Privacy policy

Aesthetics by Dr Hendler is the trading name of Dr Shane Sophie Hendler (ABN 72 301 438 813), a medical practitioner practising at 10 Curlewis Street, Bondi Beach NSW 2026. In this policy, "we", "us" and "our" refer to the practice.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the Health Records and Information Privacy Act 2002 (NSW). This policy explains what personal information, including health information, we collect, why, and how you can access or correct it.

We only collect information we need to provide safe care and run the practice. This may include:

• Contact details: your name, email address and phone number.
• Identity details: your date of birth.
• Emergency contact: the name, phone number and relationship to you of one person we can call if you are unwell or there is an emergency. This is information about someone else, so please make sure they know you have given it to us.
• Health information: your reason for attending, medical history and conditions, medications and supplements, allergies, previous cosmetic treatments, pregnancy and breastfeeding status, and your answers to screening questions about how you feel about your appearance.
• Treatment records: clinical notes, products and batch numbers used, consent forms you sign and, with your consent, clinical photographs.
• Booking and payment details: the treatment and time you book, notes you add, and invoices. Card payments are handled by Stripe; we never see or store your full card number.
• Messages you send us through the website contact form, email or social media.
• Website usage information, described under Cookies and analytics below.

We collect information directly from you: when you book or send an enquiry on this website, complete the secure forms we send you before treatment, speak with us, or attend an appointment. If you give us information about another person, please make sure they have agreed to you doing so.

You may choose not to give us some information, or to deal with us using a pseudonym for general enquiries. However, we cannot provide medical treatment without the health information needed to do so safely.

We will only use clinical photographs for education or marketing if you have separately agreed to this, and only in a de-identified form. You can withdraw that agreement at any time for future use.

We do not sell your personal information, and we do not use your health information for direct marketing.

• To assess whether a treatment is suitable and safe for you, and to provide and follow up your care.
• To manage bookings, send confirmations, reminders and aftercare instructions, and take payments.
• To contact your emergency contact if you become unwell or there is an emergency during or after your treatment. We use these details for nothing else.
• To keep accurate clinical records, as medical practitioners are required to do.
• To respond to your enquiries and complaints.
• To meet our legal, regulatory, insurance and professional obligations.

We only share your information where it is needed to care for you or run the practice, or where the law allows or requires it. This includes:

• Other health practitioners involved in your care, with your consent or in an emergency.
• Service providers that help us operate: our hosting and database providers (Vercel and Supabase), our email provider (Resend), and our payment provider (Stripe). They may only use your information to provide their service to us.
• Our professional advisers, insurers and regulators, where required.
• Courts, tribunals, law enforcement or government authorities, where required or authorised by law.

Our patient records are stored electronically in a database hosted in Sydney, Australia, and the website runs on servers in Sydney. Access to records is limited to the treating practitioner and protected by a password and two-factor authentication.

Some of our service providers may process limited information outside Australia, for example in the United States: email delivery (Resend), payment processing (Stripe) and website analytics (Google). We take reasonable steps to ensure these providers protect your information consistently with the Australian Privacy Principles.

No method of storing or transmitting information is completely secure, but we take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure.

Health records are kept for the periods required by law. In NSW this is generally at least seven years from your last visit, or until you turn 25 if you were a child when you were treated. After that, records may be securely destroyed or de-identified.

Our website uses Google Analytics and Vercel Analytics to understand how visitors use the site, such as which pages are viewed. Google Analytics uses cookies to do this; you can block cookies in your browser or use Google's opt-out tool. Analytics do not run on your pre-treatment forms, booking status or checkout pages. Our payment provider, Stripe, uses cookies on the checkout page to help prevent fraud, and the embedded Google map on our contact page may set Google cookies.

You can ask for access to the personal and health information we hold about you, or ask us to correct it, by emailing info@aestheticsbydrhendler.com.au. We will respond within 30 days. We may need to confirm your identity first, and in limited circumstances allowed by law we may decline access; if so, we will tell you why. We do not charge for requests, although a reasonable fee may apply for providing copies of large records.

If you have a concern about how we have handled your information, please contact us first at info@aestheticsbydrhendler.com.au and we will respond in writing within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or the NSW Information and Privacy Commission (ipc.nsw.gov.au, 1800 472 679).

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated.