Privacy Policy
Skyn Spa Aesthetics Shop 3, 1 Harrow Road, Bexley NSW 2207 info@skynspaaesthetics.com
Last updated: 01 July 2026
1. About this policy
Skyn Spa Aesthetics ("we", "us", "our") is a skin treatment clinic operating at Shop 3, 1 Harrow Road, Bexley NSW 2207, trading as Skyn Spa Aesthetics, ABN 79 187 465 499
This policy explains how we collect, use, store, disclose and protect your personal information, including health information. It applies to our website (skynspaaesthetics.com), our online booking system, our social media accounts, our advertising, and everything that happens in the clinic.
Because we provide skin treatments, we treat ourselves as a health service provider for the purposes of the Privacy Act 1988 (Cth) and comply with the Australian Privacy Principles (APPs), regardless of our turnover. We also comply with the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles under it.
By using our website, submitting an enquiry form, booking an appointment or attending the clinic, you agree to this policy.
2. What personal information we collect
Contact and identity information Your name, mobile number, email address, postcode or suburb, and date of birth.
Health information (sensitive information) Your skin concerns and history, medical conditions relevant to treatment, medications, allergies, previous treatments and reactions, pregnancy or breastfeeding status where relevant to a treatment, your skincare routine, treatment notes, treatment plans, and clinical photographs taken to track progress.
Health information is classified as sensitive information under Australian privacy law and is given a higher level of protection. We only collect it where it is reasonably necessary for us to treat you safely, and we only collect it with your consent.
Booking and transaction information Appointment dates and history, services booked, amounts paid, refunds, and cancellation history. We do not store your full card details — payments are processed by our booking and payment providers.
Enquiry information Information you give us when you contact us, including through a Facebook or Instagram lead form, our website contact form, email, SMS, phone, or a direct message on social media. This may include your name, contact details, what you would like help with, your postcode, your availability, and whether you have had professional treatments before.
Marketing preferences Whether you have agreed to receive marketing emails or SMS from us, and how you have interacted with those messages.
Photography and video Photographs and video of your treatment, where you have given us separate written consent. This is covered in section 7.
Technical information When you visit our website, we and our service providers may collect your IP address, device and browser type, pages viewed, time spent, the site or advertisement you arrived from, and similar analytics data. This is collected through cookies and similar technologies — see section 9.
3. How we collect it
We collect personal information:
Directly from you, in person, by phone, by email, by SMS, or through social media messages
Through our online booking system (Fresha) when you book or complete an intake or consultation form
Through our website contact forms
Through lead forms on Facebook, Instagram and other advertising platforms, when you choose to submit your details to us in response to an advertisement
Through cookies and analytics tools when you use our website
From a person acting on your behalf, such as a parent or guardian booking for a client under 18
Wherever it is reasonable and practicable, we collect personal information directly from you. If you do not provide the information we ask for, we may not be able to treat you safely, or at all.
4. Why we collect it and how we use it
We use your personal information to:
Assess your skin and determine whether a treatment is safe and appropriate for you
Provide treatments and build and adjust your treatment plan
Manage bookings, reminders, cancellations, payments and refunds
Keep accurate clinical records as required by law
Respond to your enquiries, including enquiries submitted through a Facebook or Instagram advertisement
Contact you about your enquiry by phone, SMS or email
Send you marketing communications, where you have consented (see section 5)
Improve our services and understand which of our advertisements and channels are effective
Meet our legal, insurance and professional obligations
We do not use your health information for marketing. Health information you give us — your skin concerns, conditions, medications and treatment history — is used to treat you, not to target advertising to you.
5. Marketing communications
We will only send you marketing emails or SMS where you have consented, or where you are an existing client and the message relates to services similar to those you have received from us.
Every marketing message includes a way to unsubscribe. You can also opt out at any time by emailing info@skynspaaesthetics.com or replying STOP to an SMS. We will action it promptly and at no cost to you.
Opting out of marketing will not affect appointment reminders, treatment aftercare information, or our ability to contact you about a booking.
We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).
6. Social media and online advertising
We advertise on platforms including Facebook, Instagram and TikTok. This section explains what that means for your information.
Lead forms If you submit your details through an instant form on a Facebook or Instagram advertisement, that information is collected by the platform and passed to us. We use it to contact you about your enquiry, and — where you have consented on the form — to send you marketing. The platform also handles that information under its own privacy policy, which we do not control.
Tracking pixels Our website uses the Meta Pixel and may use similar tools from other advertising and analytics providers. These place cookies on your device and send information to the platform about pages you visit and actions you take on our site, such as starting a booking. This helps us measure whether our advertising is working and show relevant ads to people who have visited our site.
Custom audiences We may provide contact information such as email addresses or mobile numbers to advertising platforms so they can show our advertisements to you or to people with similar characteristics. Where the platform supports it, this information is converted into a scrambled form (hashed) before it is sent. We do not upload health information, treatment details, clinical notes or clinical photographs to any advertising platform, ever.
Opting out You can control tracking through your browser settings, through your ad preferences on each platform, and through any cookie controls shown on our website. You can ask us to remove you from our advertising audiences at any time by emailing us.
Social media messages If you contact us through Instagram, Facebook or TikTok, those messages are stored on the platform and are subject to the platform's privacy policy as well as this one. Please do not send us detailed health information through social media — it is not a secure channel. Use our booking system or email instead.
7. Photography and video
We sometimes photograph or film treatments for two separate purposes:
Clinical records. Progress photographs taken to track how your skin responds over time. These form part of your health record, are stored securely, and are never published.
Social media and advertising. Only with your separate, specific, written consent, recorded on our Photography and Video Consent form. That form lets you choose exactly what you are comfortable with — treatment area only, face visible, use of your first name, and whether your footage may be used in paid advertising. Each is a separate choice.
You can withdraw that consent at any time, in whole or in part, by contacting us. You do not need to give a reason. We will remove the content from our own accounts and website within five business days and stop any advertisement it appears in. Content that others have already saved or reshared may not be recoverable, and we will tell you honestly if that is the case.
Declining, or later withdrawing, has no effect on your treatment, your price, or your appointments.
8. Who we share your information with
We share personal information only where it is necessary, and only with:
Our booking and payment providers (including Fresha), to manage appointments, records and payments
Our website provider (Squarespace) and analytics providers, for website hosting and performance
Email and SMS providers, to send appointment reminders and, where you have consented, marketing
Advertising platforms (including Meta), as described in section 6
Other health practitioners, where you have asked us to or where it is necessary for your care, with your consent
Product suppliers, where a treatment or product requires it — without identifying your health information unless you consent
Our professional advisers, such as accountants, insurers and lawyers, where required
Government agencies, regulators or courts, where required or authorised by law
We never sell your personal information. We never trade or licence your information, or your photographs, to another business or brand.
Overseas disclosure. Some of our providers store data outside Australia, including in the United States and the European Union. Where we disclose your information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
9. Cookies
Our website uses cookies — small files stored on your device — to make the site work, remember your preferences, understand how the site is used, and measure our advertising.
You can block or delete cookies through your browser settings. Some parts of the site may not work properly if you do.
10. Security and storage
We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification and disclosure. This includes password-protected systems, restricted access to clinical records, secure cloud storage, and physical security at the clinic.
No system is completely secure. If we become aware of a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
11. How long we keep it
We keep health information for at least seven years from the date we last provided you a service. If you were under 18 when we last treated you, we keep it until you turn 25. These periods are required under NSW health records law.
Other information is kept only as long as we need it for the purpose it was collected, or as required by law, and is then securely destroyed or de-identified.
12. Accessing and correcting your information
You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct anything inaccurate, out of date or incomplete.
Email info@skynspaaesthetics.com. We may ask you to verify your identity. We will respond within 30 days.
Access is free, though we may charge a reasonable fee for the cost of providing copies of extensive records. In limited circumstances the law allows us to refuse access — if we do, we will explain why in writing and tell you how to complain.
13. Complaints
If you think we have mishandled your personal information, please tell us first. Email info@skynspaaesthetics.com with the details. We will acknowledge your complaint within five business days and respond within 30 days.
If you are not satisfied with our response, you can contact:
Office of the Australian Information Commissioner (OAIC) oaic.gov.au · 1300 363 992
NSW Information and Privacy Commission ipc.nsw.gov.au · 1800 472 679
14. Changes to this policy
We may update this policy from time to time. The current version is always available at skynspaaesthetics.com/privacy-policy, with the date it was last updated shown at the top.
15. Contact us
Skyn Spa Aesthetics Shop 3, 1 Harrow Road, Bexley NSW 2207 info@skynspaaesthetics.com 0411 568 270
Before publishing: fill the placeholders (legal entity name, ABN, phone, date), confirm the booking and email providers named are the ones actually in use, and have the policy reviewed by a solicitor. This is a drafting starting point, not legal advice.