Privacy Policy

 Last Updated 3rd June 2026

MAXM Skate Pty Ltd ACN 161 034 939 (we, us, our) carry on business providing knee rehabilitation apparatus with integrated Bluetooth sensors (Devices) to assist in patient recovery. We also provide individuals (who use the Devices) with information regarding knee rehabilitation exercises and techniques, live data and real-time feedback regarding their use of the Devices, and other products and services from time to time (Services). The Devices and Services are made available through our website located at https://www.maxm.com.au/ (Website), our mobile application known as ‘MAXM Skate’ which is available on the Apple App Store or the Google Play Store, social media accounts, and any other platforms and software which may be provided by us from time to time (collectively, the Platforms).

This Privacy Policy sets out our, and our employees, agents, contractors, affiliates and any other related parties’ practices in relation to the collection, use, disclosure and handling of the personal information (as defined under the Privacy Act) and sensitive information (as defined in clause 4 of this Privacy Policy and the Privacy Act) of anyone who interacts with us in relation to our Services (you and your) in connection with the provision of our Devices, Platforms and Services to you (collectively, Personal Information), as well as in connection with any direct communication between you and us. We are the controller of (and are responsible for) your Personal Information.

This Privacy Policy should be read in conjunction with our Terms of Service, available via this link: [https://www.maxm.com.au/terms-conditions/] (Terms of Service), and any agreements you have entered into with us (if applicable).

 

1 SCOPE

(a) Your privacy is important to us, and we respect your Personal Information. We are committed to maintaining the highest standards to protect your Personal Information provided to us in line with this Privacy Policy.

(b) We comply with the Privacy Act 1988 (Cth) (Privacy Act) and Australian Privacy Principles and (if applicable) General Data Protection Regulation (EU) 2016/679 (GDPR) and/or the Data Protection Act 2018 (UK), “UK GDPR” (as defined in the Data Protection, Privacy and Electronic Communications Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations SI 2019/419) (UK GDPR), Privacy Act 2020 (NZ) (NZ Privacy Act), Personal Data Protection Act 2012 (Singapore Privacy Act), Health Insurance Portability and Accountability Act of 1996 (HIPAA), Privacy Act of 1974 (US Privacy Act), California Consumer Privacy Act (CCPA), California Privacy Rights Act 2020, and any other national laws and regulations applicable to you (collectively, the Applicable Privacy Laws).

(c) It is important that you read this Privacy Policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing Personal Information about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and privacy policies and is not intended to override them.

(d) We use third parties located both locally and overseas in addition to our own resources to provide the Devices, Services and Platforms.

2 COLLECTION OF PERSONAL INFORMATION

(a) The Personal Information that we may collect and hold in the course of providing the Devices, Platforms, and/or Services includes (but is not limited to):

(i) Personal Details – personal details such as an individual’s name, location, profile picture, date of birth and, nationality and other identification details (e.g. passport or driver’s licence) allowing us to identify who the individual is;

(ii) Contact Information – information such as an individual’s email address, telephone and fax number, geo-location, Internet Protocol (IP) address, unique device identifiers, mobile number, personal device model and name, operating system, browser type third party user names, residential, business and postal address and other information that allows us to contact an individual, or their healthcare provider, physiotherapist, hospital, and/or surgeon (as applicable);

(iii) User Account Credentials – your usernames, account numbers, security codes or passwords when you access our Platforms and/or Services;

(iv) Health Information – information such as the health conditions, illness, disability or injury of an individual;

(v) Financial Information – financial information such as any bank or credit card details used to transact with us and other information that allows us to transact with the individual and/or provide them with our Devices, Platforms, and/or Services;

(vi) Personal Device Information – details about the mobile phone, tablet, laptop, desktop computer or other personal device you use to access our Platforms and/or Services, such as device model and name, your operating system, your browser type, third-party user names, your Internet Protocol (IP) address or other online or device identifiers;

(vii) Technical Information – technical information about an individual and businesses in connection with the Devices, Platforms and/or Services (e.g. Bluetooth pairing information, session login timestamps, duration data, and crash reports); and

(viii) Statistical Information – statistical information about an individual and businesses in connection with the Devices, Platforms and/or Services (e.g. range of motion (ROM) measurements, pain scores, and repetition counts).

(b) We may also collect some information that is not Personal Information because it does not identify you or anyone else. For example, we may collect aggregated information about how users use our Devices, Platforms and/or Services.

(c) When collecting Personal Information from you, we may collect it at various stages, including (but not limited to):

(i) through your access and use of our Devices, Platforms, and/or Services;

(ii) when you register for an account through our Platforms;

(iii) via any one-time password (OTP) authentication processes on our Platforms;

(iv) when you contact us via our social media pages;

(v) when you contact us with an enquiry or complaint in relation to our Devices, Platforms, and/or Services;

(vi) when authorised people (such as any third-party OAuth providers) provide us with your Personal Information on your behalf;

(vii) when you attend one of our events; and

(viii) when you apply for a job with us.

(d) We may also collect Personal Information from third parties including data analysis agencies.

(e) When we provide you with the Platforms and Services, or when we are responding to your queries, we may collect your Personal Information using mandatory fields. If you elect not to respond to the mandatory fields, we may be unable to respond to your request.

3 PURPOSES FOR COLLECTING, HOLDING, USING AND DISCLOSING YOUR PERSONAL INFORMATION

(a) We only collect Personal Information from you which is necessary to carry out the following actions:

(i) to enable you to use our Platforms;

(ii) to provide our Services and ensure third parties are able to provide similar services to you;

(iii) to communicate with you, including about our Services and offers which might interest you;

(iv) to provide you with information or advice;

(v) to undertake research in relation to (and to improve) our Services;

(vi) to process payments by or to you in connection with our Services;

(vii) to create accounts, tax invoices or receipts;

(viii) to provide your Personal Information to third parties in order for them to supply the Services to you, or to undertake research in relation to (and to improve) our Services;

(ix) to consider and respond to complaints made by you;

(x) to consider an application for employment with us;

(xi) to perform identification and security checks; and

(xii) to comply with our legal and regulatory obligations.

(b) We may disclose additional purposes for collection of your Personal Information in collection statements at the point of collection.

(c) We may also perform identity verification using names, emails, date of birth, phone numbers, payment information, and third party wallets, to help prevent use of our Services by fraudulent accounts.

(d) We will immediately remove your Personal Information from our database if requested by you. We will do this in accordance with our policy on destroying Personal Information (see clause 14), in order to keep your information secure.

(e) Where possible, we will give you the option of not identifying yourself or of using a pseudonym. We may not always be able to interact with you in this manner, especially where it is required by law to identify you before providing certain information. In general, we will not be able to assist you anonymously or where you are using a pseudonym when it is impractical or we are required or authorised by law or a court/tribunal order to deal with you personally.

4 SENSITIVE INFORMATION

(a) Sensitive information is information about you that reveals your health details, racial or ethnic origin, political opinions, religious or philosophical beliefs or affiliations, membership of a professional or trade association, membership of a trade union, disability, sexual orientation or criminal record (Sensitive Information).

(b) It is our policy to only collect your Sensitive Information where it is reasonably necessary for our functions or activities and either you have consented or we are required or authorised under law to do so. We will not use your Sensitive Information for direct marketing purposes.

5 DE-IDENTIFIED INFORMATION

(a) We may use your Personal Information in de-identified form (de-identification being a process by which a collection of data or information is altered to remove or obscure personal identifiers and Personal Information) to assist us in running our business (such as for clinical research or safety compliance purposes). We may also provide, including by way of sale, de-identified information in aggregated form, to third parties.

(b) When your Personal Information is included in de-identified, aggregated data, it is not possible to identify you or anything about you from that data.

6 DIRECT MARKETING

(a) By accepting the Terms of Service, and providing us with your Personal Information, you consent to us and/or our carefully selected third party business providers sending you direct marketing communications by any of the methods listed below (see clause 8(d)). If you indicate a preference for a method of communication, we will endeavour to use that method whenever practical to do so.

(b) In addition, at any time you may opt out of receiving marketing communications from us by contacting us (see contact details below) or by using opt out facilities provided in the marketing communications, and we will then ensure that your name is removed from our mailing list.

(c) Please note that by opting out of receiving marketing communications, you may still receive communications from us (such as invoices and notices) in relation to the Devices, Platforms and/or Services.

(d) If an individual believes that they have received information from us that they opted out of receiving, they should contact us on the contact details set out in clause 24.

7 DISCLOSURE TO OVERSEAS RECIPIENTS

(a) We may disclose your Personal Information to our related bodies corporate, third party suppliers (e.g. international distributors of our Devices), service providers, government and quasi-governmental organisations, prospective purchasers of part or whole of our business and stock exchanges located overseas for some of the purposes listed below (see clause 8(d)).

(b) We will take reasonable steps to limit the amount of Personal Information disclosed to overseas recipients and ensure that the overseas recipients of your Personal Information do not breach the privacy obligations relating to your Personal Information.

8 DISCLOSURE OF PERSONAL INFORMATION

(a) We may disclose your Personal Information to the following recipients (taking reasonable steps to ensure that recipients of your Personal Information do not breach the privacy obligations relating to your Personal Information):

(i) our employees, related bodies corporate, contractors, or service providers for the purposes of operating our Devices, Platforms, or our business, fulfilling requests by you, and to otherwise provide the Services to you including, without limitation, web hosting providers, IT systems administrators, mailing houses, couriers, payment processors, data entry service providers, electronic network administrators, debt collectors, archivists and professional advisors such as accountants, solicitors, business advisors and consultants;

(ii) third parties with whom we have commercial relationships, for business, marketing, and related purposes;

(iii) government and regulatory bodies and law enforcement agencies; and

(iv) any other organisation for any authorised purpose with your express consent, including your insurers and your solicitors.

(b) We will not use any Personal Information other than for the purpose for which it was collected other than with the individual’s permission or as otherwise outlined in this Privacy Policy, unless we reasonably consider that we need to use it for another reason and that reason is compatible with, or directly related to, the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with or directly related to the original purpose, please contact us.

(c) Most commonly, we will use your Personal Information in the following circumstances:

(i) where we need to perform the contract we are about to enter into or have entered into with you;

(ii) where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and

(iii) where we need to comply with a legal obligation.

We have set out below a description of the ways we plan to use your Personal Information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your Personal Information for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your Personal Information where more than one ground has been set out in the table below.

Purpose Personal Information Legal Basis (pursuant to GDPR and UK GDPR)

Creating an account with us. • Contact and personal details such as name, address and email address. Our legitimate interests in providing the Platforms and Services to you.

Processing and completing transactions. • Contact and account details.

• Financial information including bank card details. Our legitimate interests in providing the Devices, Platforms and Services to you.

Our performance of a contract when you purchase the Devices and/or Services.

Requesting feedback in regard to our Devices, Platforms, Services, or other companies, and other news and promotions we think will be of interest to you. • Contact and account details. Our legitimate interests in providing the Devices, Platforms, and Services to you and informing you of products we believe will be of interest to you.

To monitor and analyse exercise and rehabilitation progress (and generate statistics and reports) relating to use of the Devices, Platforms and Services. • Statistical data such as range of motion (ROM) data, pain scores, and repetition counts.

• Usage data. Our legitimate interests in providing the Devices, Platforms, and Services to you.

Responding to your emails, questions, comments, requests and complaints for customer service. • Contact and account details. Our legitimate interests in providing support services to you.

To monitor and analyse usage and trends in relation to the Devices, Platforms and Services. • Contact and account details.

• Technical data such as cookies and IP addresses.

• Usage data. Our legitimate interests in monitoring our Devices, Platforms and Services to improve and analyse the same.

To perform analytics and to increase the functionality, market profile and user friendliness of the Devices, Platforms and Services. • Contact and account details.

• Technical data such as cookies and IP addresses.

• Personal device information.

• Usage data.

• De-identified Personal Information. Our legitimate interests in monitoring our Devices, Platforms and Services to improve and analyse the same.

Investigating and preventing fraudulent transactions and other illegal activities. • Contact and account details.

• Personal device information.

• Financial and payment information. Performance of our legal obligations.

To send notifications regarding important changes to our Devices, Platforms, and/or the Services. • Contact and account details. Our legitimate interests in informing you of any changes to our Devices, Platforms, and/or the Services.

To send you confirmations, updates, security alerts, additional information about our Devices, Platforms, Services and support, and otherwise assist with your use of the same. • Contact and account details. Our legitimate interests in informing you of any alerts and information regarding your account, the Devices, Platforms and/or the Services.

Where you have provided your express consent to receive direct marketing from us (in accordance with clause 6 of this Privacy Policy), you can withdraw your consent to receive direct marketing at any time.

(d) We will retain Personal Information for the following periods:

(i) if you have registered for a user account on the Platforms, indefinitely; or

(ii) if you have not registered for a user account on the Platforms (and are using the Services anonymously), for a period of 90 days.

(e) For the avoidance of doubt, we will retain Personal Information in de-identified form for a period of 7 years from the collection of such information, for business purposes.

(f) Personal Information submitted by a user into any artificial intelligence chatbot on the Platforms is not retained after a response is generated, and this information is not used to train artificial intelligence models, ensuring your privacy and confidentiality are maintained in accordance with this Privacy Policy.

(g) Subject to clause 17, we will not sell or otherwise provide or share an individual’s Personal Information to unrelated third parties unless:

(i) you consent to the sharing of your Personal Information, and you have not withdrawn your consent; and/or

(ii) in connection with, or during negotiations of any merger, sale, financing or acquisition of our assets or IPO or sale of shares where this information may be disclosed or transferred as one of our business assets.

(h) There are some circumstances in which we must disclose an individual’s information:

(i) where we reasonably believe that an individual may be engaged in fraudulent, deceptive or unlawful activity that a governmental authority should be made aware of;

(ii) where we need to prevent a serious threat to the life, health or safety of any individual, or to public health or safety;

(iii) to enforce or apply this Privacy Policy, or our terms, conditions and policies and/or agreements;

(iv) as required by any law; and/or

(v) in order to sell our business (in that we may need to transfer Personal Information to a new owner).

(i) If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

(j) Please note that we may process your Personal Information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9 ACCESS TO PERSONAL INFORMATION

(a) If you would like us to update or amend your Personal Information, please contact us on the contact details set out in clause 24 and we will make the requested amendments.

(b) We may ask you to verify your identity to ensure that Personal Information we hold is not improperly accessed.

(c) You will be able to access Personal Information that we hold about you if it can be readily retrieved, subject to some exceptions allowed by law. Where we hold information that you are entitled to access, we will try to provide you with a suitable means of accessing it (for example, by mailing or emailing it to you).

(d) To request access to your Personal Information, please contact us in writing. We may charge you a reasonable fee to cover our administrative and other reasonable costs in providing the information to you. We will not charge you for simply making the request and will not charge for making any corrections to your Personal Information.

(e) There may be instances where we cannot grant you access to the Personal Information we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality. In these instances, we will provide written reasons for any refusal.

10 UPDATING PERSONAL DETAILS

(a) We take reasonable steps to ensure that your Personal Information is up-to-date whenever we collect it or use it. This may include, for example, using data obtained from third parties to verify the accuracy of your Personal Information.

(b) If you find that current Personal Information we hold about you is inaccurate, incomplete or out-of-date, please contact us immediately and we will take reasonable steps to correct it.

11 INABILITY TO COLLECT PERSONAL INFORMATION

If you do not provide us with the Personal Information described above (see clause 2), some or all of the following may happen:

(a) we may not be able to provide the requested Devices, Platforms and/or Services to you, either to the same standard as if we did have access to Personal Information, or at all;

(b) we may not be able to process any third party discounts or benefits;

(c) we may not be able to notify you of any updates to our Privacy Policy and/or Terms of Service;

(d) we may not be able to provide you with information about the Devices, Platforms and/or Services that you may want, including information about discounts, sales or special promotions; or

(e) we may not be able to tailor the content of the Devices, Platforms and/or Services to your preferences, and your experience of the same may not be as enjoyable or useful.

12 COOKIES

We may use temporary (session) cookies or permanent cookies when you access our Platforms and/or Services. This allows us to recognise your browser and track the web pages you have visited. Some of these cookies also help improve your user experience on our Website, assist with navigation and your ability to provide feedback and assist with our promotional and marketing efforts. You can switch off cookies by adjusting the settings on your web browser.

13 SECURE STORAGE OF PERSONAL INFORMATION

(a) We take reasonable steps to ensure we protect any Personal Information that we hold from misuse, loss and unauthorised access, modification and disclosure, and review our security practices relating to Personal Information on an ongoing basis.

(b) Your Personal Information may be stored in hard copy documents and electronically.

(c) We maintain physical and electronic security over our paper and electronic data storage. We also maintain computer and network security. For example, we use firewalls (security measures for the Internet) and other systems such as user identifiers and passwords to control access to computer systems.

(d) Although we take reasonable steps to maintain the security of our Internet connections, for reasons outside of our control, information transmitted to us over the Internet may not be absolutely secure. We assume no responsibility for disclosure of data due to errors in transmission.

(e) If we become aware that any of your Personal Information has been accessed by an unauthorised party (Data Breach), we will notify you (and any supervisory authority as required) of the Data Breach as soon as practicable after we become aware of such breach.

(f) We are not liable for any loss, damage or claim arising out of another person’s use of the Personal Information where we were authorised to provide that person with the Personal Information.

(g) If an individual suspects any misuse or loss of, or unauthorised access to, their Personal Information, they should let us know immediately.

14 DELETION OF PERSONAL INFORMATION

(a) If the Personal Information we collect is no longer needed for any purposes and we are not required by law to retain it, we have procedures in place to ensure that any document or record containing your personal or health information is destroyed or de-identified in a manner that preserves your privacy.

(b) We will immediately remove your Personal Information from our database if requested by you.

(c) Where you have registered for a user account on our Platforms, you may be able to delete Personal Information yourself by navigating to the settings of the relevant Platform (after which the Personal Information will be either deleted or de-identified).

(d) If you have not registered for a user account on our Platforms, Personal Information will be deleted or de-identified after 90 days of inactivity.

15 THIRD PARTY WEBSITES

(a) Our Platforms may contain links to other mobile applications or websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third party mobile applications or websites and we are not responsible, or in any way liable, for the privacy policies or the content of any third party mobile applications or websites. Third party mobile applications or websites are responsible for informing you about their own privacy practices.

(b) We take precautions to protect your Personal Information collected through our Devices, Platforms and/or Services, but in the event that our system is infiltrated by unauthorised third parties, we will not be liable for any resulting misuse of Personal Information.

16 CONNECTING VIA SOCIAL NETWORKS

(a) You may be able to access the Platforms and/or Services by signing into social networks such as Facebook or an Open ID provider. Providers such as Facebook provide the option of posting and sharing information with others within your social network. If you stop using the network from which you signed in to use the Platforms and/or Services, you agree that we will still retain the personally identifiable information from the social network that you provided us access to in accordance with this Privacy Policy.

(b) Social media features such as the Facebook “like” and “share” buttons and widgets and interactive mini-programs which run within the Platforms and/or Services may collect your IP address and set a cookie to enable the feature to function properly. Your interaction with these features is under the Privacy Policy of the company providing them.

17 RIGHT TO BE FORGOTTEN

In the event that you decide that you no longer want us to hold your Personal Information, you may notify us in writing on the contact details set out in clause 24 of your desire for us to delete your Personal Information on record. We will use our best endeavours and comply with all legal requirements within a reasonable timeframe to delete your Personal Information, unless we are required by law to retain such information.

18 LINKS

Links from our Platforms or via our Services to third party services that we do not operate or control are provided for your convenience. We are not responsible for the privacy or security practices of services that are not covered by this Privacy Policy. Third party services should have their own privacy and security policies which we encourage you to read before supplying any Personal Information to them.

19 FOREIGN LAWS

(a) Any reference to Personal Information in this Privacy Policy is also a reference to Personal Data (as defined under the GDPR, Singapore Privacy Act, or the UK GDPR), Personal Information (as defined under the NZ Privacy Act and US Privacy Act), Protected Health Information (as defined under HIPAA), and any other equivalent terms under other Applicable Privacy Laws.

(b) We take the security and privacy of your Personal Information seriously and we have prepared this Privacy Policy and taken measures to collect, process and hold all Personal Information in compliance with the Applicable Privacy Laws regardless of the user.

(c) We have set out below a summary of the rights you have in relation to your Personal Information, depending on the country you are based. Please note that the list of countries provided is non-exhaustive, and you should contact us if you require further information regarding your rights under the specific Applicable Privacy Laws in your country.