Privacy Policy

Last updated August 2026

Clinic App ("we", "us", "our") provides white-label loyalty, membership, rewards and booking software to cosmetic and aesthetic clinics in Australia. This policy explains how we handle information when you use our website and when a clinic uses our platform. We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.

Who controls the data

When a clinic uses Clinic App, the clinic is the owner of its patient data. We act as the processor that stores and serves that data on the clinic's behalf. We do not sell, rent, or use clinic patient data for our own marketing.

What we collect

• Website visitors: analytics and advertising-measurement cookies (see "Cookies and website tracking" below), and anything you enter when booking a consultation (name, email, business details).
• Clinic operators: account and contact details needed to set up and run your app.
• Patients (via a clinic's app): name, contact details, loyalty points, membership status and booking activity, entered by the patient or the clinic.

How we use it

• To run the clinic's branded app and the features it has switched on.
• To respond to consultation enquiries and support requests.
• To contact you, where you have booked a consultation or given us your contact details, with service messages (such as booking confirmations and reminders) and marketing messages by email, SMS and phone, as described in the Communications section of our Terms of Service. You can opt out of these at any time via the unsubscribe link in any marketing email, by replying STOP to an SMS, or by emailing us. This applies to clinic operators and website visitors only — we never use a clinic's patient data for our own marketing.
• To keep the service secure, reliable and improving.

Storage and security

Data is encrypted in transit and stored with reputable infrastructure providers. Access is restricted to what is needed to run the service. We retain data only as long as a clinic remains a customer; on offboarding, a clinic's data is deleted on request.

Sharing

We share data only with the trusted providers that power the platform (for example hosting, database, authentication and payment processing), each bound to handle it securely. We do not advertise prescription-only cosmetic treatments to the public, in line with the AHPRA advertising guidelines and the therapeutic-goods advertising requirements administered by the TGA.

Cookies and website tracking

This website uses Google Analytics to understand how visitors use the site (pages viewed, how you found us, device type) and the Meta (Facebook) Pixel to measure how our advertising performs and to help us reach similar clinic owners. Both use cookies and load when you visit the site. We do not use them to identify you personally.

You can opt out at any time: block or clear cookies for this site in your browser, use your browser's tracking-prevention settings, install Google's Analytics opt-out browser add-on, or adjust your ad preferences in your Meta account settings. This applies to the website only; the Clinic App iPhone app contains no advertising trackers (see below).

The Clinic App iPhone app

If you use the Clinic App iPhone app as a patient, this is what happens with your information:

• What the app collects: your name, email address, optional phone number and date of birth, an account identifier, and your activity with the clinics you join (loyalty points, visits, and any treatments or purchases recorded). We collect this to run your account and rewards. We do not use it for advertising and we do not sell it.
• Diagnostics: we use Sentry to collect crash reports and basic performance data so we can fix bugs and keep the app stable. This is not linked to your identity and is never used for advertising.
• No tracking: the app does not track you across other companies' apps or websites, and contains no third-party advertising or analytics tracking.
• Sign in: the app signs you in with a one-time code sent to your email. We do not store passwords.
• Payments and booking: the app does not take card payments. When you book a treatment, you are taken to your clinic's own booking system, and any payment happens there. Your full card number never touches our servers.
• Push notifications: only sent if you opt in, and you can switch them off any time in your device settings.
• Joining more than one clinic: each clinic only ever sees your activity at that clinic.
• Deleting your account: you can delete your account directly inside the app under Profile, or email us and we will do it for you. When you delete your account it is deactivated immediately; we retain your information for 30 days so you can change your mind and restore everything by signing back in. After 30 days your personal information is permanently deleted. To prevent misuse of sign-up and referral rewards, we may retain a minimal record of rewards already issued to you (such as the email or phone number a reward was granted against) after deletion.

Your choices

You can ask to access, correct or delete your personal information. Patients should contact their clinic directly; clinics and website visitors can contact us at the address below.

Contact

Questions about this policy or your data? Email us at team@clinicapp.com.au.