Last updated: Oct 17, 2026
1. About this policy
Envisage Cosmetic (“Envisage”, “we”, “us”, “our”), ABN [insert ABN], operates a medical aesthetic clinic at 416/7 Maitland Place, Norwest NSW 2153 and the website envisagecosmetic.com.au.
This Privacy Policy explains how we collect, hold, use and disclose your personal information, including health information. We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Health Records and Information Privacy Act 2002 (NSW).
This policy applies when you visit our website, book an appointment, buy products from our online shop, contact us, or receive treatment at our clinic. By using our website or services, you acknowledge that you have read this policy.
2. Information we collect
We only collect information that is reasonably necessary to provide our services and run our business. This may include:
- Identity and contact details: name, date of birth, gender, address, phone number and email address.
- Health information: medical history, current medications, allergies, previous cosmetic treatments, pregnancy or breastfeeding status, skin assessments, treatment notes, consent forms and outcomes.
- Clinical photographs: before, during and after photos taken as part of your treatment record.
- Booking information: appointment dates, services selected, practitioner, deposits and cancellation history.
- Purchase information: products ordered, billing and delivery addresses, and order history. Card payments are processed by our payment provider; we do not store full card numbers.
- Communications: enquiries, emails, messages, reviews and feedback you send us, including via Instagram or Facebook.
- Website and device data: IP address, browser type, device type, pages visited, referring site, and how you interact with our site and ads (see section 6).
Health information is “sensitive information” under the Privacy Act. We only collect it with your consent and where it is needed to assess your suitability for, and safely provide, treatment.
You may deal with us anonymously or under a pseudonym for general enquiries. We cannot provide treatment without identifying you and collecting your health information.
3. How we collect information
We collect personal information directly from you wherever practical, including when you:
- book an appointment through our online booking system (Timely), by phone or in person;
- complete consultation, medical history and consent forms;
- attend a consultation or treatment;
- buy products from our online shop;
- email, call or message us, including through social media;
- visit our website or interact with our online ads.
We may also collect information from third parties with your consent or where the law allows, such as your GP or other treating health practitioners, or a person you have authorised to act for you.
4. How we use your information
We use your personal information to:
- assess your suitability for treatment and provide safe, appropriate care;
- keep accurate clinical records, as required of health service providers;
- manage bookings, reminders, deposits and cancellations;
- process and deliver online shop orders, and handle returns;
- respond to enquiries and provide aftercare follow-up;
- send you news, offers and appointment reminders where you have agreed (see section 7);
- understand how our website is used and measure and improve our advertising;
- meet our legal, regulatory, insurance and professional obligations.
We will not use your health information for any other purpose unless you consent, or the use is required or authorised by law.
5. Who we share it with
We do not sell or rent your personal information. We may share it with:
| Recipient | Purpose |
|---|---|
| Timely (booking software) | Managing online bookings, reminders and client records |
| Payment processors | Processing shop orders and deposits securely |
| Couriers and delivery services | Delivering products you order |
| Our website host and IT providers | Hosting, maintaining and securing our website and systems |
| Google (Analytics, Tag Manager, Ads) | Website analytics and advertising measurement |
| Meta (Facebook, Instagram) | Social media messaging and advertising measurement |
| Prescribing doctors, your GP or other practitioners | Prescribing and coordinating your care, with your consent |
| Professional advisers, insurers and regulators | Legal, insurance, accounting and compliance obligations |
These providers may only use your information to deliver their services to us. We do not share your health information with advertising or analytics providers.
We may also disclose information where required or authorised by law, such as to prevent a serious threat to someone’s life, health or safety, or in response to a court order.
6. Cookies, analytics and advertising
Our website uses cookies and similar technologies to make the site work, remember your shopping cart, understand how visitors use the site, and measure our advertising.
- Essential cookies run the website and online shop (for example, keeping items in your cart).
- Analytics through Google Analytics and Google Tag Manager tell us which pages are visited and how people arrive at our site.
- Advertising tools from Google and Meta may record that you visited our site so we can measure ad results and show you relevant ads on other sites and apps (remarketing).
- Embedded content, such as YouTube videos and Google Maps, may set their own cookies when you view it.
This data is generally not used to identify you personally. You can block or delete cookies in your browser settings, though parts of the site may not work properly. You can also opt out of Google Analytics using the Google Analytics opt-out add-on, and manage ad preferences in your Google and Meta account settings.
7. Marketing, photos and overseas storage
Marketing. We will only send you promotional emails or SMS if you have agreed to receive them. Every message includes a way to unsubscribe, or you can contact us at any time. Appointment reminders and service messages may still be sent while you are a client.
Before and after photos. Clinical photos form part of your medical record. We will never publish your photos on our website, social media or in advertising without your separate, written consent. You may withdraw that consent at any time, and we will remove the images from channels we control.
Overseas storage. Some of our service providers, such as Timely, Google and Meta, may store or process information on servers outside Australia, including in the United States, New Zealand and the European Union. Where we use overseas providers, we take reasonable steps to ensure they handle your information in a way consistent with the APPs.
8. Security and retention
We take reasonable steps to protect your information from misuse, loss and unauthorised access, including password-protected systems, restricted staff access, secure (HTTPS) website connections and locked storage for any paper records.
We keep health records for at least 7 years after your last visit, or for patients under 18, until they turn 25, as required by NSW law. Other information is kept only as long as needed for the purposes in this policy, then securely destroyed or de-identified.
If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.
9. Access and correction
You can ask to access or correct the personal information we hold about you by contacting us (section 11). We will respond within 30 days. We may need to verify your identity first, and may refuse access in limited circumstances allowed by law, in which case we will explain why in writing.
10. Complaints
If you have a concern about how we handled your information, please contact us first. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can contact:
- Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992
- NSW Information and Privacy Commission (health records): ipc.nsw.gov.au, 1800 472 679
11. Contact us
Envisage Cosmetic — Privacy Officer 416/7 Maitland Place, Norwest NSW 2153 Phone: 02 7205 3810 Email: info@envisagecosmetic.com.au
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on our website, with the date it was last updated at the top.