Privacy policy
This policy explains what personal and health information we collect about you, why we collect it, where it is stored, who can see it, how long we keep it, and what rights you have over it.
It is written to be read rather than to be technically complete and practically useless. If anything here is unclear, contact the practice and ask.
Last updated: [insert month year]
MBBS · Registered Medical Practitioner · Ahpra MED0002627622
We collect the health and personal information we need to assess and treat you safely, and nothing beyond that. We store it securely in Australia. We do not sell it, ever. We do not use your photographs for advertising or publication unless you have given separate, specific, written consent for that exact use, and you can withdraw that consent for future use at any time. You can access your own records and ask for corrections. We keep clinical records for a minimum of seven years after your last appointment, or until a patient who was a minor turns 25, because Australian health record law requires it.
If you want to raise a privacy concern, contact the practice first. If that does not resolve it, the Office of the Australian Information Commissioner and the Victorian Health Complaints Commissioner both accept complaints directly, and you do not need our permission to contact either of them.
Who we are and
what law applies
Because we are a health service provider handling health information, several overlapping frameworks apply. Where they overlap, we apply whichever provides the greater protection to you.
Tajmeel Cliniq is a cosmetic medical practice at Level 1, 10 Glenroy Road, Glenroy VIC 3046, operated by Dr Ibrahim Hawli, MBBS, a registered medical practitioner (Ahpra registration MED0002627622).
Privacy Act 1988 (Commonwealth)
And the thirteen Australian Privacy Principles within it. Health service providers are covered regardless of business size, which is why the small business exemption that applies to many other organisations does not apply to us.
Health Records Act 2001 (Victoria)
And the Health Privacy Principles within it, governing health information specifically in Victoria, sitting alongside the Commonwealth obligations.
Notifiable Data Breaches scheme
Requires us to notify affected individuals and the Office of the Australian Information Commissioner if a data breach occurs that is likely to result in serious harm.
Professional obligations
Under the Medical Board of Australia’s Good Medical Practice code and the Ahpra guidelines, which impose confidentiality duties independent of privacy legislation.
What information
we collect
We collect only what we need to assess and treat you safely.
- Identity and contact information: name, date of birth, address, phone, email, emergency contact where provided
- Health information: medical history, current medications and supplements, allergies, previous procedures, relevant family history, skin type and condition
- Clinical findings and records: examination findings, assessment notes, consultation discussion, recommendations, consent documentation, procedure details, aftercare, follow-up notes
- Clinical photographs: standard-view photographs taken as part of assessment and follow-up
- Payment information: transaction records. Card details are processed by our payment provider and are not stored by the practice
- Communications: emails, messages, booking enquiries, file notes of phone conversations relevant to your care
We do not collect information about your race, political opinions, religious beliefs, sexual orientation, or criminal record, because none of it is relevant to the care we provide. Where a question at consultation touches on something sensitive, it is because it is clinically relevant, and you are welcome to ask why any question is being asked.
If you choose not to provide information, we will tell you what the consequence is. In some cases the consequence is that a procedure cannot safely proceed, because the information withheld is necessary to assess whether it is appropriate for you.
Photographs, and why
they are treated separately
Clinical photographs are the single most sensitive category of information a cosmetic practice holds, and patients are right to ask about them specifically.
Taken for your clinical record
They provide the objective baseline against which change is assessed, document pre-procedure appearance, and are a legal record of the care provided. This use is covered by your general consultation consent.
Publication and sharing require separate written consent
General consent to a procedure does not include consent to publish your photographs. Separate written consent identifying the specific intended use is required, and you can consent to some uses and refuse others.
You can withdraw consent for future use at any time
Tell us and we will stop using the photographs for that purpose. We will be honest about the limit here: material already published in a place we do not control cannot always be fully recalled. That is a practical limit, not a legal position, and it is one reason to think carefully before consenting to publication in the first place.
We do not use patient photographs in advertising for higher-risk cosmetic procedures at all. Since the September 2025 AHPRA advertising guidelines took effect, before-and-after imagery for these procedures is restricted. See the FAQs for the explanation, and Informed Consent for the consent framework.
How we use
your information
We use your information for the purpose it was collected for and for directly related purposes you would reasonably expect.
- To assess your concern and determine whether a procedure is appropriate
- To provide the treatment or care you have consented to
- To provide aftercare and manage any complication
- To maintain an accurate clinical record as required by law and professional obligation
- To communicate with you about your appointments and your care
- To arrange referral where a finding warrants assessment by another practitioner
- To process payment for services provided
- To comply with legal, regulatory and professional reporting obligations
- To respond to a complaint or a claim, where one is made
We do not use your health information for marketing. We do not sell your information to anyone, under any circumstances. We do not share it with advertisers, data brokers, or third parties for their own purposes.
If we ever wanted to use your information for a purpose outside the list above, we would ask you first, and you would be free to say no without it affecting your care.
When we disclose information,
and to whom
Your health information is confidential. We disclose it only in the following circumstances.
With your consent
To another practitioner for referral or shared care, to a specialist for a second opinion, or to anyone else you nominate. You decide, and you can limit what is shared.
Emergency clinical necessity
If you require urgent care and are unable to consent, relevant clinical information may be provided to the treating medical team. Permitted under both the Privacy Act and the Health Records Act.
Service providers, under contract
Practice management software, secure records hosting, and payment processing. Each bound by contractual confidentiality and by the Privacy Act. We select providers who store data within Australia.
Where required by law
Court subpoena, coronial inquiry, mandatory reporting obligations, or a lawful direction from a regulator. Where compelled, we disclose only what is required.
To a regulator investigating a complaint
Where a notification or complaint concerns your care, the relevant records may be required by the investigating body.
Insurer and legal advisors
Where a claim or potential claim arises, under legal professional privilege and confidentiality obligations.
We do not disclose your information overseas. Our storage and our service providers are Australian. If that ever changed, we would update this policy and tell you.
We do not confirm to anyone that you are a patient here. If someone contacts the practice asking whether you attend, they will not be told, including family members, unless you have specifically authorised it.
How your information is
stored and protected
- Electronic records: access controls, individual user accounts, audit logging, encryption in transit and at rest, stored within Australia
- Physical records: locked storage on secure premises, authorised personnel only
- Photographs: within the clinical record system, not on personal devices, not in general cloud storage, not in messaging applications
- Access restricted to those who need it to provide your care or administer the practice, and logged
- Devices password-protected, encrypted, configured to lock automatically
- Disposal by secure destruction or secure deletion at end of retention period
No system is perfect and we do not claim otherwise. What we do claim is that these measures are appropriate to the sensitivity of the information, are reviewed, and are the reason we have never needed to rely on the data breach section below.
How long we
keep your records
From the date of your last appointment. This is the requirement under Australian health record law.
Or seven years from the last appointment, whichever is later.
Retaining records is not optional and is not something we do for our benefit. It is a legal obligation designed to protect you, because a record of what was done and why is what makes proper subsequent care possible.
Your rights over
your own information
Under Australian privacy law you have the following rights, and we will not make you fight for any of them.
- Access your records. Request in writing and we provide access. No charge for a straightforward request. We respond within 30 days.
- Request correction. If something is inaccurate, out of date, incomplete or misleading, tell us and we correct it. Where we disagree, you can have a statement of your position attached, and we will attach it.
- Know what we hold and why. Ask, and we will tell you.
- Limit what is shared, and to whom, outside the legally required disclosures.
- Withdraw consent for any use you previously consented to, including photograph use for future purposes.
- Deal with us anonymously or under a pseudonym where lawful and practicable. For clinical care it generally is not. For a general enquiry it is.
- Complain, through the pathways set out below.
There are narrow circumstances where access can be refused under the Privacy Act, such as where providing access would pose a serious threat to someone’s life or health, or would unreasonably affect another person’s privacy. If we ever refused access on those grounds, we would tell you in writing, explain why, and tell you how to have that decision reviewed.
Website, cookies
and analytics
What the site collects, and what it does not.
- Standard technical information is logged: IP address, browser type, device type, pages visited, time of visit, referring page. Aggregate, used to understand usage and keep the site working.
- Cookies for basic functionality and analytics. You can disable them in browser settings and core pages still work.
- Analytics data is aggregate and is not linked to your clinical record.
- Form submissions are transmitted securely and treated as confidential from receipt. Enquiry information becomes part of your record if you go on to attend.
- External links (Ahpra, TGA and others) go to sites with their own privacy policies, which we do not control.
Email is not fully secure. Standard email is not an encrypted channel. Use it for general enquiries and appointment logistics. For anything sensitive, phone the practice or raise it at your appointment.
No advertising trackers for health targeting. We do not use your interaction with this site to target health-related advertising at you, and we do not share site visitor data with advertising platforms for that purpose.
What we would do
if a breach occurred
Under the Notifiable Data Breaches scheme, if a breach occurred that was likely to result in serious harm, we would be legally required to act, and we would.
- Contain the breach immediately and assess what information was affected
- Assess the likely risk of serious harm to affected individuals
- Notify affected individuals directly: what happened, what was involved, what steps to take
- Notify the Office of the Australian Information Commissioner
- Review what failed and change it
- Delay notification to manage reputational damage
- Minimise the description of what occurred
- Notify only the individuals we thought would find out anyway
You would hear it from us, promptly, in plain language.
Making a
privacy complaint
Start with us. We will acknowledge, investigate, and respond in writing within 30 days. If you are not satisfied, or would prefer not to raise it with us at all, go directly to either body below. You do not need our permission and you do not need to tell us you are doing it.
The practice
Contact us and set out your concern. Acknowledged, investigated, and responded to in writing within 30 days.
0404 342 222
info@tajmeelcliniq.com.au
Office of the Australian Information Commissioner
The national privacy regulator, handling complaints under the Privacy Act.
1300 363 992
oaic.gov.au
Health Complaints Commissioner Victoria
Independent statutory body handling health service and health information complaints in Victoria, including under the Health Records Act 2001.
1300 582 113
hcc.vic.gov.au
For concerns about clinical care rather than information handling, see the complaint pathways on Risks and Safety.
Where the detail sits
Consent for photographs, records access, what invalidates consent
Complaint pathways, regulator contacts, urgent care thresholds
What is collected at consultation and why
Website terms, medical disclaimer, consumer rights
Privacy enquiries, access
and correction requests
Level 1, 10 Glenroy Road, Glenroy VIC 3046
0404 342 222 · info@tajmeelcliniq.com.au
Consulting hours: Sunday, Monday, Wednesday, Thursday, 10:00 to 17:00
Your information.
This privacy policy describes how Tajmeel Cliniq handles personal and health information under the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic) and the Notifiable Data Breaches scheme. It is reviewed periodically and whenever practices or legal requirements change. The current version and its date appear at the top of this page. Material changes affecting how we handle information already collected from you will be notified to you directly rather than quietly published.