Privacy Policy

• We collect what we need to look after you and run the app. Nothing beyond that.

• Your information is stored in Australia, on Australian servers.

• Health information is sensitive information under the Privacy Act. We collect it only with your consent.

• We never sell your information, and we never trade it.

• We do not use your medical history or treatment information to target marketing at you.

• If we use AI to help write up your consultation notes, we'll tell you and ask first. No audio recording is kept.

• You can see your information, correct it, delete your app account, and withdraw consent at any time.

• Some clinical records must be kept for a minimum period by law. There's a plain explanation of that below.

​

What information we collect

Information you give us

Account and identity information
Your name, date of birth, email address, mobile number, postal address, and a password (stored encrypted, never in readable form).

Health information
This is the sensitive category and it's the one we handle most carefully. Depending on your care, it may include:

• Medical history, including current and past conditions

• Medications, prescription and over the counter

• Allergies and previous adverse reactions

• Pregnancy or breastfeeding status

• Previous cosmetic and skin treatments

• Your answers to pre-treatment questionnaires and screening forms

• Consultation and treatment notes

• Anatomical markings and treatment planning records

• Clinical photographs and video, where you've consented to those

• Product batch and lot details for any treatment administered

• Aftercare notes and anything you report to us afterwards

Consent records
Where you complete a digital consent form in the app, we keep the signed form, which version you signed, the date and time, and an audit record of the signing. That's how we demonstrate informed consent was properly obtained, which is a professional obligation, not an optional extra.

Messages
Anything you send us through the app's direct messaging, plus our replies.

Appointment information
Bookings, changes, cancellations, attendance, and the reason for your visit.

Purchase information
Skincare and supplement orders placed through the app, order history, and delivery details. Payments are processed by [payment provider]. We receive confirmation the payment succeeded, the amount, and the last four digits of the card. We never receive or store your full card number, expiry date or security code.

Skin Club membership information
Your membership tier, qualifying retail purchases, and reward history.

Information collected automatically

• Device type, operating system, app version, and language settings

• A device token used to deliver push notifications

• Login and session records, including IP address, used for security and to detect unauthorised access

• Which features you use and when, used to keep the app working properly

• Crash and diagnostic logs

We don't track you across other companies' apps and websites, and we don't share your information with data brokers or advertising networks.

Information we receive from others

• Your GP or specialist, where a referral is involved

• Another practitioner, where you've asked us to obtain your records

• A family member or carer you've authorised to act for you

​

Where your information is stored

Your information is stored on Amazon Web Services infrastructure located in Sydney and Melbourne, Australia.

We've selected a platform that keeps clinical data onshore, because we think that's the right standard for health information about Australian patients.

Some limited operational data, for example website analytics on our public website, may be handled by providers outside Australia. Where any of your information is disclosed overseas, Australian Privacy Principle 8.1 requires us to take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, and under section 16C of the Privacy Act we remain accountable for what they do with it. We meet that through contractual data protection terms.

​

How we use your information

• To provide the cosmetic and skin services you've asked for

• To assess whether a treatment is clinically appropriate for you

• To maintain accurate clinical records, which we're professionally obliged to keep

• To manage appointments and send reminders and confirmations

• To obtain and record your informed consent

• To communicate with you through the app

• To process orders and payments

• To operate the Skin Club program

• To meet legal, regulatory and professional obligations, including under the Health Practitioner Regulation National Law and AHPRA's guidelines

• To handle complaints, insurance matters and legal claims

• To keep the app secure and working

We use your information for the purpose we collected it for, or a directly related purpose you'd reasonably expect. That's the requirement in Australian Privacy Principle 6.

Consent

Under Australian Privacy Principle 3.3 we can only collect health information about you with your consent, and only where it's reasonably necessary for our functions. When you complete a health questionnaire or consent form in the app, that's the consent being given. You'll always be told what we're collecting and why before we collect it.

​

Artificial intelligence

The platform we use includes AI features. We want to be straightforward about what they do and don't do.

What AI is used for
Assisting with administrative work. Drafting a summary of a consultation for the practitioner to review, structuring treatment plans and follow-ups, condensing existing records, and suggesting wording for routine communications.

What AI is not used for
AI does not diagnose you. It does not decide whether a treatment is suitable for you. It does not prescribe. Every clinical decision about your care is made by Sheri-lee Knoop, and anything AI drafts is reviewed and corrected by her before it's relied on. The platform's AI features are not a regulated medical device and aren't intended to function as one.

Ambient transcription
If we use AI transcription during your consultation, we'll tell you and ask for your consent before we switch it on. You can say no, and saying no won't affect your care. When it is used, no audio recording is stored. Transcription happens in memory and in short segments, and the audio isn't retained after processing. What's kept is the written note, which becomes part of your clinical record.

Your information is not used to train AI models
The platform doesn't use patient information to train or improve AI models, and processing stays within the platform's own environment.

Automated decisions
No decision about your care, your suitability for treatment, or your access to services is made by an automated process. From 10 December 2026, Australian Privacy Principle 1.7 will require privacy policies to disclose substantially automated decision-making. We'll update this section if that ever changes.

​

Photographs and before and after images

Clinical photography is part of the clinical record. We use it to document your baseline, to plan treatment, and to compare over time.

Your images are yours. Photographs taken of you are stored in your record and are visible to you and to your treating practitioner. They aren't visible to other patients.

We ask separately before using any image publicly. Consent to clinical photography for your record is not consent to publish. If we ever want to use an image for education or promotion, we'll ask you specifically, we'll tell you where it would appear, and you can say no or change your mind later. Any such use is also subject to AHPRA's advertising requirements, which govern how before and after images may be presented.

​

Messaging and urgent care

The app's messaging is for non-urgent questions. We check it during clinic hours.

If you're worried about a reaction, a complication, or anything that feels urgent, call us on 08 9574 6852 or 0425 905 555. In an emergency, call 000. Please don't wait for a reply in the app.

Marketing

We'd like to keep in touch about clinic news, skin education and services. You can opt in when you set up your account, or later in the app settings.

We do not use your health information to target marketing at you. Australian Privacy Principle 7.4 prohibits using sensitive information for direct marketing without consent, and we go further than that by simply not doing it. Your medical history, your treatment records and your consultation notes will never determine what we send you.

Where we send appointment reminders, rebooking prompts or product information, those are based on your appointment and purchase history and your stated preferences, not on your clinical information.

You can opt out at any time, in the app settings, by using the unsubscribe link in any email, by replying STOP to any SMS, or by calling us. We'll action it promptly and at no cost. Marketing messages will always identify us as the sender and include an unsubscribe option, as required by the Spam Act 2003 (Cth).

Opting out of marketing doesn't stop appointment reminders or messages about your care.

Who we share your information with

We do not sell, rent or trade your personal information.

DappleCRM Pty Ltd, as the operator of the platform that runs our clinic systems and this app. It stores and processes your information on our instructions and under contract.

Payment processing. [Provider] processes payments. We don't hold your card details.

Communications delivery. Our email, SMS and telephony providers deliver messages to you. They receive your contact details and the message content, not your clinical record.

Clinical integrations. The platform can integrate with external services including [confirm which are enabled]. Where an integration involves your information, we'll tell you and obtain your consent before it's used.

Other health practitioners, where you've asked us to or where it's necessary for your care and you'd reasonably expect it. That includes your GP or a specialist.

Where the law requires it, including to AHPRA or the Nursing and Midwifery Board in a regulatory matter, to a court or tribunal under subpoena, or to prevent a serious and imminent threat to someone's life, health or safety.

Our insurer and legal advisers, where a claim or complaint arises.

​

How we protect your information

We take the steps Australian Privacy Principle 11 requires to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.

• Data is encrypted in transit and at rest

• Access to clinical records is restricted to people who need it for your care, and access is logged

• Multi factor authentication protects staff accounts

• The platform maintains audit trails across clinical records

• The platform is monitored continuously and security updates are applied

• Physical records held in the clinic are kept in locked storage

• Staff are trained on their privacy obligations

​

No system is completely secure and we won't pretend otherwise. What we can tell you is that we chose a platform built for Australian healthcare, and we take this seriously.

​

If something goes wrong

If there's a data breach likely to result in serious harm to you, we're required to notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. We'll tell you what happened, what information was involved, and what you should do. Our platform provider is contractually required to notify us of any breach affecting patient data so that we can act quickly.

​

How long we keep your information

Clinical records. We keep clinical records for a minimum of seven years from the date of your last service. If you were under 18 at your last service, we keep the record until you turn 25. This reflects the accepted national standard for private health service providers and our professional obligations as a registered health practitioner.

App account information. Kept while your account is active, and for [X months] after you delete it, after which it's removed from live systems and from backups within [X days].

Marketing preferences. We keep a record of your opt-out indefinitely, so we don't accidentally contact you again.

​

Payment and order records. Seven years, to meet obligations under taxation law.

Technical and diagnostic logs. [X months], then deleted.

When we no longer need information and aren't required to keep it, we destroy it or de-identify it.

​

​

Accessing and correcting your information

You have a right under Australian Privacy Principle 12 to ask for a copy of the personal information we hold about you, and a right under Australian Privacy Principle 13 to have it corrected if it's wrong, out of date, incomplete or misleading.

Some of your information is visible to you in the app already, including your appointments, treatment plans, forms and images.

To make a request: email [privacy contact email] or call 08 9574 6852.

We'll respond within 30 days. There's no charge to make a request. We may charge a reasonable, non-excessive fee for the cost of providing access, and if we do we'll tell you before we do the work.

We may refuse access in limited circumstances, for example where giving access would pose a serious threat to someone's life or health, or would unreasonably affect another person's privacy. If we refuse we'll tell you why in writing and explain how to complain.

​

​

Deleting your data and withdrawing consent

​

Deleting your app account

You can delete your account from within the app at [Settings > Account > Delete Account], or by emailing [privacy contact email].

Deleting your account removes your login, your app profile, your preferences, your message history and your Skin Club points balance. It can't be undone.

​

What we can't delete, and why

We need to be straight with you about this, because it's the part people are most often surprised by.

​

Deleting your app account is not the same as deleting your clinical record.

If you've been treated at the clinic, we're professionally and legally obliged to keep your clinical record for the minimum periods above. We can't delete it on request inside that period. Doing so would breach our obligations as a registered health practitioner, and it would leave you without a record if you ever needed one, for example if you had a delayed reaction or needed to show another practitioner what you'd had done.

What we can do:

• Delete your app account and everything attached to it

• Stop all marketing contact immediately

• Delete photographs that aren't required as part of the clinical record for a treatment performed

• Restrict access to your record to the minimum necessary

• Delete your record in full once the retention period ends

Contact us and we'll tell you exactly what we can delete, what we have to keep, why, and for how long.

​

Withdrawing consent

You can withdraw consent at any time, and you can do it in parts. You might withdraw consent for AI transcription but continue treatment. You might withdraw consent for photography, or for marketing, and keep your account.

To withdraw consent, use the app settings, email [privacy contact email], or call us.

Withdrawing consent doesn't affect anything we did lawfully beforehand. It may mean we can't continue to provide a particular service, and if that's the case we'll explain it clearly before anything changes.

​

The App Store

The Cosmetic Images App is distributed through the Apple App Store [and Google Play]. Those platforms collect information about downloads and purchases under their own privacy policies, which we don't control. We don't receive identifiable information about you from Apple [or Google] beyond what you give us directly in the app.

Children and young people

​

The Cosmetic Images App is for people aged 18 and over. We don't knowingly collect personal information from anyone under 18 through the app.

​

Where a person under 18 attends the clinic, additional protections apply under the National Law and AHPRA's guidelines for non-surgical cosmetic procedures, including requirements around referral, assessment and cooling-off periods. Those matters are handled in the clinic, not through the app.

​

If you believe someone under 18 has created an account, contact us and we'll remove it.

​

Our website

Our website at cosmeticimages.com.au uses cookies to remember your preferences and understand how the site is used. You can control cookies through your browser. Blocking some may affect how the site works.

​

Complaints

If you're unhappy with how we've handled your personal information, please tell us first. We'd rather fix it directly.

Contact: [privacy contact name and role], [privacy contact email], 08 9574 6852

We'll acknowledge within [X business days] and respond in writing within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints

• Phone: 1300 363 992

• Post: GPO Box 10091, Sydney NSW 2001

Since 10 June 2025, individuals in Australia have also had a direct right to bring court proceedings for serious invasions of privacy, under the statutory tort introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth).

Changes to this policy

We'll update this policy as the app changes and as the law changes. When we do, we'll change the effective date and version number at the top.

If a change materially affects how we handle your information, we'll tell you in the app and by email before it takes effect. Where a change requires your consent, we'll ask for it.

Previous versions are available on request.

 

 

Questions

If anything here is unclear, please ask. Call 08 9574 6852 or 0425 905 555, or email us.

Sheri-lee Knoop
Registered Nurse Division One
NMBA/AHPRA: NMW0001560577
Cosmetic Images, North Perth WA
cosmeticimages.com.au

​