Privacy Policy

Rogue Jujitsu Pty Ltd · ACN 672 149 316 · ABN 42 672 149 316
G06/253 Northbourne Avenue, Lyneham ACT 2602
roguebjjstudios@gmail.com · 0416 264 647
Last updated: 22 September 2026

1. About this policy

Rogue Jujitsu Pty Ltd — “we”, “us”, “our”, or “the Studio” — is committed to protecting the privacy of our members, trial participants, visitors, guests, and other people whose personal information we hold.

This policy explains how we collect, use, disclose, store and otherwise handle personal information, including sensitive information such as health information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Because we collect health information about participants, we are a health service provider for the purposes of the Privacy Act, and we are bound by the Australian Privacy Principles regardless of our annual turnover. Some small businesses are exempt. We are not, and we would not want to be.

By training with us, signing our Participation Waiver, or otherwise giving us your personal information, you consent to us handling it as described here.

We may update this policy from time to time. The current version is always available at the studio and on this page, and we will tell you about material changes.

2. What we collect

We collect personal information that is reasonably necessary for running the club. That means:

• Identity information — full name, date of birth, and photographs where you have separately consented under our Photography and Media Consent.
• Contact information — residential address, phone number, email address.
• Health information — medical history, current injuries or physical limitations, medications relevant to training safety, fitness assessments, and any other health information disclosed in the Participation Waiver or during training.
• Emergency contact information — the name, relationship and phone number of the person you nominate.
• Participation records — membership type (member, trial or visitor), attendance, training history, and signed waivers and consents held in our member app.
• Financial information — payment details for membership and visitor fees, processed through our payment provider. We do not store full card details.
• Information about under-18s — where a participant is under 18, the name, date of birth and contact details of their parent or guardian, and any health information relevant to the child’s safe participation.
• Communications — records of correspondence between you and the Studio.

We do not collect sensitive information other than health information, and we do not collect health information beyond what is reasonably necessary to deliver BJJ training safely.

3. How we collect it

We collect personal information directly from you:

• through the Participation Waiver, completed and signed before your first session;
• through membership and visitor registration;
• through what you tell a coach during training;
• through the contact forms on this website, or by email; and
• through payment processing when a fee is paid.

We collect health information only with your consent, unless the law requires or authorises us to collect it another way.

Where you give us information about someone else — an emergency contact, or a child — you confirm you have their consent to do so, or are entitled to act on their behalf.

If you do not give us the information we ask for, we may not be able to let you train. Health information and emergency contact details in particular exist for your safety, not our convenience.

4. Why we collect it

• Safety and risk management — working out whether someone is fit to train, knowing about relevant conditions or injuries, and responding if there is a medical emergency on the mat.
• Running the club — managing memberships, scheduling classes, processing payments, and talking to you about your training.
• Legal compliance — meeting our obligations under the Privacy Act, the Civil Law (Wrongs) Act 2002 (ACT) and other applicable laws, and keeping records the law requires.
• Waiver and consent records — holding signed waivers and consents in the member app.
• Communication — about your membership, the timetable, and club news. You can opt out of anything non-essential at any time.
• Improving what we do — looking at participation patterns and feedback, using de-identified information wherever we can.

We will not use your personal information for any other purpose without your consent, unless the law requires or authorises it.

We will never use your health information for marketing.

5. Who we disclose it to

• Emergency services — ambulance, hospital or other emergency medical personnel, if you are injured or unwell during training and cannot speak for yourself.
• Medical practitioners — where you have consented, or where it is necessary to prevent a serious threat to someone’s life, health or safety.
• Service providers — the businesses that help us operate, including our member app provider, our payment processor and our cloud hosting provider. Each is required to handle your information in line with applicable privacy laws.
• Insurers — where a claim arises out of your participation.
• Regulators and law enforcement — where the law requires or authorises it.

We do not sell, rent or trade your personal information to anybody, for marketing or for anything else.

Overseas recipients

Some of our service providers operate infrastructure outside Australia, principally in the United States and, for email delivery, Japan. Personal information we hold — including contact details, membership records, and in some cases health information — is disclosed to, or accessible by, these providers:

• Google LLC (United States) — we use a Gmail account for general enquiries and correspondence. Emails sent to us, which may contain names, contact details and health information, are stored on Google’s servers in the United States.
• Momence Inc (United States) — our studio management platform, where we manage bookings, memberships and payments.
• Google LLC (United States) — the contact page embeds a Google map of the studio. Your browser requests that map from Google when the page loads, which tells Google your IP address, the page you are on and whatever its own cookies already identify about you. We do not receive any of that. If you would rather not load it, the address is written out on the page in text and the map is not needed to find us.
• Cloudflare Inc (United States) — our website infrastructure provider, which processes submissions from the forms on this site.
• Resend (Plus Five Five, Inc.) (United States) — our email delivery provider. When you send us a message through a form on this site, what you type is passed to Resend so that it can be delivered to us as an email. Mail for this domain is sent through Resend’s Tokyo region, so it is handled in Japan on the way. The website itself does not keep your submission — it is passed straight through, and the copy that remains is the email in our Gmail account.

Before disclosing personal information to these providers we take reasonable steps under Australian Privacy Principle 8.1 to ensure they handle it consistently with the Australian Privacy Principles. We should be straight with you about the limit of that: these companies are subject to the law of the countries they operate in — principally the United States, and Japan where our email is delivered — which differs from Australian privacy law, and the Australian Privacy Principles may not apply to how they handle your information once it reaches them. If that concerns you, talk to us.

6. Health information

Health information is sensitive information under the Privacy Act and gets a higher level of protection. We treat it that way.

• We collect it only where it is reasonably necessary to deliver training safely, and only with your consent, given through the Participation Waiver.
• It is accessible only to the coaches and staff who need it to keep you safe and to run the class.
• We do not disclose it to anybody except as described in section 5 for emergencies and medical practitioners.
• It is stored securely in the member app, and used for nothing beyond safety and legal compliance.

7. Photography and media

Photography and filming are governed by our separate Photography and Media Consent, which is given per person and can be changed or withdrawn at any time.

We do not photograph or film anyone, or use their image in promotional, instructional or any other material, without a current consent from that person — or, for a child, from their parent or guardian.

Training here and signing the waiver do not amount to consent to being photographed or filmed. The two are kept deliberately separate.

8. Storage and security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure, as Australian Privacy Principle 11 requires.

Information is stored electronically in our member app and its cloud infrastructure, and we require our providers to maintain appropriate security standards. Inside the club, access is restricted to the people who need it for their role.

We keep personal information for as long as it is needed, or as long as the law requires. Signed waivers are kept for at least seven years from signing — or, for a participant who was under 18, until they turn 25, whichever is later. That is so the records exist if a personal injury claim is made years afterwards. When information is no longer needed, we take reasonable steps to destroy or de-identify it.

9. Getting access, and correcting things

You can ask to see the personal information we hold about you, and ask us to correct anything inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 13 and we will respond within 30 days.

We can decline a request in the limited circumstances the Privacy Act allows, and if we do we will tell you why in writing.

There is no fee for asking. If a request involves a lot of information we may charge a reasonable amount for the cost of providing it.

10. Complaints

If you think we have handled your personal information in a way that breaches the Privacy Act or this policy, tell us using the details in section 13. We will acknowledge it within five business days and respond properly within 30 days. If we need longer to look into it, we will say so.

If you are not satisfied with how we respond, you can complain to the Office of the Australian Information Commissioner:

• www.oaic.gov.au
• 1300 363 992
• GPO Box 5218, Sydney NSW 2001

11. Notifiable data breaches

As a health service provider bound by the Australian Privacy Principles, we are subject to the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

An eligible data breach is where personal information we hold is accessed or disclosed without authorisation, or is lost, and a reasonable person would conclude that this is likely to result in serious harm to somebody.

If we suspect one has happened, we will:

• assess promptly whether it is an eligible data breach, and finish that assessment within 30 days of becoming aware of it;
• if it is, notify the Office of the Australian Information Commissioner as soon as practicable; and
• notify each person whose information was involved, as soon as practicable, where serious harm is likely — unless an exception under the Privacy Act applies.

Because of what we hold, we treat any suspected breach involving health information as a priority, and will act quickly to contain it, assess it and tell the people affected.

If you think your information held by us may have been accessed or disclosed without authorisation, contact us straight away using the details below.

12. Children

Where a participant is under 18, we collect their personal information, including health information, from their parent or guardian, who signs the Participation Waiver on their behalf.

We handle information about children with particular care and use it for nothing beyond delivering training safely and meeting our legal obligations.

Photography and media consent for a child is obtained separately from the parent or guardian, one form per child.

13. Contact us

For any privacy enquiry, an access or correction request, or a complaint:

Privacy Contact
Rogue Jujitsu Pty Ltd
G06/253 Northbourne Avenue, Lyneham ACT 2602
roguebjjstudios@gmail.com
0416 264 647

Published by Rogue Jujitsu Pty Ltd ACN 672 149 316 in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.