Bodhi Skin HQ (“Bodhi Skin HQ”, “we”, “us” or “our”) is an Australian sole trader business providing skin coaching, consulting, educational and related services to clients in Australia and internationally.
We recognise that people who use our services may share highly personal information with us, including information about their health, skin conditions, symptoms, medical history, medications, photographs and, in some cases, information relating to children.
We take the privacy of this information seriously.
This Privacy Policy explains how we collect, hold, use, disclose, protect and otherwise handle personal information.
It applies to personal information collected through:
• bodhiskinhq.com;
• our enquiry, application, intake and assessment forms;
• coaching and consulting services;
• consultations and calls;
• email, SMS and other communications;
• our client portal, community and courses;
• payment and booking systems;
• social media;
• photographs and documents submitted to us;
• marketing and advertising activities; and
• any other interaction you have with Bodhi Skin HQ.
We aim to handle personal information consistently with applicable Australian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and, where applicable, relevant State and Territory health privacy legislation.
Where our services are provided to people outside Australia, additional privacy rights may apply under the laws of their jurisdiction.
This Privacy Policy does not replace any separate client agreement, informed consent document, terms and conditions, health disclaimer or other agreement that applies to our services.
2. Who is responsible for your information?
Bodhi Skin HQ is operated as a sole trader business under:
For privacy enquiries, access or correction requests, complaints or questions about this Privacy Policy, please contact us using the email address above.
3. The nature of our services
Bodhi Skin HQ provides skin coaching, consulting, education and support services.
Our services may involve discussions about matters including skin symptoms, eczema, lifestyle, diet, supplements, environmental factors, sleep, stress, medication history, previous healthcare, personal circumstances and other factors potentially relevant to a client's skin and wellbeing.
Because of the nature of these services, some information supplied to us may constitute health information or other sensitive information under applicable privacy legislation.
We apply additional care to the collection and handling of such information.
Bodhi Skin HQ's services should also be read together with any health, medical and scope-of-service disclaimers contained in our Terms and Conditions, client agreement or other service documentation.
4. What personal information we may collect
The information we collect depends upon how you interact with Bodhi Skin HQ.
4.1 Identity and contact information
We may collect information including:
full name;
preferred name;
date of birth;
age;
residential or postal address;
country of residence;
email address;
telephone number;
emergency contact information;
social media username;
parent or guardian details;
relationship between a parent or guardian and a child client; and
other information reasonably necessary to identify or communicate with you.
4.2 Health and sensitive information
Where reasonably necessary to provide our services, and with appropriate consent where required, we may collect health and sensitive information such as:
• current or previous skin conditions;
• eczema symptoms and history;
• symptoms, flare patterns and severity;
• areas of the body affected;
• photographs or videos of affected skin;
• medical diagnoses;
• medical history;
• family medical history;
• allergies and intolerances;
• prescription medication use;
• over-the-counter medication use;
• topical treatments;
• corticosteroid or other treatment history;
• supplement use;
• previous treatment experiences;
• pathology results;
• blood test results;
• laboratory reports;
• medical reports;
• information supplied by doctors or other healthcare professionals;
• dietary information;
• food diaries;
• digestive or gastrointestinal information;
• bowel habits where relevant;
• sleep information;
• exercise and activity information;
•stress and lifestyle information;
• environmental exposures;
• occupation;
• personal habits relevant to the services;
• menstrual or hormonal information where relevant;
• emotional or psychological wellbeing information where voluntarily disclosed and relevant;
• progress information;
• symptom tracking information;
• consultation notes;
• coaching notes; and
• information contained in messages, questionnaires or other communications sent to us.
You are not required to provide information that is unrelated to the services we provide.
However, if relevant information is not provided, we may be unable to provide some or all of our services safely or effectively.
5. Photographs and videos of skin
Clients may submit photographs or videos showing affected areas of their skin so that we can provide our services, review changes over time or discuss progress.
These images may themselves constitute sensitive health information.
Images submitted for service delivery purposes are treated as confidential client information and are not automatically authorised for marketing, advertising, educational or public use.
We will not publish a client's before-and-after images, progress photographs, identifiable health photographs or similar material for marketing purposes merely because those images were provided as part of the coaching relationship.
If we wish to use an image, testimonial, case study or other identifiable health information publicly, we will seek separate consent appropriate to the proposed use.
Where appropriate, this may include consent specifying:
• which photographs or information may be used;
• whether the person's name may be used;
• whether the person will remain anonymous;
• which platforms the material may appear on;
• whether the material may be used in paid advertising;
• whether the material may be edited or reformatted; and
• any relevant limitations on consent.
Refusal to provide marketing consent will not affect a person's ability to receive our services.
6. Information relating to children and young people
Bodhi Skin HQ may provide services relating to clients under the age of 18.
As a business policy, a person under 18 must have the consent of a parent or legal guardian before commencing paid services with Bodhi Skin HQ unless we determine that another arrangement is lawful and appropriate in the circumstances.
Where the services relate to a child, we may collect personal and health information about both:
the child, whose skin, health or wellbeing is the subject of the service; and
the parent or guardian, who may purchase, manage, participate in or consent to the service.
The child's information may include their name, age, date of birth, health history, photographs, symptoms, medical information, medications, diet, lifestyle information and other relevant information.
We will seek to collect only information reasonably necessary for the services being provided.
Parents and guardians who provide information about a child must ensure, to the extent reasonably possible, that they are authorised to provide that information to us.
Where appropriate, we may also seek the involvement or assent of an older child or teenager rather than relying solely on parental participation.
Privacy rights concerning a young person's information can depend on the young person's age, maturity, capacity and applicable law. Accordingly, a parent's access to, control over or ability to authorise disclosure of a young person's information may not be absolute in every circumstance.
Where we receive competing requests concerning a child's information, we may request evidence of parental responsibility, guardianship or legal authority before releasing information.
We may refuse, postpone or limit disclosure where required or permitted by law, including where disclosure could create a serious risk to a person's health, safety or privacy.
7. Information about parents, guardians and family members
Where a parent engages Bodhi Skin HQ in relation to their child, information about the parent may also become part of the client relationship.
• For example, we may collect a parent's:
•identity and contact information;
• payment information;
• health information where relevant to family history;
• observations concerning their child;
• correspondence;
• consultation participation; and
• other information reasonably necessary to manage the service.
• Information about siblings, parents or other family members should only be provided where it is reasonably relevant to the services.
8. Financial and transaction information
When you purchase a service or product, we may collect information relating to the transaction, including:
your name;
• billing details;
• transaction amount;
• services purchased;
• payment status;
• invoice information;
• refund information; and
• limited payment-related information provided to us by our payment processor.
Payments are expected to be processed using third-party payment providers, including Square, or another payment provider we identify at checkout.
Complete payment card information may be collected and processed directly by the relevant payment provider rather than stored by Bodhi Skin HQ.
Those providers have their own privacy, security and payment practices.
We may retain transaction information that is necessary for accounting, taxation, fraud prevention, dispute resolution and legal compliance.
9. Information collected automatically through our website
When you visit bodhiskinhq.com, certain technical information may be collected automatically.
This can include:
• IP address;
• browser type;
• device type;
• operating system;
• approximate geographic location;
• referring website;
• pages viewed;
• links clicked;
• time spent on pages;
• dates and times of visits;
• advertising identifiers;
• cookie identifiers;
• conversion information; and
• general website interaction data.
We may use cookies, pixels, tags, local storage and similar technologies to collect this information.
10. Cookies, pixels and analytics
We may use first-party and third-party technologies for purposes including:
making the website function;
remembering user preferences;
measuring website traffic;
understanding how visitors use the website;
improving pages and user experience;
measuring marketing performance;
attributing enquiries and purchases to advertising;
creating advertising audiences;
measuring conversions;
preventing fraud; and
displaying or measuring relevant advertising.
These technologies may include, now or in the future:
Google Analytics and Google technologies
We may use Google Analytics, Google Tag Manager, Google advertising or related Google products.
Meta technologies
We may use the Meta Pixel or other technologies associated with Facebook and Instagram.
TikTok technologies
We may use the TikTok Pixel or other TikTok advertising and measurement technologies.
Other analytics or advertising providers may be added as our business and website develop.
These providers may collect information directly from a user's browser or device and may combine information obtained through our website with information they already hold, subject to their own terms and privacy policies.
Where applicable law requires consent before non-essential advertising or analytics technologies are activated, we will take reasonable steps to obtain that consent.
Users may also be able to control cookies using browser settings, device settings, advertising preference controls or our website's cookie consent mechanism.
Blocking some cookies may affect website functionality.
11. How we collect information
We generally collect personal information directly from you or, for a child client, from their parent or guardian.
Information may be collected when you:
visit our website;
submit an enquiry;
complete an application or intake form;
book a consultation;
purchase a service;
join a coaching program;
join our online community;
access one of our courses;
send us an email;
communicate with us by SMS or another messaging service;
participate in a video or telephone consultation;
send photographs or documents;
complete a questionnaire;
provide a testimonial;
interact with our social media accounts;
enter a promotion or survey;
subscribe to marketing communications; or
otherwise communicate with Bodhi Skin HQ.
We may occasionally receive personal information from another person, such as:
a parent or guardian;
a healthcare professional;
a person who refers you to us;
a payment provider;
a technology platform; or
another person authorised by you.
Where reasonable and appropriate, we will take steps to ensure you are aware of the collection.
12. Why we collect personal information
We may collect, use and hold personal information for purposes including:
determining whether our services are appropriate for you;
communicating with prospective clients;
providing skin coaching and consulting services;
understanding a client's circumstances;
preparing personalised coaching or educational information;
monitoring progress;
reviewing photographs and symptom information;
conducting consultations;
responding to questions;
maintaining client records;
administering programs;
operating our online community;
delivering courses and educational content;
processing payments;
issuing invoices and receipts;
managing bookings;
providing customer service;
sending appointment or program reminders;
managing contracts and client relationships;
preventing fraud and misuse;
managing complaints or disputes;
maintaining security;
improving our services;
conducting internal business administration;
complying with taxation, accounting and record-keeping obligations;
obtaining professional legal, accounting, insurance or other advice;
complying with applicable laws;
sending marketing communications where permitted;
measuring website and advertising performance; and
otherwise carrying out activities reasonably connected with operating Bodhi Skin HQ.
We will not ordinarily use sensitive health information for unrelated marketing purposes merely because it was supplied as part of a coaching relationship.
13. Consent to collection of sensitive information
Health information is sensitive information.
Where consent is required for us to collect sensitive information, we rely on the client's consent or, where appropriate, the consent or authority of a parent, guardian or other authorised representative.
By voluntarily supplying health information in connection with an enquiry or service, you acknowledge that we will handle that information for purposes reasonably connected with assessing, administering and providing the requested services.
Where we consider additional consent appropriate or legally necessary, we may obtain it separately.
Consent to the provision of coaching services does not automatically constitute consent to:
public disclosure of health information;
public use of photographs;
publication of testimonials;
use of identifiable case studies;
advertising use; or
unrelated secondary uses.
Separate permission may be sought for those activities.
14. Consultations and recordings
Bodhi Skin HQ may provide consultations by video conference, telephone or other online communication technology.
We may use services such as Zoom or comparable providers.
We may offer to record a consultation for purposes such as:
maintaining an accurate record;
reviewing information discussed during the consultation;
preparing follow-up material;
quality assurance; or
allowing a client to revisit information.
Where a consultation is to be recorded, we will seek appropriate notice or consent before intentionally recording it.
Recordings may contain sensitive health information and will be treated accordingly.
A client who does not wish to be recorded should notify us before or at the beginning of the consultation.
Where practicable, an alternative such as written consultation notes may be used.
15. Client communications
We may communicate with clients using channels including:
email;
telephone;
SMS;
online messaging;
video conferencing;
our client portal;
community messaging functionality; and
social media messaging.
Electronic communications inherently involve some security risk.
We recommend that clients avoid sending highly sensitive information through public comments, unsecured social media posts or other channels that are not intended for confidential communications.
If you send health information to us using a communication channel, you authorise us to receive and use that information for the relevant purpose, subject to this Privacy Policy.
16. Social media
Bodhi Skin HQ may maintain accounts on platforms including:
Instagram;
Facebook;
TikTok; and
YouTube.
Information you submit publicly on social media may be visible to other users and is subject to the privacy practices of the relevant platform.
You should avoid posting confidential health information publicly.
Where you send us a private message through a social platform, we may use that information to respond to you or, where appropriate, move the conversation to a more suitable communication channel.
Social media platforms may independently collect information about your interaction with our accounts and advertisements.
17. Our online community
Bodhi Skin HQ may provide access to an online client or member community.
Information posted by you within areas visible to other community members may be seen, copied, discussed or retained by those members.
You should therefore avoid posting information in community spaces that you do not want other authorised community members to see.
In particular, you should exercise caution before publishing:
medical information;
photographs;
your child's personal information;
identifiable photographs of children;
contact details;
addresses;
pathology results; or
other highly sensitive information.
Bodhi Skin HQ may establish community rules and moderate or remove content.
However, we cannot guarantee that another member will never copy, screenshot or improperly use information that a person chooses to publish to a shared community area.
Information provided privately to Bodhi Skin HQ should not be posted publicly by us merely because you participate in the community.
18. Courses and digital educational content
Clients or website users may be able to access digital courses, educational material or other resources through Bodhi Skin HQ.
We may collect information about:
enrolment;
account details;
course progress;
lessons viewed;
quiz or assessment responses;
login history; and
interactions with the platform.
Where course functionality allows users to submit health information, that information will be handled in accordance with this Privacy Policy.
19. GoHighLevel and technology infrastructure
Our website, customer relationship management systems, forms, automation, communications, course functionality, community functionality and related business infrastructure may be operated using GoHighLevel/HighLevel and associated service providers.
As a result, personal information submitted through our website or services may be processed or stored using systems operated by HighLevel and its infrastructure providers.
Our domain and related domain services may also be provided through Squarespace or related providers.
We may change technology providers as our business evolves.
When selecting providers that process personal information on our behalf, we aim to take reasonable steps appropriate to the nature and sensitivity of the information involved.
20. Other service providers
We may disclose or make personal information accessible to third-party service providers where reasonably necessary to operate the business.
These may include providers of:
website infrastructure;
hosting;
customer relationship management systems;
email;
cloud storage;
payment processing;
video conferencing;
online forms;
appointment scheduling;
client portals;
online communities;
course hosting;
analytics;
advertising;
accounting;
bookkeeping;
legal services;
insurance;
information technology;
cybersecurity;
data backup;
communications;
document storage; and
administrative support.
Access should be limited to information reasonably necessary for the relevant service.
Some providers operate independently and may also have their own privacy policies.
21. Employees, contractors and assistants
At present, Bodhi Skin HQ is principally operated by its owner.
As the business grows, we may engage employees, contractors, virtual assistants, coaches, consultants or administrative personnel.
Where such people require access to personal information to perform their duties, we will seek to limit their access to information reasonably necessary for their role and require appropriate confidentiality and privacy protections.
A virtual assistant or marketing contractor, for example, should not automatically receive access to a client's detailed health records merely because they assist with other aspects of the business.
22. Disclosure to health professionals
With your permission, we may communicate with an appropriately qualified healthcare professional involved in your or your child's care.
This could include a:
general practitioner;
dermatologist;
specialist;
pharmacist;
naturopath;
dietitian;
nutrition professional;
psychologist; or
other health professional.
Our usual approach is to obtain the client's, parent's or appropriate representative's permission before intentionally sharing identifiable client information with another practitioner.
The nature of the permission required may depend on the circumstances and applicable law.
Nothing in this section prevents disclosure without consent where disclosure is otherwise required or expressly authorised by applicable law.
23. When we may disclose information without specific consent
Although confidentiality is important to us, we cannot promise that information will never be disclosed under any circumstances.
We may use or disclose information without obtaining specific consent where the disclosure is required or authorised by applicable law.
Depending on the circumstances, this may include disclosure:
in response to a legally enforceable court order, subpoena or warrant;
where required by legislation;
to regulators or government authorities where lawfully required;
where reasonably necessary to establish, exercise or defend legal claims;
where permitted by privacy legislation in connection with a serious threat to life, health or safety;
in connection with suspected unlawful activity where disclosure is legally permitted; or
in another circumstance expressly authorised by law.
We will not voluntarily provide sensitive client information to third parties simply because they request it.
Where a request for information is made, we may require evidence of the requesting person's lawful authority before disclosing information.
24. Direct marketing
We may use contact information to communicate with people who have consented to receive marketing or where marketing is otherwise permitted by law.
Marketing may include:
educational newsletters;
information about Bodhi Skin HQ services;
new programs;
courses;
events;
offers;
resources; and
other relevant communications.
Consent to receive a service does not necessarily mean that a person has agreed to receive every form of marketing.
Where required, we will obtain appropriate marketing consent.
Marketing communications sent by email or SMS will include, where required, an appropriate method of unsubscribing.
You may unsubscribe at any time using the unsubscribe method provided in the communication or by contacting us.
We may still send non-marketing communications that are necessary for an existing service, transaction or client relationship, such as appointment reminders, receipts, security notices or important changes affecting a service.
25. Advertising and remarketing
We may use advertising platforms such as Google, Meta and TikTok to promote Bodhi Skin HQ.
Subject to applicable privacy and consent requirements, website interaction data may be used to:
measure advertising performance;
understand whether an advertisement led to an enquiry or purchase;
build advertising audiences;
exclude existing users from certain advertising;
display advertising to previous website visitors; or
analyse advertising campaigns.
We do not intend to provide detailed client health records, consultation notes, medical histories or private skin photographs to advertising platforms for the purpose of targeting advertisements.
Because health-related advertising and sensitive-data rules imposed by advertising platforms can change, we may restrict certain tracking technologies or events where necessary.
26. Product links, recommendations and third-party websites
Our website, coaching services, courses or other content may include links to third-party products, services, websites or retailers.
If you follow one of these links, the third party may independently collect information from you.
Their handling of information is governed by their own privacy policy, not this Privacy Policy.
Some links may in the future be affiliate or referral links through which Bodhi Skin HQ may receive a commission or other benefit.
Where appropriate, this relationship will be disclosed separately.
We are not responsible for the privacy practices of an independent third party merely because we link to its website or product.
27. International clients
Bodhi Skin HQ may provide services to people located outside Australia.
By engaging an Australian business, international clients acknowledge that their information may be processed in Australia and through service providers used by Bodhi Skin HQ.
Australian privacy requirements will apply to Bodhi Skin HQ where applicable.
Depending on where an international client resides, the client may also have rights under local privacy or data protection law.
We will seek to respect legally applicable privacy rights and obligations where those laws apply to us.
Nothing in this Privacy Policy is intended to remove a mandatory privacy right that cannot lawfully be excluded.
28. Overseas storage and disclosure
Some technology providers used by Bodhi Skin HQ may operate infrastructure, personnel or servers outside Australia.
This means personal information may be stored in, accessible from or otherwise processed in other countries.
For example, cloud software, customer relationship management systems, payment providers, website infrastructure, analytics providers, communications providers and social media companies may use international infrastructure.
Countries involved may change as providers change their hosting arrangements and subprocessors.
Where Australian privacy law applies to an overseas disclosure, we will take such steps as are reasonably required of us in the circumstances.
Before supplying particularly sensitive information, clients should understand that using online and cloud-based services can involve international data processing.
Where reasonably practicable, further information about relevant service providers may be made available on request.
29. European Economic Area and United Kingdom users
Where the European Union General Data Protection Regulation, UK GDPR or comparable data protection laws apply to our processing, additional rights and obligations may apply.
Depending on the activity, the legal basis on which we process personal information may include:
performance of a contract or taking steps at your request before entering a contract;
your consent;
explicit consent in relation to certain health or special-category information;
compliance with legal obligations;
our legitimate interests in operating, securing and improving our business, where those interests are not overridden by your rights; or
another lawful basis available under applicable law.
Where those laws apply, you may have rights including the right to:
request access to personal information;
request correction;
request erasure in certain circumstances;
restrict certain processing;
object to certain processing;
withdraw consent where processing is based on consent;
receive certain information in a portable format; and
lodge a complaint with an appropriate supervisory authority.
These rights are not absolute and may be subject to legal exceptions, including healthcare or record-retention obligations.
Requests may be made using the contact details in this Privacy Policy.
30. Data storage
Personal information may be stored electronically using systems including:
GoHighLevel/HighLevel;
cloud-based business systems;
secure email;
encrypted or password-protected computers;
mobile devices used for business purposes;
cloud storage;
video-conferencing systems where recordings are authorised; and
other systems reasonably necessary to operate Bodhi Skin HQ.
Limited information may also be stored locally on secured devices.
As our systems develop, the exact storage environment may change.
We will endeavour to keep our published privacy information materially accurate when significant changes occur.
31. Security
Bodhi Skin HQ takes reasonable administrative, technical and physical measures designed to protect personal information against risks such as:
unauthorised access;
misuse;
interference;
loss;
alteration;
accidental disclosure; and
unlawful disclosure.
Measures may include, where appropriate:
strong passwords;
multi-factor authentication;
password management;
device encryption;
access controls;
software updates;
secure cloud infrastructure;
malware and security protection;
restricted staff access;
backups;
confidentiality requirements;
secure deletion practices; and
limiting access to sensitive information according to role.
No internet transmission, cloud service, electronic system or data-storage method can be guaranteed to be completely secure.
Accordingly, while we take reasonable measures to protect information, we cannot guarantee absolute security.
32. Data minimisation
We aim to collect and retain only personal information that is reasonably necessary for legitimate business and service purposes.
Because detailed health histories can be relevant to personalised skin coaching, our client intake process may necessarily collect substantially more information than an ordinary ecommerce or informational website.
Nevertheless, clients should avoid supplying information that is unrelated to the services.
We may periodically review information we hold and delete or de-identify information that we no longer reasonably require, subject to legal, insurance, professional and record-retention obligations.
33. Retention of client and health records
We retain information for as long as reasonably necessary for the purposes for which it was collected and for any additional period required by applicable law.
The appropriate retention period depends on matters including:
the nature of the information;
whether it forms part of a health or client record;
the client's age;
when services were last provided;
legal requirements;
taxation and accounting requirements;
insurance requirements;
complaint and limitation periods;
dispute resolution;
fraud prevention; and
the need to establish, exercise or defend legal claims.
Where NSW health-record retention requirements apply to Bodhi Skin HQ, health information concerning an adult may need to be retained for at least seven years from the last occasion on which a health service was provided.
Where health information was collected while the individual was under 18, different minimum retention requirements may apply, including retention until the individual reaches 25 years of age where applicable.
Information may therefore remain in our records after a client relationship ends.
When information is no longer required to be retained and we have no lawful reason to continue holding it, we may securely destroy or de-identify it.
34. Children's records
Because Bodhi Skin HQ may work with children, we may retain records relating to a child for longer than records relating to an adult where required by applicable law.
A parent requesting deletion of a child's record should therefore understand that we may not lawfully be able to delete the entire record immediately.
Where deletion cannot be completed, we can explain the general reason for continued retention where appropriate.
35. Access to your information
Subject to applicable law, you may request access to personal information we hold about you.
We may need to verify your identity before providing access.
Depending on the request, access may be provided through:
a copy of the relevant record;
an electronic export;
inspection;
a summary or explanation; or
another reasonable method.
There may be circumstances in which access can lawfully be refused or limited.
If that occurs, we will provide an explanation where legally appropriate.
For information relating to a child, we may also need to consider the child's age, maturity, capacity, safety and privacy interests as well as the requesting adult's legal authority.
We aim to keep personal information accurate, complete, relevant and up to date.
If you believe information we hold about you is inaccurate, incomplete, misleading or out of date, please contact us.
We may take reasonable steps to verify the requested correction before amending a record.
In some circumstances, rather than removing an original clinical or service record, it may be appropriate to retain the original record and attach a correction, clarification or updated information.
37. Requests for deletion
You may ask us to delete personal information.
We will consider the request in accordance with applicable law.
A request for deletion does not necessarily create an absolute right to immediate destruction of every record.
We may need or be permitted to retain information where necessary for:
mandatory health-record retention;
taxation or accounting;
contractual obligations;
insurance;
legal claims;
complaints;
dispute resolution;
fraud prevention;
security;
regulatory compliance; or
another lawful purpose.
Where we cannot delete information immediately, we may restrict its use where appropriate and retain it only for relevant lawful purposes.
38. Withdrawal of consent
Where we rely on consent for a particular use of information, you may withdraw that consent for future processing by contacting us.
Withdrawal does not necessarily make processing that occurred before withdrawal unlawful.
Withdrawal may also affect our ability to continue providing a service where the information is necessary to deliver that service.
For example, if a client withdraws permission for us to hold information necessary to understand their health history, we may determine that we cannot responsibly continue personalised coaching.
39. Anonymous and pseudonymous dealings
People may browse general portions of our website without identifying themselves.
In some circumstances, you may also make a general enquiry without providing extensive identifying information.
However, personalised skin coaching involves individualised information and ongoing client records.
Accordingly, it may not be practicable for us to provide certain personalised services anonymously or under a pseudonym.
We may require accurate identifying information where reasonably necessary for:
client safety;
informed consent;
parental consent;
record keeping;
payment;
contractual purposes; or
appropriate service delivery.
40. Data breaches
Bodhi Skin HQ takes suspected privacy and data-security incidents seriously.
If we become aware of a suspected breach affecting personal information, we may take steps including:
containing the incident;
investigating what occurred;
identifying what information was affected;
assessing the potential consequences;
securing affected systems;
changing credentials or access rights where necessary;
working with relevant technology providers;
documenting the incident;
taking steps to reduce the risk of recurrence; and
providing notifications where required by applicable law.
Where Australia's Notifiable Data Breaches scheme applies and a breach is assessed as meeting the relevant legal threshold, we will take steps required under that scheme, which may include notifying affected individuals and the Office of the Australian Information Commissioner.
41. Business transfer or restructure
If Bodhi Skin HQ is sold, reorganised, incorporated, merged or otherwise restructured in the future, personal information may form part of the business records involved in that process where lawful and reasonably necessary.
Any such transfer would be expected to occur subject to appropriate confidentiality and privacy obligations.
Sensitive health information would not become unrestricted information merely because the legal structure or ownership of the business changed.
42. Legal and professional advisers
We may provide information to professional advisers where reasonably necessary, including:
lawyers;
accountants;
insurers;
insurance brokers;
cybersecurity specialists; and
other professional advisers.
Where practicable, only information reasonably necessary for the relevant purpose will be supplied.
Professional advisers may also be subject to independent confidentiality or professional obligations.
43. Artificial intelligence and emerging technologies
Bodhi Skin HQ may from time to time use software containing artificial intelligence, machine-learning, transcription, summarisation or automation functionality to assist with business administration, content preparation, communications or service-support functions.
We will not intentionally treat the use of an AI system as removing our responsibility for how personal information is handled.
Before using a third-party AI or automated system to process identifiable sensitive client information, we will consider matters such as:
whether use of that information is necessary;
whether information can reasonably be de-identified;
the provider's privacy and data-use terms;
security;
retention;
access controls;
whether information may be used to train models;
international data processing;
the sensitivity of the information; and
whether consent or additional notice is appropriate.
Bodhi Skin HQ does not currently represent that important personalised skin-coaching decisions are made solely by an automated system without human involvement.
If our use of automated decision-making materially changes, we may update this Privacy Policy and provide any additional disclosure required by applicable law.
44. Information about other people
If you provide us with personal information about another person, you should ensure that you have an appropriate basis for doing so.
This is particularly important for:
photographs of other people;
medical records;
family health information;
information about a child;
correspondence from another practitioner; or
information concerning a partner or family member.
Where appropriate, you should make the person aware that their information has been provided to us.
45. External websites and services
Our website may contain links or integrations associated with third-party websites and services.
Once you interact directly with a third party, that provider's privacy practices may apply.
We do not control the privacy practices of independent third parties and encourage users to review their privacy information where appropriate.
46. Complaints
If you believe we have mishandled your personal information or breached an applicable privacy obligation, please contact us at:
Please provide sufficient information for us to understand:
who you are;
the nature of your concern;
the information or interaction involved; and
what outcome you are seeking.
We may request additional information to verify your identity or investigate the matter.
We will endeavour to investigate privacy complaints fairly and respond within a reasonable period.
If your complaint concerns Australian privacy law and you are dissatisfied with our response, you may have the right to raise the matter with an appropriate privacy regulator, including the Office of the Australian Information Commissioner (OAIC) or, where applicable, a State or Territory privacy authority.
47. Changes to this Privacy Policy
Our business, technology and legal obligations may change.
We may therefore update this Privacy Policy from time to time.
The current version will be published on bodhiskinhq.com and will display the date on which it was last updated.
Material changes may also be communicated by another reasonable method where appropriate.
Continued use of our website after an updated policy is published does not override any consent that applicable law requires us to obtain separately.
48. Governing privacy framework
Bodhi Skin HQ is an Australian business.
Our handling of personal information is therefore primarily informed by applicable Australian privacy legislation, including the Privacy Act 1988 (Cth), Australian Privacy Principles and applicable health privacy legislation.
The fact that an individual lives outside Australia does not necessarily mean that every law in their jurisdiction applies to Bodhi Skin HQ.
Where a foreign privacy law does apply to our activities, we will seek to comply with the mandatory obligations applicable to us.
Nothing in this Privacy Policy is intended to exclude a privacy, consumer or data-protection right that cannot lawfully be excluded.
49. Contact us
Questions about this Privacy Policy, requests for access or correction, deletion requests, consent withdrawals and privacy complaints should be directed to:
Please do not send highly sensitive health information to a general business email address unless it is reasonably necessary. Where available, we may direct clients to a more appropriate secure method for submitting health records, photographs or other sensitive information.