Privacy Policy

Serenity Skin Clinic Pty Ltd (ABN 71 699 306 397), trading as Serenity Skin (“Serenity Skin”, “Clinic”, “we”, “us” or “our”), collects, holds, uses and discloses personal and health information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the health privacy obligations that apply to us in Queensland. This Privacy Policy applies to the products and services we provide at our clinic at 23 Bundock Street, Belgian Gardens QLD 4810, through our site https://www.serenityskin.au (“Site”), through telehealth, and through our social media channels. It forms part of our Website Terms and Conditions.

Effective date: 19 October 2026

Who we are and how you can contact us

We are Serenity Skin, a doctor-led skin and aesthetic clinic based in Townsville, Queensland. We are committed to protecting your privacy and to respecting and upholding your rights when you attend our clinic, consult with us by telehealth, or use this Site.

You can contact us about any privacy matter:

Email: bookings@serenityskin.au
Phone: (07) 4771 5666
Post: Serenity Skin, 23 Bundock Street, Belgian Gardens QLD 4810

This Privacy Policy explains how we collect, hold, use and disclose data, and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Because we provide health services, we are bound by the Privacy Act regardless of our turnover, and we also comply with our record-keeping and confidentiality obligations as health service providers in Queensland.

This Privacy Policy does not cover information you submit on other websites, even where we communicate with you there. If you post something on Instagram, Facebook or another platform, that information is governed by the privacy policy of that platform.

We will only use your personal information (including sensitive and health information) in compliance with Australian privacy laws, and, to the extent it applies to you, the EU General Data Protection Regulation (GDPR), together with any replacement legislation, regulation, guideline or standard governing the use, storage or transmission of data.

Our role in your privacy

If you are a patient, client, subscriber or simply a visitor to our Site, this Privacy Policy applies to you.

Our responsibilities

As the provider of the services described on this Site, we determine how and why your data is processed. We do not sell or rent your details to any third party. We want you to know exactly what information is collected and how it is used.

Children’s privacy

Where we provide services to, or are likely to be accessed by, individuals under the age of 18, we comply with the requirements of the Children’s Online Privacy Code (COP Code). This may include providing child-friendly privacy notices and limiting the collection and use of personal information from children. Patients under 18 are treated only where clinically appropriate and with the consent of a parent or legal guardian, and we handle their health information with the same protections set out in this policy.

Your responsibilities

Please read this Privacy Policy together with our Website Terms and Conditions and our Cancellation and Refund Policy at https://www.serenityskin.au. If you give us any data relating to another person, you confirm that you are authorised to do so and that we may process that data on your behalf in accordance with this Privacy Policy.

When and how we collect data

From the moment you visit our Site we may be collecting data. Sometimes you provide it directly, by completing a form or booking an appointment; at other times we collect it automatically. We may also collect data when you:

Register as a patient or client of the clinic
Provide us with your medical history, current health concerns, medications, allergies or other clinical details during intake or consultation, including through secure online forms
Attend an in-clinic or telehealth consultation
Book, reschedule or cancel an appointment through our online booking platform
Purchase products, treatments, treatment packages or gift vouchers
Interact with us on social media, or send us a direct message
Complete any sign-up form or landing page, or email us at any of our nominated addresses
Participate in events, promotions, giveaways, surveys or requests for feedback
Are referred to us by, or we correspond with, your general practitioner, specialist or another treating practitioner
Voluntarily submit your data to us for any other reason
Accept our cookies and tracking technologies, which may include services from third parties providing analytics, traffic management, content delivery and load balancing

For more detail on the cookies we use, including those from third-party providers that assist with performance, analytics and functionality, see the cookies section of this policy.

Types of data we may collect

To provide our services, operate our Site and meet our legal obligations, we may collect different types of personal information. The type and amount depends on how you interact with us, the services you receive, and the permissions you give us. This may include:

Contact details (name, date of birth, address, email, phone number)
Emergency contact and, where relevant, parent or guardian details
Medicare number, private health fund details and concession details, where applicable
Financial information (payment details when you make a purchase or pay a deposit)
Medical and health information, including medical history, current conditions, medications, allergies, prior treatments and test results
Health information received from your other treating practitioners, with your consent
Clinical photographs of treatment areas taken before, during and after a procedure, for treatment planning, clinical documentation and, where you give express and separate written consent, for marketing. All images are stored securely
Skin imaging and diagnostic results, including imaging taken during a skin consultation
Records of the products, treatments and services you purchase, and your appointment history
Data about your experience with our Site, our products and our services
Data that identifies your device (IP address, login, browser type, time zone, browser plugins, geolocation, operating system and version) — we do not link this with your clinical records
Data on how you use our Site (pages viewed, links clicked, time spent on pages and other actions)
Technical data collected through third-party services such as content delivery networks or font services, used to improve the performance and functionality of our Site
Data relating to your attendance at any seminar, event, webinar or information session we hold

Use and disclosure of your data

We are only permitted to use your data for specific reasons and where we have a legal basis to do so. We use your data for the purpose for which it was collected and for related purposes, including:

Providing medical, skin and aesthetic consultations, treatments and aftercare
Assessing your suitability for treatment and developing your treatment plan
Operating our Site and managing your bookings
Patient and customer support
Tracking your treatment and purchase history
Detecting and preventing fraud
Improving our Site and our services
Market research, including contacting you for feedback about your experience
Providing you with information about events, products, services or opportunities that may be of interest
Marketing, with your consent
Monitoring your compliance with our Website Terms and Conditions

We may also use and disclose your personal data for secondary purposes, such as:

Quality assurance and clinical governance
Research and education, generally in de-identified form
Administrative, billing, insurance and debt-recovery purposes
As required or authorised by law
With your consent
Within our business and to our personnel who need the information to do their job
To send you marketing material, with your consent
To process your participation in promotions and giveaways, including contacting you if you win and, with your consent, displaying your name online or on our social media
To share with third parties who enable us to provide our products and services

Sensitive and health information

Collection

We collect sensitive information, including health information, from our patients and clients with their consent and only for purposes directly related to their care.

The types of sensitive information we may collect include personal details, medical history, current health conditions, medications, allergies, test and imaging results, clinical photographs, and any other information required for the provision of care.

We collect sensitive information through face-to-face consultations, telehealth consultations, phone calls, online intake forms and other secure electronic means.

Use

We use sensitive information for the purpose of providing medical, skin and aesthetic care to our patients and clients. This includes treatment planning, documenting services, prescribing where clinically appropriate, and ensuring continuity of care.

Sensitive information may also be used for administrative purposes such as appointment scheduling, billing, insurance and quality improvement activities.

We may use de-identified information for research, education and statistical purposes, in a way that protects patient identity.

Clinical photography

Clinical photographs are taken only with your consent and are stored securely as part of your clinical record. Consent to clinical photography for your own treatment record is separate from consent to use any image for marketing, education or publication. You may withdraw consent to marketing use at any time by contacting us, and we will cease further use, although we cannot recall material already printed or distributed.

Disclosure

We disclose sensitive information to other healthcare professionals and organisations involved in your care on a need-to-know basis and with your consent, except where the law requires or permits disclosure without consent. This may include your general practitioner, a specialist to whom you are referred, a pathology or imaging provider, or a third-party prescriber or compounding pharmacy.

We may disclose sensitive information to government agencies, regulatory bodies and insurers where required by law, or for insurance claims, adverse-event reporting and compliance purposes.

We do not disclose sensitive information to third parties for marketing or commercial purposes.

Storage and security

We take all reasonable steps to ensure sensitive information is stored securely and protected from unauthorised access, loss, misuse or disclosure. Electronic records are stored securely and encrypted, and any physical records are kept in locked cabinets or secure storage. We regularly review and update our security measures.

Doxxing and data misuse

The unauthorised publishing or sharing of personal data online, commonly referred to as doxxing, is strictly prohibited. We take all necessary steps to protect personal data, and any misuse of data may result in legal action, including criminal charges, under Australian privacy law.

Choosing not to provide personal data

You can choose not to provide us with personal data. However, if you do, we will not be able to provide you with consultations, treatments or products, as we cannot safely treat you without an accurate health history. You can continue to browse our Site.

Marketing

Before we collect data from you we will tell you what we intend to use it for, including whether we intend to use it for marketing and whether third parties are involved. Where consent is required we will obtain it, and you can withdraw that consent at any time.

You can opt out of marketing by:

Contacting us at bookings@serenityskin.au or on (07) 4771 5666; or
Using the unsubscribe link in any marketing email you receive from us.

Our marketing complies with the Therapeutic Goods Act 1989 (Cth) and the Therapeutic Goods Advertising Code, and with the advertising guidelines issued by the Australian Health Practitioner Regulation Agency (AHPRA) and the national boards. We do not advertise prescription-only medicines to the public and we do not use testimonials about clinical care in our advertising.

SMS and appointment notifications

By providing your phone number you agree to receive text messages from us about your appointments, including confirmations, reminders and changes. If you opt in to SMS marketing, you also agree to receive promotional messages. Message and data rates may apply.

We collect and store your phone number for these purposes. We do not share your phone number with third parties except as needed to deliver these messages or where required by law.

You can opt out of SMS marketing at any time by replying STOP to any marketing message. Once you opt out you will no longer receive SMS marketing, but you may still receive essential transactional messages about your appointments and orders.

Cookies and how to block them

Our Site uses cookies and similar technologies to provide certain functionality. Cookies are small data files placed on your device, often including an anonymous unique identifier. They can also be used to analyse traffic and for advertising and marketing purposes. They do not harm your system, and the help function in your browser will tell you how to restrict or block them.

You can turn off cookies by changing your browser settings, and you can delete cookies through those settings. For more information about cookies and how to disable them, visit http://www.allaboutcookies.org. If you block all cookies, you may not be able to access all or parts of our Site.

Web beacons

We may use web beacons (or clear gifs) on our Site and in our emails. When we send emails we can track behaviour such as who opened the email and which links were clicked, and collect information such as your IP address and browser or email type. We use this to improve the performance of our email campaigns and to provide services that better suit your needs. You can always opt out by clicking the unsubscribe link in any email.

Meta insights

We use Meta Insights and Meta Analytics to understand how you interact with our content on our Facebook and Instagram pages. This helps us measure engagement and improve what we offer. For details on how Meta collects and uses your data, see Meta’s Privacy Policy at https://www.facebook.com/privacy/policy/.

If you would prefer not to receive personalised ads on Facebook based on this data, you can change your ad preferences in your Facebook settings under Ad Preferences.

Use of artificial intelligence

We may use secure third-party AI-powered software to assist with non-clinical tasks such as consultation transcription, administrative record-keeping and clinical note drafting. These tools support efficiency and service quality.

All data processed through AI systems is handled in accordance with this Privacy Policy and applicable privacy laws. No AI tool is used to provide a medical diagnosis or to make a treatment decision. Where required by law, we will obtain your consent before using such technology in your care.

Your rights

You can exercise your rights at any time by contacting us at bookings@serenityskin.au or on (07) 4771 5666.

Accessing information we hold about you

You may request access to the personal and health information we hold about you. We will respond within 30 days of your request, unless doing so would adversely affect the rights and freedoms of others, pose a serious threat to the life, health or safety of any person, or where access is otherwise restricted by law. If we cannot comply with your request we will tell you why. An administrative fee may apply to the cost of retrieving and copying records, and we will tell you the amount before proceeding.

Correcting inaccurate information

You can ask us to correct any information we hold about you that you believe is inaccurate, out of date, incomplete or misleading. Where a clinical record cannot be altered, we will add a notation recording your view.

Profiling and automated decisions

We may use your personal information to understand which products, services or information are most relevant to you, for example by tailoring our communications based on your interactions with us. These activities are administrative and marketing-related and do not involve automated decision-making that produces legal or similarly significant effects.

In limited circumstances we may use automated tools to support operational or compliance processes. Where we do, we take reasonable steps to ensure transparency and oversight. Contact us if you would like more information about how these processes work.

The right to be forgotten

You may request that your data be erased. We will delete the information we hold about you, except to the extent we are required to retain it under our legal and professional obligations. Health records must generally be retained for at least seven years from the date of last service, or, for a patient who was a child, until they turn 25.

Making a complaint

If you have a complaint about how your data has been handled, please contact us first at bookings@serenityskin.au so we can try to resolve it. If you are not satisfied with our response, you may seek a review by contacting the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.

If you are located in the European Union and believe your data has been mishandled, you may lodge a complaint with your local data protection authority, which you can find through the European Data Protection Board at https://edpb.europa.eu/about-edpb/board/members_en.

Under Australian privacy law, individuals may have the right to take legal action for serious invasions of privacy, including misuse of private information or unreasonable intrusion into their private affairs. If you believe your personal information has been intentionally or recklessly mishandled in a way that constitutes a serious invasion of privacy, you may be entitled to seek remedies, including compensation, in addition to making a complaint to the OAIC or another relevant authority.

Security of the data we collect

We know you trust us to protect your data. While we cannot guarantee the security of any information you transmit to or receive from us, we take that responsibility seriously and maintain reasonable and appropriate physical, electronic and procedural safeguards, including:

Firewalls and secure network configuration
Password-protected access to systems and accounts, with access limited to personnel who need it
Storing electronic data with reputable third-party providers who have appropriate security protections
Using payment providers who are PCI DSS compliant
Not storing your full payment card details
Staff training on privacy and confidentiality obligations

Payment security

All real-time credit card authorisations are handled by secure third-party gateway providers. The following measures protect your data:

Payments are fully automated with an immediate response
Your complete credit card number cannot be viewed by us or any outside party
All transaction data is encrypted for storage within the gateway provider’s bank-grade data centre
Our gateway provider is an authorised third-party processor for the major Australian banks
Our gateway provider does not hold your funds; monies are transferred directly from your card to our merchant account

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for all organisations that handle branded credit cards from the major card schemes. PCI DSS requirements help ensure the secure handling of credit card information through our Site and our service providers. While we take care to protect the information in our possession, no security system is perfect and we cannot promise that information about you will remain secure in all circumstances.

Data breach response and notification

Despite the measures we have in place, no system is completely secure. In the event of a data breach that is likely to result in serious harm to the individuals affected, we will comply with our obligations under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth). This includes:

Promptly assessing the suspected breach and taking reasonable steps to contain and remediate it
Notifying affected individuals and the OAIC where required by law
Including in those notifications the nature of the breach, the type of information involved, and the steps affected individuals can take to reduce potential harm

Where we store data

We use reputable third-party service providers to store and process data on our behalf, including our practice-management and online booking platform. Some of these providers may store or process data on servers located outside Australia.

We may share your data with overseas organisations in countries or under privacy frameworks approved by the Australian Government, which are considered to have privacy protections similar to Australia’s. Where this occurs, we take steps to ensure your data remains protected in line with Australian privacy laws.

How long we store data for

We retain your data for as long as is reasonably necessary for the purposes for which it was collected and as required by Australian law. Health records are retained for a minimum of seven years from the date of last service, or, where the patient was a child, until they turn 25. Financial records are kept for the period required by Australian tax law. Once we no longer require your information, we will securely destroy it or de-identify it.

Third parties who access your data

We share data with third parties in the following circumstances:

Our suppliers and service providers, including our practice-management and online booking platform, our payment processor, and our accounting software
Other treating health practitioners, pathology and imaging providers, and third-party prescribers or pharmacies involved in your care
Government bodies such as Medicare or Services Australia, for the purposes of claiming and verifying healthcare benefits and entitlements
Our professional and legal advisers, and our insurers
Third parties engaged in fraud prevention and detection
Law enforcement and other government authorities where required or authorised by law
Social media and analytics providers such as Meta and Google, for audience generation and advertising targeting, using data that does not include your clinical records
Email and marketing platforms that enable us to keep you informed of appointments, offers, newsletters and clinic news

We share data where we have your consent to do so or where we are otherwise legally permitted.

Age of consent

By using this Site you warrant that you are at least 18 years of age, or that you have the consent of a parent or legal guardian. Our Site is not intended for use by children, and we do not knowingly collect data online from anyone under 18 without parental or guardian consent.

Governing law

This Privacy Policy and your use of this Site are governed in all respects by the laws of Queensland and the Commonwealth of Australia.

Updates to our Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal or regulatory reasons. Please check back periodically. The current effective date is always shown at the top of this policy so you know you are reading the latest version.