Skip to content
11 Leonard Street, Dandenong 0423 722 389 Request a consultation

Privacy Policy

Last updated: 6 October 2026

Who we are

This policy applies to Soma Skin & Body Pty Ltd (ABN 20 692 611 448), trading as Soma Skin & Body, at 11 Leonard Street, Dandenong VIC 3175. We are a nurse-led skin and cosmetic clinic. In this policy, "we", "us" and "our" mean Soma Skin & Body Pty Ltd.

We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) and the Health Privacy Principles in the Health Records Act 2001 (Vic). You can read the APPs on the website of the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

What we collect

We collect only what we need to respond to you and to care for you.

  • Contact details: your name, mobile number, email address and address.
  • Enquiry details: the treatment you are interested in, and any areas of your face or skin you choose to tell us about.
  • Health information: your medical history, medicines, allergies, skin and facial assessments, photos taken for your clinical record, treatment plans, treatment notes, consent forms and aftercare records.
  • Payment details and records of the services you receive.
  • Website data: how you reached our site (for example, the ad or link you clicked) and basic technical data such as your browser type.

Health information is sensitive information under the Privacy Act. We only collect it with your consent, or where the law allows.

How we collect it

We collect information directly from you. This happens when you fill in a form on our website, call or email us, or attend a consultation or treatment. With your consent, we may also receive information from another health practitioner involved in your care.

Dealing with us anonymously

You can ask general questions without giving your name. Due to the nature of the health services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves for a consultation or treatment. Accurate identification is required to ensure the safety and continuity of clinical care and to comply with our legal and professional obligations under applicable health legislation.

Information we did not ask for

From time to time, we may receive personal or health information that we did not solicit. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.

How we use your information

  • To respond to your enquiry and book appointments.
  • To assess your suitability for treatment, provide care and keep accurate clinical records.
  • To send appointment reminders and aftercare information.
  • To process payments and manage our business.
  • To meet our legal, insurance and professional obligations.

We do not sell your information. We do not use your health information for marketing.

Who we share it with

We only share your information when it is needed, such as with:

  • A prescribing practitioner involved in your care, where a treatment needs a prescriber's assessment. This happens with your consent.
  • Other health practitioners, but only with your consent or where the law allows.
  • Service providers who help us run the clinic, such as our booking, email, website and IT providers. They must protect your information and only use it for the service they provide to us.
  • Our insurers, lawyers or regulators, where required or allowed by law.

There are limits to confidentiality. We may disclose information without your consent where the law requires or allows it. This includes a serious threat to someone's life, health or safety, a court order, or a mandatory notification under the Health Practitioner Regulation National Law.

Information sent outside Australia

Some of our website and email providers may store or process information on servers outside Australia, including in the United States. We take reasonable steps to make sure these providers protect your information in line with the APPs. We do not send your clinical records overseas.

Marketing

We only send you marketing messages if you agree to receive them. Each message includes a simple way to opt out. You can also ask us to stop at any time.

Our website, cookies and tracking

Our website records how you arrived at it, such as the ad or link you clicked, so we know which ads are working. When you send us a form, this information is sent with it.

If we use advertising tools such as the Meta (Facebook and Instagram) pixel, or analytics tools such as Google Analytics, we will ask for your consent first. These tools would never receive details of your health or the treatments you ask about. You can block or delete cookies in your browser settings.

Government identifiers and My Health Record

We do not use government identifiers, such as a Medicare number, as our own way of identifying you. We do not upload information to My Health Record.

AI and automated tools

We do not use automated tools to make decisions about your care. We do not enter your health information into public AI tools.

How we protect and keep your information

We store your information securely. Electronic records are password-protected and access is limited to people who need it. Paper records are kept in secure storage.

Under the Health Records Act 2001 (Vic), we keep health records for at least 7 years after the last time we provided you a service. If you were under 18 when we last provided a service, we keep them until you turn 25. After that, we destroy or de-identify them securely.

Data breaches

If we suspect a data breach, we will assess it promptly, and within 30 days. If it is likely to cause you serious harm, we will notify you and the OAIC as soon as practicable, under the Notifiable Data Breaches scheme in the Privacy Act.

Accessing and correcting your information

You can ask to see the information we hold about you, and ask us to correct it. Contact us using the details below. We will respond within 30 days. We will not charge a fee for your request. We may charge a reasonable fee to cover the cost of copying records, and we will tell you about it first. If we refuse access, we will explain why in writing.

Complaints

If you have a concern about your privacy, please contact us first. We will respond within 30 days. If you are not satisfied, you can contact:

  • The Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992
  • The Health Complaints Commissioner (Victoria): hcc.vic.gov.au, 1300 582 113

Contact us

We may update this policy. The date at the top shows the latest version.