Privacy Policy

Version 2, 26 September 2026. Its facts were brought up to date on 3 November 2026.

Take5 Thrive® provides team-level psychosocial risk screening to Australian workplaces, schools and health services. We are a small, pre-revenue business based in regional Western Australia. Our screening looks at how a team is going as a group, across the five points of our framework: Wellbeing, Communication, Empowerment, Mentoring, Resilience®. It is not an individual assessment, it is not diagnostic, and it is not a wellness app.

This policy explains, in plain words, what personal information we collect, how we handle it, and what you can do about it. We have written it to the standard set by Australian Privacy Principle 1 in the Privacy Act 1988 (Cth). If anything here is unclear, ask us. The contact details are in section 1.

The short version

Through our website we collect only what you choose to send us: a message through the Contact or Investors form, or the details you give when you sign up for an account. There are no analytics that identify you.

Our surveys are anonymous. We do not ask for your name, your email address or anything else that could identify you, and we could not work out who you are if we tried.

We never report a result for a group of fewer than five people. Small groups are combined into a larger one, and we always combine at least two, so nobody can work out a small group’s result by comparing the numbers.

The personal information we do hold is mostly work contact details for the organisations, suppliers and advisers we do business with.

We hold information in Australia and we do not send personal information overseas (see section 9).

1. Who we are, and how to contact us

Take5 Thrive® is a registered trade mark. The business trades through THRIVE METRICS PTY LTD, ACN 135 232 218.

Our postal address is PO Box 1702 Geraldton DC WA 6531.

We do not publish a telephone number. Privacy questions and requests are handled in writing (by email, or by post to the address above) so that what you asked for and what we told you is on the record for both of us.

For anything to do with privacy (a question, a request to see what we hold, a correction or a complaint), email hello@take5thrive.com.au and put “Privacy” in the subject line. This address reaches the founder directly.

2. Where we stand under the Privacy Act

We want to be straight with you about this, because most privacy policies are not.

The Privacy Act 1988 (Cth) does not automatically apply to a business with an annual turnover of A$3 million or less. Take5 Thrive® is a small business of that size. We are not claiming that the Act binds us, and we are not claiming an exemption from it either.

What we are saying is simpler. We apply the Australian Privacy Principles as our standard regardless. Our clients in health and education expect information about their people to be handled that way, and it is the right way to handle it. Everything in this policy is a commitment we make to you, whether or not a regulator can enforce it.

Separately, the Privacy and Responsible Information Sharing Act 2024 (WA) applies to Western Australian public entities, including public schools and public health services. Where we work for one of those organisations, we expect our contract to require us to support the client’s obligations under that Act, and we are set up to accept that.

3. Dealing with us anonymously, or under a name that is not yours

You can deal with us anonymously, or using a pseudonym, wherever that is lawful and practical. In practice:

Survey respondents are always anonymous. There is no option to identify yourself, because we do not ask.

General enquiries. If you email us with a question, you do not have to tell us who you are.

Access, correction and complaints. Here we usually do need to know who you are. If we cannot identify you, we cannot find the information you are asking about, and we cannot be confident we are giving it to the right person.

4. The kinds of personal information we collect and hold

We collect as little as we can. The table below covers all of it.

Sensitive information. Survey responses ask how people experience their work. Because that touches on wellbeing, we handle response data as carefully as we would handle sensitive information, even though it is anonymous. We do not collect health records, diagnoses or clinical information about anyone.

5. Survey responses are anonymous: here is what that means

This is the heart of how the product works, so it is worth setting out properly.

We do not collect your name, your email address, your IP address, any device identifier, or your location.

We do not ask your role, your age, your gender or how long you have worked there.

You select one work area, and that is all. There is no second grouping question, because two grouping questions in a small workplace can narrow a response down to a person.

The reporting floor. We never report a result for a group of fewer than five people. A group under five is combined upward into a larger, named parent group. Whenever we combine one group, we always combine at least one other with it. Otherwise the missing group could be worked out by subtracting the published figures from the total. The organisation still gets a complete picture; no small group is ever visible in it.

Your employer never sees an individual response. There is nothing individual to see. Participation is voluntary, and because we do not collect identity, nobody can track who did or did not take part.

6. What our website collects

Our website collects only what you choose to send us. The Contact and Investors forms ask for your name, your email address, your organisation and your message (on Investors, also what you are interested in). Signing up for an account asks for your full name, your work email address, your organisation and a password, and, if you choose, your job title and the number of staff. Your password is kept only in scrambled form, never as you typed it. There are no analytics that identify a visitor.

What you send through the website is held on our own server in Sydney (see section 7). Survey answers go only to the survey a check-in runs on (see section 7), never to the website's other pages. If we ever decide a website needs to collect something from you, we will assess it against this policy and update this policy before we build it, not after.

7. How we collect it, and where we hold it

How we collect it. Almost always directly from you: you email us, you meet with us, you give us your work details so we can run a project together, or you sign an agreement with us. If we ever collect information about you from someone else, we will tell you.

Business email. Our business email runs on Zoho Mail, in Zoho’s Australian data centre. Email is correspondence only: no survey response data, no identifiers and no data exports are ever sent or held as mail attachments. That rule has no exceptions.

Survey responses. Each check-in runs on one of two surveys. Our own survey runs on a server in Sydney, hosted by Binary Lane, an Australian company: its responses are held on that server, and Binary Lane keeps short-term backups of it on site. Otherwise, responses are collected and held inside an Australian-resident survey vendor’s platform, Zoho Survey. That vendor has confirmed in writing, on 4 August 2026, that for its Australian data centre the storage of responses (including backups and replicas), the processing of them, and its sub-processors are all in Australia. We hold those answers on file. The contracting entity is an Australian company. The vendor is Zoho Survey, on Zoho’s Australian data centre.

Website messages and accounts. What you send through the website’s forms, and the account you create, are held on that same server in Sydney.

Local copies. Where we need a local copy of a data export to do the scoring, it lives only in an encrypted store on a single nominated Windows device, outside any cloud-synced folder. It is never saved to a shared drive, a personal cloud account, an email attachment or removable media.

8. Why we collect it, how we use it, and who we give it to

We use the personal information we hold for the purpose we collected it for, and for directly related purposes you would reasonably expect. In practice that means:

Delivering the service: setting up screening, arranging survey windows, producing and delivering reports.

Running the business relationship: correspondence, agreements, invoicing and record-keeping.

Answering you: responding to enquiries and following them up.

Meeting obligations: where we are required by law to use or disclose information.

We do not sell personal information. We do not trade, rent or share it so that someone else can market to you, and we do not send marketing to people who have not asked to hear from us.

We disclose personal information only in these situations:

To service providers who help us operate (our email provider, our hosting provider and our survey vendor), and only what they need to provide that service.

To our professional advisers (for example our lawyer or accountant), where it is necessary, such as advice on an agreement.

Where the law requires it: for example a court order, or a serious data breach notification.

Where you ask us to. With your agreement, to whoever you nominate.

Client reports contain no personal information. What a client organisation receives is a team-level report built from anonymous responses, subject to the reporting floor in section 5.

9. Sending information overseas

At the date of this policy we do not disclose personal information to overseas recipients, and there are no countries to name. We are set up so that information stays in Australia: our business email runs in Zoho’s Australian data centre, our website and our own survey run on a server in Sydney hosted by Binary Lane, an Australian company, and other survey responses are collected through an Australian-resident survey vendor.

We asked our survey vendor the three questions that actually decide this (where data is stored, where it is processed, and where its sub-processors sit), and it answered all three in writing on 4 August 2026: all in Australia, for the Australian data centre we use. Its one sub-processor is a translation service located in the United States. It is optional, it is switched off, and it cannot reach survey responses, because we field no free-text question for it to translate. We check that setting before every survey opens. If that position ever changes, we will name the country here, and we will do it before anything is sent, not afterwards.

10. Keeping information accurate, safe, and only for as long as we need it

Accuracy. We take reasonable steps to keep the contact details we hold accurate and up to date. If something we hold about you is wrong, tell us and we will fix it (see section 12).

Security. The steps we take include:

Multi-factor authentication on business accounts.

An encrypted store on a single nominated device for any local copy of response data, on a device that is password-protected and locks itself automatically.

Access limited to the owners during the pilot phase. Client contacts receive aggregate reports; they never have access to the response store.

No exports by email or shared link. Ever.

How long we keep it. Raw survey response data for a check-in is kept only until the earliest of three dates: when the next full check-in opens, nine months after the check-in closed, or thirty days after the engagement ends. It is then permanently deleted from the survey platform and from every export. The destruction is recorded. A client may ask us to destroy raw responses earlier at any time, and we confirm that in writing.

Business contact details and correspondence are kept while the relationship continues and for seven years after our last dealing with you, in line with business record-keeping, and are then deleted.

Destruction and de-identification. When we no longer need personal information for any purpose set out in this policy, and we are not required to keep it, we destroy it or de-identify it.

11. Computers do not make decisions about you

No computer program makes a decision about any individual using their personal information. Our intervention mapping works on aggregated team-level data, and a person reviews every flag before anything is acted on. Nothing in our process produces an automated decision about a person, and no result is ever attributed to a person.

12. Seeing what we hold, and asking us to correct it

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it if it is wrong, out of date, incomplete or misleading. Email hello@take5thrive.com.au and tell us what you are looking for.

We will need enough information to identify you and to find the right record. If we cannot give you access, or we do not agree that a correction is needed, we will tell you why in writing, and we will tell you how to take it further.

We will respond to an access or correction request within 30 days of receiving it, and we do not charge for giving you access.

One honest limitation. We cannot give you access to your own survey responses, and we cannot correct or delete them. That is not a refusal. It is arithmetic. The responses carry nothing that identifies anyone, so we have no way of telling which ones are yours. That is exactly what makes the survey anonymous, and we are not willing to weaken it.

13. Making a complaint

If you think we have mishandled your personal information, or breached an Australian Privacy Principle, please tell us. We would rather hear it than not.

Step 1: tell us. Email hello@take5thrive.com.au with “Privacy complaint” in the subject line, and set out what happened. We will acknowledge your complaint, tell you who is handling it, investigate it, and write back to you with our answer and what we intend to do about it. We will acknowledge your complaint within five business days and give you our full response within 30 days.

Step 2: the Office of the Australian Information Commissioner (OAIC). If you are not satisfied with our answer, or we do not respond, you can complain to the OAIC, the national privacy regulator, at oaic.gov.au. The OAIC handles complaints about organisations covered by the Privacy Act 1988 (Cth); whether it can take a complaint about us depends on the position described in section 2. We will not use that as a reason to avoid dealing with your complaint properly.

Step 3: the Office of the Information Commissioner, Western Australia. The WA Information Commissioner oversees the Privacy and Responsible Information Sharing Act 2024 (WA), which applies to Western Australian public entities such as public schools and public health services. If your complaint concerns information handled for one of those organisations, you can raise it there (details at wa.gov.au).

14. Changes to this policy

We update this policy when what we do changes, and whenever one of the decisions it records changes. The version number and date at the top of the page tell you which version you are reading. The current version is always the one published at take5thrive.com.au. If we make a change that materially affects how we handle your personal information, we will tell the people it affects rather than relying on you to notice.

This policy has not been reviewed by a lawyer. That is a knowing decision by the owners taken on 3 August 2026 on cost grounds, not an oversight, and it is recorded here so that anyone relying on this policy can see the position. The first legal spend when funds allow is a fixed-fee review of the Participant Information & Consent.