Client data does not automatically belong to whoever buys a cosmetic clinic just because they bought the business. It is treated as an asset that transfers with the sale, like the client list and the equipment, but the transfer itself is a disclosure under the Privacy Act and has to meet the same standard the clinic was already operating under. The new owner becomes the data's custodian, not a fresh, unaccountable owner of it.
Who legally owns client data when a clinic changes hands?
Personal information is not owned the way a chair or a laser machine is owned. Under the Privacy Act 1988, an organisation that holds personal information is its custodian: responsible for looking after it, using it only for what it was collected for, and keeping it secure. When a clinic is sold as a going concern, that custodianship is usually intended to transfer with the business, along with the client list, treatment records and booking history.
The handover is a disclosure, not a free transfer. Moving client records from a seller to a buyer counts as a disclosure of personal information under the Australian Privacy Principles, so it needs a lawful basis, most often that the clients were told, directly or through the clinic's privacy policy, that their data might be transferred if the business changed hands.
If the sale is structured as a share sale, where the buyer takes over the company itself rather than its assets, the legal entity holding the data does not change, which simplifies this question considerably. Most small clinic sales are asset sales, which is where the data question actually needs deliberate handling.
Do clients need to be told the clinic is being sold?
There is no single national rule that says a clinic must get fresh, individual consent from every client before a sale can proceed. What matters is whether a business transfer was already a disclosed, reasonably expected use of the data.
If the clinic's privacy policy already names a business sale, merger or restructure as a circumstance in which client data might be disclosed, that generally covers the transfer itself. If it does not, or if the new owner intends to use the data differently, such as running a different treatment mix or a new marketing program, clients should be told before or shortly after settlement, not left to find out from a changed sign on the door.
Would a client be surprised to learn their records moved to a new owner without being told? If the honest answer is yes, tell them. Silence is the thing that turns a routine sale into a complaint.
What should a clinic sale contract say about client data?
Data is easy to leave out of a sale contract that focuses on the lease, the equipment schedule and the goodwill figure. It belongs in there just as specifically as anything else changing hands.
- A data schedule that lists exactly which records, systems and vendor accounts are included in the sale, not a vague reference to "client information".
- A warranty from the seller that the data was collected and stored lawfully, and that no undisclosed data breach has occurred.
- Who notifies clients about the change of ownership, and by when.
- What happens to software logins, including the booking system, the loyalty or membership app, and any marketing tools, on settlement day.
- A retention and deletion clause covering what the outgoing owner may keep for their own records, and for how long, once they no longer run the clinic.
A solicitor experienced in clinic or medical practice sales will usually have templates for most of this. The mistake is treating it as boilerplate rather than reading it against what your clinic's software actually holds.
What happens to the booking, loyalty or membership app when the clinic sells?
Software accounts do not transfer themselves. A booking system, a loyalty program or a client app is usually tied to an account the seller set up, with the seller as the billing contact and administrator. If nobody tells the vendor the clinic has changed hands, the account can end up with the wrong person still able to access client records, or with nobody able to log in at all once the previous owner cancels their card.
The practical fix is simple but easy to skip in the rush of settlement: tell every software vendor the clinic uses about the change of ownership, and formally transfer admin access rather than just handing over a shared password. Keep clients through the handover covers the retention and communication side of a sale in more depth; this is the data-custody side of the same event.
Nobody asks who owns the data on the day a clinic is sold. They ask on the day something goes wrong with it, and by then the answer needs to already be on paper.
Does the new owner inherit the previous owner's privacy risk?
Largely, yes. The buyer takes on client data as it actually was collected and stored, shortcuts included. If the previous owner kept before-and-after photos on personal phones, used shared logins, or never had a breach response plan, those problems do not reset to zero at settlement. Is your clients' data actually safe? covers what good data practice looks like day to day, and is worth checking against before a sale closes, not after.
This is why data handling belongs in buyer due diligence alongside the financials: ask to see the privacy policy, ask whether there has ever been a data breach, and ask where records are actually stored. A seller who cannot answer clearly is telling you something about the risk you are about to take on.
What if a client asks to have their data deleted during a sale?
Clients can ask at any time, sale or no sale, and the request does not disappear because ownership is changing hands. The answer depends on whether a retention reason still applies, such as a professional record-keeping obligation for clinical treatment. How long should a cosmetic clinic keep client records? sets out the retention periods that generally apply and when a record can actually be deleted rather than kept. During a sale, whoever receives that request, seller or buyer, should pass it on and confirm it has been actioned, rather than letting it fall into the gap between the two.
Clinic App is built for the Australian cosmetic and skin clinic market and sits on top of the booking system you already use. If your clinic changes ownership, the client app, loyalty balances and membership records move with it in the same way any other clinic asset does, provided the account handover is done properly rather than left informal.
Frequently asked questions
Who legally owns client data when a cosmetic clinic is sold?
Client data is generally treated as a business asset that transfers with the sale, along with goodwill, equipment and the client list, rather than something bought or sold on its own footing. The incoming owner becomes the new custodian of that data, but the handover itself counts as a disclosure under the Privacy Act, so it has to meet the same standard the clinic was already operating under, not a lower one.
Do clients need to be told when their clinic is sold?
There is no blanket legal requirement to get fresh consent from every client, but telling them is standard practice and usually the safer path. If a clinic's privacy policy already names a business sale as a reason data might be disclosed, that covers the transfer. If it does not, or the new owner plans to use the data differently, clients should be told before or shortly after settlement.
What should a clinic sale contract say about client data?
A data schedule listing exactly what records, systems and accounts are included, a warranty from the seller that the data was collected and stored lawfully, disclosure of any past data breaches, who is responsible for notifying clients, and what happens to software logins and vendor accounts on settlement day.
Does a new clinic owner inherit the previous owner's privacy compliance risk?
Largely yes. The new owner takes on the client data as it actually was collected and stored, including any past shortcuts, so if the previous owner mishandled data, that risk generally follows the records rather than staying with the seller. This is why data practices belong in due diligence, not just equipment and lease terms.
