Privacy Policy

1. Our commitment to your privacy

The Maison Hair Clinic ("we", "us", "our") respects your privacy and takes the protection of your personal and health information seriously. Because we are a healthcare provider, much of the information we hold about you is health information — which Australian law treats as sensitive information and protects accordingly.

This policy explains what we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have over it. We handle your information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and applicable Queensland health records legislation.

2. What information we collect

Personal information

• Your name, date of birth, address, phone number and email address
• Emergency contact details
• Your GP's name and practice details
• Payment and billing information
• Records of your communications with us (calls, emails, SMS, messages and enquiry forms)

Health information (sensitive information)

• Your medical history, current medications, allergies and relevant health conditions
• Photographs of your scalp, hair and treatment areas — including images you submit online as part of a preliminary assessment, and clinical photography taken before, during and after treatment
• Assessment findings, diagnostic and test results (including genetic hair-analysis testing where undertaken)
• Treatment plans, procedure records, prescriptions and clinical notes
• Consent forms and related documentation

Website and marketing information

• Information you provide through our website forms and landing pages
• Website usage data collected through cookies and similar technologies, including analytics tools that help us understand how our website is used and, where applicable, advertising tools that measure the performance of our advertising
• Your marketing preferences and consents

3. How we collect your information

We collect information directly from you wherever possible — when you make an enquiry, complete a form, submit photographs for assessment, attend a consultation or appointment, or communicate with us. Consultations and procedures take place at our clinical facilities within Bespoke Longevity and Aesthetic Medicine.

We may also collect information about you from others where it is necessary for your care and where you would reasonably expect us to, including from your GP or referring practitioner, other treating health practitioners, pathology or testing providers, and (where relevant to your treatment) a person authorised to act on your behalf.

4. Why we collect and use your information

We collect and use your information to:

• Assess your suitability for treatment and provide you with safe, appropriate clinical care
• Prepare and deliver your treatment plan, procedure and aftercare
• Communicate with you about your appointments, treatment, recovery and follow-up
• Obtain and record your informed consent
• Manage billing, payments and our business administration
• Meet our legal, professional, insurance and regulatory obligations, including those under the Health Practitioner Regulation National Law
• Improve our services, and — only where you have separately consented — send you marketing communications

Clinical photographs: images are taken and stored as part of your clinical record and are used to assess your baseline, guide your treatment, and review your progress. They are only ever used beyond your clinical record — for example, in education or marketing — if you give separate, explicit, written consent, which you may withdraw at any time. Consent to such use is never a condition of your care.

5. Who we share your information with

We do not sell your information. We share it only where necessary for your care, for the operation of our practice, or where required by law. This may include:

• Your treating medical practitioner and the clinical team involved in your care
• Other health practitioners involved in your treatment, including your GP where appropriate
• Bespoke Longevity and Aesthetic Medicine — the practice at which our consulting rooms and clinical facilities are located, where your care is delivered
• Artisan Chemist — our compounded medication provider, where compounded medication is part of your treatment plan
• Other third-party clinical service providers involved in your care, such as a hyperbaric oxygen therapy provider or pathology and testing laboratories, where relevant to your treatment
• Our practice management and communications systems provider, which hosts our clinical and contact records securely and is contractually bound to protect your information
• Our third-party payment processor, which handles card payments securely — we do not store your full card details
• Our marketing and administrative service provider, Freedom Legacy Planning Pty Ltd, which acts on our behalf and is bound to protect your information
• Our insurers, professional advisers and auditors, where necessary
• Regulatory or law-enforcement bodies, where required or authorised by law

6. Overseas disclosure

Some of the third parties and systems we use to provide and support your care are located outside Australia, or store or access data on servers that may be located outside Australia. This means that some of your personal and health information may be disclosed to, stored by, or accessed from, overseas recipients.

In particular:

• Our practice management and communications platform (our CRM) stores data using cloud infrastructure that may be located in, or replicated across, countries outside Australia, including the United States. Our platform provider is contractually required to handle personal information in accordance with the Australian Privacy Principles and the Privacy Act 1988 (Cth).
• Our email is hosted on Microsoft services configured to store data within Australia. Where any file storage or backup occurs on servers outside Australia, we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles.
• Members of our administrative and support team are located outside Australia (including in the Philippines) and may access your personal information to support your care and our clinic's operations. They are bound by confidentiality obligations and are required to handle your information consistently with this policy and the Australian Privacy Principles.

Where we disclose personal information to an overseas recipient, we take reasonable steps in the circumstances to ensure that the recipient handles your information in a manner consistent with the Australian Privacy Principles — for example, through contractual arrangements requiring APP-compliant handling. However, you acknowledge that an overseas recipient may be subject to foreign laws that could compel disclosure of personal information, and that we are not responsible for the privacy practices of a recipient to the extent they are required to act under a foreign law.

By providing your information to us and consenting to this policy, you acknowledge and agree to the disclosure of your personal information to overseas recipients as described above. If you do not wish for your information to be disclosed overseas, please contact us — although we may then be unable to provide some or all of our services, because these systems are integral to how we operate.

7. How we protect your information

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include:

• Storing records in secure, access-controlled systems
• Limiting access to those members of our team who need it to provide or support your care
• Requiring individual user accounts, and applying confidentiality obligations to all staff and contractors
• Securing physical records and clinical areas
• Regular review of our systems and processes, the use of reputable providers that apply encryption and access controls, and secure backup practices

If a data breach occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

8. How long we keep your information

We retain your health records for at least the minimum periods required by law. For adults, health records are generally retained for a minimum of seven years from the date of the last entry. For patients who were under 18 at the time of their last visit, records are retained until the patient reaches 25 years of age. We may retain records for longer where reasonably necessary, including to meet our professional, insurance or legal obligations. When records are no longer required, they are securely destroyed or de-identified.

9. Your rights

Accessing your information

You may request access to the personal and health information we hold about you. We will respond within a reasonable period and may charge a reasonable fee for retrieval and copying. In limited circumstances we may decline access — for example, where providing it would pose a serious threat to life, health or safety, or where the law permits refusal — and we will explain our reasons in writing.

Correcting your information

If you believe information we hold is inaccurate, out of date, incomplete or misleading, please tell us and we will take reasonable steps to correct it.

Withdrawing consent

You may withdraw your consent to marketing communications at any time by using the unsubscribe link in any email, replying to any SMS, or contacting us directly. You may also withdraw consent for any optional use of your clinical images at any time in writing. Withdrawing consent will never affect the care you receive.

Anonymity

You may deal with us anonymously or by pseudonym for general enquiries. However, we cannot provide clinical care without knowing who you are, as accurate identification is essential to safe treatment.

10. Marketing communications

We only send marketing communications to people who have consented to receive them, and every such message includes a simple way to unsubscribe, in accordance with the Spam Act 2003 (Cth). We do not use your health information to target marketing to you.

11. Cookies and website analytics

Our website and landing pages use cookies and similar technologies to understand how visitors use our site, to improve it, and to measure the performance of our advertising. This may include analytics tools and advertising measurement tools provided by third parties. We do not use health information to target advertising, and we do not carry out advertising that targets individuals based on health conditions. You can control or disable cookies through your browser settings, though some parts of our website may not function as intended if you do.

12. Complaints

If you have a concern about how we have handled your information, please contact us first — we take privacy complaints seriously and will investigate and respond, usually within 30 days.

Privacy contact: The Maison Hair Clinic, 2nd Level, 63 Ferry Road, Southport QLD 4215 · 1300 767 716 · hello@maisonhairclinic.com.au

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. Complaints about health services in Queensland may also be directed to the Office of the Health Ombudsman.

13. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and the date at the top shows when it was last updated.