Last updated 15 November 2026
Privacy policy
Draft for staging: items in [brackets] are filled in before launch, and a lawyer reviews this page.
- Your clinic owns its dataWe store your clients' information for you, in your own database.
- Kept in AustraliaClinic databases and files are hosted in Sydney.
- Never soldWe do not sell or rent personal information, or use it for our own advertising.
1. Two kinds of information
About our customers (clinic owners and staff): name, business details, email, phone, sign-in details, billing records and support conversations. We decide how this is used.
About your clinic's clients: contact details, bookings, purchases, consent forms, health questionnaires, treatment notes and photos. Your clinic decides how this is used; we process it only to provide the service to your clinic, on your instructions.
2. Why we use it
- To run your account, take payments, send invoices and give support.
- To send the messages your clinic sets up (booking confirmations, reminders, aftercare), and marketing only to clients who agreed.
- To keep the service secure, back it up and fix faults.
3. Health information and AI
Consent answers, health questionnaires, treatment notes and before/after photos are health information. Only staff your clinic allows can see them, every view is logged, and photos are kept in private storage.
Our AI features never use health information. They work only with bookings, services, sales and settings. We do not use your clinic's data to train AI models.
4. Service providers and overseas
We use trusted providers to run the service: database and file hosting (Sydney), website hosting, payments, email and SMS delivery, error monitoring and AI. Some of these process limited information outside Australia, mainly in the United States. A current list is at [LINK].
5. Security
- Every clinic has its own separate database. One clinic's data is never stored with another's.
- Encrypted connections, two-factor sign-in for owners and managers, permissions per staff role, audit logs and encrypted nightly backups.
- If a data breach is likely to cause serious harm, we tell the affected clinic and the Office of the Australian Information Commissioner as the law requires.
6. How long we keep it
While your account is active, and for 90 days after it closes so you can export your data. Then it is permanently deleted. Clinics remain responsible for keeping client health records for the period the law requires (see Billing & refunds, section 5). Billing records are kept for 7 years for tax.
7. Access, correction and complaints
Clinic owners can see, correct and export their data in the app. Clinic clients should contact their clinic first. For anything else, email [privacy@beautylabsupply.com.au]; we reply within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, for health information in Victoria, the Health Complaints Commissioner (hcc.vic.gov.au).