Privacy Policy

Introduction

This Privacy Policy describes how Lavanika Academy Pty Ltd (ACN 663 950 605) (‘we’, ‘our’, ‘us’) collects, uses, holds, discloses, and protects your personal information when you interact with us through our website at https://adcprep.com/ https://www.lavanika.academy (‘Website’), purchase or use our Services, attend our training programs in person, or communicate with us by any means including phone, email, WhatsApp, or other electronic communication.

We are committed to handling your personal information responsibly and in accordance with the Australian Privacy Principles (‘APPs’) contained in the Privacy Act 1988 (Cth) (‘Privacy Act’), to the extent those obligations apply to us.

Lavanika Academy Pty Ltd is committed to handling your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). We have adopted these principles as our voluntary standard because we believe you deserve to know how your information is handled — regardless of any technical exemptions that may apply to small businesses under Australian law.

By using our Website or Services, or by providing us with your personal information, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not provide us with your personal information or use our Services.

We reserve the right to update this Privacy Policy from time to time. We will notify you of material changes by updating the ‘Last updated’ date at the top of this policy and, where appropriate, by direct communication. We recommend you review this policy periodically.

1. What Is Personal Information?

‘Personal information’ has the meaning given in the Privacy Act 1988 (Cth) — that is, information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true and whether or not it is recorded in material form.

Information that does not identify you, or from which your identity cannot reasonably be ascertained, is not personal information for the purposes of this policy (for example, anonymised or aggregated website usage data).

2. What Personal Information We Collect

The personal information we collect depends on how you interact with us. It may include:

• Contact details: full name, preferred name, email address, phone number, and postal address
• Account and registration details: Gmail address, login credentials, and enrolment information
• Payment information: transaction records and payment confirmation details (note: we do not store credit or debit card numbers — these are processed by Stripe)
• Examination and professional details: ADC exam registration status, exam date, dental qualification details, and country of original qualification
• Recordings: audio recordings, video recordings, and photographs taken during online or in-person sessions
• Communications: records of your communications with us including emails, WhatsApp messages, and feedback
• Technical data: device identifiers, IP address, browser type, pages visited, and cookies (see Clause 5)
• User-generated content: any content you submit through our Website, platforms, or during the delivery of Services

We collect only the personal information that is reasonably necessary for the purposes described in this policy. If you choose not to provide certain information, we may not be able to deliver all or part of our Services to you.

Sensitive Information: We do not actively collect sensitive information (such as health data). However, if you voluntarily provide such information to us (e.g., supporting documentation for a course transfer request), we will only use it for the purpose for which it was provided and with your consent.

3. How We Collect Your Personal Information

We collect personal information in the following ways:

• Directly from you when you register for a course, make a purchase, complete a form, or communicate with us
• When you interact with our Website, including through cookies and standard web logging
• During the delivery of Services, including during live and online sessions
• Through third-party platforms we use to deliver our Services (such as Google Drive, WhatsApp, Telegram, and Zoom), where you interact with us on those platforms
• From publicly available sources, where relevant to our Services

We will take reasonable steps to notify you of the collection of your personal information at or before the time of collection, or as soon as practicable afterwards.

4. Why We Collect and Use Your Personal Information

4.1 Primary Purpose

The primary purpose for which we collect and hold your personal information is to provide you with our Services — including dental exam coaching, mock examinations, live training, and study materials — and to manage your enrolment and account with us.

4.2 Secondary Purposes

We may also use your personal information for the following secondary purposes:

• Processing payments and managing accounts
• Communicating with you about your enrolment, program dates, and related matters
• Providing customer support and resolving disputes
• Improving and developing our Website, content, and Services
• Sending you direct marketing communications about our Services (see Clause 7 — Marketing)
• Complying with our legal obligations
• Preventing fraud, misuse, or illegal activity
• Internal reporting, analysis, and business planning using de-identified or aggregated data

4.3 Recordings — Specific Purposes

Audio and video recordings and photographs collected during our sessions are used for the following specific purposes:

• Quality assurance and review of coaching sessions
• Providing you with a recording of your own session performance for personal study purposes
• Training of our faculty and staff (in de-identified form where practicable)
• Marketing and promotional use on our Website and social media channels, subject to the consent provisions in our Terms and Conditions (Clause 11)

Recordings in which you are the primary subject will only be used for marketing purposes with your separate written consent. Recordings used for internal quality assurance and training are retained for 12 months after your program completion and then securely destroyed.

4.4 Consequences of Not Providing Information

If you do not provide us with personal information that is necessary for the primary purpose of collection, we may not be able to provide you with our Services or a relevant part of them. We will tell you at the time of collection whether providing the information is mandatory or optional.

5. Cookies and Website Analytics

Our Website uses cookies — small data files stored on your device — to improve your browsing experience, remember your preferences, and understand how visitors use our Website. We also use standard web analytics tools that may collect information such as your IP address, browser type, pages visited, and time spent on the Website.

Cookies used on our Website may be:

• Essential cookies: required for the Website to function correctly (e.g. maintaining your shopping cart and login session)
• Analytics cookies: used to understand how visitors interact with our Website in aggregate and anonymous form
• Marketing cookies: used to deliver relevant advertising and track the effectiveness of our communications

You can control cookies through your browser settings. Disabling cookies may affect the functionality of some parts of our Website, including the ability to complete a purchase. You can also opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

6. Disclosure of Your Personal Information

6.1 When We Disclose

We do not sell your personal information to third parties. We may disclose your personal information to:

• Third-party service providers who assist us in operating our Website and delivering our Services (see Clause 8 — Third-Party Services)
• Payment processors (Stripe) for the purpose of processing your payment
• Professional advisers including lawyers, accountants, and auditors, under confidentiality obligations
• Regulatory bodies or law enforcement agencies where required or permitted by law
• Any person or entity to whom you have consented to disclosure

6.2 No Sale of Personal Information

We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes.

7. Direct Marketing

We may use your personal information to send you direct marketing communications about our Services, upcoming programs, special offers, and relevant dental examination updates. We will only do this where:

• you have opted in to receive marketing communications from us at the time of enrolment or registration; or
• you are an existing student or past student and the communication relates to similar services to those you have previously used, and you have not opted out

Every marketing communication we send will include a clear and simple way to unsubscribe or opt out. You can also opt out at any time by contacting us at privacy@lavanika.academy or by following the unsubscribe instructions in any marketing email.

We will action all opt-out requests promptly and within 5 business days at the latest. We do not use sensitive personal information for direct marketing purposes.

8. Third-Party Services and Platforms

We use a number of third-party services and platforms to deliver our Services and operate our business. When you interact with us through these platforms, your personal information may be collected and processed by those third parties in accordance with their own privacy policies. We encourage you to review those policies.

The key third-party services we use are:

We take reasonable steps to ensure that the third-party services we use handle personal information responsibly. However, once your information is transmitted to a third-party platform (such as when you join a WhatsApp group or Google Drive folder), we are not responsible for the privacy practices of that platform. This policy does not apply to any third-party websites or services linked from our Website.

9. Overseas Transfer of Personal Information

To deliver our Services, we use the third-party platforms listed in Clause 8, several of which are operated by companies based in the United States and other countries. Your personal information may therefore be stored on, or accessible from, servers located outside Australia.

We take the following steps to ensure reasonable protection of your personal information when it is handled overseas:

• We use reputable, internationally recognised service providers that maintain their own privacy and security frameworks
• We rely on industry-standard data processing agreements with service providers where available
• We limit the personal information shared with third-party platforms to what is necessary for the specific purpose

Important: Because Lavanika Academy Pty Ltd is currently a small business operator under the Privacy Act 1988 (Cth) and is exempt from the mandatory APP 8 cross-border disclosure requirements, we cannot guarantee that overseas recipients will handle your information in a manner consistent with the Australian Privacy Principles. However, as a matter of good practice we will always take reasonable steps to select reputable service providers. By using our Services and providing your personal information, you acknowledge that it may be transferred to and processed in countries outside Australia, including the United States.

If you have concerns about your personal information being transferred overseas, please contact us at privacy@lavanika.academy before using our Services.

10. How We Protect Your Personal Information

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• Secure HTTPS encryption on our Website
• Payment processing exclusively through Stripe — we do not store credit or debit card numbers on our systems
• Password-protected access to our systems and administrative accounts
• Limiting access to personal information to staff and contractors who need it to perform their role
• Using reputable cloud platforms with their own security certifications for data storage and communication

Despite our efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of information transmitted to us over the internet. If you suspect your account has been compromised, please contact us immediately at privacy@lavanika.academy.

11. How Long We Retain Your Personal Information

We retain personal information only for as long as it is necessary for the purposes for which it was collected, or as required by law. Our general retention practices are:

• Enrolment and account records: retained for 7 years after your last interaction with us, to meet tax, legal, and audit obligations under Australian law
• Payment transaction records: retained for 7 years in accordance with the Income Tax Assessment Act and GST requirements
• Audio and video recordings used for quality assurance and internal training: retained for 12 months after program completion, then securely deleted
• Recordings used for marketing (with your consent): retained for as long as the consent remains in force, or until you withdraw consent
• Communications (email, WhatsApp messages): retained for as long as necessary to maintain a record of our interactions with you, or as required by law
• Technical data and cookies: retained in accordance with the relevant platform’s own retention settings (typically 90 days to 2 years)

When personal information is no longer required, we will take reasonable steps to destroy or permanently de-identify it in a secure manner.

12. Your Right to Access and Correct Your Personal Information

You have the right to request access to personal information we hold about you, and to request that we correct any information that is inaccurate, out of date, incomplete, irrelevant, or misleading. These rights are supported by Australian Privacy Principles 12 and 13.

To make an access or correction request, please contact us at privacy@lavanika.academy. We will:

• Acknowledge your request within 5 business days
• Respond to your request within 30 calendar days of receipt
• Provide access in a format that is reasonable in the circumstances

We may refuse access or correction in certain limited circumstances permitted by the Privacy Act (for example, where providing access would unreasonably impact another person’s privacy, or where the request is vexatious). If we refuse, we will explain the reason in writing and advise you of any complaint mechanisms available.

We do not charge a fee for making an access or correction request, though we may charge a reasonable fee to cover the cost of processing a large or complex request. We will advise you of any such fee before proceeding.

13. Data Breaches

We take data security seriously. In the event of a data breach involving your personal information, we will take the following steps:

• Contain and assess the breach as quickly as practicable
• Notify you directly if the breach is likely to result in serious harm to you, as soon as reasonably possible after we become aware of it
• Notify the Office of the Australian Information Commissioner (OAIC) if required by applicable law
• Take remedial action to prevent further harm or recurrence

Note on the Notifiable Data Breaches (NDB) Scheme: The mandatory NDB scheme under Part IIIC of the Privacy Act 1988 (Cth) applies to entities covered by the Privacy Act. As a current small business operator below the AU$3 million turnover threshold, Lavanika Academy Pty Ltd is not presently subject to mandatory NDB reporting obligations. However, we are committed to notifying affected individuals of any breach that is likely to result in serious harm, regardless of our legal obligations, as a matter of good practice and transparency.

If you become aware of or suspect a data breach involving your personal information held by us, please contact us immediately at privacy@lavanika.academy.

14. Automated Decision-Making

We do not currently use automated decision-making systems to make decisions about you that have a significant legal or similarly significant effect (such as automated enrolment approval or rejection decisions). All material decisions affecting your enrolment and participation in our programs are made by human staff.

We do use automated tools for standard website operations such as email marketing automation, order processing via WooCommerce, and payment confirmation via Stripe. These automations are operational in nature and do not make significant decisions about you without human oversight.

If we introduce automated decision-making processes in the future that significantly affect you, we will update this policy and notify you accordingly, in compliance with the Privacy and Other Legislation Amendment Act 2024 (Cth) requirements when they come into effect.

15. Privacy Complaints

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer using the details in Clause 17. We take all privacy complaints seriously.

Our complaints process is:

• Step 1 — Contact us: Send your complaint in writing to privacy@lavanika.academy, describing the nature of your concern and your desired outcome.
• Step 2 — Acknowledgement: We will acknowledge receipt of your complaint within 5 business days.
• Step 3 — Investigation: We will investigate your complaint and respond with our findings and any proposed resolution within 30 calendar days of receipt. If your complaint is complex and requires more time, we will notify you before the 30-day mark and give an estimated resolution date, which will not exceed 60 calendar days in total.
• Step 4 — Resolution: If we uphold your complaint, we will take appropriate remedial steps in consultation with you.

If you are not satisfied with our response, or if we have not responded within 60 calendar days, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner (OAIC) Website: www.oaic.gov.au Phone: 1300 363 992 Online complaint form: www.oaic.gov.au/privacy/privacy-complaints

16. International Visitors and Overseas Candidates

Our Services are primarily used by overseas-trained dentists seeking registration in Australia. If you are located outside Australia when you interact with us, please be aware that:

• Your personal information will be collected and processed in Australia and is subject to Australian law
• The laws of your country of residence may provide you with additional privacy rights — this policy does not affect any such rights you may have
• If you are an individual located in a country with its own privacy framework (such as the European Union’s GDPR, India’s DPDP Act, or Canada’s PIPEDA), you may have rights under those frameworks in addition to those described in this policy

We are aware that some candidates may be EU residents or may exercise their rights under GDPR where applicable. While our Website is not specifically directed at EU residents and we do not systematically monitor behaviour of individuals in the EU, if you are an EU resident and you believe GDPR applies to your interaction with us, please contact us at privacy@lavanika.academy and we will address your query on its merits.

As a practical matter, the protections we have adopted voluntarily in this policy broadly align with internationally recognised privacy standards, and we will treat all individuals’ personal information with equal respect regardless of their country of origin.

17. How to Contact Us About Privacy

For any privacy-related queries, access requests, correction requests, or complaints, please contact our Privacy Officer:

Privacy Officer — Lavanika Academy Pty Ltd (ACN 663 950 605) Email: privacy@lavanika.academy Website: https://adcprep.com/contact-us/ , https://www.lavanika.academy/contact Postal address: Suite 205, 838 Collins St, Docklands VIC 3008

We aim to respond to all privacy inquiries within 5 business days.

18. Glossary

• APPs means the Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 (Cth).
• OAIC means the Office of the Australian Information Commissioner.
• Personal information has the meaning given in Clause 1 of this policy and in the Privacy Act 1988 (Cth).
• Privacy Act means the Privacy Act 1988 (Cth) as amended from time to time, including by the Privacy and Other Legislation Amendment Act 2024 (Cth).
• Services means any course, coaching program, mock examination, live training session, digital content, or study materials provided by Lavanika Academy Pty Ltd.
• Small business operator has the meaning given in s 6C of the Privacy Act 1988 (Cth) — currently a business with annual turnover of AU$3 million or less that does not otherwise fall within a category subject to the Privacy Act.
• Website means the website operated by Lavanika Academy Pty Ltd at https://adcprep.com/ https://www.lavanika.academy and all associated pages, applications, and tools.