Privacy Policy

Version Version 5Effective 13 July 2026

Applies to: Everyone who uses the EXsessions platform The EXsessions platform is operated by Wyuna Ventures Pty Ltd (ABN 55 133 591 250), trading as EXsessions, of Suite 607, Level 6, 80 William Street, Woolloomooloo NSW 2011, Australia ("EXsessions", "we", "us", "our"). EXsessions respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, hold, use and disclose personal information when you use the EXsessions platform, including our website, booking tools, messaging features, session tools, provider profiles and related services. By using EXsessions, you acknowledge that your personal information will be handled in accordance with this Privacy Policy.

1. What personal information we collect

We may collect personal information that is reasonably necessary for our functions and activities, including:

a. identity and account information, such as your name, email address, phone number, profile information, login details and account preferences;

b. booking and transaction information, such as session details, booking history, payment information, billing information, receipts, tax invoice details and payout-related information;

c. provider information, such as biography information, qualifications, experience, categories, availability, pricing, business details, ABN, payment details, verification information, licences, registrations and insurance details;

d. communications and session information, such as messages sent through the platform, support requests, scheduling information, session metadata and related records;

e. content and materials, such as files, notes, public profiles, images and other material submitted through the platform;

f. recordings, transcripts, summaries and AI-generated notes or outputs, where those features are enabled for a session and the required disclosures and consents have been obtained;

g. technical and usage information, such as IP address, browser type, device information, operating system, log data and information about how you use the platform; and

h. any other personal information you provide to us, or that we reasonably need to operate the platform, support bookings, manage risk, investigate issues or comply with law.

2. How we collect personal information

We may collect personal information:

a. directly from you when you create an account, complete your profile, make or receive a booking, contact us, submit information through the platform, complete onboarding or verification, or otherwise interact with us;

b. from your use of the platform, including through cookies, analytics tools, session tools, messaging systems and related technologies;

c. from payment processors, identity verification providers, service providers and platform integrations;

d. from providers, clients or other users where that information is provided in connection with a booking, session, complaint, support request or dispute; and

e. from publicly available sources or third parties where reasonably necessary for verification, fraud prevention, legal compliance or risk management.

If you provide us with personal information about another person, you must ensure that you are authorised to do so.

3. Why we collect, use and hold personal information

We may collect, use and hold personal information for purposes including:

a. creating and managing user accounts;

b. enabling providers to create public profiles and offers;

c. facilitating bookings, sessions, messaging and related platform activity;

d. processing payments, refunds, credits, receipts, tax invoices and provider payouts;

e. verifying identity, eligibility, payment details, provider credentials and platform compliance;

f. providing customer support and responding to enquiries, complaints and disputes;

g. operating, improving, maintaining and securing the platform;

h. generating and providing session-related features such as recordings, transcripts, summaries or AI-generated notes where enabled;

i. sending service-related communications, updates, reminders and transactional notifications;

j. carrying out analytics, quality assurance, moderation, fraud prevention and risk management; and

k. complying with legal, regulatory, tax, accounting, security and reporting obligations.

4. When we disclose personal information

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy, including to:

a. providers and clients involved in a booking or session;

b. payment processors, payout providers and other financial service providers;

c. identity verification, fraud prevention, analytics, hosting, communications, customer support and technology service providers;

d. professional advisers, insurers, auditors and financiers;

e. government agencies, regulators, courts, dispute bodies, law enforcement or other authorities where required or authorised by law; and

f. any person or entity in connection with an actual or proposed restructure, financing, sale, merger or transfer of all or part of our business or assets.

We do not sell personal information as that term is commonly understood.

Provider business information

Provider business information (including ABN, registered business name, registered business address, payout details and tax information) is collected and held for the purposes of payouts, tax documentation, identity and risk management, and platform compliance. We do not display this information to clients on the platform. Client-facing receipts and tax invoices show EXsessions as the seller; provider identity details appear only in internal payout documentation issued by EXsessions to the provider.

5. Overseas disclosures

EXsessions is based in Australia, but some of our service providers, technology providers and users may be located outside Australia. As a result, personal information may be disclosed to overseas recipients or stored or processed outside Australia, including in countries where our service providers operate or where users access the platform.

This may include overseas disclosure or processing for hosting, cloud storage, analytics, communications, payments, identity verification, customer support, recordings, transcripts, AI-enabled features and other platform operations.

Where we disclose personal information to an overseas recipient, we will take such steps as are reasonable in the circumstances to help protect that information in accordance with applicable privacy law. OAIC guidance explains that an APP entity disclosing personal information to an overseas recipient must generally take reasonable steps before the disclosure, and may be accountable in certain circumstances for the overseas recipient's handling of the information.

6. Recordings, transcripts and AI-generated notes

If recording, transcription, summaries, notes or other AI-generated outputs are enabled for a session, EXsessions may collect, generate, store, use and disclose those materials as reasonably necessary to operate the relevant feature, provide the service, support the booking, respond to disputes, maintain safety and platform integrity, and comply with legal obligations.

Recordings, transcripts, summaries and AI-generated outputs may contain personal information.

These features will only apply where enabled for the relevant session and where any required disclosures and consents have been obtained.

7. Cookies and similar technologies

We may use cookies and similar technologies to operate the platform, remember preferences, maintain security, understand usage and improve performance.

Further information about our use of cookies and similar technologies is set out in our Cookie Policy.

8. Security

We take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure.

These steps may include access controls, authentication measures, encryption, secure hosting arrangements, monitoring, internal policies, provider management and other technical and organisational safeguards.

OAIC guidance states that APP entities must take reasonable steps to protect personal information they hold and to consider whether information still needs to be retained.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of a data breach that we assess to be an "eligible data breach" under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), we will notify affected individuals and the Office of the Australian Information Commissioner as required by that scheme.

9. Retention

We keep personal information for as long as it is reasonably needed for the purposes for which it was collected, including to provide the platform, manage bookings and sessions, handle disputes, comply with legal obligations, maintain records and protect our legal interests.

Booking, payment, tax and other transaction records are typically retained for at least seven years to meet Australian tax, accounting and record-keeping obligations. Other categories of information may be retained for shorter or longer periods having regard to their purpose, sensitivity and any applicable legal requirement.

When personal information is no longer required, we may destroy it or de-identify it where permitted or required by law.

10. Access and correction

You may request access to the personal information we hold about you, and you may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We will respond to access and correction requests in accordance with applicable privacy law.

OAIC guidance explains that APP 12 provides a right of access to personal information held by an APP entity in the circumstances set out in the Privacy Act, and APP 13 requires reasonable steps to correct personal information so that it is accurate, up to date, complete, relevant and not misleading.

To make a request, please contact us using the details below.

11. Anonymity and pseudonymity

Where lawful and practicable, you may have the option to deal with us anonymously or using a pseudonym in limited situations.

However, in many cases we need identifying information to create accounts, process bookings, verify providers, manage payments, provide support, investigate issues and comply with law, so anonymous or pseudonymous use will often not be possible.

12. Marketing and service communications

We may send you service-related communications that are necessary for your use of the platform, including booking confirmations, reminders, support messages, security notices and policy updates.

We may also send you marketing communications where permitted by law. You can opt out of marketing communications using the unsubscribe function in the message or by contacting us.

Where we send you marketing communications, we will only do so as permitted by law and we will provide an opt-out mechanism (such as an unsubscribe link in the message). You can also opt out at any time by contacting us using the details below. If a marketing channel does not yet provide an in-message opt-out, contacting us is sufficient to be removed from that channel.

13. Children and minors

EXsessions is intended for use by individuals aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you become aware that a person under 18 has provided personal information to us, please contact us so that we can take appropriate steps to remove the information.

14. Complaints

If you believe we have breached applicable privacy law or you have a complaint about how we have handled your personal information, you may contact us using the details below.

We will review your complaint and respond within a reasonable time.

If you are not satisfied with our response, you may be able to make a complaint to the Office of the Australian Information Commissioner.

15. Contact details

If you have any questions, requests or complaints about this Privacy Policy or how we handle personal information, you can contact us through exsessions.com/support.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify users by posting the updated version on the platform, by email, through the account interface, or by other reasonable means.

The updated Privacy Policy will take effect from the date stated at the top of the policy.

Contact: exsessions.com/support