PRIVACY POLICY
We are committed to protecting the privacy of patient information and to handling your personal information in a responsible manner in accordance with the Privacy Act (1988), the Privacy Amendment (Enhancing Privacy Protection) Act (2012), the Australian Privacy Principles and relevant State and Territory privacy legislation.
This Privacy Policy explains how we collect, use and disclose your personal information, how you may access that information and how you may seek the correction of any information. It also explains how you may make a complaint about a breach of privacy legislation.
This Privacy Policy is current from 25th September 2026 and is reviewed annually. From time to time we may make changes to our policy, processes and systems in relation to how we handle your personal information. We will update this Privacy Policy to reflect any changes. Those changes will be available on our website and in the practice.
1 About this policy
Prestons Hydrafacial, ABN 89 852 237 329, operates at 1 Quaama Close, Prestons NSW, Australia. In this policy, “we”, “us” and “our” refer to the operator of Prestons Hydrafacial.
This Privacy Policy describes how we collect, hold, use and disclose personal information, including health information, in connection with enquiries, appointments, treatments, product purchases, our website and social media. We handle this information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles.
Our Privacy Officer manages privacy enquiries, requests for access or correction, and privacy complaints. Please contact the Privacy Officer, Prestons Hydrafacial, by email at info@prestonshydrafacial.com.au, by telephone on 0414 054 158, or in writing at the address above. Our website is prestonshydrafacial.com.au. A copy of this policy is available free of charge on request.
2 Information we collect
We collect personal information reasonably necessary to provide and administer our services. The information collected depends on your interactions with us and may include:
-
Your name, date of birth and contact details, together with relevant parent, guardian or emergency contact details.
-
Your skin concerns, relevant medical history, medications, allergies, pregnancy or breastfeeding information, previous treatments and information needed to assess treatment suitability.
-
Consultation and consent forms, treatment plans and notes, products used, treatment outcomes, aftercare communications, clinical photographs and VISIA images and analysis.
-
Appointment, purchase, payment and refund records; marketing preferences; image consent records; and enquiries and complaints.
-
Digital interaction information and any CCTV images lawfully provided to us by the medical centre, as explained below.
Health information is sensitive information. We obtain consent to collect this information unless collection without consent is permitted or required by law. This policy describes our information-handling practices and does not replace consent to treatment, marketing or promotional use of images.
3 Collection and use of information
We generally collect information directly from you through Timely booking and consultation forms, consultations, treatment, VISIA analysis, telephone conversations, messages, email and social media. Where appropriate, information may also be collected from a parent, guardian, authorised representative or another health practitioner with your consent, or as otherwise permitted or required by law.
Our services include Hydrafacial, microneedling, plasma fibroblast, TCA and AHA/BHA chemical peels, LED, dermaplaning, VISIA skin analysis, and skin tag and milia removal. We use relevant information to assess treatment suitability, plan and provide care, monitor outcomes, provide aftercare advice and respond to adverse reactions.
We also use information to administer appointments and payments, communicate with you, maintain accurate records, address complaints and meet our legal obligations. Promotional communications and public use of images are subject to the separate provisions below.
You may make general enquiries anonymously or under a pseudonym where practicable. If you choose not to provide information necessary for safe treatment or accurate clinical records, we may be unable to provide the requested service. Declining optional marketing or promotional photography does not affect your access to treatment.
4 Access to and disclosure of information
Access to client records within Prestons Hydrafacial is currently limited to the owner, who is also the treating clinician. We do not share reception access, booking systems or client records with Prestons Medical Centre. Occupation of shared premises does not authorise access to your information.
We use Timely for bookings, consultation forms and treatment notes; VISIA for skin imaging and analysis; Tyro for payments; and Wix for website hosting. Timely, Tyro and Wix process or hold information necessary to provide their services. VISIA images and analysis are stored only on the clinic computer. Access for technical support is permitted only where necessary and appropriately authorised.
We may disclose relevant information to another treating practitioner with your consent or as otherwise permitted by law; to advisers or insurers where reasonably necessary and legally permitted; and to regulators, emergency services, courts or other recipients where required or authorised by law. Disclosures are limited to information appropriate for the relevant purpose. Emergency disclosure without consent occurs only where a legal exception applies.
Receiving treatment does not authorise disclosure of your clinical records to advertisers. Promotional use of images and digital advertising are addressed in sections 5 and 8.
5 Clinical photography and promotional images
Clinical photographs and VISIA images support skin assessment, treatment planning and comparison of treatment outcomes. These images form part of your health record and are subject to the same privacy protections as your treatment notes. We explain the purpose of clinical photography and obtain appropriate consent.
Consent to clinical photography is separate from consent to publication. Before using an identifiable image or video on our website, social media, paid advertising or other promotional material, we obtain specific consent describing the intended use, publication channels and any identifying details to be included. Consent for one use does not automatically extend to other uses.
You may decline publication or withdraw consent to future promotional use by contacting us. Following withdrawal, we will discontinue new uses and take reasonable steps to remove the material from channels we control. We cannot guarantee the retrieval of printed material already distributed or copies, screenshots or reposts made by third parties. Withdrawal of promotional consent does not require deletion of clinical records subject to mandatory retention.
6 Clients under 18 years of age
We require parent or guardian consent when treating clients under 18 years of age. We also consider the young person’s maturity and capacity to understand decisions concerning their personal information and involve them in those decisions as appropriate.
Before disclosing a young person’s records to a parent or guardian, we assess the representative’s authority, the young person’s capacity and consent, and applicable legal requirements. Parent or guardian status does not automatically confer unrestricted access. Where a young person lacks capacity to provide valid privacy consent, we seek consent from an appropriately authorised representative.
Promotional use of a young person’s image requires separate, specific consent, taking account of their capacity and the authority of their parent or guardian. Consent to treatment does not authorise publication.
7 Email and SMS marketing
We send promotional emails and SMS messages with the consent required by law. We maintain marketing preferences and include an unsubscribe option in promotional messages. You may also withdraw consent by contacting us on 0414 054 158. Unsubscribe requests are processed within five working days, without an unsubscribe fee.
We obtain consent before using sensitive health information for direct marketing, and you may withdraw that consent. Unsubscribing from promotions does not prevent necessary appointment confirmations, aftercare communications or other non-promotional service messages. Email and SMS preferences are separate from advertising preferences managed through Google and Meta.
8 Website and social media advertising
We advertise through Google and Meta platforms, including Facebook and Instagram. These platforms may process account, device and advertising interaction information in accordance with their respective privacy policies. Information published in public comments or posts may be accessible to other users.
Our website is hosted on Wix and managed by the clinic owner. Wix processes technical and usage information to operate and secure the website. Cookies and similar technologies may support website functions and, depending on the settings enabled, analytics or advertising. Information can include IP addresses, browser or device details, pages viewed and referral sources.
We will obtain specific consent where required before collecting or disclosing sensitive information through advertising technologies. General acceptance of this policy does not authorise disclosure of health information to an advertising platform. Browser cookie settings and Google or Meta advertising settings may provide controls over tracking and personalisation; disabling cookies can affect website functions.
Please contact us to arrange an appropriate method for providing detailed medical histories or intimate photographs needed for your care. These should not be submitted through public comments or social media messages.
9 Overseas processing and disclosure
Our software and digital service providers may process or access information outside Australia. Timely’s published provider list identifies overseas entities in the United States and New Zealand, with certain service-specific providers in Spain and Malta. Tyro identifies overseas recipients in the United States, India, New Zealand, Ireland, the Netherlands, Singapore and China. The countries relevant to your information depend on the services and features used.
Wix identifies potential storage locations for site visitors’ information in the United States, Ireland, South Korea, Taiwan and Israel. Google and Meta may also process digital interaction information overseas, including in the United States. We take reasonable steps required by Australian privacy law to protect information disclosed overseas, including reviewing provider arrangements. Acceptance of this policy does not waive our obligations for overseas disclosures.
10 CCTV
Prestons Medical Centre operates CCTV at reception, at the rear of the premises and at two locations covering the front parking area. The cameras do not record audio. The medical centre controls the CCTV system, which is separate from Prestons Hydrafacial’s clinical records. Enquiries about footage, access and retention should be directed to the medical centre. Our Privacy Officer can assist you in identifying the appropriate contact.
If CCTV footage is lawfully provided to us in connection with an incident, we restrict its use and disclosure to the relevant lawful purpose and protect it in accordance with this policy. We do not record telephone calls.
11 Information storage and retention
Bookings, consultation forms and treatment notes are stored in Timely. VISIA images and analysis are stored only on the clinic computer, without online backup. We take reasonable steps to protect information against loss, misuse, interference and unauthorised access, alteration or disclosure, including limiting access within the clinic to the owner and treating clinician. Safeguards must reflect the sensitivity of the information and the systems used. Absolute security cannot be guaranteed.
We retain adult health records for at least seven years from the last health service provided. Health information collected while a client is under 18 is retained until at least their 25th birthday. A longer applicable retention requirement, including for subsequent adult care or legal proceedings, may extend these periods. Withdrawal of consent does not override mandatory retention.
Other information is retained for as long as necessary for its lawful purposes or to satisfy legal requirements. When information is no longer required, we take reasonable steps to securely destroy or de-identify it. We maintain disposal and transfer records where required by NSW law.
We respond promptly to suspected data breaches to contain the incident and assess the risk. Where an incident constitutes an eligible data breach under the Notifiable Data Breaches scheme, we notify the Office of the Australian Information Commissioner and affected individuals as required, including information about protective measures.
12 Access and correction
You may request access to your personal information or correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading by contacting our Privacy Officer using the details in section 1. We may verify your identity and the authority of any representative before releasing or amending records.
We aim to respond within 30 calendar days and will respond to health-record access requests within the applicable NSW limit of 45 calendar days. No fee applies to making a request or correcting information. If a reasonable access fee applies, we will advise you in advance. We will consider your preferred format for access.
We may refuse access or correction only where permitted by law. If a request is refused, we provide written reasons, unless the law permits otherwise, and explain the available complaint options. Where a requested correction is not made, you may ask us to attach a statement of your position to the record. You may also request that previous recipients be notified of a correction where required by law.
13 Privacy complaints and policy updates
Privacy complaints may be submitted to our Privacy Officer using the contact details in section 1. Please describe the circumstances, relevant dates and the outcome sought. We will investigate your complaint and aim to respond within 30 calendar days. If further time is required, we will keep you informed. Assistance is available if you need help documenting your complaint.
We review this policy when our information-handling practices or legal obligations change. The current version will be available on our website and on request. Amendments do not retrospectively authorise a new use of information for which your consent is required.