How Serene Co Pty Ltd collects, holds, uses and discloses personal information, including the information it holds on behalf of the clinics that use its software.
Effective date: 1 February 2026
Last updated: 13 October 2026
Serene Co Pty Ltd ABN 34 697 561 443 trading as Serene (“we”, “us” or “our”) provides point-of-sale, customer relationship management, marketing and related software, websites, mobile applications, APIs and support services (collectively, the “Services”).
This Privacy Policy explains how we collect, hold, use and disclose personal information. It applies to:
We are an organisation covered by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).
This policy is a notice about our information-handling practices. It is not intended to obtain consent for unrelated uses of personal information.
“Customer” means a business or organisation that subscribes to or uses the Services. “Customer Data” means information that a Customer or its authorised users enter, import, connect, generate or otherwise process through the Services.
A Customer generally decides why it collects Customer Data and how it will use that information. We usually handle Customer Data to:
The Customer is responsible for providing appropriate collection notices and obtaining any consent or other authority required for its activities. This does not limit any independent privacy obligations that apply to us.
If your information was collected by one of our Customers (for example, a retailer, service provider or loyalty program), you should normally direct your initial privacy request to that Customer. We will reasonably assist the Customer and will respond directly where required by law.
Where we determine the purpose of handling information, including for our account administration, billing, security, support and legal compliance, we are responsible for that handling.
Depending on the Services used and their configuration, we may collect and hold the following information.
Full payment card details are sent directly to our payment provider and are not stored by us. Our current payment provider is Stripe (stripe.com/au/privacy).
We may receive information from Customer-selected payment, ecommerce, accounting, communications, calendar, advertising, social media or other systems. The information received depends on the integration and permissions configured by the Customer.
Customer Data may contain sensitive information, for example information in CRM notes, custom fields, attachments or transaction histories that reveals health information, racial or ethnic origin, religious beliefs, sexual orientation, biometrics or other sensitive matters.
We only intentionally collect sensitive information where it is reasonably necessary and the individual has consented, or where collection is otherwise permitted by law. Customers should not enter sensitive information unless the Services are intended and configured for it and they have appropriate authority.
Where we hold sensitive information, we apply safeguards appropriate to its sensitivity and comply with the obligations that apply to us.
We may also collect information about suppliers, contractors, professional contacts and job applicants, including qualifications, employment history, references and application records.
We may collect personal information:
Where practical, we provide collection notices at or before the relevant collection point.
If you provide information about another person, you must have appropriate authority to do so and, where required, ensure the person is aware of this policy.
You may interact with us anonymously or using a pseudonym where lawful and practical, such as when browsing our public website or making a general enquiry. We will generally need identifying information to create an account, process a transaction, provide support or respond to a privacy request.
If required information is not provided, we may be unable to create an account, complete a transaction, deliver a requested feature or resolve an enquiry.
We may collect, hold, use and disclose personal information to:
We will not use Customer Data to market our own products directly to a Customer’s consumers unless the Customer and, where required, the individual have authorised that use.
We generally use personal information for the purpose for which it was collected or for a related purpose the individual would reasonably expect. We may use it for another purpose where the individual consents or the use is otherwise permitted or required by law.
We may send information about our products, events and services where the recipient has consented or where the communication is otherwise permitted by law.
Our commercial electronic messages will identify the sender and include a simple unsubscribe method. We will action email and SMS unsubscribe requests within five working days or any shorter period required by law.
You may also:
We may retain a minimal suppression record to ensure that a marketing opt-out continues to be honoured.
Opting out of marketing does not prevent us from sending necessary account, transaction, security or service messages.
Customers use our Services to select recipients and send campaigns. The Customer normally determines the message, sender, recipients and purpose.
Customers are responsible for maintaining required consent and sender information and for using lawfully obtained recipient lists. We provide features intended to manage subscriptions, consent records and unsubscribe requests.
If you receive an unwanted campaign sent through the Services, use the unsubscribe facility in the message or contact the identified sender. You may also contact us at hello@theserene.app, and we will investigate and assist as appropriate.
We and our service providers may use:
Our marketing features may use tracking pixels or tagged links to inform a Customer whether a message was delivered, opened or clicked.
You can manage non-essential technologies through your browser or device settings. Blocking some technologies may affect functionality.
Where enabled, some Services may use automated tools to create segments, recommendations, lead scores, fraud indicators, summaries or generated content.
AI-enabled features may process bookings, sales and client records using a third-party AI model provider. Customer Data is not used to train shared models.
Customers decide whether to enable these features and how to use their outputs. Automated outputs may be incomplete or incorrect and should be reviewed appropriately.
As at the “Last updated” date, the following disclosures apply to automated decisions that could reasonably be expected to significantly affect an individual’s rights or interests:
A Customer may independently use reports, scores or outputs when making decisions. Questions about a Customer’s decision should normally be directed to that Customer. We will assist where appropriate and explain any review process available for decisions made by us.
We may disclose personal information to:
A current list of our service providers and subprocessors is available on request from hello@theserene.app.
We require contracted providers to handle information only for authorised purposes and to apply appropriate privacy and security safeguards.
We do not sell personal information or disclose it to unrelated parties for their own advertising.
We are likely to disclose personal information to, or allow it to be accessed by, recipients located in:
Australia
This may include locations used for hosting, backups, technical support, communications, analytics, security or other subprocessors.
Before disclosing personal information overseas, we take reasonable steps required by the APPs to ensure that the recipient handles it appropriately, unless a legal exception applies. These steps may include due diligence, contractual protections, access controls and security reviews.
Customer-selected integrations may process information in additional countries chosen by the Customer. Customers should review the integration provider’s privacy terms before enabling an integration.
We use reasonable technical and organisational measures appropriate to the volume, sensitivity and risks associated with the information we hold.
Our safeguards include:
No method of storage or transmission is completely secure. Individuals and Customers should protect account credentials, use available security controls and promptly report suspected unauthorised access.
We maintain procedures to contain, assess, remediate and review suspected data breaches.
Where we suspect an eligible data breach under the Notifiable Data Breaches scheme, we will take all reasonable steps to complete the required assessment within 30 calendar days. Where notification is required, we will notify affected individuals and the Office of the Australian Information Commissioner (“OAIC”) as soon as practicable.
If an incident involves Customer Data, we will also notify and coordinate with the relevant Customer in accordance with our contract and applicable law.
We retain personal information only for as long as reasonably needed for the purposes described in this policy, to meet contractual commitments, resolve disputes or comply with legal obligations.
Our usual retention periods are:
Information may be retained longer where required by law, subject to a legal hold, or reasonably needed for fraud prevention, security or legal claims.
When personal information is no longer required for a permitted purpose, we take reasonable steps to destroy it or ensure it is appropriately de-identified. Deleted information may remain in protected backups until those backups are securely cycled out.
You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
Send requests to hello@theserene.app. We may ask for information needed to verify your identity or authority and to locate the relevant records.
We aim to respond within a reasonable period, ordinarily within 30 calendar days. There is no charge for making a request. If reasonable access costs apply, we will explain them in advance.
In some circumstances, the law permits or requires us to refuse access or correction. Where required, we will provide written reasons and explain how to complain.
You may also ask us to:
These requests are subject to applicable legal, contractual, security and record-retention requirements.
For Customer Data, contact the relevant Customer first where practical. We will assist the Customer or handle the request directly where required.
You may make a privacy complaint by contacting our Privacy Officer:
Email:hello@theserene.app
Post: Privacy Officer, Serene Co Pty Ltd, 7 Elfrida Street, Mosman NSW 2088
Please describe:
We will acknowledge the complaint, investigate it fairly and aim to provide a written response within 30 calendar days. If we need more time, we will explain why and provide an expected response date.
If a complaint concerns Customer Data, we may need to coordinate with the relevant Customer while protecting the privacy of everyone involved.
If you are not satisfied with our response, or we do not respond within 30 days, you may complain to the Office of the Australian Information Commissioner:
Website:www.oaic.gov.au
Telephone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001
An approved external dispute-resolution scheme or state or territory privacy regulator may also be available, depending on the service and information involved.
The Services are business tools and are not intended for children to create administrator accounts. Account users must be 18 years or older or otherwise authorised by a Customer.
Customers may lawfully use the Services to hold information about younger consumers. Where this occurs, the Customer must provide appropriate notices and obtain consent from a person with capacity or from a parent or guardian where required. We will comply with the obligations that apply independently to us.
A child, young person, parent or guardian may contact hello@theserene.app about information held through the Services.
The Services may link to or integrate with third-party applications, payment services, websites or platforms. Those parties may independently collect and handle information under their own privacy policies.
Enabling a Customer-selected integration authorises us to exchange the information required to operate that integration. Customers should review the third party’s privacy and security practices before enabling it.
We may update this policy when our Services, information-handling practices or legal obligations change.
The updated policy will show a revised “Last updated” date. We will provide additional notice of material changes through the Services, by email or on our website where appropriate.
A policy update does not, by itself, obtain consent for a materially new use where consent is required.
Privacy Officer
Serene Co Pty Ltd
ABN 34 697 561 443
7 Elfrida Street, Mosman NSW 2088
You may request this policy in an alternative accessible format by contacting the Privacy Officer.
