Privacy policy

Last updated: 2 October 2026

Anna Jo Beauty Clinic (ABN 60 612 780 873), trading as Anna Jo Medical Beauty ("Anna Jo", "we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, hold, use and disclose your personal information, including health information, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Health Records Act 2001 (Vic).

This policy applies to information collected through our clinic, our website www.annajo.com.au, our online store, and any communication with us by phone, email, social media or messaging apps.

1. What information we collect

Depending on how you interact with us, we may collect:

Contact and identity details such as your name, date of birth, gender, address, phone number and email address.
Health information such as your medical history, medications, allergies, skin type and concerns, pregnancy or breastfeeding status, treatment records, consent forms, and before and after clinical photographs.
Booking and transaction information such as appointments, treatments received, products purchased, deposits and payment confirmations. Card payments are processed by our payment providers and we do not store your full card details.
Account information if you create an account on our online store, such as login details, order history and preferences.
Website and device information such as your IP address, browser type, pages viewed and how you arrived at our website, collected through cookies and similar technologies.
Communications including enquiries, feedback and messages you send us.

2. How we collect information

We collect personal information directly from you wherever possible, for example when you book an appointment, complete a consultation or consent form, make a purchase, subscribe to our newsletter or contact us. We may also collect information from your referring doctor or other health practitioners with your consent, and automatically through our website.

You may choose to deal with us anonymously or under a pseudonym when making a general enquiry. However, we cannot provide treatments without identifying you and collecting relevant health information, as this is required for your safety.

3. Why we collect and use your information

We collect, hold and use your personal information to:

assess your suitability for treatments and provide safe, appropriate care;
maintain accurate clinical records, including treatment notes and clinical photographs;
manage appointments, deposits, reminders and follow-up care;
process and deliver online orders;
respond to enquiries and provide customer support;
send you marketing communications where you have agreed to receive them;
improve our services and website; and
comply with our legal, regulatory and professional obligations.

4. Health information and clinical photographs

Health information is sensitive information. We only collect it with your consent and where it is reasonably necessary to provide our services. Clinical photographs are taken to record your treatment and progress and form part of your clinical record.

We will never use your photographs, name or any identifying information in advertising, social media or on our website without your separate, express written consent. You may withdraw that consent at any time.

5. Who we disclose information to

We do not sell your personal information. We may disclose your information to:

our practitioners and clinic staff involved in your care;
other health practitioners, such as your GP or a specialist, where you have consented or where it is necessary for your care;
service providers who help us operate our business, such as our booking system, website and e-commerce platform (Shopify), payment processors, IT and cloud storage providers, delivery services and email marketing providers. These providers may only use your information to perform services for us;
our insurers, legal advisers and auditors; and
government and regulatory authorities where required or authorised by law.

6. Overseas disclosure

Some of our service providers, including Shopify, may store or process information on servers located outside Australia, including in Canada, the United States and other countries. Where this occurs, we take reasonable steps to ensure those providers handle your information in a manner consistent with the APPs. Clinical records are stored securely and access is restricted to authorised personnel.

7. Marketing

With your consent, we may send you information about treatments, products, offers and events by email or SMS. Every marketing message includes an easy way to unsubscribe. You can also opt out at any time by contacting us. Opting out of marketing will not affect messages about your appointments or orders.

8. Cookies and website analytics

Our website uses cookies and similar technologies to operate the online store, remember your preferences, understand how visitors use the site and, where you allow it, show relevant advertising. You can manage cookies through your browser settings and our cookie banner. Disabling cookies may affect some website features.

9. Security and retention

We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access, modification or disclosure, including secure systems, access controls and staff confidentiality obligations.

In accordance with the Health Records Act 2001 (Vic), we retain health records for at least 7 years after your last visit, or for a person treated as a minor, until they turn 25, whichever is later. When information is no longer required, we securely destroy or de-identify it.

10. Accessing and correcting your information

You may request access to the personal and health information we hold about you, or ask us to correct it if you believe it is inaccurate, out of date or incomplete. Please contact us using the details below. We will respond within a reasonable time, usually within 30 days. In limited circumstances permitted by law we may decline access, and if so we will explain why. We may charge a reasonable fee for providing copies of records, but not for making a request.

11. Complaints

If you have a concern about how we have handled your personal information, please contact us first so we can try to resolve it. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you may contact:

Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992
Health Complaints Commissioner (Victoria): hcc.vic.gov.au, phone 1300 582 113