Most Australian medical indemnity insurers recommend keeping a cosmetic or injectable client's clinical records for at least seven years after their last visit, and until they turn 25 if they were a minor when treated. The Privacy Act adds a second rule on top of that: once none of those retention reasons still apply, a clinic is expected to destroy or de-identify the personal information it holds, not keep it indefinitely by default.
What does the Privacy Act actually say about deleting old client records?
The Privacy Act 1988 covers most cosmetic clinics because they collect health information, and Australian Privacy Principle 11.2 is the relevant one here: an organisation must take reasonable steps to destroy or de-identify personal information once it no longer has a lawful reason to hold it. That is the opposite instinct to how most clinics actually operate, where the default is to keep everything forever "just in case".
The important detail is what "no longer has a reason" actually means. It does not mean the moment a client stops booking. It means once every applicable retention requirement, professional, tax and otherwise, has run out. APP 11.2 is a floor on how long a clinic can keep data it truly has no use for, not a ceiling that overrides a longer professional record-keeping obligation.
How long should a cosmetic clinic keep clinical treatment records?
This is where most of the confusion actually sits, because there is no single, clinic-specific law with one national number in it. Instead, the widely used benchmark comes from medical indemnity insurers and professional bodies advising doctors, nurses and other AHPRA-registered practitioners: keep clinical records for at least seven years from the date of the last service provided to an adult client, and until the client turns 25 if they were under 18 when treated.
That standard is consistent across the major Australian medical indemnity insurers because it is built to cover the outer limit of when a client could reasonably raise a complaint or a claim, not the minimum a clinic can get away with. Retention periods can vary slightly by state and by profession, so a clinic's own indemnity insurer or professional body is the right place to confirm the exact figure that applies, especially for a nurse-led or multidisciplinary practice.
| Record type | Typical minimum | Why |
|---|---|---|
| Clinical records, adult client | At least 7 years from the last visit | Standard medical indemnity guidance |
| Clinical records, client was a minor | Until the client turns 25 | Standard medical indemnity guidance |
| Before-and-after treatment photos | Same as the clinical record they belong to | Part of the same clinical file, not a separate rule |
| General enquiries, no booking made | Only as long as needed for the enquiry, then delete or de-identify | Privacy Act, APP 11.2 |
| Billing and payment records | Generally 5 years | Australian Taxation Office record-keeping requirement |
General guidance, not legal advice. Confirm the exact figure for your own state and profession with your indemnity insurer or professional body before setting a policy.
What about enquiries, no-shows or people who never became a client?
The seven-year clinical benchmark only applies once a clinical relationship exists, meaning a service was actually provided. A person who messaged asking about pricing, filled in a contact form, or booked and then no-showed without ever being treated has not generated a clinical record, so that rule does not apply to them.
They are still covered by the Privacy Act as soon as their personal information is collected, though. APP 11.2 applies in full here: once the enquiry is resolved, or once any marketing consent they gave has expired or been withdrawn, that record should be deleted or de-identified rather than left sitting in a CRM or spreadsheet indefinitely. A general marketing list is one of the easiest places for old, unused personal information to quietly build up.
A record retention policy is not really about deleting things sooner. It is about having a genuine reason to still be holding what you have, for as long as you are holding it.
How do you actually put a record retention policy in place?
Most clinics do not need a complicated system, they need a written decision that gets followed. A workable version covers four things:
Categorise what you hold. Clinical records, billing records, and general marketing or enquiry data are not the same thing and should not share one retention period.
Set a length for each category using the benchmarks above, confirmed against your own indemnity insurer's current guidance rather than assumed.
State it in your privacy policy so clients can see how long their information is kept, which the Privacy Act expects a clinic's privacy policy to cover in any case.
Make deletion a scheduled task, not a hope. A retention period only means something if records past it actually get removed or de-identified, which usually means checking annually rather than relying on someone remembering.
It is also worth checking what any software your clinic uses, booking system, marketing tool or clinic app, actually stores and for how long, since a vendor holding data past your own policy's cut-off undermines the policy regardless of what your own files say. Clinic App keeps client data in an encrypted database with role-based staff access, but it does not set a retention or deletion schedule on a clinic's behalf, that decision, and the responsibility for it, stays with the clinic.
Frequently asked questions
Does this apply to before-and-after photos as well as consultation notes?
Yes. A before-and-after photo taken for treatment purposes is part of the clinical record it documents, not a separate category with its own rule, so it follows the same retention period as the consultation notes it belongs to.
What happens if a clinic deletes clinical records too early?
It can leave a clinic unable to respond to a client dispute, an insurance claim or a regulator request, and medical indemnity insurers treat early deletion as a real risk in its own right, separate from anything the Privacy Act requires about eventual destruction.
Can a client ask a clinic to delete their records before the retention period ends?
They can ask, but a clinic still inside its own professional retention period is generally entitled, and often obligated, to decline for the clinical file itself. Marketing or loyalty data held outside that clinical file is usually more flexible to act on.
Do billing and payment records follow the same retention period as clinical records?
No. Financial and tax records are a separate requirement, with the ATO generally expecting Australian businesses to keep records for five years, so a clinic can end up holding clinical notes for a visit well after the invoice for it is gone.
