Bewell

Policy provides clear scope statement, specific contact details, structured sections, and introductory overview. However, lacks definitions/glossary and has unusual future date (2026) which raises currency concerns.

Clearly enumerates five specific purposes for data use including service provision, payments, and communications. Requires opt-in consent for marketing and prohibits third-party marketing without consent, showing good purpose limitation practices.

Reserves right to update policy with immediate effect and encourages periodic review. Provides contact details but lacks named privacy officer, specific review frequency, governance framework, or proactive change notifications.

Lists specific data types including sensitive health information with collection contexts and consent mechanisms. However, lacks detail on automated collection methods like cookies/analytics and collection limitation principles are only implied.

Identifies specific categories of recipients with examples (payment processors, IT providers) and includes marketing restrictions with consent requirements. However, lacks named parties, contractual obligations details, and specific safeguards.

Only provides generic commitment to technical and organisational measures protecting against common threats. Lacks specific security measures, encryption details, certifications, breach notification procedures, or audit practices.

Implies overseas disclosure through service providers but lacks specific countries, adequacy mechanisms, or safeguards. Only provides general third-party sharing restrictions and website linking disclaimers without cross-border specifics.

Provides access, correction, and update rights with multiple contact methods specified. However, lacks response timeframes, deletion rights, complaint escalation procedures to OAIC, and detailed processes for exercising rights.

No disclosure of automated decision-making use, AI/ML systems, or related rights. Policy mentions 'personalise services' but provides no transparency about automated systems, opt-out rights, or human review mechanisms.

No relevant claims found in policy.

No specific findings.