Privacy Policy

Effective July 2026. This policy replaces our previous policy of July 2021.

Diamond Aesthetics Cosmetic Clinic (H & S Co Pty Ltd) is committed to protecting your privacy and to handling your personal and health information with care. This policy explains what we collect, why we collect it, who we share it with, and the choices you have.

It applies to our clinic at 1A Grose Street, Parramatta NSW 2150, to our website at diamondaesthetics.com.au, and to every way you might contact us, including our online booking, our online shop, and our AI assistant.

1. The laws we follow

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Most small businesses are exempt from that Act, but health service providers are not exempt at any size, so it applies to us in full.

Because we hold health information in New South Wales, we are also bound by the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles. Health information is treated as more sensitive than ordinary personal information, and we handle it accordingly.

2. What we collect

We collect only what we need. Depending on how you deal with us, that may include:

Contact details: your name, mobile number, email address and postal address.
Date of birth, which we use to confirm your identity and to send you a birthday offer if you have joined our mailing list.
Health information: your medical history, medications and allergies, skin concerns and goals, consultation notes, treatment records, consent forms, and clinical photographs. We collect this only where it is relevant to your care.
Appointment and payment information, including what you booked, when you attended, and your transaction records. We do not store your full card details.
Your communications with us, including emails, text messages, enquiry forms, and conversations with our AI assistant.
Website information such as your browser type and version, operating system, the pages you view, the time of your visit, and the website that referred you. This is used to understand how our site is used.

We do not collect health information through our AI assistant, and we ask that you do not share health details, Medicare numbers or payment details in a chat.

3. How we collect it

We collect information directly from you wherever possible: when you book, when you complete an intake or consent form, when you attend the clinic, when you email or message us, when you shop online, and when you speak with our AI assistant.

Sometimes we collect information from someone else, for example a referring practitioner. Where we do, we will tell you, unless you would already reasonably expect it.

4. Why we collect it

To provide safe and appropriate treatment, and to assess whether a treatment suits you.
To manage your appointments, including reminders and follow-up.
To keep the clinical records we are required by law to keep.
To take payment and meet our tax and accounting obligations.
To answer your questions and respond to enquiries.
To send you marketing, only if you have opted in, and you can opt out at any time.
To improve our services and our website.

We will not use your information for a new purpose you would not reasonably expect without telling you first, and where the law requires it, without asking your consent.

5. Our AI assistant

We use a small amount of artificial intelligence in our business, mostly so that everyday questions get answered quickly and our clinical time goes where it belongs, which is with you. We would rather tell you plainly how it works than have you wonder.

Meet Sienna

Sienna is our virtual assistant. She answers the chat on our website and, at times, our phone. Sienna is an AI assistant, not a person, and she will tell you so. She can help with our hours, our location, parking, general information about treatments, taking a message, or passing on a booking request.

What Sienna will never do

Give you clinical or medical advice, or tell you whether a treatment is right for you.
Diagnose anything, or assess a symptom, a reaction or a complication.
Answer questions about your own treatment or your own results. Those go to Soheila or our staff.
Explain what a treatment product is or does, or compare products. That is what a consultation is for.
Name prescription medicines, which we are not permitted to advertise.
Promise or guarantee a result.
Take payment or card details.
Pretend to be a person, or write to you as though she were Soheila.

If something does not feel right after a treatment, please do not ask an AI assistant. For urgent post-treatment concerns call 0414 477 204. For anything else call the clinic on (02) 9000 5611 and a clinician will speak with you. In a medical emergency, call 000.

What happens to what you type

If Sienna takes a booking request, she may ask for your name, mobile and email so that we can hold your appointment. Nothing more. She does not ask for your date of birth, your health details, your Medicare number or your card details.
Your conversation is sent to our AI provider, Anthropic, to generate a reply. Anthropic stores and processes this information outside Australia, including in the United States. By using the chat, you consent to that transfer. If you would rather not, please call or email us instead and a person will help you.
We keep chat transcripts and call summaries for up to 12 months, and then delete them. We review them to check that Sienna is answering accurately and safely.
We do not use your conversations to sell you anything, and we do not share them outside the providers listed in this policy.

Your choices

You will always be told when you are dealing with AI rather than a person.
You can ask to speak with a human at any time, and you never have to explain why.
You can opt out of AI entirely. Call us on (02) 9000 5611 or email us, and a person will help you.
You can ask us what information we hold about you, ask us to correct it, or ask us to delete it.
You can ask us how AI is used to support our services, and we will tell you.

A person is accountable for our AI systems. If Sienna ever says something unhelpful, wrong or uncomfortable, we would genuinely like to know, because it is how we make her better. Please contact us using the details at the end of this policy.

6. Who we share your information with

We do not sell your information. We never share it for someone else’s marketing. We share it only where we need to, and only with organisations bound by confidentiality obligations:

Our practitioners and staff, so that we can care for you.
Our booking and clinical records provider, so that we can manage your appointments and records.
Our email marketing provider, if you have opted in to hear from us.
Our AI provider, as described in section 5.
Our telephone provider, if you call our AI assistant.
Our payment providers, when you pay us.
Our website and analytics providers.
Our prescribing doctors, and the portals they use to authorise your treatment, which hold the information from your doctor consultation.
Our accountant, insurer or legal adviser, where genuinely necessary.
Another health practitioner involved in your care, with your consent.
Anyone else where the law requires or permits it, for example, a subpoena, or a serious and imminent threat to someone’s life, health or safety.

7. Information sent overseas

Some of our providers are located outside Australia, or store information outside Australia. This includes our AI provider and our email marketing provider, which are based in the United States, and may include our website hosting and analytics providers.

Before disclosing your information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. Your clinical records are held in our booking and records system, and are not sent to our AI provider.

8. How we protect your information

Clinical records are held in secure, access-controlled systems, and only staff who need them can see them.
Clinical photographs are taken on clinic devices and stored in our clinical system. They are not kept on personal phones.
Our website uses encryption, and our accounts are protected by passwords and, where available, two-factor authentication.
We limit what we collect in the first place, which is the simplest protection of all.

No system is perfect. If something does go wrong, we will act on it, and section 10 explains what we do.

9. How long we keep it

Health records: we are required by law to keep adult health records for at least 7 years after your last visit. For anyone treated under the age of 18, we keep records until they turn 25.
AI chat transcripts and call summaries: up to 12 months, then deleted.
Marketing lists: until you unsubscribe.
Financial records: as required by tax law, generally 5 years.

When we no longer need information, and no law requires us to keep it, we destroy it or de-identify it.

10. If something goes wrong

If your personal information is lost, or accessed or disclosed without authorisation, and it is likely to cause you serious harm, we are required to tell you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved, and what we recommend you do.

11. Access and correction

You have a right to ask for the personal and health information we hold about you, and to ask us to correct anything wrong. Please ask us in writing, so that we can be sure it is you.

We will respond within 30 days. There are limited situations where the law allows us to refuse access, for example where giving it would seriously threaten someone’s life or health, or unreasonably affect another person’s privacy. If we refuse, we will tell you why and how to have that reviewed.

We do not charge for making a request. We may charge a reasonable fee for the cost of copying a large or old record, and we will tell you before any cost is incurred.

12. Marketing, and how to stop it

We only send you marketing if you have opted in. Every marketing email has an unsubscribe link, and it works. You can also reply to any message, or call the clinic, and we will remove you. Unsubscribing from marketing does not affect appointment reminders or messages about your care.

13. Our website

Our website uses cookies and similar technologies to make it work and to help us understand how it is used. Most browsers let you refuse cookies or delete them, though some parts of our site may not work as well if you do. Our site may also use analytics tools which collect information about your visit in a form that does not identify you.

14. Complaints

If you are concerned about how we have handled your information, please tell us first. Contact us using the details below and we will respond within 30 days. We would much rather hear from you and fix it.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. For health information held in New South Wales, you can also contact the NSW Information and Privacy Commission at ipc.nsw.gov.au or on 1800 472 679.

15. Changes to this policy

We may update this policy as our services, our tools or the law change. The current version is always on our website, with the date it took effect. If we make a significant change to how we handle your information, we will make that clear.

16. Contact us

We welcome your questions about this policy or about how we handle your information.

Diamond Aesthetics Cosmetic Clinic (H & S Co Pty Ltd)
1A Grose Street, Parramatta NSW 2150
Phone: (02) 9000 5611
Email: info@diamondaesthetics.com.au
Urgent post-treatment concerns: 0414 477 204