Last updated: 12 June 2026

1. About this policy
 

AB Clinics Pty Ltd (ABN 92 688 548 450), trading as Curate Aesthetic Clinic (“Curate”, “we”, “us” or “our”), respects your privacy and is committed to handling your personal information carefully, respectfully and securely.

This Privacy Policy explains:

• The kinds of personal information we collect and hold

• How we collect, use, store and disclose that information

• How you may access or correct your information

• How you may make a privacy enquiry or complaint

• How we manage information collected through our website, booking systems and digital services

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable laws, professional obligations and clinical recordkeeping requirements.

This policy applies to patients, prospective patients, website visitors, gift-card purchasers, suppliers, contractors, job applicants and other people who interact with Curate.
 

2. Who we are
 

Curate Aesthetic Clinic provides cosmetic medicine, skin and related health services from our clinic in Graceville, Queensland.

Our contact details are:

Curate Aesthetic Clinic
AB Clinics Pty Ltd
1/306 Oxley Road
Graceville QLD, Australia

Telephone: 0433 456 936
Email: admin@curateclinic.com

Privacy enquiries may be directed to our Privacy Officer using these details.
 

3. The information we collect
 

The information we collect depends on how you interact with us and the services you receive.
 

Personal and contact information

This may include:

• Your name, date of birth and preferred name

• Residential or postal address

• Telephone number and email address

• Emergency contact details

• Gender, pronouns or other information relevant to providing respectful care

• Identity information where reasonably necessary

• Appointment, account and communication details
   

Health and sensitive information

To assess your suitability and provide safe clinical care, we may collect sensitive information such as:

• Medical and surgical history

• Current and previous health conditions

• Medications and supplements

• Allergies and previous reactions

• Pregnancy or breastfeeding information

• Relevant lifestyle information

• Treatment concerns, preferences and goals

• Previous cosmetic, skin, dental or medical procedures

• Consultation notes, assessments and treatment plans

• Prescribing and medication information

• Procedure records, product and device details

• Treatment outcomes, aftercare and follow-up records

• Adverse reactions, complications and incident information

• Referrals, pathology results or correspondence from other healthcare practitioners, where relevant

• Clinical photographs and videos
   

Health information is sensitive information and is handled with additional care.

Clinical photographs and recordings

We may take photographs or recordings where reasonably necessary for:

• Clinical assessment

• Treatment planning

• Monitoring progress

• Comparing changes over time

• Documenting treatment and recovery

• Supporting continuity of care

• Managing a concern, adverse reaction or complication
   

Clinical images form part of your health record.

We will not use identifiable clinical photographs, videos or other personal information for advertising, social media, education or promotional purposes without obtaining separate and specific consent.

You may withdraw permission for future promotional use by contacting us. Withdrawal may not enable us to retrieve material that has already been lawfully printed, distributed, shared or republished by others.
 

Payment and transaction information

We may collect information relating to:

• Payments, deposits and refunds

• Invoices and receipts

• Gift-card purchases and redemptions

• Transaction history

• Billing or payment disputes

Payments may be processed by third-party payment providers. Curate will not ordinarily receive or retain your complete payment-card details when those details are entered directly into a secure third-party payment system.
 

Website and technical information

When you visit our website or use our online services, we may automatically collect:

• Internet Protocol address

• Browser and device type

• Operating system

• General location information

• Pages viewed and links selected

• Date, time and duration of visits

• Referring website

• Cookie identifiers

• Website performance and security information
   

Communications and marketing information

We may retain:

• Emails, telephone calls, SMS messages and online enquiries

• Messages sent through social media

• Appointment reminders and responses

• Treatment follow-up communications

• Marketing preferences and consent records

• Feedback, reviews, complaints and survey responses
   

Please avoid sending detailed or urgent health information through social media. Contact the clinic directly when clinical advice or prompt assistance is required.
 

Other information

We may also collect information relating to suppliers, contractors, employment applicants and people working with Curate where reasonably necessary for our business and legal obligations.
 

4. How we collect information
 

We usually collect information directly from you when you:

• Complete a consultation, consent or medical-history form

• Create an account or use our patient portal

• Book, change or cancel an appointment

• Attend the clinic or receive a telehealth consultation

• Speak with our practitioners or administrative team

• Contact us by telephone, email, SMS, website form or social media

• Purchase a treatment, product or gift card

• Provide photographs, documents or health information

• Subscribe to updates or consent to marketing

• Complete a survey, review or complaint

• Visit our website or use our online services
   

We may also collect information from:

• Your parent, guardian, authorised representative or support person

• A referring or treating healthcare practitioner

• A prescribing practitioner or medical director involved in your care

• A pathology provider, pharmacy or other healthcare service

• Our booking, patient-management, payment and communication providers

• Publicly available sources, where lawful and appropriate
   

We will generally obtain your consent before collecting health information from another person, unless collection is otherwise permitted or required by law.

If we receive unsolicited information, we will determine whether we could lawfully have collected it. Information that is not required and does not need to be retained will be securely destroyed or de-identified where reasonably practicable.
 

5. Why we collect and use your information
 

We may collect, hold, use and disclose personal information to:

• Respond to enquiries

• Identify you and maintain accurate patient records

• Assess your health, concerns, goals and treatment suitability

• Provide consultations, treatments, prescriptions and clinical care

• Develop and review individual treatment plans

• Communicate with practitioners involved in your care

• Arrange appointments, reviews and follow-up

• Send appointment reminders, preparation instructions and aftercare

• Monitor treatment progress and respond to concerns

• Manage adverse reactions, complications and emergencies

• Process payments, deposits, refunds and gift cards

• Provide products or services you request

• Maintain clinical, financial and administrative records

• Verify consent and communication preferences

• Improve the safety, quality and administration of our services

• Train and supervise staff using appropriately authorised or de-identified information

• Respond to feedback, complaints, legal claims or disputes

• Meet professional, regulatory, insurance, taxation and legal obligations

• Detect or prevent fraud, misuse or security threats

• Protect the health, safety or welfare of patients, staff and others

• Send marketing communications where permitted and appropriately consented to

We may use de-identified or aggregated information for internal auditing, service planning, quality improvement and statistical analysis where individuals cannot reasonably be identified.

We will not sell or rent identifiable patient information.
 

6. What happens if information is not provided?

You may choose not to provide requested personal information. However, we may be unable to:

• Respond fully to your enquiry

• Determine whether a treatment is suitable

• Provide safe clinical care

• Prescribe or administer a treatment

• Process a booking or payment

• Contact you regarding an appointment or clinical concern

• Meet our legal or professional obligations

We will explain when particular information is necessary.
 

7. Anonymity and pseudonyms

You may contact us anonymously or use a pseudonym when making a general enquiry where it is lawful and practical to do so.

We will ordinarily need to confirm your identity when providing clinical services, prescribing treatment, processing certain transactions, maintaining health records or responding to an access request.
 

8. When we disclose information

We may disclose relevant personal information to:

• Curate’s practitioners, employees and authorised contractors

• Our medical director, prescribing practitioners or other clinicians involved in your care

• Healthcare practitioners, pharmacies, pathology providers or emergency services where necessary and lawful

• A person you have authorised to receive information

• Patient-management, booking and clinical software providers

• Website hosting, cloud-storage, cybersecurity and IT support providers

• Email, telephone, SMS and communication providers

• Payment processors, banks and financial service providers

• Accountants, auditors, legal advisers and insurers

• Professional advisers assisting with a complaint, incident or claim

• Government agencies, courts, tribunals, regulators or law-enforcement bodies where required or authorised by law

• A prospective purchaser or adviser involved in a proposed sale or restructure of the business, subject to appropriate confidentiality and privacy safeguards
   

Only information reasonably necessary for the relevant purpose will be disclosed.

We may disclose information without consent where required or authorised by law, or where permitted to lessen or prevent a serious threat to a person’s life, health or safety.

9. Our service providers

Curate uses third-party providers to support services such as:

• Patient records and practice management

• Online bookings and patient portals

• Website hosting and website forms

• Payment processing

• Email and SMS communications

• Cloud storage and document management

• Website analytics and security

• Accounting, professional advice and business administration
   

Our website currently links to a Dapple patient booking and portal service and uses Google reCAPTCHA to protect online forms.

Third-party services have their own terms and privacy policies. We take reasonable steps when selecting and managing providers, but their handling of information is also governed by their own privacy practices.
 

10. Direct marketing

With your consent, or where otherwise permitted by law, we may send information about:

• Clinic news

• Services and treatment information

• Events

• Product information

• Educational material

• Offers or promotions
   

We will not use sensitive health information for direct marketing without your consent.

You may opt out at any time by:

• Selecting the unsubscribe link in an email

• Replying STOP to an SMS where that option is provided

• Contacting the clinic

• Emailing admin@curateclinic.com
   

There is no charge to opt out.

Opting out of promotional communications will not prevent us from sending necessary service communications, including appointment information, consent documentation, treatment preparation, aftercare, safety information or clinically appropriate follow-up.
 

11. Cookies, analytics and website technologies

Our website may use cookies and similar technologies to:

• Enable website functions

• Remember preferences

• Maintain security

• Understand website traffic

• Measure website performance

• Improve the user experience
   

Cookies may collect technical and usage information but do not necessarily identify you by name.

You may manage or disable cookies through your browser or available website settings. Disabling certain cookies may affect website functionality.

Our website forms are protected by Google reCAPTCHA. Information collected through reCAPTCHA is handled in accordance with Google’s applicable privacy terms.

Our website may contain links to third-party websites, booking portals and social-media services. Curate is not responsible for the privacy practices or content of external websites.
 

12. Overseas processing and disclosure

Some technology, cloud, communications, analytics and payment providers may store, process or access information outside Australia.

Overseas recipients or service-provider operations may be located in the United States and other countries in which the relevant providers or their approved subprocessors operate.

The location of overseas processing may change as providers update their infrastructure. Where we disclose personal information overseas, we take reasonable steps required by Australian privacy law to ensure that the information is handled appropriately.

You may contact us for further information about the overseas locations relevant to the services we currently use.
 

13. How we store and protect information

Personal information may be stored:

• In electronic patient-management and clinical systems

• In secure cloud-based services

• In clinic computers, email systems and business applications

• In securely stored paper records

• With authorised third-party service providers

We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
 

These measures may include:

• Role-based access restrictions

• Password controls and multi-factor authentication where available

• Secure premises and physical storage

• Encryption and secure transmission where supported

• Staff confidentiality requirements

• Privacy and security procedures

• Software maintenance and security monitoring

• Secure disposal processes

• Data-breach response procedures

No method of electronic transmission or storage is completely secure. We regularly review our practices in light of the sensitivity of the health information we hold.
 

14. Retention and disposal

We retain health and business records for as long as reasonably necessary to:

• Provide ongoing and safe care

• Meet clinical and professional recordkeeping requirements

• Comply with legal, taxation, insurance and regulatory obligations

• Respond to complaints, incidents or legal claims

Different types of records may have different retention periods.

When information is no longer required and we are not legally required to retain it, we take reasonable steps to securely destroy or permanently de-identify it.
 

15. Data breaches

A data breach may occur when personal information is lost, accessed or disclosed without authorisation.

We maintain procedures for responding to suspected or confirmed data breaches. This may include containing the incident, assessing the possible consequences, taking remedial action and reviewing our safeguards.

Where a breach is likely to result in serious harm and notification is legally required, we will notify affected individuals and the Office of the Australian Information Commissioner.
 

16. Accessing your information

You may request access to the personal information we hold about you.

Requests may be made by contacting our Privacy Officer. We may ask you to verify your identity before releasing information.

We will respond within a reasonable period. We will not charge you for making an access request, although a reasonable administrative charge may apply to providing access where permitted by law. We will tell you about any proposed charge before proceeding.

In some circumstances, access may be limited or refused where permitted or required by law. Where appropriate, we will provide written reasons and information about available complaint options.
 

17. Correcting your information

You may ask us to correct personal information that you believe is inaccurate, incomplete, out of date, irrelevant or misleading.

Please contact us as soon as possible when your:

• Contact details change

• Health status changes

• Medications or allergies change

• Emergency contact changes

• Other information relevant to your care changes

If we do not agree to a requested correction, we will explain why where required and advise you of available complaint options. You may ask us to associate a statement with the record noting that you consider the information incorrect.
 

18. Privacy enquiries and complaints

Please contact our Privacy Officer if you:

• Have a question about this policy

• Wish to access or correct your information

• Believe your information has been mishandled

• Have a concern about our privacy practices

Complaints should include enough information for us to understand and investigate the concern.
 

We will:

1. Acknowledge your complaint

2. Review the relevant circumstances and records

3. Seek further information where necessary

4. Provide a response within a reasonable period, generally within 30 days

Privacy complaints may be directed to:

Privacy Officer
Curate Aesthetic Clinic
1/306 Oxley Road
Graceville QLD, Australia

Email: admin@curateclinic.com
Telephone: 0433 456 936

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.
 

19. Changes to this policy

We may update this Privacy Policy to reflect changes to:

• Our services

• Our systems and service providers

• Our information-handling practices

• Applicable laws and professional requirements

The current version will be published on our website with the date it was last updated.

20. Alternative formats

You may request a copy of this Privacy Policy in an alternative or accessible format by contacting us.