Privacy Policy

---

TRIPLETS HOUSE OF BEAUTY

Triplets House of Beauty (“THOB”, “we”, “us”, “our”) is a hair, beauty and skin therapy business operating at 61 Adelphi Street, Rouse Hill NSW 2155. Our ABN is 91673406267. 

This policy explains how we collect, hold, use, disclose, store and protect your personal information, including the health information we collect before certain treatments. It applies to everyone we deal with: clients, prospective clients, website and social media visitors, suppliers and job applicants.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we provide treatments intended to assess, maintain or improve your physical health, and because we collect and record health information in order to do so, we treat ourselves as a health service provider under that Act. Health service providers are covered by the Privacy Act regardless of annual turnover, so the small business exemption does not apply to us.

As a private sector health service provider in New South Wales, we are also bound by the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles it contains. Where our marketing communications are concerned, we comply with the Spam Act 2003 (Cth).

2. What we mean by personal and health information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Your name, phone number and appointment history are personal information.

Health information is a type of sensitive information. It includes information about your physical or mental health, any disability, your medications, and the health services you have received. Most of what we record on a consultation or consent form is health information.

Sensitive information attracts stronger protection under the Privacy Act than ordinary personal information. We will only collect it with your consent and only where it is reasonably necessary for us to treat you safely.

3. What information we collect

3.1 Identity and contact information

Your name, date of birth, postal address, email address and phone numbers.

Your preferred method of contact.

Emergency contact name, relationship and contact details, where a treatment requires one.

How you heard about us.

3.2 Health information

Before certain services, particularly skin therapy, laser, chemical and smoothing treatments, we ask you to complete a consultation or consent form. Depending on the service, this may record:

Your medical history and any chronic or current medical conditions.

Medications, supplements and recent prescription treatments.

Allergies and sensitivities, including to products, latex, metals and anaesthetic agents.

Whether you are pregnant, trying to conceive or breastfeeding.

Active skin conditions and skin type, including Fitzpatrick classification.

Previous cosmetic, laser or injectable treatments, and your response to them.

Any adverse reaction you have experienced to a treatment or product.

We collect this information for one reason: some treatments are unsafe, less effective, or require a different approach depending on your health. We do not collect health information we do not need.

3.3 Treatment and service records

Services performed, dates, and the staff member who performed them.

Technical treatment parameters, such as colour formulations, product and batch details, device settings and treatment areas.

Consultation notes, recommendations and home care prescriptions.

Your consent forms and signatures.

3.4 Photographs

For some treatments we take clinical before and after photographs as part of your treatment record. We will always tell you when we intend to take a photograph. Separately, we may ask whether you consent to us using photographs of your hair or skin for promotional purposes, including on our website and social media. Those are two different things, and you can agree to one and refuse the other. Declining promotional use will never affect the treatment you receive or the way you are treated.

3.5 Payment information

When you pay us, your card details are processed by our payment providers and are not stored by us. We retain a record of the transaction, the amount and the payment method, but we do not hold your full card number.

3.6 Website and online information

Information you submit through our website, booking page or online forms.

Standard technical information such as IP address, browser type and pages visited, collected through cookies and analytics.

Messages you send us through social media, email or SMS.

3.7 Job applicants

If you apply to work with us, we collect your application, resume, qualifications, work history and referee comments. We use this only to assess your application and, if you are successful, to employ you.

4. How we collect your information

We collect most information directly from you: in person at the salon, through our online booking system, through digital consultation and consent forms, by phone, email or SMS, and through our website and social media channels.

Where it is reasonable and practicable, we collect personal information directly from you rather than from someone else. Occasionally we may receive information from a third party, such as a referring practitioner or a family member making a booking on your behalf. If we do, we will take reasonable steps to make you aware of it.

You can deal with us anonymously or under a pseudonym for general enquiries. However, we cannot provide most treatments without your identity and health information, because we cannot assess whether a treatment is safe for you without it.

5. Why we collect, hold and use your information

We use your information for the following purposes:

Providing your treatment. Assessing suitability, identifying contraindications, planning and performing services, and recording what was done.

Your safety. Screening for medical conditions, allergies and interactions, and responding appropriately if an adverse reaction occurs.

Continuity of care. Ensuring any of our therapists can see your history, formulations and prior responses.

Managing appointments. Confirmations, reminders, rescheduling, cancellations, deposits and cancellation fees.

Payment and accounts. Processing payments, issuing receipts and invoices, and meeting our tax and record-keeping obligations.

Communicating with you. Answering enquiries and responding to feedback or complaints.

Marketing. Sending you offers, promotions and news, where you have consented. See section 9.

Improving our business. Understanding which services are used, training our team, and improving the client experience.

Legal and insurance. Meeting our legal obligations and responding to any claim, complaint or regulatory enquiry.

6. Consent

We collect health information only with your consent. By completing a consultation or consent form and proceeding with treatment, you consent to us collecting, holding and using that information for the purposes set out in this policy.

You may withdraw your consent at any time by contacting us. If you withdraw consent for us to hold health information necessary to treat you safely, we may be unable to continue providing certain services. Withdrawing consent does not require us to delete records we are legally required to retain. See section 11.

7. Who we share your information with

We do not sell your personal information, and we do not trade or rent it to anyone. We share it only where necessary, and only with the following:

Our team. Staff and contractors who need it to provide your service or run the business.

Our booking and client management provider. We use Timely to manage bookings, client records, consultation forms and communications.

Our payment providers. Card payments are processed by Stripe (through TimelyPay) and by Commonwealth Bank of Australia for in-salon transactions.

Messaging providers. The telecommunications and email providers that deliver our appointment reminders and marketing messages.

Professional advisers. Our accountant, insurer, lawyers and, where relevant, product suppliers in connection with a product reaction or recall.

Health practitioners. Where you ask us to, or where it is necessary to lessen or prevent a serious threat to your life, health or safety.

Where the law requires it. Including to a court, tribunal or regulator.

We require our service providers to handle your information consistently with this policy and with Australian privacy law.

8. Overseas disclosure

Some of our service providers store or process information outside Australia. In particular:

Timely, our booking and client management platform, is based in New Zealand and may store data in New Zealand or other locations.

Stripe, our payment processor, is based in the United States and processes payment data internationally.

Some email, messaging and analytics providers may store data in the United States or the European Union.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles. By providing your information to us, you acknowledge that it may be stored or processed outside Australia.

9. Marketing communications

We send marketing messages by SMS and email only where you have consented to receive them. Consent is collected separately from your booking and treatment consent, and declining marketing will never affect the service you receive.

Appointment confirmations, reminders, consultation forms and aftercare instructions are not marketing. They relate directly to a service you have booked, and we will continue to send them even if you opt out of marketing.

Every marketing message we send identifies us as the sender and includes a way to unsubscribe. You can opt out at any time by using the unsubscribe link, replying STOP to an SMS, or contacting us directly. We action opt-out requests promptly.

10. How we protect your information

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:

Storing client records in a password-protected, access-controlled system rather than on paper wherever possible.

Limiting access to client records to staff who need it to do their job.

Storing any paper records securely and out of public view.

Using payment providers that handle card data to recognised security standards, so we do not store card numbers ourselves.

Training our team on their privacy and confidentiality obligations.

Securely destroying or de-identifying information we no longer need and are not required to keep.

No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

11. How long we keep your information

We keep health information for as long as the law requires. In New South Wales, private sector health service providers must retain health information for at least seven years from the date of the last service provided to you. Where the information relates to someone who was under 18 at the time it was collected, it must be retained until that person turns 25.

Other records, such as financial and tax records, are kept for the periods required under Australian tax law. Information we are not required to keep is destroyed or de-identified once it is no longer needed for the purpose it was collected.

12. Accessing and correcting your information

You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct anything that is inaccurate, out of date, incomplete or misleading.

To make a request, contact our Privacy Officer using the details in section 15. We will ask you to verify your identity. We will respond within 30 days.

Access is usually free, though we may charge a reasonable fee for the cost of retrieving and copying records where a request is substantial. We will tell you about any fee before proceeding.

In limited circumstances we may refuse access or correction, for example where giving access would pose a serious threat to someone’s life, health or safety, or where it would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and explain how to complain.

13. Our website

Our website uses cookies to analyse traffic and improve your experience. Cookies are small files stored on your device. You can disable cookies through your browser settings, though some features of the site may not work properly if you do.

Our website and social media channels may contain links to other websites. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

14. Complaints

If you believe we have breached your privacy, please tell us first. Contact our Privacy Officer using the details below, setting out what happened and how you would like it resolved. We will acknowledge your complaint within +61 428 839 590 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can take the matter further:

Office of the Australian Information Commissioner (OAIC). Phone 1300 363 992, or lodge a complaint at oaic.gov.au.

Information and Privacy Commission NSW. For complaints about health information held in New South Wales. Phone 1800 472 679, or visit ipc.nsw.gov.au.

15. Contact us

For any question about this policy, or to make an access, correction or complaint request, contact our Privacy Officer:

Privacy Officer, Triplets House of Beauty

61 Adelphi Street, Rouse Hill NSW 2155

Email: tripletshouseofbeauty@gmail.com

Phone: +61 428 839 590

16. Changes to this policy

We review this policy periodically and may update it to reflect changes in our services, our systems or the law. The current version is always available on our website, and the effective date appears at the top of this document. Where changes are significant, we will take reasonable steps to notify you.

Thank you for choosing Triplets House of Beauty. We are committed to protecting your privacy and ensuring the security of your personal information.