Privacy policy

1. About this policy

This Privacy Policy explains how Microbioflora Pty Limited, trading as Progurt, ABN 88 003 268 979 (“Progurt”, “we”, “us”, “our”), collects, holds, uses and discloses personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It is a notice about our practices, not a request to consent to every practice described.

2. Personal information we collect

  • Identity and contact information, including name, email address, telephone number, delivery and billing addresses.
  • Account, order, payment-status, subscription, delivery and customer-service records. Payment providers process full card details; we do not store full card numbers.
  • Communications, product preferences, reviews and other content you choose to provide.
  • Device, browser, IP, general location, referral, page-view and interaction information collected through cookies and similar technologies.
  • If you choose to use our product-finder quiz or discuss your circumstances with support, health-related information such as quiz questions and raw answers about digestive comfort and wellbeing goals, inferred interests, recommendations, and the identifiers needed to return your result or respond.

3. Health information: consent, necessity and minimisation

Health information is sensitive information. We collect it only with your consent, only where it is reasonably necessary for a function or activity described to you, and only to the minimum extent required. You can buy Progurt products without answering health-related quiz questions. If you do not provide quiz information, we may be unable to generate a tailored quiz result, but that choice does not prevent a purchase or access to general product information.

4. How we collect information

We collect information directly when you order, create an account, manage a subscription, contact us, complete the quiz, request a result, opt into marketing, or submit a review. We also collect site and device information automatically through our website technologies. We may receive transaction, delivery, subscription and communication status from the providers that perform those functions for us.

5. The product-finder quiz

Your quiz answers stay in your browser while you take the quiz and are not linked to your identity unless you ask us to email your result. Analytics tools receive only de-identified, PII-scrubbed interaction events, and the quiz interface is masked in session-replay tools. If you ask us to email your result, we tell you at that point — next to the request button — that your answers will be used to create and deliver your personalised recommendation and to personalise related follow-up emails, with a link to this policy. Making that request is your express consent to those uses. Information about overseas recipients is in section 10.

You can unsubscribe from follow-up emails at any time without affecting your result, and you can buy Progurt products without taking the quiz.

6. Why we use personal information

  • To accept payment, fulfil and deliver orders, manage accounts and subscriptions, and provide customer service.
  • To generate a quiz result or recommendation that you request and remember preferences you ask us to save.
  • To communicate about transactions, service and safety matters.
  • To send direct marketing only where permitted and with the required consent.
  • To operate, secure, analyse and improve our website and services.
  • To prevent fraud, resolve disputes and meet legal obligations.

7. Who receives personal information

We disclose only the information reasonably required for the relevant function to providers such as Shopify for ecommerce and accounts; Recharge for subscriptions; payment providers; fulfilment and shipping providers; Klaviyo as a first-party communication provider; Okendo for reviews; and hosting, security and support providers. A review is displayed publicly only when you submit it for publication, subject to the review notice presented at collection.

GA4 and Microsoft Clarity may receive de-identified, PII-scrubbed usage information for analytics. Advertising partners may receive site identifiers or interactions only where permitted, but identifiable health information, raw health answers and inferred health interests are not sent to advertising pixels. We may also disclose information where law requires or permits it, or as part of a business transaction subject to appropriate protections.

8. Direct marketing

We send direct marketing only where permitted and provide an unsubscribe method in each marketing email. We use quiz answers to personalise follow-up emails only where you have expressly consented at the point you requested your result, and we do not otherwise use health fields, raw health answers or inferred health interests for direct marketing without your consent. Withdrawing marketing consent does not affect transactional or safety communications.

9. How information is held, linked and secured

Information is held in controlled systems used for ecommerce, subscriptions, communications, support, reviews and analytics. Records may be linked using an account, customer, order, email, subscription or pseudonymous analytics identifier so that we can perform the requested function. Access is limited according to role and business need. We use measures such as access controls, authentication, provider diligence, contractual restrictions, transmission protections, monitoring and staff processes proportionate to the information’s sensitivity. No system is completely secure.

10. Overseas disclosures

Some providers process or store information outside Australia. The countries in which recipients are likely to be located are the United States — where Shopify, Recharge, Klaviyo, Okendo, Google and Microsoft process information — and other countries where those providers maintain infrastructure, including Canada and countries in the European Union. Before permitting an overseas disclosure, we assess the provider’s security and privacy practices, use contracts or equivalent controls appropriate to the service, limit the information disclosed, and take reasonable steps required by APP 8.1. Different legal protections may apply overseas.

11. Retention, deletion and de-identification

We retain personal information only while it is needed for the disclosed purpose, a legal or accounting obligation, dispute resolution, fraud prevention, or enforcement. When it is no longer required, we take reasonable steps to delete it securely or irreversibly de-identify it, including by instructing relevant providers where appropriate. Backups are isolated from ordinary use and expire or are securely overwritten under the applicable schedule.

12. Access and correction

You may ask to access or correct personal information we hold by emailing support@progurt.com.au. We may verify identity before acting. We will respond within the period required by the APPs, explain any lawful refusal, and tell you about available complaint steps. We do not charge for making a request, although the law may permit a reasonable access charge in limited circumstances after notice.

13. Privacy complaints

Email support@progurt.com.au with the subject “Privacy complaint” and describe the issue and desired outcome. We will acknowledge the complaint, investigate it fairly, request only information reasonably needed, communicate the outcome and any corrective action, and explain escalation options. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner through oaic.gov.au/privacy/privacy-complaints.

14. Data breaches

We maintain an incident-response process. If an incident is likely to result in serious harm, we will assess it and make notifications required by the Notifiable Data Breaches scheme, including to affected individuals and the OAIC where required. We also require relevant providers to notify us of security incidents under their contractual obligations.

15. Changes to this policy

We may update this policy prospectively and will post the revised version. We will provide direct notice where reasonably practicable or legally required before a material new use takes effect, and we will obtain new consent where a materially different purpose or sensitive-information use requires it.

16. Contact

Email: support@progurt.com.au
Microbioflora Pty Limited, trading as Progurt · ABN 88 003 268 979 · 16 Sunnyridge Road, Arcadia NSW 2159, Australia

Last updated: 16 July 2026