OA Coach — Privacy Policy

Effective date: 16 June 2026
Last updated: 16 June 2026

This Privacy Policy explains how the OA Coach mobile application ("OA Coach", "the App", "we", "us", "our") collects, uses, stores, discloses, and protects your personal information, including health information.

OA Coach is published and operated by Vulsen Pty Ltd (ABN 27 613 572 473) ("Vulsen"), a company registered in New South Wales, Australia, on behalf of The University of Sydney ("the University"). The App and its content are owned by the University, and OA Coach is used as part of research conducted by the University — the COASTAL randomised controlled trial (see "Research use" below). Vulsen operates the App and handles your information solely to provide and support the App on the University's behalf; Vulsen does not use your information for its own commercial purposes.

We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Health Records and Information Privacy Act 2002 (NSW) where applicable, and the requirements of any platform we integrate with, including Google.

By creating an account and using OA Coach, you agree to the collection and use of information in accordance with this Privacy Policy. Your participation in the research study is also governed by the separate Participant Information Statement and Consent Form provided to you.

1. Who we are and how to contact us

Vulsen operates OA Coach on behalf of the University, which is responsible for the COASTAL research and the data collected through the App.

• Privacy contact: Vulsen Pty Ltd (Attention: Privacy Officer)
• Email: info@vulsen.com

For matters relating to the research study, you may also contact the COASTAL study team at coastal.study@sydney.edu.au, or via the details in your Participant Information Statement (Coordinating Principal Investigator: Prof David Hunter, The University of Sydney).

2. What information we collect

2.1 Information you provide directly

• Account and registration information — such as your name, email address, login credentials, and demographic details you provide when setting up the App (such as age and sex).
• Self-reported health information entered in the App, which may include: information about your knee osteoarthritis you provide at set-up, pain scores (numerical rating scale), body weight, responses to surveys you complete in the App (including the Depression, Anxiety and Stress Scale (DASS-21) and the Pittsburgh Sleep Quality Index (PSQI)), and personal goals.
• Communications you send to us (for example, support requests or feedback).

2.2 Health and fitness information from the Google Health API

With your explicit authorisation, OA Coach connects to the Google Health API to read health and fitness data associated with your Fitbit or compatible Google account. We request read-only access only. We never add to, edit, or delete data in your Google or Fitbit account.

We request the following scopes and use the data as described:

You can review and revoke OA Coach's access to your Google Health data at any time (see Section 8).

2.3 Information collected automatically

• Device and technical information — such as device type, operating system, app version, and unique identifiers.
• Usage information — such as features used, notification interactions, and log data, used to operate and improve the App.

We do not collect precise location data through the App.

3. Google API Services — Limited Use

OA Coach's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Health API terms.

Specifically:

• We use Google Health API data only to provide and improve the user-facing features of OA Coach described in this policy, and only to operate the App on the University's behalf — not for any commercial purpose of our own.
• We do not sell this data.
• We do not use or transfer this data for advertising, including personalised, retargeted, or interest-based advertising.
• We do not use this data to train artificial intelligence or machine-learning models, to determine credit-worthiness, for lending purposes, to sell or provide to data brokers or information resellers, or to build databases or user profiles for advertising or other commercial purposes.
• We do not transfer this data to third parties, except: (i) to the University research team for the COASTAL trial as described in Section 4; (ii) to our hosting provider strictly as necessary to operate and secure the App, under confidentiality and data-protection obligations; or (iii) where required by law.
• We do not allow humans to read this data, except: (a) with your affirmative consent; (b) where necessary for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) where the data has been aggregated and de-identified, or is processed by the University research team for the COASTAL trial under your separate consent and ethics approval as described in Section 4.

A plain-language summary: OA Coach collects health and fitness data to enable personalised activity and sleep goals; behaviour-change notifications; and progress feedback for self-management of knee osteoarthritis.

4. How we use your information

We use your personal and health information to:

• Create and manage your account.
• Deliver the App's core features: personalised goals, just-in-time encouragement and call-to-action notifications, educational messages, dashboards, and progress feedback.
• Respond to your enquiries and provide support.
• Maintain the security, integrity, and performance of the App.
• Comply with our legal obligations.

Research use

OA Coach is used as part of the COASTAL randomised controlled trial (Comparison of Osteoarthritis Management Programs: remote versus face-to-face care), conducted by the University. The following applies:

• Your participation in research is voluntary and is governed by a separate Participant Information Statement and Consent Form (PIS), which describes in full what data is collected, how it is handled, and your rights as a research participant. This Privacy Policy summarises how the App handles your data; the PIS governs the study as a whole, including additional data the study may collect or link under separate consent (such as Medicare/PBS information through Services Australia).
• The trial is registered with the Australian New Zealand Clinical Trials Registry (ACTRN12624000996561) and is approved by the Northern Sydney Local Health District Human Research Ethics Committee (reference 2024/ETH01461, approved 3 September 2024).
• Data collected through the App is shared with the University research team for the purposes of the trial, under your consent and the ethics approval. Authorised members of the research team can access and export this data (for example, as a CSV file) via the secure research dashboard for analysis. Research data is managed on the University's secure systems (including REDCap and the University's Highly Protected SharePoint) and is stored within Australia.
• Sharing with your GP: with your permission, the research team may inform your GP or referring clinician of your participation and notify them of information relevant to your ongoing care.
• Sharing with other researchers: the research team may share study data with other researchers working on the study, in Australia and overseas, but only where it has been aggregated or coded so that you are not directly identifiable. All such research requires ethics approval.
• Future research: you may separately and optionally consent to your de-identified information being used in future research, as described in the PIS.
• Withdrawal: you may withdraw from the research at any time by contacting the study team at coastal.study@sydney.edu.au. Information already collected before you withdraw may be retained to preserve the integrity of the study results, as explained in the PIS.

5. Disclosure of your information

We do not sell your personal information. We disclose it only to:

• The University research team, for the purposes of the COASTAL trial, in accordance with your consent and the ethics approval described in Section 4.
• Your GP or referring clinician, where you have given permission, so they can be informed of your participation and any information relevant to your ongoing care.
• Other researchers working on the COASTAL study, in Australia and overseas, but only where the information has been aggregated or coded so that you are not directly identifiable, and always subject to ethics approval.
• Our cloud hosting provider, which provides the infrastructure on which the App's data is stored. Your data is hosted in a Sydney, Australia data centre and remains within Australia. The hosting provider acts as our infrastructure provider only; it does not access or use your data for its own purposes, and is bound by confidentiality and data-protection obligations.
• Authorities where required or authorised by law.

6. Data storage and security

We take the security of your information seriously and implement administrative, technical, and physical safeguards designed to protect it, including encryption in transit and at rest and role-based access controls. Your data is hosted on cloud infrastructure located in a Sydney, Australia data centre, and is stored and processed within Australia.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data retention

We retain your personal information only for as long as necessary to provide the App, to fulfil the purposes described in this policy, and to meet legal and research-governance obligations.

Active data collection for the COASTAL trial is anticipated to conclude on 31 March 2028. After the trial concludes, research data is retained in accordance with the trial's HREC-approved data management plan and the Australian Code for the Responsible Conduct of Research. Consistent with this study's requirements and the National Health and Medical Research Council's guidance for clinical trials, research data and consent forms are retained for a minimum of 15 years, after which they are securely destroyed — for example, by shredding hard-copy forms and permanently deleting electronic data.

Account and operational data not required for the research is deleted on your request, or within 30 days of account closure.

8. Your rights and choices

Subject to applicable law, you may:

• Access the personal information we hold about you.
• Correct information that is inaccurate, incomplete, or out of date.
• Request deletion of your account and associated personal data.
• Withdraw consent to data collection, including disconnecting the Google Health API integration.

To disconnect Google Health access, you can revoke OA Coach's permissions at any time within the App's settings and/or via your Google Account security settings at https://myaccount.google.com/permissions. Revoking access stops further data collection; features relying on that data will no longer function.

To exercise any of these rights, contact us at info@vulsen.com. We will respond within a reasonable period and in accordance with the APPs. (Note that withdrawal of research data is handled under your Participant Information Statement and Consent Form.)

9. Children

OA Coach is intended for adults aged 18 years and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with information, please contact us so we can delete it.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version in the App and update the "Last updated" date. Where changes are material, we will take reasonable steps to notify you. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.

11. Complaints

If you have a concern about how we have handled your personal information, please contact us first at info@vulsen.com so we can try to resolve it. You may also contact:

• The Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au — 1300 363 992
• For concerns about the conduct of the research: this study has been approved by the Northern Sydney Local Health District Human Research Ethics Committee (reference 2024/ETH01461; REGIS reference 2024/STE02739). Complaints can be directed to the Research Governance Manager at NSLHD-Research@health.nsw.gov.au or +61 2 9450 7089.