Menopause Training Matrix™

Privacy policy

Last updated 26 October 2026

This policy explains how mishfit Franchising Pty Ltd (ABN 32 147 131 986) (“we”, “us”) collects, uses and shares personal information on the Menopause Training Matrix™ learning platform. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. What we collect

Account details: Your name (as it appears on your certificate), email address and the country you're based in (so the Menopause Symptom Sorter can show your clients the right support lines). If you joined through a gym or business, the organisation you belong to and whether you're a learner or a manager.
Learning activity: Which videos you've watched and how much of each, where you stopped, which files you've downloaded, your quiz answers and results, when you completed the course, and your certificate details.
Sign-in information: When you create a passkey, your device gives us a public key. This is not your fingerprint, face or PIN, which never leave your device. We also store a label for each passkey (for example “iPhone · Safari”) and when it was last used, plus records of your signed-in sessions.
Emails we send you: Copies of invites, sign-in links and notices we send, so we can help if something goes astray.
Technical information: Like most websites, our hosting provider records technical details of each request, such as IP address, browser type and the page requested, to keep the service running and secure.
Payments: If you buy a seat, payment is handled by Stripe. We receive confirmation of the purchase and your billing name and email, but never your full card number.
The question box on our website: If you ask our automated assistant a question, we keep what you typed and its replies for 90 days, so we can check its answers and improve them. The conversation isn't linked to your name, email or account, and we ask you not to put personal or health details in it.

We collect this from you directly, from the person at your organisation who invited you (your name and email), and automatically as you use the platform. We don't ask for health information about you.

2. How we use it

To give you access to the course, remember your progress and issue your certificate.
To sign you in securely and send you invites and sign-in links.
To show your organisation's managers how their team is progressing.
To let others confirm your certificate is genuine (for example, when you claim CPDs with AUSactive).
To manage seats and billing, provide support, and improve the course content.
To keep the platform secure and meet our legal obligations.

We don't use your information for advertising and we don't sell it.

3. Who can see it

You: Everything in your account, on the My learning, Certificate and Account pages.
Your organisation's managers: If a gym or business gave you your seat, its managers can see your name and email, your progress in each module, whether you've passed each quiz (and how many attempts you've had), whether you have a certificate, and when you were last active. They can't see your individual quiz answers.
mishfit Franchising Pty Ltd: Our administrators (Mish Wright and our support team) can see account and progress information to run the platform and help you.
Anyone with your certificate ID: The certificate verification page shows your name, the course and your completion date to anyone who has your certificate ID or scans its QR code. That is what makes it verifiable.
Service providers: The companies in section 5, only as needed to provide their service to us.

We may also disclose information where the law requires or allows it.

4. The Menopause Symptom Sorter

Trainers can give their clients a link to the Menopause Symptom Sorter, a checklist of menopause symptoms. Clients don't need an account, and we've designed it so that we never receive their answers.

A client's answers, first name and notes are saved only in the browser on their own device. They can clear them at any time.
When a client shares their answers with their trainer, the answers are carried inside the link (after the “#”), which browsers don't send to our servers. The trainer's browser shows the read-out and clears it when the tab is closed. If a trainer saves a PDF, that copy is theirs to look after.
Anyone who receives a shared link can see the answers in it, so clients should only send it to their trainer.
We store each trainer's link and who it belongs to, so the checklist can show the trainer's name and their gym's name. When a client opens the link, our hosting provider records the usual technical details of the request (see section 1), but not their answers.
We record when a trainer last opened a client's read-out (the time only, never whose or what it said), so we can remind them about six weeks later that it's worth running the sorter again.

5. Service providers and overseas disclosure

We use these providers to run the platform. Some store or process information outside Australia.

Cloudflare: Hosts the platform and its database, and delivers our emails. Our database is set to the Oceania region, but Cloudflare's global network may process requests in other countries, including the United States.
Vimeo: Plays the course videos. When you watch a video, your browser connects to Vimeo (United States), which receives your IP address and viewing activity. We load the player in Vimeo's “do not track” mode.
Stripe: Processes payments (Australia and United States).
Anthropic: Provides the AI model behind the question box on our website (United States). What you type into it is sent to Anthropic to produce the reply. Anthropic doesn't use it to train its models.
LeadConnector (GoHighLevel): Currently hosts some course images and files (United States). Your browser loads course images from it. We plan to move these files onto our own hosting.

We choose providers with strong security and privacy practices and take reasonable steps to ensure they handle personal information consistently with the Australian Privacy Principles.

6. Cookies and browser storage

We only use cookies that are needed for the platform to work:

__Host-mtm_session: Keeps you signed in. It lasts up to 30 days, or until you sign out.
__Host-mtm_chal: Holds a one-time security check while you use a passkey. It expires after 5 minutes.
__Host-mtm_nudged: Remembers that this device has been offered a passkey, so you're only asked once. It lasts a year.
mtm_checkout: While you pay, remembers which checkout this browser started, so your details come back if you cancel. It lasts an hour.

The Menopause Symptom Sorter keeps information in browser storage rather than cookies, and never sends it to us:

mtm-sorter (a client's device): A client's answers, kept on their own device until they clear them.
mtm-check-in (a trainer's device): A shared check-in while the trainer has it open. It's removed when the tab is closed.

We don't use analytics, advertising or tracking cookies. The Vimeo player is loaded in “do not track” mode, but Vimeo may still set cookies it needs to play videos.

7. Keeping it secure

Information is encrypted in transit. Sign-in uses passkeys or single-use email links, with no passwords to steal or reuse. We store session and invite tokens only in scrambled (hashed) form. Access is limited to people who need it, and invite links work once, for one email address.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. How long we keep it

We keep your account and learning records while you have access. If your seat ends, we keep your progress and certificate so you can still prove your training and pick up where you left off if you return. We keep certificate records (your name, certificate number, course, completion date and CPD points) for 7 years from the date the certificate is issued, so employers and registration bodies can verify them. After that we delete them or remove anything that identifies you. If you ask us to delete your certificate sooner, its verification link will stop working. Technical logs are kept for a short period only. Conversations with the question box on our website are deleted after 90 days.

You can ask us to delete your information sooner (see section 9). We'll do so unless we're required to keep it by law.

9. Your choices and rights

See your information: ask us for a copy of what we hold about you.
Correct it: you can change your name on your Account page. For anything else, contact us.
Delete it: ask us to delete your account. If you deleted it, your certificate could no longer be verified.
Remove a device: you can remove any passkey from your Account page at any time.

We'll respond within 30 days. We may need to confirm your identity first.

10. Contact and complaints

For privacy questions, requests or complaints, email support@mishwright.com. We'll acknowledge your complaint and aim to resolve it within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

11. Changes to this policy

We may update this policy as the platform changes. We'll show the date of the latest update at the top of this page and let you know by email about any significant changes.