AI in Australian cosmetic clinics: what the Ahpra, TGA and privacy rules allow (2026)

Yes, an Australian cosmetic clinic can use AI. But the rules that apply to your website and your staff also apply to your AI. An AI receptionist must not promote prescription medicines, should say it is an AI, and must keep patient data safe. Tools that predict how someone will look after a procedure must not be used to advertise higher risk cosmetic procedures. And Ahpra has no approval scheme for software, so the clinic stays responsible for what its AI says.

Updated 1 November 2026. Built from the Ahpra, TGA and OAIC pages linked below. The Ahpra and some TGA pages were read from archived copies dated August to October 2026, because the Ahpra site was down on 1 November. A guide, not legal advice.

AI receptionists, chatbots, AI scribes and "see your results" apps are now sold to clinics every week. Many say they are "AHPRA compliant". This guide sets out what the regulators actually say, in their own words, so you can check any AI tool before you switch it on, including ours.

Who the rules apply to (and why "AHPRA approved" software does not exist)

The Ahpra advertising rules are not only for practitioners. The guidelines for advertising higher risk non-surgical cosmetic procedures apply to anyone who advertises them, including "individuals who are not registered health practitioners, and business, partnerships and corporate entities". The guideline also says the person who authorises the advertising is responsible, and "this includes the owner of the business" (Ahpra, 2 September 2025).

The TGA takes the same view. A person can be liable if they advertise "or cause the advertising" of therapeutic goods, which includes material published on their behalf or content they control (TGA, April 2026). In our reading, that means what your AI says to the public is likely to count as your clinic's advertising.

And no software can be "AHPRA approved", because Ahpra has no approval scheme for software. Ahpra says it "cannot give advertisers legal advice about their advertising and they cannot approve advertising" (Ahpra advertising guidelines, s 2.1). The TGA says "TGA approved" must not be used in advertising. When a vendor says its AI is "AHPRA compliant", read it as "built around the rules". The responsibility stays with you.

AI receptionists and chatbots

This is where the newest rule sits. In June 2026 the TGA listed, as likely unlawful advertising, "an interactive or automated system such as a chatbot that suggests a prescription can be issued for certain medical conditions" (TGA, 18 June 2026). The same page lists symptom checkers and quizzes that check if someone is eligible for a prescription medicine.

Three more lines from that TGA page matter for any clinic AI:

• A login does not make it private. Promoting prescription medicines "behind a login feature, paywall, or any other restricted access area may still be considered unlawful advertising", including where people must create an account or become a member.
• Emails to past patients count. The TGA's own example is a cosmetic clinic emailing former patients about injectables and prices. It is not compliant because "it is not provided in the course of treatment".
• Booking menus count. Listing prescription medicines by name in a booking system "is prohibited advertising".

The practitioner-to-patient exception is narrow. Information a practitioner gives a patient while treating them is not advertising, but the TGA says the exception does not apply where "the content is publicly accessible" or "there is no direct contact between the practitioner and the customer" (TGA, updated 18 June 2026). In our reading, a chatbot on your public website is unlikely to fit it.

Names are wider than brand names. The TGA says not to refer to prescription medicines "even indirectly", including brand names, acronyms, nicknames and hashtags. Its FAQ says it no longer expressly permits terms like "wrinkle reducing injections" or "dermal fillers" where people would read them as promoting a prescription medicine, and that a price for them, per unit or per treatment, "is likely to be considered an advertisement" (TGA FAQ v2.0, May 2024).

Privacy law adds one more rule. The OAIC says public-facing AI tools such as chatbots should be "clearly identified as such", and people should know "they are interacting with an AI system rather than a human" (OAIC, updated January 2025).

These are examples, not a full list.

AI images and "see your results" tools

The 2025 cosmetic advertising guidelines rule out one kind of tool in advertising. Advertising of higher risk cosmetic procedures "must not use automated apps, websites, tools or programs that predict an individual's appearance post-procedure", or that predict a person's appearance without a procedure (Ahpra, para 7.2). The guideline does not mention AI, but in our reading it covers AI face-preview apps and "see your results" filters used to promote those procedures.

The guidelines do not use the words "AI-generated". But they say images must not be "airbrushed, soft-filter or modified", and before-and-after images must be "of actual patients who have had the procedure being advertised performed by that health practitioner" (paras 5.2 and 5.4). In our reading, an AI-made image could not meet that. Images of anyone under 18 must not be used at all (para 5.5), and using a patient's photo in advertising needs consent separate from their treatment consent (para 5.8).

The TGA adds that content implying the effect of a prescription medicine, "for example, before and after images or treatment progress", is likely to be prohibited. And the OAIC treats an AI-generated image of a real person as a new collection of personal information.

Patient data and AI tools

A cosmetic clinic is covered by the Privacy Act whatever its size. The OAIC says it covers any business that is "a health service provider", "regardless of turnover" (OAIC). Health information is sensitive information, which gets a higher level of protection under the Privacy Act.

• Don't paste patient details into public AI tools. The OAIC recommends organisations "do not enter personal information, and particularly sensitive information, into publicly available generative AI tools". Ahpra's own case study warns that tools like ChatGPT "may store data outside Australia" (Ahpra case studies).
• Know where the AI runs. Sending personal information overseas brings in APP 8, and the clinic stays accountable for what the overseas provider does with it (OAIC). Ahpra's AI guidance asks practitioners to understand "where data is located and how it is stored".
• What the AI writes is personal information too. The OAIC says privacy obligations apply to what goes into an AI tool "as well as the output data generated by AI".

AI scribes and clinical notes

Ahpra's AI guidance is short and clear (Ahpra, reviewed 22 August 2024):

• The practitioner "remains responsible for delivering safe and quality care" and "must apply human judgment to any output of AI".
• With an AI scribe, the practitioner is responsible for "checking the accuracy and relevance of records created using generative AI".
• Patients should be told about AI use, and informed consent obtained, "ideally" noted in the record. There "may be criminal implications if consent is not obtained before recording".
• A scribe that suggests a diagnosis may become a medical device that the TGA regulates.

The privacy policy change on 10 December 2026

From 10 December 2026, your privacy policy must explain when a computer program makes, or helps make, decisions that could "significantly affect" a person's rights or interests using their personal information (OAIC, 30 September 2026). The OAIC's fact sheet says chatbots count as computer programs, and gives prioritising health services as an example in scope.

A chatbot that only answers questions and sends a booking link may not reach that bar. One that triages, decides who is eligible, or sets prices for a person may. Either way, the OAIC already expects privacy policies to explain how a business uses AI. Read your privacy policy before 10 December.

How Clinic App's AI is built around these rules

We build Clinic App, so read this part knowing that. Our AI front desk always says it is an AI assistant. It answers from the clinic's own menu and policies. It is told never to name a prescription medicine or its price, or give medical advice, and a check blocks the known names before a reply sends. It hands medical questions, possible reactions, complaints and money questions to the team, and stops answering after a possible reaction. It finds free times and sends a link; it never books or takes money itself. The AI model runs in Australia and our database is in Sydney; texts and social messages also pass through the carrier's or Meta's systems. There is no tool that predicts how a face will look. The AI front desk stays off until we switch it on with the clinic.

That does not make it "approved". As above, Ahpra has no approval scheme for software, and no regulator approves a clinic's AI receptionist. It means the tool is built to make the right thing the easy thing, and your team stays in charge.

Zoe Wogan

Founder, Clinic App

Zoe founded Clinic App and works hands-on with Australian cosmetic and skin clinics on the system that runs their bookings, front desk, memberships and patient app.