Privacy & Health Information Policy
Last updated: August 2026
Cosmetic Doctors Skin & Hair Clinic (“the Clinic”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of our patients’ personal and health information.
We manage personal and health information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles (HPPs).
1. Information We Collect
We collect personal and health information reasonably necessary to provide and manage our services. This may include:
Name, date of birth and contact details
Medical history, medications, allergies and relevant health conditions
Previous and current treatments
Consultation notes, assessments and treatment plans
Prescribing and medication-related information where applicable
Clinical photographs and imaging
Consent forms and clinical documentation
Appointment and communication records
Payment and transaction information
Information relating to treatment outcomes, complications, complaints or adverse events
Where reasonably practicable, information is collected directly from the patient. Where appropriate and permitted by law, information may also be obtained from another healthcare provider or authorised third party.
2. Why We Collect and Use Information
We may collect and use personal and health information to:
Assess treatment suitability and provide safe and appropriate care
Develop and manage treatment plans
Maintain clinical records
Prescribe, supply or administer treatments or medicines where applicable
Monitor treatment progress and provide follow-up care
Manage appointments, accounts and communications
Respond to enquiries, complaints and clinical incidents
Support clinical governance, quality assurance and risk management
Meet professional, insurance, regulatory and legal obligations
Health information will generally only be used for the purpose for which it was collected, a directly related purpose that the patient would reasonably expect, or as otherwise permitted or required by law. (IPC NSW)
3. Clinical Photographs and Videos
Clinical photographs and videos may be taken where appropriate for assessment, treatment planning, clinical documentation, monitoring treatment progress or continuity of care.
Clinical images form part of the patient’s health information and are handled confidentially.
Consent to clinical photography does not constitute consent to use photographs or videos for advertising, social media, website content or other promotional purposes.
Separate consent will be obtained where identifiable patient images, videos, testimonials or treatment results are proposed to be used for marketing.
Declining marketing consent will not affect a patient’s access to treatment or care.
4. Disclosure of Information
Where reasonably necessary or permitted by law, information may be disclosed to persons or organisations involved in providing or supporting the patient’s care, including:
Treating doctors, nurses and other healthcare practitioners
Pathology, laboratory, pharmacy or other healthcare providers
Hospitals or emergency healthcare providers
Professional advisers, insurers or indemnity providers
Regulatory or government authorities where legally required or authorised
Service providers supporting our clinical, administrative, payment or information technology systems
We do not sell patient health information.
Health information will only be disclosed in accordance with applicable privacy requirements. (IPC NSW)
5. Marketing Communications
Where permitted by law, we may communicate with patients about Clinic services, promotions or relevant information.
Patients may opt out of marketing communications at any time.
Opting out of marketing does not prevent the Clinic from sending communications reasonably necessary for appointments, treatment, follow-up care or administration.
Clinical photographs, health information or treatment information will not be used for identifiable marketing purposes without appropriate consent.
6. Storage and Security
Patient clinical and health information is maintained through the Clinic’s secure clinical management platform and is hosted in Australia.
We take reasonable steps to protect personal and health information against misuse, interference, loss, unauthorised access, modification or disclosure.
Access to patient information is limited to authorised persons who require access for legitimate clinical, administrative, legal or operational purposes.
NSW privacy requirements specifically require health service providers to maintain reasonable security safeguards for health information. (IPC NSW)
7. Retention of Health Records
The Clinic retains health records in accordance with applicable legal requirements.
For private health service providers in NSW, health information relating to an adult patient is generally retained for at least 7 years from the last occasion on which a health service was provided.
Where health information was collected while the patient was under 18 years of age, records are generally retained until the patient reaches 25 years of age.
Records may be retained for longer where required or permitted by law.
When information is no longer required to be retained, it will be securely destroyed or otherwise managed in accordance with applicable requirements. (IPC NSW)
8. Access and Correction
Patients may request access to personal and health information held about them and may request correction where information is inaccurate, incomplete, out of date or misleading.
The Clinic may need to verify identity before providing access.
Requests will be managed within applicable legal requirements. Access may be limited or refused where permitted by law.
NSW law provides patients with a general right to access their health information, subject to limited exceptions. (IPC NSW)
9. Website and Online Information
Our website may use cookies and similar technologies to support website functionality, analytics, security and marketing.
Information provided through online forms, booking systems or other digital services will be handled in accordance with applicable privacy requirements.
Third-party websites accessed through links from our website are governed by their own privacy policies.
10. Data Breaches
The Clinic takes privacy and information security incidents seriously.
Suspected or actual data breaches will be assessed, contained and managed in accordance with applicable privacy and data-breach notification requirements.
Where legally required, affected individuals and relevant regulatory authorities will be notified.
11. Privacy Complaints
If you have a concern about how your personal or health information has been handled, please contact Clinic Management.
We will review and respond to privacy complaints in accordance with applicable requirements.
If a concern cannot be resolved directly with the Clinic, individuals may have the right to contact the relevant privacy regulator, including the Office of the Australian Information Commissioner (OAIC) or Information and Privacy Commission NSW (IPC NSW).
12. Contact Us
Privacy enquiries, requests for access or correction of records, and privacy complaints can be directed to:
Privacy Officer / Clinic Management
Cosmetic Doctors Skin & Hair Clinic
Mount Annan
mtannan@cdshc.com.au
+61 481 792 619
Eastgardens
Eastgardens@cdshc.com.au
+61 409 995 420
Chatswood
chatswood@cdshc.com.au
(02) 9904 8554
Patients may also contact their treating clinic directly.
13. Changes to this Policy
We may update this policy from time to time to reflect changes in our services, operations, technology or legal obligations.
The current version will be published on our website.