Privacy Policy
Clinic operator: Menopause Medical Aesthetics Pty Ltd (ACN 701 275 783), registered address [to be completed], trading as Menopause Medical Aesthetics
Privacy Officer: [to be completed]
Version: Revised Version 3 - 3 August 2026
1. INTRODUCTION AND SCOPE
1.1 This Privacy Policy explains how the Clinic Operator identified on the first page, trading as Menopause Medical Aesthetics (Clinic, we, us or our), collects, holds, uses, discloses, secures, provides access to and otherwise handles personal information and health information.
1.2 It applies to the Menopause Medical Aesthetics website, booking pathway, patient portal, telehealth consultations, clinical-care programs, communications and related clinical and administrative services.
1.3 The policy is intended to operate consistently with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), applicable State and Territory health-records legislation, the Notifiable Data Breaches scheme and other applicable laws.
1.4 Using the website acknowledges this policy. It does not, by itself, provide blanket consent for every collection, use or disclosure. Where consent is required, the Clinic will seek consent in a form intended to be informed, voluntary, current and sufficiently specific.
2. SEPARATE ENTITIES AND PRIVACY RESPONSIBILITIES
2.1 The Clinic is the clinical-service provider and is responsible for its clinical records, patient portal, clinical governance, complaints, adverse-event information and health-information handling.
2.2 Skin by MenoWell is a separate education, community and referral business. It is not the Clinic and does not automatically receive or control the Clinic's patient records.
2.3 If a person asks Skin by MenoWell to make a referral, Skin by MenoWell may provide the Clinic with limited referral and contact details only after the person is informed of and agrees to that disclosure. The Clinic then provides its own collection notice before collecting clinical information.
2.4 Pharmacies are independent organisations responsible for their own privacy practices. Information is disclosed to a pharmacy only where authorised, reasonably necessary for the chosen dispensing pathway, or otherwise permitted or required by law.
3. INFORMATION WE MAY COLLECT
3.1 Identity and contact information may include name, date of birth, address, email, telephone number, emergency contact, Medicare details where applicable and identity documents where reasonably required.
3.2 Health information may include medical history, menopause and skin concerns, allergies, current and previous medicines, sensitivities, pregnancy or breastfeeding information where relevant, clinical questionnaires, consultation notes, assessments, pathology, referrals, prescriptions, treatment plans, adverse reactions and follow-up records.
3.3 Clinical images may include photographs voluntarily uploaded or requested for assessment and monitoring. They form part of the health record where used for clinical care.
3.4 Booking and payment information may include appointment details, program enrolment, invoices, transaction references, payment status, refunds, recurring-payment authorisations and delivery details. Full card details are generally handled by the payment processor rather than stored by the Clinic.
3.5 Technical information may include IP address, browser and device information, login and security events, cookies, consent records, page interactions and portal audit logs.
3.6 Communication information may include email, SMS, telephone, support enquiries, complaints and portal messages.
4. HOW INFORMATION IS COLLECTED
4.1 We collect information directly when you browse the website, request information, create an account, book or activate an appointment, complete a health form or consent, upload an image, attend a consultation, enrol in ongoing care, communicate with us or make a payment.
4.2 We may collect information from treating clinicians, your authorised representative, pathology or imaging providers, your chosen pharmacy, payment and identity providers, technology platforms, delivery providers, regulators and other persons where you consent or collection is otherwise permitted or required by law.
4.3 If someone provides information about another person, they must be authorised to do so and provide accurate information.
5. PURPOSES OF COLLECTION AND USE
5.1 We may handle information to verify identity, assess service eligibility, arrange and conduct telehealth consultations, assess clinical suitability, create and maintain records, plan and monitor care, issue or manage prescriptions where clinically appropriate, respond to adverse events and support continuity of care.
5.2 We may use information to administer booking activation, patient accounts, ongoing clinical-care programs, recurring payments, reminders, billing, cancellations, complaints, quality assurance, security, fraud prevention, legal compliance and service operations.
5.3 We may use appropriately de-identified or aggregated information for service evaluation, clinical governance, safety monitoring and operational improvement where lawful and reasonably practicable. Information will be used to develop, test, validate or train the Menopause Medical Aesthetics artificial intelligence-assisted clinical support agent (MMA AI Agent) only in accordance with section 16 and the separate consent described there.
5.4 We will not use clinical information to advertise a prescription medicine or to create an entitlement to prescribing.
6. BOOKING ACTIVATION AND CONSENT RECORDS
6.1 After selecting an appointment and entering card details, a patient must complete the mandatory confirmation and consent gate before the booking is activated.
6.2 We may record the patient identifier, appointment reference, consent wording, accepted-document versions, checkbox state, activation event, date, time, payment reference and technical audit information reasonably required to evidence the transaction, prevent fraud and demonstrate compliance.
6.3 The checkbox is not pre-selected. Failure to complete the activation step means the booking remains inactive and may expire under the booking terms.
6.4 Consent to booking conditions and necessary clinical administration is not consent to marketing, testimonials, research, publication of images or other optional secondary purposes.
7. TELEHEALTH AND CONSULTATION INFORMATION
7.1 Telehealth may involve video, audio, secure messaging, electronic records and digital consent. We use service providers listed or described in Schedule 1.
7.2 Consultations are not recorded by default. We will not record, transcribe, take screenshots of or use consultation audio or video footage for analytics, training or artificial intelligence unless a separate notice is provided and an appropriate express consent or other documented lawful basis applies. Consultation footage is not included in the MMA AI Agent training dataset under the metadata-only consent described in section 16.
7.3 Patients must participate from a private environment and must not record a consultation without the express consent of all participants.
8. CLINICAL PHOTOGRAPHS AND IMAGES
8.1 Clinical photographs may be requested where reasonably necessary for assessment, monitoring or continuity of care. The purpose and upload method will be explained.
8.2 Clinical images are stored as part of the health record and access is limited to authorised persons with a clinical, operational or legal need.
8.3 Images will not be used for marketing, testimonials, social media, public education, publication or model training without separate, specific consent. For the MMA AI Agent, clinical photographs may be processed to remove identifying information and converted into non-identifying metadata, measurements, labels or other derived data. Raw photographs and recognisable facial images will not be included in the MMA AI Agent training dataset under that consent.
8.4 Declining optional use will not affect access to core clinical Services. Withdrawal of optional consent affects future use but may not require removal of records that must be retained by law or reversal of training already lawfully completed using data that had been effectively de-identified and incorporated into the MMA AI Agent before withdrawal was received.
9. CLINICAL RECORDS AND RECORD CONTROL
9.1 The Clinic controls or is responsible for the clinical record system used for its Services, currently expected to include MediRecords or an equivalent approved platform.
9.2 Records may include health forms, consultation notes, assessments, prescriptions, care plans, clinical images, pathology, referrals, correspondence, consent records, adverse-event information and reviews.
9.3 Treating practitioners may also have independent record-keeping obligations. This does not give Skin by MenoWell control of Clinic records.
9.4 Access is role-based and limited to authorised practitioners, workforce members and providers with a legitimate need.
10. DISCLOSURE TO CLINICIANS AND HEALTH PROVIDERS
10.1 Information may be disclosed to treating clinicians and, where reasonably necessary or authorised, pathology providers, imaging providers, referred practitioners, hospitals, emergency services or other health providers.
10.2 The Clinic may disclose information without consent where required or authorised by law, including in a permitted health situation or where necessary to lessen or prevent a serious threat, subject to applicable requirements.
11. PHARMACY CHOICE AND INFORMATION SHARING
11.1 If a prescription is issued, you may request a copy and use a pharmacy of your choice.
11.2 If you want the Clinic to send a prescription to a nominated pharmacy and arrange an order, you must actively tick the separate prescribed-item authorisation box.
11.3 If you do not tick that box, the Clinic will not send the prescription to the nominated pharmacy or arrange an order or delivery. You may make your own pharmacy arrangements.
11.4 Where authorised, the Clinic may disclose the prescription, identity and contact details, delivery information and minimum relevant clinical information reasonably necessary for dispensing, counselling, supply and safety.
11.5 The pharmacy handles information under its own privacy policy and legal obligations. Pharmacy prices, payment, supply and delivery are separate from Clinic fees and Services.
12. OTHER DISCLOSURES AND SERVICE PROVIDERS
12.1 We may disclose information to booking, patient-record, video, cloud-hosting, communications, identity, cybersecurity, payment, analytics, document-signing, professional-advisory, insurance and complaint-handling providers where reasonably necessary.
12.2 We may disclose information to regulators, courts, tribunals, law-enforcement bodies or government agencies where required or authorised by law.
12.3 We do not sell patient personal information. We require service providers to handle information consistently with applicable privacy, security and confidentiality obligations.
13. PAYMENTS AND FINANCIAL INFORMATION
13.1 Payment providers may collect card and financial details directly under their own privacy terms. The Clinic generally retains transaction identifiers, amount, status, invoice and refund information rather than complete card details.
13.2 Where a payment relates to an independent pharmacy, the recipient, agency arrangement if any, amount and refund responsibility must be disclosed separately before payment.
14. DIRECT MARKETING AND ENTITY SEPARATION
14.1 Necessary clinical and transactional communications, such as appointment reminders, safety messages, invoices and service notices, are not marketing and may continue while you receive Services.
14.2 The Clinic will send direct marketing only where permitted and will provide an accessible unsubscribe method.
14.3 The Clinic will not disclose patient information to Skin by MenoWell for Skin by MenoWell marketing merely because a referral occurred. Any cross-entity marketing disclosure requires a separate notice and consent where required.
14.4 Marketing consent is optional and may be withdrawn without affecting core clinical care, although withdrawal does not stop necessary service communications.
15. COOKIES, ANALYTICS AND ONLINE TRACKING
15.1 The website may use essential cookies for security, authentication, preferences and operation. Non-essential analytics or marketing technologies will be managed through the applicable notice and consent mechanism.
15.2 The Clinic must identify its deployed cookies, pixels and analytics tools in Schedule 1 or a cookie notice before publication.
15.3 Cookie preferences may be adjusted through the website control or browser settings, although disabling essential technologies may affect functionality.
16. ARTIFICIAL INTELLIGENCE AND AUTOMATED TOOLS
16.1 The Clinic may use approved artificial intelligence and automated tools to assist with administration, scheduling, transcription where separately authorised, quality assurance or clinical decision support. The Clinic is developing a Menopause Medical Aesthetics artificial intelligence-assisted clinical support agent (MMA AI Agent) to support qualified clinicians in reviewing relevant information and considering care options.
16.2 The MMA AI Agent and other automated tools support, and do not replace, a clinician. They will not make autonomous prescribing or treatment decisions, and do not guarantee treatment or outcomes. Material clinical decisions remain with an appropriately qualified practitioner exercising independent professional judgment.
16.3 We may invite you to give separate, optional consent for certain information collected during your care to be used to develop, test, validate and train the MMA AI Agent. This consent is separate from consent to treatment, pharmacy disclosure, marketing, testimonials, research and publication.
16.4 Information used to train the MMA AI Agent will be limited to de-identified, non-identifying metadata and derived data. Before use, we will remove direct identifiers and take reasonable technical and organisational steps to reduce the risk that you could reasonably be re-identified. Names, contact details, patient identifiers and other information that directly identifies you will not be included in the training dataset.
16.5 Clinical photographs may be processed to remove identifying information and converted into non-identifying metadata, measurements, labels or other derived data. Raw photographs, recognisable facial images, identifiable consultation footage and identifiable medical records will not be used to train the MMA AI Agent under this consent. They remain protected clinical records handled and retained under this policy and applicable law.
16.6 Participation is voluntary. Refusing or withdrawing consent will not affect your eligibility for, or the standard of, clinical care. You may withdraw consent for future use by contacting the Privacy Officer. Withdrawal will not require us to reverse training already lawfully completed using data that had been effectively de-identified and incorporated into the MMA AI Agent before the withdrawal was received.
16.7 We will not sell the AI training data or use it for advertising, marketing profiles, autonomous prescribing or autonomous treatment decisions. Access will be restricted to authorised personnel and contracted service providers subject to privacy, confidentiality and security obligations.
16.8 Before training or materially changing the MMA AI Agent, the Clinic will undertake and document appropriate privacy, security, contractual and clinical-governance assessments, including a privacy impact assessment and an assessment of re-identification risk. The Clinic will apply data minimisation and use only the information reasonably required for the approved purpose.
16.9 Where a contracted technology provider processes training data, its identity or provider category, location, purpose, access, retention arrangements and model-training restrictions will be documented in Schedule 1 or an associated collection and consent notice. A provider must not use the data to train its own general-purpose or third-party model unless a separate lawful basis, appropriate transparency and any required express consent have been established.
16.10 The Clinic will periodically review the MMA AI Agent's data handling, security, human oversight and continued fitness for purpose. More information about the project, approved inputs, service providers, safeguards and withdrawal method will be provided when consent is requested.
17. OVERSEAS HANDLING AND DISCLOSURE
17.1 Some technology providers may store or process information outside Australia. The likely countries and provider categories must be identified in Schedule 1 before publication.
17.2 Where APP 8 applies, the Clinic will take reasonable steps to ensure an overseas recipient handles information consistently with the APPs and will remain accountable where required by law.
17.3 This policy does not ask patients to waive rights or simply deem overseas disclosure accepted by using the Services.
18. DATA QUALITY AND SECURITY
18.1 The Clinic takes reasonable steps to ensure information is accurate, complete, current and relevant for the purpose for which it is used or disclosed.
18.2 Security measures may include encryption in transit and at rest where supported, multifactor authentication, role-based access, audit logging, secure hosting, backups, confidentiality obligations, workforce training, vendor assessment, monitoring and incident-response procedures.
18.3 No system is completely secure. Patients should protect credentials, use secure devices and promptly report suspected unauthorised access or misdirected communications.
19. DATA BREACHES
19.1 The Clinic maintains a data-breach response process. Suspected incidents will be assessed and contained, investigated and remediated as appropriate.
19.2 Where an eligible data breach occurs, affected individuals and the Office of the Australian Information Commissioner will be notified in accordance with the Notifiable Data Breaches scheme.
20. RETENTION AND DESTRUCTION
20.1 Information is retained for the periods required by applicable clinical, health-records, tax, corporate, insurance, limitation and regulatory obligations and for legitimate continuity, safety and dispute purposes.
20.2 Before publication, the Clinic must insert or link to the applicable adult and minor health-record retention periods for each jurisdiction in which it operates.
20.3 When information is no longer required, reasonable steps are taken to securely destroy it or de-identify it, unless retention is required or authorised by law.
20.4 Backups and immutable audit records may be deleted according to controlled retention cycles rather than immediately.
21. ACCESS AND CORRECTION
21.1 You may request access to personal information or correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information by contacting the Privacy Officer.
21.2 Identity verification may be required. Access or correction may be limited where permitted by law, including to protect another person, legal privilege, safety or lawful confidentiality.
21.3 If a request is refused, the Clinic will provide reasons and available complaint mechanisms where required.
22. CONSENT AND WITHDRAWAL
22.1 Where the Clinic relies on consent, it seeks to ensure the choice is informed, voluntary, current and specific and that consequences of declining are explained.
22.2 Consent will be separated where practicable for clinical care, pharmacy disclosure, direct marketing, testimonials, research, publication of images, recording or transcription and AI-related secondary uses.
22.3 You may withdraw consent for future handling where consent is the lawful basis. Withdrawal does not affect prior lawful handling or records that must be retained, and may affect the Clinic's ability to provide a requested Service.
23. CHILDREN
23.1 Services are intended for adults aged 18 and over unless the Clinic expressly establishes an approved minor-care pathway.
23.2 The Clinic does not knowingly collect a child's information outside an authorised pathway. If that occurs, it will assess and address the information appropriately.
24. COMPLAINTS
24.1 Privacy questions or complaints should be sent to the Privacy Officer using the details below. The Clinic will acknowledge, investigate and respond within a reasonable time.
24.2 If dissatisfied, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992, and to any applicable State or Territory health privacy or complaints body.
24.3 Complaints will not affect access to lawful clinical care or your right to contact an external regulator.
25. CHANGES TO THIS POLICY
25.1 The Clinic may update this policy to reflect legal, technological, clinical or operational changes.
25.2 The effective date and version will be displayed. Material changes will be notified where reasonably practicable or required, and fresh consent will be sought where an existing consent is no longer sufficiently specific.
.
26. CONTACT DETAILS
26.1 Clinic Operator: Menopause Medical Aesthetics Pty Ltd (ACN 701 275 783).
26.2 Trading name: Menopause Medical Aesthetics.
26.3 Privacy Officer: [to be completed].
26.4 Privacy email: [email protected].
26.5 Support email: [email protected].
26.6 Website: menoskin.com.au.
26.7 Postal address: [to be completed]
27. GOVERNING LAW AND NON-EXCLUDABLE RIGHTS
27.1 This policy is governed by the laws of New South Wales, Australia, subject to any mandatory law applying in another jurisdiction.
27.2 Nothing in this policy limits any privacy, health-record, consumer or other right that cannot lawfully be excluded.
SCHEDULE 1 - DATA HANDLING
TBC
SCHEDULE 2 - CONSENT MATRIX
TBC
Independent telehealth care for menopausal skin.
Information on this page is general and does not replace individual medical advice. Treatment and prescribing decisions remain with the treating clinician.
Consultation does not guarantee treatment or a prescription. Any treatment decision is made independently by your clinician. Treatment and pharmacy costs, if any, are separate. Patients may use a pharmacy of their choice.