Privacy

1. Who we are

Elite Hair Clinic (“we”, “us”) is operated by THE TRUSTEE FOR LID.DOC 2 TRUST & THE TRUSTEE FOR LID.DOC TRUST (ABN 31 786 117 368), at Level 7, Suite 701, 135 Macquarie Street, Sydney NSW 2000.

We are a health service provider that holds health information. Under section 6D(4)(b) of the Privacy Act 1988 (Cth), the small business operator exemption does not apply to us, so we are bound by the Australian Privacy Principles (“APPs”) regardless of our turnover.

This policy explains how we handle personal information and is published to meet our obligations under APP 1.

2. The laws that apply to us

Privacy Act 1988 (Cth) and the Australian Privacy Principles
Privacy Act 1988 (Cth), Part IIIC – Notifiable Data Breaches scheme
Health Records and Information Privacy Act 2002 (NSW)
Healthcare Identifiers Act 2010 (Cth)
Spam Act 2003 (Cth) and Do Not Call Register Act 2006 (Cth)
Health Practitioner Regulation National Law (NSW)

3. What information we collect

Identity and contact information. Your full name, date of birth, residential address, email address, phone number, emergency contact, and where applicable your Medicare number and private health fund details.

Health information. This is sensitive information under the Privacy Act and attracts stronger protection. It includes: your medical and surgical history, current medications, allergies, relevant family history; the results of your consultation and scalp assessment; donor and recipient area assessments and graft planning; anaesthetic and procedure records; post-operative notes and progress reviews; pathology or blood test results where ordered; and correspondence with your GP, dermatologist or other treating practitioners.

Clinical photographs. We take photographs of your scalp, hairline and donor area before, during and after treatment. These form part of your clinical record. See section 6 – the use of photographs beyond your own care requires your separate, specific consent.

Payment information. Your treatment plan, amounts paid and payment schedule. We do not store your full card number – card details are captured and held by our payment provider, Square, which is PCI-DSS compliant. Where you apply for a payment plan, your application is handled by TLC, Zip Pay, Elevant or Release My Super.

Technical information. Your IP address, device and browser type, and how you use our website. See section 13.

4. How we collect it

We collect information directly from you wherever possible – through your enquiry or booking, your new patient forms, your consultation, your procedure, and your follow-up appointments. We collect it in person at the clinic, by phone, by email, through our website, and through secure online forms.

We may also collect information from third parties, including: a referring GP or dermatologist; a pathology provider where tests are ordered; your private health fund or Medicare.

Where we collect information about you from someone other than you, we will tell you, unless it would be unreasonable or impracticable to do so.

5. Why we collect, use and disclose it

to assess your suitability for treatment and provide you with clinical care;
to plan, perform and review your procedure, and manage your aftercare;
to communicate with you about your appointments, treatment and recovery;
to correspond with your GP or other treating practitioners where relevant to your care;
to process payments and manage treatment plans;
to respond to your enquiries and complaints;
to meet our record-keeping, insurance and legal obligations;
to report adverse events where required; and
to improve our services and train our staff, using de-identified information wherever possible.

Consent to collect health information. Under APP 3.3 we may only collect health information about you with your consent, or where collection is required or authorised by law. You give that consent when you complete our patient forms and proceed with assessment or treatment.

6. Clinical photographs and use of images

Photographs of your scalp and hair are a necessary part of assessment, planning, and measuring your result over time. They are stored as part of your clinical record and handled with the same protection as the rest of it.

We will not use your photographs for any purpose beyond your own clinical care unless you give us separate, specific, written consent. That includes use in marketing, on our website, on social media, in presentations, in case studies, or for training.

If you do consent to wider use:

your consent is specific – you choose which uses you agree to, and you may agree to some and not others;
consent is never a condition of treatment, and declining will not affect your care in any way;
you may withdraw consent at any time by contacting us. We will stop using the images going forward and remove them from material we control, though we may not be able to recover copies already distributed, printed, or shared by others;
we will tell you whether images will be identifiable, and what steps we will take to de-identify them if that is what you have agreed to.

Advertising of regulated health services in Australia is subject to section 133 of the Health Practitioner Regulation National Law and Ahpra’s advertising guidelines, which restrict the use of testimonials and impose requirements on before-and-after images. Our use of any image you consent to is subject to those rules.

7. Who we disclose it to

Recipient	What they receive	Why
Your treating doctor, nurses and technicians	Your clinical record	To assess, treat and care for you
Your GP or referring practitioner	Relevant correspondence and summaries	To coordinate your care, where you have consented or where it is reasonably expected
Our practice management and CRM provider – Go High Level	Your records held in the system	To operate our patient records and communications
Payment provider – Square	Your name, contact and billing details	To process payments
Our professional advisers and insurers	Relevant information	Where necessary for legal or insurance purposes

We do not sell your personal information, and we do not disclose your health information to advertisers or data brokers.

We may also disclose your information where required or authorised by law, or where necessary to lessen or prevent a serious threat to life, health or safety.

8. Overseas disclosure

Your information is disclosed to recipients outside Australia:

United States – our practice management and CRM system is operated by Go High Level and hosted in the United States.
Philippines – administrative support staff engaged through BruntWork provide services to us from the Philippines, including appointment scheduling, enquiry handling, patient communications and records administration.

Before disclosing your information to an overseas recipient we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. Those steps include written contractual obligations, restrictions on use and further disclosure, security requirements, confidentiality obligations binding on individual personnel, access limited to what each role requires, and obligations to notify us of any suspected data breach.

9. Direct marketing

We will only use your health information to send you marketing material if you have expressly consented, separately from your consent to treatment.

We may use your name and contact details to send you information about our services. Every marketing message includes an unsubscribe facility, and we action unsubscribe requests promptly as required by the Spam Act 2003 (Cth). Where we contact you by telephone for marketing purposes, we will do so between 9am and 8pm AEST on business days. You can opt out at any time by contacting contact_us@elitehairclinic.com.au.

Messages about your appointments, procedure, aftercare and results are service messages, not marketing, and you will continue to receive them while you are a patient.

10. How we protect your information

We hold your information in secure systems and take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. That includes encryption, access controls limiting information to the people who need it to provide your care, physical security of the clinic and any paper records, and written privacy and confidentiality obligations on our staff, practitioners and service providers. We securely destroy or de-identify information we no longer need.

11. How long we keep it

We keep clinical records for at least seven years from the date of the last entry, or where the patient was under 18 at that time, until they turn 25 – the retention periods required under the Health Records and Information Privacy Act 2002 (NSW). We then securely destroy or permanently de-identify them, unless we are required to keep them longer.

Other information, such as marketing contact details, is deleted when no longer needed or when you ask us to delete it.

12. Data breaches

We maintain a data breach response plan. If an eligible data breach occurs – one likely to result in serious harm – we will notify you and the Office of the Australian Information Commissioner as required by the Privacy Act 1988 (Cth).

13. Cookies, analytics and online advertising

Our website uses cookies, pixels and similar technologies to understand how the site is used and to measure our advertising.

Where required, we will obtain your consent before placing non-essential cookies. You can manage cookies through your browser settings.

14. Reviews and feedback

If you leave a review on Google or another platform, that review is public and governed by that platform’s terms, not by this policy. We may respond to reviews, but we will not disclose or confirm that you are a patient, or discuss any aspect of your care, in a public reply. If you raise a clinical matter publicly, we will invite you to contact us directly.

15. Accessing and correcting your information

You may ask for a copy of the personal and health information we hold about you (APP 12), and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13). You have equivalent rights under NSW health records legislation.

Email contact_us@elitehairclinic.com.au. We will acknowledge within 7 days, respond within 30 days, and verify your identity before releasing anything. We do not charge for making a request, but may charge a reasonable, non-excessive fee for the cost of providing access – we will tell you the amount first.

We can refuse access in the limited circumstances set out in APP 12.3. If we do, we will explain why in writing and how to complain.

16. Complaints

Please tell us first so we can fix it. Email contact_us@elitehairclinic.com.au or write to the Privacy Officer at Level 7, Suite 701, 135 Macquarie Street, Sydney NSW 2000. We will acknowledge within 7 days and respond within 30 days.

If you are not satisfied:

Office of the Australian Information Commissioner – 1300 363 992, oaic.gov.au, GPO Box 5218 Sydney NSW 2001
Information and Privacy Commission NSW – 1800 472 679, ipc.nsw.gov.au
NSW Health Care Complaints Commission – 1800 043 159, hccc.nsw.gov.au
Ahpra – 1300 419 495, ahpra.gov.au

17. Changes to this policy

We may update this policy. The current version is always at www.elitehairclinic.com.au/privacypolicy. If a change materially affects how we handle your information, we will notify you before it takes effect. Last updated 6th October, 2026