Privacy Policy - MD Cosmetic Nurse

Michelle Lorraine Dodd t/as MD Cosmetic Nurse (ABN 74 934 421 293) (“we”, “us” or “MD Cosmetic Nurse”) is committed to privacy protection. At https://mdcosmeticnurse.com.au/ (“this site”), we understand the importance of keeping personal information private and secure. This privacy policy (“Privacy Policy”) describes generally how we manage personal information and safeguard privacy. If you would like more information, please don’t hesitate to contact us.

This Privacy Policy forms part of, and is subject to the provisions of, our Website Terms of Use (https://mdcosmeticnurse.com.au/termsofuse).

We care about your privacy:

We will never rent, trade or sell your email address to anyone.

We will never publicly display your email address or other personal details that identify you.

The Australian Privacy Principles

We will treat all personal information in accordance with any and all obligations that are binding upon us under the Privacy Act 1988 (Cth) (“Privacy Act”). The Privacy Act lays down 13 key principles in relation to the collection and treatment of personal information, which are called the “Australian Privacy Principles”.

What is “personal information”?

All personal information collected in the course of providing a health service is considered health information under the Privacy Act. In accordance with the Privacy Act, “health information” is:
Information or an opinion about:
1. The health, including an illness, disability or injury, (at any time) of an individual; or
1. An individual’s expressed wishes about the future provision of health services to the individual; or
1. A health service provided, or to be provided, to an individual;
Other personal information collected to provide, or in providing, a health service to an individual; (this includes personal details such as a patient’s name, address, admission and discharge dates, billing information)
Other personal information collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances;
Genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

We collect personal information (including health information) that is necessary for our functions and activities as a cosmetic clinic. Personal information held by the MD Cosmetic Nurse may include your:

name and date of birth and contact details
residential and business postal addresses, telephone/mobile/fax numbers and email addresses
bank account and/or credit card details for agreed billing purposes
Sensitive information such as medical information provided by you and collected by us as part of your treatment file, details of telehealth consultations, medical history, current medications and any allergies you may have.
Medical history and current medications
Information about your cosmetic concerns and treatment preferences
Photographs (with your consent) for treatment planning and progress monitoring
your computer and connection information; and
any information that you otherwise share with us.

Information provided to Timely booking system and Stripe

All purchases that are made through this site are processed securely and externally through the Timely platform and Stripe. TimelyPay uses Stripe, is PCI compliant and supports 3D Secure checkouts. We securely save your credit card information within the Timely Web App using TimelyPay’s secure card processing system.

Unless you expressly consent otherwise, we do not see or have access to any personal information that you may provide to Stripe, other than information that is required in order to process your order and deliver your purchased items to you (eg, your name, email address and billing address).

We may capture your card details and reserve the right to charge your card the applicable cancellation fee upon cancellations.

How we may collect your personal information

At this site, we only collect personal information that is necessary for us to conduct our business at MD Cosmetic Nurse. We collect personal information about you where you provide it to us, or where required by law.

We collect your personal information primarily to enable us to provide you with our services and products, including (without limitation):

when you use our website, for example, if you purchase a treatment or make a booking via our website or if you make a customer account on our website;
if you complete a client for or questionnaire at or before attending our clinic;
register for access to premium content or request certain premium features; or
complete an online contact form to contact us;
entering information int our booking system (Timely) with your contact details and health information and recording that information into our scripting app;
add reviews, forum or chat room messages or comments in any elements of this site that permit user-generated content;
if you contact us via phone or email or social media with a query or complaint;
during treatment consultations; and
if you provide feedback about your experience with us.

By using our website, services, or by providing any personal information to us, you consent to our collection, holding, use, and disclosure of your personal information, as set out in this Privacy Policy.

Information that you provide to us (website)

We may collect information relating to your access and use of our website including social media accounts or apps, IP address, device type, browser information, time and date of access, location data, webpages visited, and other website-related information including through the use of internet cookies.

IP addresses

This site may also collect Internet Protocol (IP) addresses. IP addresses are assigned to computers on the internet to uniquely identify them within the global network. MD Cosmetic Nurse collects and manages IP addresses as part of the service of providing internet session management and for security purposes. MD Cosmetic Nurse may also collect and use web log, computer and connection information for security purposes and to help prevent and detect any misuse of, or fraudulent activities involving, this site.

Cookies

This site uses “cookies” to help personalise your online experience. A cookie is a text file or a packet of information that is placed on your hard disk by a web page server to identify and interact more effectively with your computer. There are two types of cookies that may be used at this site: a persistent cookie and a session cookie. A persistent cookie is entered by your web browser into the “Cookies” folder on your computer and remains in that folder after you close your browser, and may be used by your browser on subsequent visits to this site. A session cookie is held temporarily in your computer’s memory and disappears after you close your browser or shut down your computer. Cookies cannot be used to run programs. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you. In some cases, cookies may collect and store personal information about you. MD Cosmetic Nurse extends the same privacy protection to your personal information, whether gathered via cookies or from other sources.

You can configure your internet browser to accept all cookies, reject all cookies or notify you when a cookie is sent. Please refer to your internet browser’s instructions to learn more about these functions. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of this site.

Why we use cookies

This site uses cookies in order to:

remember your preferences for using this site;
facilitate e-commerce transactions, to ensure that your order is remembered between pages during the checkout process;
show relevant notifications to you (eg, notifications that are relevant only to users who have, or have not, subscribed to newsletters or email or other subscription services); and
remember details of data that you choose to submit to us (eg, through online contact forms or by way of comments, forum posts, chat room messages, reviews, ratings, etc).

Many of these cookies are removed or cleared when you log out but some may remain so that your preferences are remembered for future sessions.

Third party cookies

In some cases, third parties may place cookies through this site. For example:

Google Analytics, one of the most widespread and trusted website analytics solutions, may use cookies de-identified data about how long users spend on this site and the pages that they visit;
Google AdSense, one of the most widespread and trusted website advertising solutions, may use cookies to serve more relevant advertisements across the web and limit the number of times that a particular advertisement is shown to you; and
third party social media applications (eg, Facebook, Twitter, LinkedIn, Pinterest, YouTube, Instagram, etc) may use cookies in order to facilitate various social media buttons and/or plugins in this site.

How we may use your personal information

Your personal information may be used in order to:

verify your identity;
assist you to place orders through the website;
process any purchases of services that you may make through the website, including charging, billing and collecting debts;
share information with Fresh Clinics Pty Ltd who provide scripting services;
respond to any queries or feedback that you may have;
conduct appropriate checks for credit-worthiness and for fraud;
prevent and detect any misuse of, or fraudulent activities involving, this site;
conduct research and development in respect of our services;
gain an understanding of your information and communication needs or obtain your feedback or views about our services in order for us to improve them; and/or
maintain and develop our business systems and infrastructure, including testing and upgrading of these systems,

and for any other purpose reasonably considered necessary or desirable by the MD Cosmetic Nurse in relation to the operation of our business.

From time to time we may email our customers with news, information and offers relating to our own services or those of selected partners. Your personal information may also be collected so that MD Cosmetic Nurse can promote and market products and services to you. This is to keep you informed of products, services, and special offers we believe you will find valuable and may continue after you cease acquiring products and services from us. If you would prefer not to receive promotional or other material from us, please let us know and we will respect your request. You can unsubscribe from such communications at any time if you choose.

When we may disclose your personal information

In accordance with the Privacy Act, we may use or disclose your health information for the following purposes:

For the primary purpose for which it was collected, i.e., to provide you with cosmetic and health services;
For a directly related secondary purpose that you would reasonably expect;
With your consent (express or implied);
When required or authorized by law;
For research or statistical purposes, with your consent or in accordance with ethical guidelines;
To lessen or prevent a serious threat to public health or safety;
For the management, funding or monitoring of a health service;
To assist in locating a missing person;
For the defense of a legal claim.

We use and disclose your personal information in our business in the following ways:

providing cosmetic and medical services
to communicate with you about your treatment
administrative and billing purposes
create a record of your treatments and preferences
with your consent, publish before and after treatment images on our website;
with your consent, contact you to provide information about our products, services, and special offers;
obtain feedback from you about our products and services;
record statistical data for our internal marketing analysis;
comply with legal and regulatory obligations, carry out internal audits or investigations, prevent fraud or other unlawful activities, or ensure the safety and security of you and us;
enable our medical practitioners to provide you medical consultation for your treatments and any post-treatment review and consultation;
record quantitative and qualitative medical and treatment data for internal medical and treatment analysis and research;
fulfil purposes that are reasonably necessary or ancillary to the abovementioned purposes; and
fulfil any other purposes which we may have notified you prior to, or at the time of, obtaining your consent.

We may disclose your information to:

Other healthcare providers involved in your care including other medical practitioners, allied health practitioners, hospitals, suppliers and health funds Government institutions when required by law and if applicable (eg the Department of Veterans’ Affairs and the Department of Human Services) and insurance companies involved in claims
Third-party service providers (e.g., IT services, payment processors).

Your personal information may also be disclosed to applicable organisations in relation to our website, and MD Cosmetic Nurse takes reasonable steps to ensure that these organisations are bound by confidentiality and privacy obligations in relation to the protection of your personal information.

These organisations may carry out or provide:

customer enquiries;
mailing systems;
billing and debt-recovery functions;
information technology services;
marketing, telemarketing and sales services;
market research; and
website usage analysis.

In addition, we may disclose your personal information to:

your authorised representatives or legal advisers (when requested by you to do so);
credit-reporting and fraud-checking agencies;
credit providers (for credit-related purposes such as creditworthiness, credit rating, credit provision and financing);
our professional advisers, including our accountants, auditors and lawyers;
government and regulatory authorities and other organisations, as required or authorised by law;
organisations who manage our business strategies, including those involved in a transfer/sale of all or part of our assets or business (including accounts and trade receivables) and those involved in managing our business risk and funding functions; and
the police or other appropriate persons where your communication suggests possible illegal activity or harm to others.
If you do not wish for your personal information to be disclosed to another organisation please indicate at the time your information is collected. This will be noted on your patients and/or client records and every effort will be made to respect this wish.

Contacting us about privacy

If you would like more information about the way we manage personal information that we hold about you, or are concerned that we may have breached your privacy, please contact us by email to info@mdcosmeticnurse.com.au or by post.

Access to your personal information

In most cases, you may have access to personal information that we hold about you. We will handle requests for access to your personal information in accordance with the Australian Privacy Principles.

All requests for access to your personal information must be directed to the Privacy Officer by email using the email address provided above or by writing to us at our postal address. We will deal with all requests for access to personal information as quickly as possible. Requests for a large amount of information, or information that is not currently in use, may require further time before a response can be given. We may charge you a fee for access if a cost is incurred by us in order to retrieve your information, but in no case will we charge you a fee for your application for access.

In some cases, we may refuse to give you access to personal information that we hold about you. This may include circumstances where giving you access would:

be unlawful (eg, where a record that contains personal information about you is subject to a claim for legal professional privilege by one of our contractual counterparties);
have an unreasonable impact on another person’s privacy; or
prejudice an investigation of unlawful activity.

We may also refuse access where the personal information relates to existing or anticipated legal proceedings, and the information would not be accessible by the process of discovery in those proceedings.

If we refuse to give you access, we will provide you with reasons for our refusal.

Correcting your personal information

We will amend any personal information about you that is held by us and that is inaccurate, incomplete or out of date if you request us to do so. If we disagree with your view about the accuracy, completeness or currency of a record of your personal information that is held by us, and you ask us to associate with that record a statement that you have a contrary view, we will take reasonable steps to do so.

If you believe we have breached your privacy, please contact our Privacy Officer. We will investigate your complaint and respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

Storage and security of your personal information

We are committed to maintaining the confidentiality of the information that you provide us and we will take all reasonable precautions to protect your personal information from unauthorised use or alteration.

In our business, personal information may be stored both electronically (on our computer systems and with our website hosting provider) and in hard-copy form. Firewalls, anti-virus software and email filters, as well as passwords, protect all of our electronic information. Likewise, we take all reasonable measures to ensure the security of hard-copy information.

We destroy or de-identify your personal information when the purpose for which it was collected no longer exists, if you have asked us to remove it from our records, if you have withdrawn your consent to our collection of your sensitive or health information, or where we are no longer required by law to keep it.

Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorized access, modification, or disclosure. This includes secure storage systems, staff training, and regular security audits.

Payment Card Industry Data Security Standard (PCI DSS) Compliance

MD Cosmetic Nurse is committed to maintaining the security of your payment card information. We comply with the Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account data security. Our compliance with this standard includes:
Maintaining a secure network for processing credit card transactions
Encrypting transmission of cardholder data across open, public networks
Regularly monitoring and testing our networks
Maintaining an information security policy
Restricting access to cardholder data on a need-to-know basis.
All payment processing is handled through PCI DSS compliant third-party payment processors, Timely and Stripe.

Third party websites

You may click-through to third party websites from this site, in which case we recommend that you refer to the privacy statement of the websites you visit. This Privacy Policy applies to this site only and the MD Cosmetic Nurse assumes no responsibility for the content of any third party websites.

Re-marketing

We may use the Google AdWords and/or Facebook re-marketing services to advertise on third party websites to previous visitors to this site based upon their activity on this site. This allows us to tailor our marketing to better suit your needs and to only display advertisements that are relevant to you. Such advertising may be displayed on a Google search results page or a website in the Google Display Network or inside Facebook. Google and Facebook may use cookies and/or pixel tags to achieve this. Any data so collected by Google and/or Facebook will be used in accordance with their own respective privacy policies. None of your personal Google and/or Facebook information is reported to us.

You can set preferences for how Google advertises to you using the Google Ads Settings page (https://www.google.com/settings/ads). Facebook has enabled an AdChoices link that enables you to opt out of targeted advertising.

GDPR

The Company welcomes the General Data Protection Regulation (“GDPR”) of the European Union (“EU”) as an important step forward in streamlining data protection globally. Although we do not operate an establishment within the EU and do not target any offering of services towards clients in the EU specifically, we intend to comply with the data handling regime laid out in the GDPR in respect of any personal information of data subjects in the EU that we may obtain.

GDPR rights

The requirements of the GDPR are broadly similar to those set out in the Privacy Act and include the following rights:

you are entitled to request details of the information that we hold about you and how we process it. For EU residents, we will provide this information for no fee;
you may also have a right to:
have that information rectified or deleted;
restrict our processing of that information;
stop unauthorised transfers of your personal information to a third party;
in some circumstances, have that information transferred to another organisation; and
lodge a complaint in relation to our processing of your personal information with a local supervisory authority; and
where we rely upon your consent as our legal basis for collecting and processing your data, you may withdraw that consent at any time.

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. However, please be aware that:

such objection or withdrawal of consent could mean that we are unable to provide our services to you, and could unduly prevent us from legitimately providing our services to other clients subject to appropriate confidentiality protections; and
even after you have chosen to withdraw your consent, we may be able to continue to keep and process your personal information to the extent required or otherwise permitted by law, in particular:
to pursue our legitimate interests in a way that might reasonably be expected as part of running our business and which does not materially impact on your rights, freedoms or interests; and
in exercising and defending our legal rights and meeting our legal and regulatory obligations.

Storage and processing by third parties

Data that we collect about you may be stored or otherwise processed by third party services with data centres based outside the EU, such as Google Analytics, Microsoft Azure, Amazon Web Services, Apple, etc and online relationship management tools. We consider that the collection and such processing of this information is necessary to pursue our legitimate interests in a way that might reasonably be expected (eg, to analyse how our clients use our services, develop our services and grow our business) and which does not materially impact your rights, freedom or interests.

The Company requires that all third parties that act as “data processors” for us provide sufficient guarantees and implement appropriate technical and organisational measures to secure your data, only process personal data for specified purposes and have committed themselves to confidentiality.

Duration of retention of your data

We will only keep your data for as long as is necessary for the purpose for which it was collected, subject to satisfying any legal, accounting or reporting requirements. At the end of any retention period, your data will either be deleted completely or anonymised (for example, by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning). In some circumstances, you can ask us to delete your data.

Keeping your information up-to-date

To ensure that your personal information is accurate and up to date, please promptly advise us of any changes to your information by contacting our data protection officer by email at info@mdcosmeticnurse.com.au or by post.

Changes to this Privacy Policy

From time to time, it may be necessary for us to revise this Privacy Policy. Any changes will be in accordance with any applicable requirements under the Privacy Act and the Australian Privacy Principles. We may notify you about changes to this Privacy Policy by posting an updated version on this site.

* * * *

If you require any further information about the Privacy Act and the Australian Privacy Principles, you can visit the Federal Privacy Commissioner’s website (see www.privacy.gov.au).