Legal
Privacy Policy
Last updated: 9 November 2026
1. Who we are
This policy explains how Superposition Pty Ltd (ABN 92 660 995 095), trading as Carlyle Jenkins and Xone Health ("we", "us", "our"), handles personal information. It covers www.carlylejenkins.com, the Capacity Check, our workshops and digital products, and the Xone Health programme.
Carlyle Jenkins is an AHPRA registered chiropractor and lifestyle medicine practitioner. He is not a medical practitioner. Our services do not replace your GP or specialist care.
Contact for anything in this policy: carlyle@drcarlyle.com.au, or post to Suite 1, 16 Sunshine Beach Road, Noosa Heads QLD 4567.
We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where we work with people in the United Kingdom, we also follow the UK GDPR and the Data Protection Act 2018 (see section 11).
2. The short version
- We collect what we need to answer you, run the Capacity Check, and deliver the work you sign up for.
- Health and genetic information is sensitive information. We only collect it with your consent and only to deliver your programme.
- We never sell your information. We never share your health information with your employer.
- Some of the services we use are overseas. We list the types below and say where.
- You can ask to see or correct what we hold at any time.
3. What we collect
If you visit the website: technical information such as your IP address, browser, device and the pages you view, collected through our hosting provider's logs.
If you take the Capacity Check: your name, email address, and your answers about stress and recovery, sleep, energy, clarity. Some answers may be health information. You give them by choice, and we use them to score your result and send it to you.
If you buy a workshop or product, enquire or apply: your name, email, phone number, location, what you want help with, and payment confirmation. Card details are handled by our payment provider. We do not see or store your full card number.
If you become a client: with your consent, information needed to deliver your programme, which may include:
- date of birth and sex, which pathology reference ranges need
- health history, medications, supplements and goals from your intake
- blood test results from an accredited pathology laboratory
- genetic test results
- continuous glucose monitor readings
- food logs and meal photos
- data from wearables you choose to connect or share
- notes from our sessions, and recordings if you agree to them
- your Decoded Report and the plans we make together
If an AI agent or assistant contacts us for you: whatever it sends. We treat it as information you have provided, and we confirm directly with you before accepting an application.
We do not knowingly collect information from anyone under 18.
4. Why we use it
- To answer enquiries, deliver the Capacity Check and send your result.
- To assess an application and decide whether we are a good fit.
- To deliver your programme: ordering tests, interpreting results, preparing your report, and supporting you between sessions.
- To take payment and keep business and tax records.
- To send updates and offers if you have agreed to them. Every email has an unsubscribe link, and we follow the Spam Act 2003.
- To meet legal and professional obligations.
We will not use your health information for marketing. We will not use your results, story or likeness to promote our services without your separate written consent.
5. AI tools and automated decisions
We use AI tools, including OpenAI, to help organise your data and draft parts of your analysis and report. Carlyle reviews every output before it reaches you. No decision about you is made by software alone.
Before any of your information goes to an AI tool, we remove your name, contact details and other details that directly identify you, and replace them with a code. Only we can link the results back to you.
AI output informs two kinds of decision about your programme. Carlyle makes both:
- how we interpret your test results and other data
- what we recommend in your report and programme
The information AI tools use is your intake (health history, medications, supplements and goals), age and sex, blood and genetic test results, glucose monitor readings, food logs and meal photos, and wearable data. Much of this is health or genetic information.
We only use AI providers whose terms state that our data is not used to train their models. Where those providers are overseas, section 7 applies.
6. Who we share it with
We share information only to deliver our services, and only as much as each recipient needs. We share it with these types of providers:
| Purpose | Type of provider | Where |
|---|---|---|
| Email, documents and file storage | Cloud email and storage providers | Australia and United States |
| Enquiries, forms, email and booking | Customer relationship management provider | United States |
| The Capacity Check | Online assessment provider | United Kingdom |
| Payments | Payment processors | Australia and United States |
| Video sessions | Video conferencing provider | United States |
| Records from clinic consultations | Clinic practice management software | Australia |
| Programme database | Secure cloud database provider | Sydney, Australia |
| AI analysis | OpenAI, under a signed data processing agreement | United States |
| Blood testing | Accredited pathology laboratories | Australia, or the United Kingdom for UK clients |
| Genetic testing | Accredited genetic testing laboratory | Denmark |
| Food logging | Food logging app | Canada and United States |
| Website hosting | Website hosting provider | United States |
You can ask us for the name of any provider in this list.
We may also disclose information when the law requires it, to prevent a serious threat to someone's life or health, or to our professional advisers under confidentiality.
7. Overseas disclosure
Some providers in section 6 hold or process information outside Australia: in the United States, the United Kingdom, Denmark and Canada. Before we use an overseas provider we take reasonable steps to make sure it protects your information in line with the Australian Privacy Principles, usually through its contract terms or a data processing agreement. Your consent form will name any overseas provider that receives your health or genetic information.
8. How we protect it
We use multi-factor authentication, role-limited access, encrypted connections and providers with recognised security standards. Client health information is kept in systems built for it, not in marketing tools. Capacity Check answers are held by our online assessment provider and our customer relationship management provider. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
9. How long we keep it
- Health records: at least seven years after your last service.
- Enquiries and Capacity Check results from people who do not become clients: up to three years, or until you ask us to delete them.
- Financial records: as long as tax law requires, currently five years.
When we no longer need information, we delete or de-identify it.
10. Your choices and rights
You can ask us to show you or correct the information we hold about you. We will respond within 30 days. If we cannot give you access, for example because the law prevents it, we will tell you why in writing.
You can withdraw consent or unsubscribe at any time. Withdrawing consent for health information may mean we cannot continue your programme. We will explain what that means before anything changes.
You can deal with us using a pseudonym for general enquiries and the Capacity Check. We need your real name to order tests and deliver a programme.
11. If you are in the United Kingdom
We are the controller of your personal data. The lawful bases we rely on are:
- contract, to deliver the services you sign up for
- explicit consent, for health and genetic data
- legitimate interests, for running our business and answering enquiries
- legal obligation, for tax and records
We are based in Australia, which does not have a UK adequacy decision. Where your data is held by providers outside the UK, we rely on the UK International Data Transfer Addendum or equivalent safeguards in their data processing terms. You can ask us for a copy of these safeguards.
You have the right to access, correct, erase, restrict, object to and port your data, and to withdraw consent at any time. You can complain to the Information Commissioner's Office (ico.org.uk).
12. Complaints
Contact us first at carlyle@drcarlyle.com.au, or by post to the address in section 1. We will acknowledge your complaint within five business days and respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13. Changes
If we change this policy, we will post the new version here with a new date. If a change affects clients materially, we will tell you by email before it takes effect.