Policy

Dose of Envy Aesthetics

30c Duggan Street

Toowoomba Qld 4350

[email protected]

0467 029 027

Privacy contact: Alison Platt, Privacy Officer

Effective as of 1 September 2025

About this policy

We respect your privacy and manage your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, how we use and disclose it, how we keep it secure, and how you can access or correct your information.

What we collect

Identification and contact details such as name, date of birth, address, phone, and email.

Health information such as medical history, medicines, allergies, pregnancy/breastfeeding status, skin type, photographs and videos of treatment areas, treatment notes, consent forms, and test results. Health information is sensitive information and is handled with additional care.

Payment and billing information such as transaction records, deposits, gift voucher and package balances. Card details may be stored by our booking system and/or payment gateway in accordance with our security practices. Card details are processed via secure third‑party gateways and not stored in our primary systems beyond what is necessary for bookings and processing.

Digital information such as website analytics, cookies, IP address, device type, and communications preferences.

How we collect information

Directly from you in person, by phone, email, SMS, online forms, bookings, or during consultations and treatments.

From treating practitioners (e.g., prescribing doctor) or pathology only with your consent or as permitted by law.

From our website and social media through cookies, analytics, and pixels. You can manage cookies via your browser settings.

Why we collect and how we use information

To identify you, assess suitability for treatment, obtain informed consent, provide safe and effective care, and maintain accurate clinical records.

To arrange prescriptions and clinical oversight where required by law.

To manage bookings, reminders, payments, deposits, packages, and aftercare.

To improve our services, quality, safety, and staff training.

With your consent, to send appointment reminders and service information by SMS or email. You can opt out at any time.

With your express marketing consent, to send newsletters and promotions. You can unsubscribe at any time.

Clinical images and how we use photos/videos

Clinical images are part of your health record and are used for assessment, treatment planning, monitoring outcomes, and internal quality purposes.

Separate written consent is required to use any identifiable images for marketing. You can refuse marketing use without affecting your care.

If you consent to marketing use, we will explain where images may appear (e.g., website, social media) and how we will handle de-identification. You can withdraw marketing consent at any time by contacting us. Withdrawal will not affect materials already published but we will remove or cease future use where practical.

Disclosure of personal information

We may disclose information to your treating team such as our prescribing practitioner, on a need-to-know basis for your care.

We may disclose to service providers who support our operations such as booking software, payment gateways, cloud storage, SMS/email services, IT support, insurers, and legal advisers. These providers must handle your data in accordance with privacy obligations.

We will not sell your personal information.

We may disclose where required or authorised by law (e.g., a court order, mandatory reporting, serious threat to life/health).

If we disclose to overseas recipients (for example, where a cloud service or helpdesk is located overseas), we will take reasonable steps to ensure they comply with the APPs. On request we can tell you the likely countries where your information may be stored or accessed.

Data security and storage

We use reasonable physical, technical, and administrative safeguards including role-based access, staff training, secure passwords, encryption in transit where supported, and secure disposal of records.

Records are retained for at least 7 years from the last entry for adults and for minors until the patient turns 25 (or longer if required by law or clinical need).

When no longer required, information is securely destroyed or de-identified.

Access and correction

You can request access to your personal information or ask us to correct it if it is inaccurate, out of date, or incomplete. We may charge a reasonable administration fee for access in line with the APPs.

To request access or correction, contact us using the details below. We’ll respond within a reasonable timeframe.

Complaints about privacy

If you have a privacy concern, please contact us first so we can work to resolve it.

If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992.

Marketing preferences

You can opt out of marketing emails and SMS at any time using the unsubscribe link in messages or by contacting us.

Cookies and analytics

We use cookies and analytics tools (e.g., Google Analytics, Meta Pixel) to help improve our website and measure performance. You can block cookies in your browser, but some features may not work properly.

Policy updates

We may update this policy from time to time. The latest version will be published on our website with the effective date.