Effective date: 8 August 2026.
Elemental Protocol (we, us, our), ABN 73 655 028 032, operates the Elemental Protocol program, the website at elementalprotocol.com.au and the Performance Audit at audit.elementalprotocol.com.au. We are committed to protecting your privacy and handling your personal and health information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Because our work involves your health, much of the information we hold is “sensitive information” under the Privacy Act and is given a higher level of protection.
Who we are
Elemental Protocol is a nutritional-medicine practice based at 17 Glen Osmond Road, Eastwood SA 5063, delivering the program by telehealth across Australia. For any privacy question or request, contact us at rohan@elementalprotocol.com.au.
The information we collect
- Contact and identity information. Name, email, phone, location, and details you provide when you enquire, book a call, or enrol.
- Performance Audit responses (sensitive information). Your answers to the Performance Audit, which include questions about sleep, cognition, mood, digestion and alcohol intake, and which include standard screening questions about low mood and about thoughts of self-harm. Your pillar scores and overall result are generated from those answers.
- Health information (sensitive information). Your health history, symptoms, lifestyle, medications and supplements, and the information you share during consultations and in questionnaires.
- Pathology and functional test results. Blood, urine, stool, epigenetic (biological age) and related test results ordered as part of the program.
- Wearable and continuous glucose monitor data. With your consent, data from devices such as an Oura ring, Apple Watch or Apple Health, or a continuous glucose monitor, including heart-rate variability, resting heart rate, sleep, readiness and glucose data, where you choose to connect or share it with us.
- Payment information. Processed by our payment provider. We do not store your full card details.
- Website usage information. Cookies and analytics when you use our website. See “Cookies, analytics and our website” below.
How we collect it
We collect information directly from you through enquiry forms, the Performance Audit, calls, questionnaires and email. We also receive it from the pathology and functional-testing laboratories that process your samples on our instruction, and from wearable or glucose-monitoring platforms that you connect with your consent. Where it is reasonable and practicable, we collect information directly from you.
Why we collect and use it
We use your information to:
- generate your Performance Audit result and report, where you have completed the audit;
- assess whether the program is appropriate for you;
- deliver the program, meaning to interpret your results, build and adjust your protocol, prepare your reports, and support you between sessions;
- communicate with you about your care and the program;
- arrange testing and, where relevant, coordinate with your GP or other practitioners with your consent;
- process payments and administer your enrolment;
- meet our legal and professional obligations.
We only collect health and other sensitive information with your consent, and we use it only for the purpose for which it was collected, or a directly related purpose you would reasonably expect.
The Performance Audit
The Performance Audit is a self-assessment questionnaire hosted on our behalf by a third-party assessment platform located in the United Kingdom. Completing it involves telling us sensitive information about your health, so this section sets out plainly what happens to it.
- What we do with your answers. We generate your result, your pillar scores and your report, and we send those to the email address you provide. Your answers and result are held against your record.
- The safety questions. The audit includes standard screening questions about low mood and about thoughts of self-harm. If your answers indicate a risk to your safety, the result page directs you to Australian support services and to your GP. Your practitioner is notified that a submission has been flagged so that your result is handled with appropriate care. We do not disclose your answers to anyone else unless you ask us to, or unless we are required or authorised by law to do so, or unless we reasonably believe it is necessary to lessen or prevent a serious threat to your life, health or safety.
- Follow-up email. When you take the audit we email you your result, and then a short series of follow-up emails about what it means. Every one carries an unsubscribe link, and you can opt out at any time. See “Email and direct marketing” below.
- Asking us to delete it. You can ask us to delete your audit result and remove you from any email list at any time, and we will do it.
Email and direct marketing
When you complete the Performance Audit, or you otherwise ask to hear from us, we send you email about the program using an email delivery platform. That email is sent on the basis of the consent you gave, and we do not sell or rent your details to anyone or send you email on behalf of anyone else.
Every one of those emails carries an unsubscribe link, and unsubscribing takes effect without you having to give a reason. You can also ask us directly at rohan@elementalprotocol.com.au. Unsubscribing from program email does not affect email about your care if you are enrolled, and it does not affect the delivery of your audit result.
When we disclose it
We do not sell your information. We disclose it only where necessary to deliver your care or run the practice, including to:
- pathology and functional-testing laboratories engaged to process your tests;
- the assessment platform that hosts the Performance Audit, and the email delivery platform that sends your result and any follow-up email;
- wearable or glucose-monitoring platforms you have connected, to retrieve the data you have chosen to share;
- your GP or other treating practitioners, with your consent, for example where your results point to something that belongs with a doctor and we provide a written brief;
- service providers who help us operate, including secure scheduling, email, hosting, practice and payment systems, who are bound to protect your information;
- others where required or authorised by law, or where we reasonably believe disclosure is necessary to lessen or prevent a serious threat to life, health or safety.
Overseas disclosure and storage
Some of the laboratories and platforms we use are located outside Australia, so some of your information is disclosed to or stored in another country. Specifically:
- Laboratories. Certain functional tests are processed outside Australia, including in the United States, for example epigenetic biological-age testing and certain hormone testing.
- The Performance Audit platform is located in the United Kingdom, so your audit answers and result are stored there.
- Our email delivery platform operates in the European Union and the United States.
- Website hosting, analytics and content delivery involve providers that operate servers outside Australia, including in the United States.
Where your information is handled overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. By completing the Performance Audit, and by enrolling and consenting to your testing, you consent to these overseas disclosures. If you would prefer that your samples not be sent to an overseas laboratory, tell us before your testing is ordered and we will discuss what can be done within Australia.
How we store and protect it
We hold your information in secure electronic systems and take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Access to your clinical record is limited to your practitioner.
If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
How long we keep it
We retain your health records for at least seven years from your last consultation with us, and longer where the law or our professional obligations require it. Where you were under 18 at the time, we retain the record until you turn 25. Information that is not part of a clinical record, such as an audit result from someone who never enrolled, or an unsubscribed email contact, is deleted or de-identified once it is no longer needed. You can ask us to delete an audit result at any time.
Accessing and correcting your information
You may request access to the personal and health information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Contact us at rohan@elementalprotocol.com.au. We will respond within a reasonable time. In limited circumstances we may need to decline access, and we will explain why.
Wearable and device data
Connecting a wearable or a continuous glucose monitor is optional and within your control. You choose what to share, and you can disconnect or stop sharing at any time through the relevant app or by contacting us. Device data we hold becomes part of your clinical record and is handled under this policy.
Cookies, analytics and our website
Our website uses cookies and similar technologies to function and to understand how it is used, including analytics provided by third parties whose servers are located overseas. You can manage your preferences through the consent tool on the site and through your browser settings. Declining analytics cookies does not affect your ability to use the site or to complete the Performance Audit.
Young people
The program and the Performance Audit are intended for people aged 18 and over, and we do not knowingly collect information from anyone under 18 through them. If you believe we hold information about a young person that we should not, contact us and we will deal with it.
Complaints
If you have a concern about how we have handled your information, please contact us first at rohan@elementalprotocol.com.au and we will work to resolve it. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the effective date shown above.
Elemental Protocol, ABN 73 655 028 032, 17 Glen Osmond Road, Eastwood SA 5063. rohan@elementalprotocol.com.au