HeraVita Body Data Trust Charter

This Body Data Trust Charter ("Charter") explains how HeraVita collects, uses, stores, and discloses personal information in connection with the HeraVita fit study, including three-dimensional body scan data collected via our 3D body scanning technology partner. This Charter is intended to ensure participants are fully informed of our data handling practices prior to participation, consistent with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Who We Are

HeraVita is a fit-research initiative operated by Bubbaroo Pty Ltd (ACN 113 520 255), a company incorporated in Australia and based in Perth, Western Australia ("HeraVita", "we", "us", "our"). Bubbaroo Pty Ltd is the entity responsible for the personal information described in this Charter.

Contact: info@heravita.com.au

2. Scope of This Charter

This Charter applies to all individuals who participate in the HeraVita fit study, from initial screening and survey completion through to attendance at a scan event and receipt of results. It covers both survey responses and three-dimensional body scan data.

3. Information We Collect

3.1 Contact and Identity Information

We collect your name, email address, phone number, and postcode. Your email address links your survey responses, appointment booking, and account records across our systems. For your scan appointment specifically, we assign a separate unique reference code, presented to you as a QR code, which identifies your scan to our 3D body scanning technology partner. We link this code back to your account internally; this partner does not receive your email address directly.

3.2 Survey and Lifestyle Information

We collect your responses to our screening and detailed survey questionnaires, including information such as age group, height, activity level, garment fit concerns, and interest in wear-testing. You may decline to answer any question that is not required to determine your eligibility for the study.

3.3 Three-Dimensional Body Scan Data

Where you attend a scan event, our 3D body scanning system captures a set of body measurements (approximately 250 individual measurements) and generates two rendered snapshot images depicting your body shape from the front and back. These images are produced using an algorithmic rendering process and do not constitute a photographic or identifiable image of your face.

3.4 Booking and Payment Information

Where you book a scan appointment through Acuity Scheduling, we collect your appointment details. Where a fee applies, payment is processed by Stripe via our booking platform; HeraVita does not access or retain your payment card details.

3.5 Website Usage Information

Our website uses Microsoft Clarity to collect aggregate website usage analytics. This information is not used to construct an individual profile of you.

4. Purpose of Collection and Use

We collect and use your personal information to:

• Determine your eligibility for the fit study and invite you to take part
• Book, manage, and remind you about your scan appointment
• Capture and deliver your body scan measurements and results to you
• Design and improve HeraVita garments based on aggregate research findings
• Contact you about your participation, booking, and results
• Meet our own legal and accounting obligations, including issuing receipts for paid bookings

We do not use your personal information for advertising, and we do not sell it to third parties. We will not use your photographs, scan images, testimonials, or personal quotes for marketing purposes without your prior, separate, and explicit consent.

We may share de-identified, aggregated data (for example, "62% of participants in this age group reported bra band sizing issues") with our garment design team and research partners. Aggregated data of this kind cannot be traced back to you.

5. Disclosure to Third Parties

The operation of the fit study requires the engagement of a limited number of specialist service providers. Each provider receives only the information necessary to perform its specific function and is contractually restricted from using your information for any other purpose.

• 3D body scanning technology partner — body scanning hardware and measurement processing
• Shopify — customer accounts, results delivery
• Klaviyo — email communications
• Typeform — survey collection
• Make.com — automation connecting our systems
• Acuity Scheduling — appointment booking
• Stripe — payment processing (paid bookings only)
• Cloudflare — storage and delivery of your scan snapshot images
• Microsoft (Excel Online) — internal research data compilation

We maintain contractual data protection agreements with these providers, including a data protection agreement with our 3D body scanning technology partner governing the handling of your scan data, currently being finalised.

6. Overseas Disclosure

Some of the service providers listed in Section 5 are located, or store data, outside Australia. We may disclose your information to service providers located in South Korea, the United States, Canada, and the European Union. Most significantly, your three-dimensional body scan measurements are processed and stored on servers located in Seoul, South Korea. For one provider, used for internal research data compilation, it is not practicable for us to specify a single country, as this depends on the underlying cloud infrastructure in use.

Prior to disclosing your information overseas, we take reasonable steps to ensure it will be handled consistently with the Australian Privacy Principles, including through contractual protections with each provider. By participating in the fit study, you consent to this overseas handling of your information as described in this Charter.

7. Retention of Your Information

HeraVita retains your fit study information, including your survey responses and body scan measurements, for the duration of your relationship with HeraVita. Your measurements and scan results remain stored in your HeraVita customer account so that you may continue to access your own results over time; this information is not automatically deleted at the conclusion of the research study.

You may request deletion of your information, including your survey responses, scan measurements, and customer account data, at any time. On receipt of a valid request, we will delete or de-identify the applicable information across our systems, other than any component we are required by law to retain (for example, payment records), see Section 8.

8. Your Rights

Under the Australian Privacy Principles, you may:

• Request access to your information. Email info@heravita.com.au and we will compile a summary of the information we hold about you across our systems.
• Request correction. If any information we hold is inaccurate or out of date, we will correct it on request.
• Withdraw your consent or request deletion. You may withdraw from the study and request deletion of your survey responses, scan data, and customer account information at any time, without providing a reason. Certain information may be retained briefly to complete a payment refund or to meet a legal obligation; all other information will be deleted.
• Lodge a complaint. If you are dissatisfied with how we have handled your information, please contact us in the first instance at info@heravita.com.au. If you remain dissatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

We will respond to requests as soon as practicable.

9. Security of Your Information

We engage service providers with industry-standard security practices, including encryption of data in transit and at rest. Your scan snapshot images are stored in a private, access-controlled system and are not publicly listed or searchable. No system is entirely free of risk. In the event of a data breach likely to result in serious harm, we will notify affected participants and the OAIC as required by law.

10. Children

The HeraVita fit study is intended for adult participants. We do not knowingly collect personal information from individuals under 18 years of age. If you believe a minor has provided us with information, please contact us and we will delete it.

11. Changes to This Charter

We may update this Charter from time to time as the fit study evolves. The current version is always available on our website, and the date at the top of this page reflects the most recent update.

12. Contact Us

For questions, concerns, or requests regarding your information, contact: info@heravita.com.au