Privacy Policy

Last updated: October 2026

ELIIXA respects your privacy and is committed to protecting the personal and health information entrusted to us.

This Privacy Policy explains how ELIIXA collects, holds, uses, discloses, stores and protects personal information and health information in connection with our clinic, treatments, consultations, website, online bookings, communications and related services.

This policy applies to information collected in person, online, by telephone, by email, through booking and client management systems, through forms and questionnaires, and through other interactions with ELIIXA.

1. Privacy Laws That Apply

ELIIXA handles personal and health information in accordance with applicable Australian privacy requirements, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records Act 2001 (Vic), including the Health Privacy Principles, where applicable.

Health information is sensitive information and is treated with additional care.

Nothing in this policy limits any privacy or health information rights that cannot lawfully be excluded.

2. Personal Information We May Collect

Depending on your interaction with ELIIXA, we may collect information including:

• your name, date of birth and contact details
• address and postcode
• emergency contact details
• appointment and booking information
• payment and transaction information
• communications with ELIIXA
• feedback, enquiries and complaints
• website and device information where applicable
• other information reasonably necessary to provide or administer our services.

3. Health and Sensitive Information

Where relevant to your treatment or care, ELIIXA may collect health and sensitive information including:

• medical history and relevant medical conditions
• medications and supplements
• allergies and sensitivities
• pregnancy or breastfeeding information where clinically relevant
• skin history, skin conditions and treatment concerns
• previous cosmetic, medical, laser, skin or surgical procedures
• contraindications and treatment suitability information
• relevant family or lifestyle information where necessary for safe treatment
• information supplied during consultations and reviews
• adverse reactions, complications and treatment outcomes.

We only collect health and sensitive information where it is reasonably necessary for our functions and permitted by law.

4. Clinical Records

ELIIXA maintains clinical records to support safe, appropriate and continuous care.

Clinical records may include consultation notes, treatment plans, consent forms, treatment dates, treatment settings and parameters, practitioner notes, prescriptions or prescribing information where applicable, clinical photographs, treatment outcomes, adverse reactions, aftercare information and follow up communications.

Clinical records are confidential health information and are not used or disclosed outside permitted purposes except with appropriate consent or where otherwise permitted or required by law.

5. Clinical Photographs and Videos

ELIIXA may take photographs or videos where reasonably required for assessment, treatment planning, clinical documentation, monitoring progress, continuity of care or other legitimate clinical purposes.

Clinical images form part of your confidential health record.

Where clinical images are required, we will handle them in accordance with applicable privacy requirements and take reasonable steps to protect them from unauthorised access, use or disclosure.

Consent to clinical photography does not constitute consent to publish or use an image for advertising, social media, promotional or other public purposes.

6. Marketing Photographs and Content

ELIIXA will obtain separate appropriate consent before using identifiable photographs, videos or other client material for advertising, marketing, social media, website content, promotional material or other public communications.

Refusing marketing photography or content consent will not affect your access to appropriate treatment.

Where permitted, consent for future marketing use may be withdrawn by contacting ELIIXA. Withdrawal will apply to future use. ELIIXA may not always be able to retrieve material that has already been lawfully published, distributed or shared outside systems under our control.

Any marketing use remains subject to applicable health practitioner advertising, privacy and other legal requirements.

7. How We Collect Information

We generally collect information directly from you, including when you:

• make an enquiry or booking
• complete a consultation, consent or intake form
• attend the clinic
• communicate with us by telephone, SMS or email
• use our website or online booking system
• purchase a product, treatment, package or gift card
• participate in a consultation, treatment or review
• provide photographs or other information to us.

We may also receive information from an authorised representative, treating practitioner, prescriber, referring health provider, pharmacy, booking or payment provider, or another person or organisation where you have authorised the disclosure or where collection is otherwise permitted by law.

8. Why We Collect and Use Information

We may collect, use and disclose information where reasonably necessary to:

• assess treatment suitability and safety
• provide consultations, treatments and aftercare
• develop and manage treatment plans
• maintain accurate clinical records
• manage bookings, reminders and appointment administration
• process payments and purchases
• communicate with you about your care
• respond to enquiries, complaints and treatment concerns
• coordinate care with authorised health practitioners and providers
• meet legal, regulatory, professional, insurance and record keeping obligations
• maintain clinic safety, quality assurance and business administration
• protect against fraud, misuse or unlawful activity
• send marketing communications where you have provided the required consent or where otherwise permitted by law.

9. Consent

Where consent is required, ELIIXA may obtain express or implied consent depending on the information and circumstances.

Health information will generally be collected with your consent unless another lawful basis permits or requires collection.

Consent for treatment, consent for clinical photography and consent for marketing or publication are separate matters and may be obtained separately.

10. If You Do Not Provide Information

You are not required to provide personal information simply to make a general enquiry where identification is not reasonably necessary.

However, ELIIXA requires sufficient accurate information to assess and provide clinical services safely.

If you do not provide relevant medical, health, identity or treatment information, we may be unable to assess your suitability, provide a requested treatment, prescribe or arrange a regulated treatment, process a transaction or meet our legal and professional obligations.

11. Information from Third Parties

Where reasonable and practicable, ELIIXA will collect personal and health information directly from you.

In some circumstances we may receive information from another person or organisation, including an authorised representative, parent or guardian, treating health practitioner, prescriber or other provider involved in your care.

Where required, we will take reasonable steps to ensure you are aware of the collection.

12. Disclosure to Health Practitioners and Providers

Where reasonably necessary to provide or coordinate your care, and where permitted by law, ELIIXA may disclose relevant information to appropriately involved health practitioners or providers.

These may include registered nurses, medical practitioners, authorised prescribers, pharmacies, pathology or laboratory services, emergency health providers or another practitioner involved in your treatment or follow up care.

We will only disclose information that is reasonably necessary for the relevant purpose.

13. Service Providers and Other Third Parties

ELIIXA may use third party providers to support the operation of the clinic and delivery of services. These may include:

• appointment booking and client management systems
• clinical record and electronic form providers
• payment processors
• website hosting and technology providers
• cloud storage and information technology providers
• email and SMS communication providers
• accountants, insurers and professional advisers
• professional or regulatory bodies where required or authorised by law.

Third party providers are expected to handle information for authorised purposes and with appropriate safeguards.

ELIIXA does not sell client health information.

14. Appointment and Clinical Communications

By providing your contact details, you acknowledge that ELIIXA may contact you where reasonably necessary regarding bookings, appointment reminders, forms, payments, treatment preparation, aftercare, reviews and other matters connected with your care or transactions.

These communications are separate from marketing communications.

15. Marketing Communications

ELIIXA may send information about clinic services, products, events, education or promotions where permitted by law.

Health information will not be used for direct marketing unless the required consent has been obtained.

You may withdraw marketing consent or unsubscribe from marketing communications at any time using the unsubscribe facility provided or by contacting ELIIXA.

Opting out of marketing will not prevent ELIIXA from sending communications reasonably necessary for appointments, treatment, aftercare, safety, payments or administration.

16. Social Media and Messaging

ELIIXA may communicate through social media or messaging platforms where appropriate. Third party platforms operate under their own privacy practices and are not controlled by ELIIXA.

Clients should avoid sending highly sensitive medical information, identification documents or urgent medical concerns through public comments or unsecured social media channels.

Where information provided through social media is relevant to your care, ELIIXA may transfer or record that information in the appropriate client or clinical record.

17. Website, Cookies and Analytics

When you use our website, certain technical information may be collected automatically, including IP address, device and browser information, pages visited, date and time of access and similar usage information.

Our website and service providers may use cookies, pixels or similar technologies for functionality, security, analytics and, where permitted, advertising measurement.

You may be able to manage cookies through your browser or device settings. Disabling certain technologies may affect website functionality.

18. Payment Information

Payments may be processed by third party payment providers.

ELIIXA may receive transaction information and limited payment details necessary to administer a purchase, refund or account. Payment providers may separately collect and process payment information under their own privacy policies and security requirements.

ELIIXA does not intentionally retain complete payment card information where it is not necessary to do so.

19. Storage and Security

ELIIXA takes reasonable steps to protect personal and health information from misuse, interference, loss and unauthorised access, modification or disclosure.

Measures may include access controls, passwords, secure electronic systems, staff confidentiality requirements, restricted access to clinical records, secure storage and appropriate technology safeguards.

No electronic system is completely risk free. If ELIIXA becomes aware of a suspected privacy or security incident, we will assess and respond to it in accordance with applicable law.

20. Overseas Processing and Storage

Some technology or service providers used by ELIIXA may process, host or store information outside Victoria or Australia.

Where cross border disclosure or storage occurs, ELIIXA will take reasonable steps required by applicable privacy law to ensure appropriate protections are in place.

The countries in which information is processed may vary depending on the service providers used by ELIIXA from time to time.

21. Access to Your Personal and Health Information

You may request access to personal and health information held about you, subject to limited exceptions permitted by law.

ELIIXA may require a request to be made in writing and may require reasonable identification before releasing information.

Access may be provided by inspection, copy, electronic record, summary or another appropriate method depending on the request and applicable law.

A reasonable fee may apply where permitted by law for providing access. We will not charge merely for making an access request.

If access is refused or restricted, ELIIXA will provide the information required by applicable law regarding the reason and available complaint process.

22. Correction of Information

ELIIXA takes reasonable steps to ensure personal and health information is accurate, complete, current, relevant and not misleading for the purpose for which it is held.

You may request correction of information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Where ELIIXA does not agree that a clinical record should be altered, we will deal with the request in accordance with applicable law, which may include attaching a statement recording your position.

23. Transfer to Another Health Service Provider

You may request that relevant health information be made available to another health service provider.

ELIIXA will deal with transfer requests in accordance with the Health Records Act 2001 (Vic) and other applicable requirements.

We may require written authority and sufficient details to verify the receiving provider and securely complete the transfer.

24. Record Retention and Destruction

ELIIXA retains health and clinical records for the periods required by applicable Victorian law and professional requirements.

As a general rule, health records for an adult are retained for at least seven years from the date of the last entry. Records relating to a person who was under 18 when the information was collected are generally retained until that person reaches 25 years of age, subject to applicable legal requirements.

Records may be retained for longer where reasonably required by law, professional obligations, insurance requirements, complaints, claims or other legitimate purposes.

When information is no longer required to be retained, ELIIXA will take reasonable steps to securely destroy or permanently de identify it where permitted by law.

25. Data Breaches

If ELIIXA becomes aware of unauthorised access, disclosure, loss or another suspected data breach, we will take reasonable steps to contain and assess the incident.

Where notification is required under applicable law, including the Notifiable Data Breaches scheme where applicable, ELIIXA will notify affected individuals and the relevant regulator as required.

26. Minors and Authorised Representatives

Where a client is a minor or is unable to manage their own information, ELIIXA may collect information from or communicate with a parent, guardian or other authorised representative where permitted or required by law.

ELIIXA will take reasonable steps to verify authority before providing access to health information or acting on an information request made on another person's behalf.

The privacy rights and interests of the client remain relevant when dealing with parents, guardians and representatives.

27. Anonymity and Pseudonyms

Where lawful and practicable, you may make a general enquiry without identifying yourself or may use a pseudonym.

For clinical treatments and certain transactions, ELIIXA may need to establish your identity in order to provide safe care, maintain accurate health records, process payments or meet legal and professional obligations.

28. Practice Transfer or Closure

If ELIIXA's health service practice is sold, transferred, restructured or closed, health records will be handled in accordance with applicable Victorian health privacy and record keeping requirements.

Where required, reasonable steps will be taken to notify affected clients and preserve appropriate access to their health information.

29. Privacy Complaints

If you have a concern about how ELIIXA has handled your personal or health information, please contact ELIIXA first so that we can investigate and respond.

We may request sufficient details to understand and assess the complaint.

If you are not satisfied with our response, you may have the right to make a complaint to the Office of the Australian Information Commissioner or, for matters within Victorian health privacy jurisdiction, the Victorian Health Complaints Commissioner.

Nothing in this policy limits your right to contact an appropriate regulator.

30. Changes to This Privacy Policy

ELIIXA may update this Privacy Policy from time to time to reflect changes to our services, systems, legal requirements or privacy practices.

The current version will be published on our website with its most recent update date.

31. Contact ELIIXA

For privacy enquiries, access or correction requests, record transfer requests or privacy complaints, please contact ELIIXA using the contact details published on our website.

ELIIXA
Moonee Ponds, Victoria
0423 328 700
info@eliixa.com.au