Privacy Policy

About this policy

NDI Cosmetic Nurse ("NDI") is a Fairfield, Victoria aesthetics business, ABN 20 696 514 039.

NDI is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles that sit under it. Some small businesses are exempt from the Privacy Act, but that exemption doesn't apply to NDI - any business that provides a health service and holds health information is covered, regardless of size. Because NDI holds clinical and treatment records in Victoria, it's also bound by the Health Records Act 2001 (Vic).

Business details

What NDI collects

General information: your name, date of birth, contact details, payment and billing details, an emergency contact if you provide one, and any correspondence you have with NDI.

Health information: this is treated as sensitive information under the Privacy Act and given extra protection. It includes your medical and treatment history, current medications and allergies, relevant health conditions, consultation notes, treatment plans and records, and clinical photos taken before, during, or after treatment.

NDI only collects health information that's reasonably necessary to plan and deliver your treatment safely, and always with your consent.

How NDI collects it

• Directly from you, through consultation and health history forms, booking forms in Timely, enquiry and contact forms in GoHighLevel, phone calls, emails, and messages through Instagram or Facebook.
• In person, as consultation notes and clinical photos taken as part of your treatment record.
• From another practitioner, only where relevant and with your knowledge - for example if you're referred to NDI, or NDI consults a colleague about your case (see section 10).

NDI doesn't collect health information about you from social media, public sources, or anyone else without your involvement.

How NDI uses it

• Plan and deliver your treatment, including assessing suitability and any relevant risks
• Manage your bookings, reminders, and communication with NDI
• Process payments, memberships, and the NDI Treatment Wallet, through Aglow
• Keep the clinical record the Health Records Act requires NDI to keep
• Respond to your questions, requests, and feedback
• Send you marketing, but only if you've opted in - see section 13
• Meet NDI's legal, professional, and insurance obligations, including if a complaint or claim is ever raised

NDI doesn't use your health information beyond what's needed to look after you, unless you've separately agreed to it or NDI is required to by law.

Clinical photos

Photos taken during your consultation or treatment are part of your clinical record. They stay confidential and are stored securely with the rest of your file.

They're never used for anything else, including marketing, without your separate, specific, written consent - and you can withdraw that consent at any time. If you've agreed to a photo being used publicly, it's only ever used in line with AHPRA's advertising guidelines, meaning it's never presented as a promise or guarantee of a result.

How long NDI keeps it

Under the Health Records Act 2001 (Vic), NDI is required to keep your clinical record for at least 7 years from your last treatment, or, if you were under 18 at the time, until you turn 25 - whichever is later.

NDI keeps other personal information, like billing records, only as long as reasonably needed or the law requires - for example, financial records generally need to be kept for 7 years under Australian tax law.

AI tools

NDI sometimes uses AI tools to help draft marketing content and manage administrative tasks. Anything AI-assisted is reviewed before it's used or sent.

NDI doesn't put your name, contact details, health information, or anything that could identify you into an AI tool. AI is never used to make a clinical decision about your care - any clinical judgement about your treatment is made by your practitioner, not a computer program.

Cookies & tracking

NDI's website uses Google Analytics and the Meta Pixel to understand how people use the site and to show relevant ads on Facebook and Instagram to people who've visited it before. These tools use cookies and don't identify you personally to NDI.

You can control cookies through your browser settings, and opt out of Meta's ad personalisation through your Facebook or Instagram account settings.

Sharing your information

NDI doesn't sell your information. It's only shared with:

• The software used to run bookings and enquiries, client communication, and clinical file storage
• NDI's payment providers, to process memberships, the Treatment Wallet, and in-person payments
• Another practitioner, only with your consent or where necessary for your care - for example if NDI consults a colleague about your case, or you're referred elsewhere
• Regulators and authorities where legally required, for example AHPRA or a court
• NDI's professional indemnity insurer, if a claim or complaint is ever raised
• A lawyer or adviser, where reasonably needed to get advice

Where it's stored

Some of the platforms NDI uses for bookings, client records, and file storage store data on servers outside Australia, including in the United States. NDI only uses established providers with their own security and privacy standards, and takes reasonable steps to keep your information secure regardless of where it's stored.

Keeping it secure

Your information is stored behind password-protected systems, and access is limited to authorised personnel involved in your care. Any paper records are kept in a locked space.

If NDI ever becomes aware of a data breach likely to cause serious harm, it will follow the Notifiable Data Breaches scheme - notifying you and the Office of the Australian Information Commissioner, and taking steps to limit any harm.

Direct marketing

NDI only sends marketing - offers, newsletters, treatment updates - to people who've opted in. Every email and SMS includes an unsubscribe option, and you can also ask NDI directly at any time.

Children's privacy

NDI Cosmetic Nurse's services are intended for adults. NDI doesn't knowingly collect personal information from children. If information about someone under 18 is ever needed, it's only with a parent or guardian's knowledge and consent.

If you believe NDI holds information about a minor without appropriate consent, contact NDI and it will be addressed.

Access & correction

You can ask to see or get a copy of the personal information NDI holds about you at any time, using the details in section 17. Your identity will be verified first, and access given unless there's a legal reason not to - for example if it would seriously risk someone else's safety or privacy.

If anything NDI holds about you is wrong, out of date, or incomplete, let NDI know and it will be corrected. If there's disagreement about the correction, you can ask NDI to attach a note with your version to your file.

Concerns & complaints

If you're not happy with how NDI has handled your personal information, contact NDI directly first and it will be looked into. If you're not satisfied with the response, you can take it further:

Contact NDI

Changes to this policy

This policy is reviewed regularly and may be updated as NDI's tools, services, or the law change. The current version is always available on NDI's website, and the effective date at the top shows when it was last updated. If a significant change is made, NDI will let you know.