Get Blys Pty Ltd, Get Blys, Inc. and their related entities (together "Blys"). Version 2.0, effective 22 October 2026.

1. Purpose and scope

This policy explains how Blys stores, protects, retains and deletes personal information across the Blys platform and all of its services. It applies to every type of user (clients, recipients of services, providers, corporate and event clients, and visitors to our websites and apps) and to all Blys staff and contractors who handle personal information.

2. Information we hold

  • Account information: name, email, phone number, address and account preferences.
  • Booking information: service details, locations, booking notes, ratings, reviews and in-app messages.
  • Health and safety information: health intake answers, contraindications, waivers and consent forms needed to deliver a service safely.
  • Provider information: identity, qualifications, licences, background checks, insurance documents and payout details.
  • Payment information: processed by our payment partner Stripe. Blys does not store full card numbers.
  • Support and communications: emails, calls, chats and SMS with our support teams.
  • Technical data: device, log and usage data from our websites and apps.

3. How information is stored and protected

  • Data is stored in Blys systems hosted on Amazon Web Services (AWS) and in the Blys Google Workspace (Google Drive and Gmail), and with trusted service providers that support our platform (for example payments and communications).
  • Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
  • Access is role-based and limited to staff who need it to deliver or support a service.
  • Providers can only see the client details needed to complete a booking and must not copy, keep or use them outside the Blys platform.
  • Blys does not sell personal information.

4. Retention periods

Client and provider account data: While the account is active, then 7 years after the account is closed or last used

Booking records, ratings and in-app messages: 7 years from the booking date

Health intake forms, waivers and consent forms: 7 years from the service date (personal injury limitation periods and insurance claims)

Records for people under 18: Until they turn 25, or 7 years, whichever is longer

Provider verification documents (ID, licences, checks, insurance): While the provider is active, then 7 years after they leave the platform

Safety incidents and complaints: 7 years from closure of the matter

Payment, invoice and tax records: 7 years (tax and accounting requirements)

Support emails, calls and chats: 3 years from last contact

Marketing preferences: Until you unsubscribe, then only a suppression record

Technical and analytics logs: Up to 26 months

5. Deletion and destruction

At the end of the retention period, records are permanently deleted or de-identified in active systems, Google Drive and email archives, and purged from backups within 35 days. Paper records are cross-cut shredded. Records subject to a legal hold, safety incident, insurance claim or dispute are kept until the matter is resolved, then deleted on the normal schedule.

6. Corporate clients and events

This section applies in addition to the rest of this policy when Blys delivers services to a business, such as corporate wellness programs and onsite events.

  • Event waivers and health intake forms are kept for 7 years from the event date, then deleted.
  • Event participant lists are kept for 12 months after the event, then deleted.
  • Paper waivers, if used, are collected by the Blys event lead on the day, scanned within 2 business days and the paper copies shredded.
  • Providers may only view participant details during the event and may not copy, photograph or keep waivers or contact details.
  • Where the client supplies its own waiver or participant data, the client owns that record. Blys follows the client's retention instructions, returns or deletes copies on request and confirms deletion in writing.
  • Participant data is never used for marketing.

7. Your rights

You can request access to, correction of, or deletion of your personal information by emailing hello@getblys.com. We acknowledge requests within 5 business days and complete them within 30 days, except for records we must keep by law or for an open claim. Blys complies with applicable privacy laws in the markets where we operate, including the Australian Privacy Act 1988, the NZ Privacy Act 2020, UK and EU GDPR, Canada PIPEDA and US state privacy laws such as CCPA/CPRA.

8. Data breaches

Report any suspected privacy or security incident to us at hello@getblys.com. We investigate immediately. Affected users are notified without undue delay and within the timeframes required by law.

9. Contact us

Questions about this policy or your personal information? Email hello@getblys.com.

10. Review

This policy is reviewed at least annually, or earlier if laws or our systems change.