Privacy Policy

Who we are

JUNISH Cosmetic Clinic is a nurse-led cosmetic clinic at 1/11 Windsor Avenue, Mount Waverley VIC 3149. In this policy, "we", "us" and "our" mean JUNISH Cosmetic Clinic.

We are a health service provider. That means we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles regardless of our size, and by the Health Records Act 2001 (Vic), which governs how health information is handled in Victoria.

This policy explains what information we collect about you, why we collect it, who we share it with, and how you can access or correct it.

What we collect

The information we hold depends on how you interact with us. It may include:

• Identity and contact details — your name, date of birth, phone number, email address and postal address.
• Health information — your medical history, medications, allergies, skin history, previous treatments, the treatments we provide to you, your consent forms, clinical notes, and any photographs taken for clinical records.
• Appointment and payment records — your booking history and records of payments made.
• Enquiry information — the content of messages you send us by email, SMS, our website, or social media, including your name and anything else you choose to tell us.
• Website information — basic technical data such as your device type, browser and pages viewed.

Health information is treated as sensitive information under the Privacy Act and is given a higher level of protection.

How we collect it

Wherever it is reasonable and practical, we collect information directly from you. That happens when you book an appointment, complete a consultation or consent form, attend the clinic, contact us by phone, SMS or email, or message us on Instagram.

We may also collect information from a third party, such as your treating doctor or another health practitioner, where you have asked us to or where it is necessary for your care.

Why we collect it

We collect and use your information to:

• assess whether a treatment is suitable and safe for you;
• provide the treatment and the aftercare that follows it;
• keep accurate clinical records, as we are professionally required to do;
• manage your appointments, reminders and payments;
• answer your enquiries; and
• meet our legal, professional and insurance obligations.

We will only send you marketing material if you have opted in, and every message will include a way to opt out. We do not sell your information to anyone, and we do not disclose your health information for marketing purposes.

Instagram, Facebook and online advertising

We advertise on Instagram. If you tap one of our ads and start a conversation, Meta Platforms may ask you for your first name before passing the conversation to us, and Meta will hold a record of that interaction under its own privacy policy.

Please do not send us health information, photographs of a medical concern, or other sensitive details through Instagram, Facebook or any other social media platform. Those platforms are not a secure channel and we do not control them. If you would like to discuss something personal, ask us and we will move the conversation to email, phone, or a consultation.

We do not upload your health information to advertising platforms, and we do not use it to target advertising to you.

Who we share it with

We disclose your information only where it is necessary, and only to:

• other health practitioners involved in your care, with your consent;
• our booking and records provider, Timely, which stores appointment and client records on our behalf;
• our payment providers, for processing payments;
• our insurers and professional advisers, where required; and
• a government body, regulator or court, where the law requires or authorises us to.

Some of these providers store data on servers outside Australia. Where that is the case, we take reasonable steps to ensure the information remains protected to a standard consistent with the Australian Privacy Principles.

How we store and protect it

Clinical records are held electronically in our practice management system, protected by access controls and passwords, and are accessible only to authorised staff. Any paper records are kept securely on the premises. We take reasonable steps to protect your information from misuse, loss, and unauthorised access, modification or disclosure.

How long we keep it

We are required to retain health records for at least seven years from the date of your last visit. Where the record relates to a person under 18, we retain it until that person turns 25. After that, records are securely destroyed or de-identified.

Accessing and correcting your information

You can ask to see the information we hold about you, and you can ask us to correct anything that is wrong or out of date. Contact us using the details below and we will respond within a reasonable time, usually within 30 days.

There are limited circumstances in which we may need to refuse access, for example where giving access would pose a serious threat to someone's life or health, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how you can respond.

We may ask you to verify your identity before releasing records, and a reasonable administrative fee may apply to retrieving and copying them.

Making a complaint

If you think we have mishandled your information, please tell us first. Contact us using the details below and we will investigate and respond to you.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. For complaints about health records specifically in Victoria, you can contact the Health Complaints Commissioner at hcc.vic.gov.au or on 1300 582 113.

Changes to this policy

We may update this policy from time to time. The current version will always be available on this page, with the date it was last updated shown at the top.