia?
Yes, in most cases your health or wellness app should have a privacy policy if it collects personal information from Australian users.
Under the Privacy Act 1988 and the Australian Privacy Principles, many businesses need a privacy policy if they collect personal information. The usual threshold is an annual turnover of more than $3 million, but there are important exceptions.
Your app may be covered even if you're under that turnover threshold if you:
- Provide a health service and hold health information
- Trade in personal information, such as selling or exchanging user data
- Are a contractor to the Australian Government
- Operate in another category specifically covered by the Privacy Act
Health and wellness apps can fall into the health service category more easily than you might expect. If your app helps users assess, maintain or improve their health, records health information, or gives personalised health-related recommendations, you should treat privacy compliance seriously.
State and territory health privacy laws may also apply, especially in NSW, Victoria and the ACT. These rules can apply to private sector health service providers handling health information, so app businesses should check the rules that apply to their users, services and operations.
Even where the Privacy Act doesn't strictly apply, app stores, investors, enterprise partners and users will usually expect a clear privacy policy. Apple and Google also ask for privacy disclosures when you publish or update an app.
A generic privacy policy template Australia-wide might cover basic contact forms and website analytics. But health apps usually need more detail because the information is more sensitive and the data flows are more complex.
What Counts As Health Information Or Sensitive Information?
Health information is a type of sensitive information, and the Privacy Act treats it more carefully than ordinary personal information.
Personal information is information or an opinion about an identified person, or someone who is reasonably identifiable. For an app, this could include a user's name, email address, phone number, IP address, device ID, account details or usage history.
Sensitive information includes information about a person's health, genetic information, biometric information used for automated biometric verification or identification, biometric templates, race or ethnic origin, sexual orientation, religious beliefs and some other personal matters. For health and wellness apps, the most common sensitive information is health information.
For example, your app may collect health information if users enter or generate data about:
- Weight, height, heart rate, sleep or menstrual cycle tracking
- Mental health check-ins, mood journals or stress levels
- Symptoms, injuries, medications or diagnoses
- Fitness testing, mobility scores or recovery plans
- Nutrition, alcohol intake, smoking, pregnancy or fertility information
- Health goals or personalised wellness recommendations
Health information can also be created by your app, not just typed in by the user. For example, if your app analyses workout data and classifies a user as high injury risk, that output may be sensitive too.
Because sensitive information generally requires consent before collection, your privacy policy should work together with your app onboarding screens, consent tick boxes and account settings. A policy sitting in the footer won't fix a sensitive information consent process that isn't clear.
What Should A Health App Privacy Policy Template Include?
A health app privacy policy should include the usual privacy policy sections, plus extra detail about sensitive information, app data, third party tools and user choices.
Templates can be a helpful starting point, but they often miss how your app actually works. Before you publish it, a lawyer should tailor the document to your data flows, technology providers and business model.
Privacy Policy Outline
- Who You Are: State your legal business name, ABN or ACN if you have one, and how users can contact you.
- What Information You Collect: List personal information, health information, device data, location data, payment details and support messages.
- How You Collect Information: Explain collection through account creation, app use, connected devices, forms, customer support and third party integrations.
- Why You Collect It: Describe purposes such as providing the app, personalising content, improving features, safety, analytics, billing and support.
- Consent For Sensitive Information: Explain when and how users consent to collection and how they can withdraw consent.
- Analytics And Tracking: Name the types of analytics, crash reporting, advertising or attribution tools you use and what they collect.
- Automated Decisions From 10 December 2026: If you're an APP entity and use computer programs, AI, risk scoring, triage tools or recommendation engines to make, or substantially assist in making, decisions that could reasonably be expected to significantly affect a user's rights or interests, your privacy policy may need to describe the kinds of personal information used and the kinds of decisions made or assisted by those programs.
- Push Notifications And Communications: Explain reminders, alerts, marketing messages and how users can opt out.
- Who You Share Information With: Cover hosting providers, app stores, payment processors, clinicians, coaches, contractors and software vendors.
- Overseas Disclosure And Storage: Say whether data may be stored or accessed overseas and list countries where practicable.
- Data Security And Retention: Explain the practical steps you take to protect information and when you delete or de-identify it.
- Access And Correction: Tell users how they can request access to, or correction of, their personal information.
- Complaints: Explain how users can complain and how you'll respond.
- App Store Disclosures: Keep your Apple App Privacy Details and Google Play Data safety disclosures consistent with the policy.
Your privacy policy should be easy to find before users sign up, during onboarding and inside the app settings. If you materially change how you use health data later, you may need to update the policy and ask for fresh consent.
How Do You Get Consent For Sensitive Information?
You generally need clear, informed consent before collecting sensitive information such as health information.
Consent doesn't have to be complicated, but it should be meaningful. Users should understand what they're agreeing to before they share sensitive data with your app.
For a wellness app, good consent usually means:
- Using plain language, not hidden legal wording
- Explaining the specific health or wellness data you collect
- Explaining why you need it and what happens if the user doesn't provide it
- Separating sensitive information consent from unrelated marketing consent
- Giving users practical choices where possible
- Keeping a record of when and how the user gave consent
Say Mia runs a recovery app for runners. Users create an account, connect a wearable device and enter injuries, pain scores and weekly training loads. The app has 12,000 users in Australia and stores data with a cloud provider in Singapore.
Mia shouldn't rely on a single sentence saying, we collect information to provide our services. A better approach is to tell users during onboarding that the app collects injury history, pain scores, training data and wearable data to generate recovery recommendations. The app should link to the privacy policy, require an active consent step and store a timestamped record of that consent.
If Mia later wants to use de-identified training data to develop a new injury prediction model, the answer depends on whether the data is truly de-identified and what users were told at the time. If there's any chance users can be re-identified, Mia should get tailored advice before relying on that data.
What Should Your Policy Say About Overseas Storage And Third Party Tools?
Your policy should clearly explain when personal information may be disclosed to, stored by or accessed by providers outside Australia.
Many app businesses use overseas services without thinking of them as overseas disclosure. Common examples include:
- Cloud hosting and database providers
- Customer support platforms
- Email and push notification tools
- Analytics, crash reporting and session replay tools
- Payment processors and subscription platforms
- AI tools used for customer support, triage or product features, supported by an AI governance policy where needed
Under Australian Privacy Principle 8, if you disclose personal information overseas, you usually need to take reasonable steps to make sure the overseas recipient doesn't breach the Australian Privacy Principles. In some cases, you may also remain accountable for what that overseas recipient does with the information.
Practically, this means you should know where your key providers store or access user data. If you can list countries, do that. If countries change depending on the provider's infrastructure, say so clearly and keep your internal vendor register up to date.
Your privacy policy shouldn't say data stays in Australia if your analytics provider, help desk or cloud backups are overseas. That's a common mismatch, and it can create problems with users, app stores and enterprise customers.
You should also check your contracts with software vendors. For health information, look closely at confidentiality, data security, subcontracting, breach notification, data deletion, audit rights and whether the provider can use your data to train its own systems, and whether a health data sharing agreement is needed.
Do Analytics, Push Notifications And App Store Disclosures Need To Match Your Policy?
Yes, your analytics settings, push notification wording and app store disclosures should match what your privacy policy says.
Privacy compliance isn't just the document. It's also what your app actually does in the background.
Analytics And Tracking
If you use analytics to understand retention, drop-off points, feature usage or subscription conversion, your policy should say so. If analytics tools collect device identifiers, location, user events or health-related app activity, don't describe them as anonymous unless they truly are.
Be careful with session replay or heat mapping tools. In a health app, screen recordings or event logs may capture sensitive entries unless you've configured them to mask fields properly.
Push Notifications
Push notifications can reveal sensitive information on a lock screen. A reminder saying time to log your anxiety medication is very different from you have a reminder in the app.
Your policy and settings should explain the types of notifications users may receive, such as health reminders, appointment prompts, habit tracking, product updates and marketing. Users should be able to manage notification preferences through their device settings and, where practical, inside the app.
App Store Disclosures
Apple's App Privacy Details and Google Play's Data safety section ask you to disclose what data your app collects, how it's used and whether it's shared. These disclosures should line up with your privacy policy and your actual software development kit settings.
If your privacy policy says you don't share data for advertising, but your app store disclosure or ad attribution tool suggests otherwise, you'll need to fix the inconsistency before it becomes a bigger issue.
What Happens If Something Goes Wrong With User Data?
If something goes wrong, your first step is to contain the issue, work out what happened and keep a clear record of your decisions.
For app businesses covered by the Privacy Act, the Notifiable Data Breaches scheme may apply. If there are reasonable grounds to suspect an eligible data breach, you should carry out a reasonable and expeditious assessment. The OAIC expects that assessment to be completed within 30 days where possible.
An eligible data breach generally involves unauthorised access to, disclosure of, or loss of personal information where serious harm is likely, and you haven't been able to prevent that risk through remedial action.
If you suspect a privacy incident, work through these steps:
- Contain: Disable affected access, rotate keys, remove exposed files or pause risky integrations.
- Preserve Evidence: Keep logs, screenshots, vendor emails, timelines and internal decisions.
- Assess Impact: Identify what data was involved, who was affected and whether health information was included.
- Remediate: Reset passwords, patch the issue, revoke tokens or ask vendors to delete incorrectly received data.
- Decide On Notification: Work out whether users and the Office of the Australian Information Commissioner need to be notified.
- Update Your Systems: Fix consent flows, vendor settings, staff access or policy wording that contributed to the issue.
A serious interference with privacy can attract significant penalties under the Privacy Act. Repeated or continuous conduct may be relevant to whether an interference is serious. For companies, the maximum penalty can be the greatest of $50 million, three times the value of any benefit obtained if the court can determine that value, or, if the court can't determine the value of the benefit, 30% of adjusted turnover during the breach turnover period.
Most issues don't start with bad intentions. They start with unclear data maps, rushed product updates or tools switched on without checking what they collect. A simple internal privacy review, supported by an information security policy, before each major release can save you a lot of stress later.
Key Takeaways
- A generic privacy policy template usually isn't enough for a health, fitness or wellness app collecting sensitive information.
- Health information is sensitive information, so your consent process needs to be clear, specific and recorded.
- Your policy should cover overseas storage, third party tools, analytics, push notifications, automated decision making and app store disclosures.
- State and territory health privacy laws may also apply, especially in NSW, Victoria and the ACT.
- Your privacy policy must match what your app actually does, including software development kits and background data collection.
- If a data incident happens, contain it, keep records and assess whether the Notifiable Data Breaches scheme applies within the expected 30-day assessment period.
If you'd like help with your health app privacy policy, sensitive information consent process, overseas data disclosures or app store privacy wording, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
Drafted by Taylor, Sprintlaw's AI, and overseen by Alex Solo. How we write
Connect the privacy document to the real data flow
What should the business map before updating its policy?
Collection points, purposes, vendors, disclosures, retention and incident handling must match what the policy and notices actually say.
Privacy, data and cyber guideMap the data, documents and response processes together.Privacy policyPrepare privacy wording that fits how the business handles information.Get a fixed-fee quoteTell us what you need. Our team will review your enquiry and send a clear fixed-fee quote before any work starts.
Alex SoloCo-Founder
