Privacy Policy

1. About this policy

Lash Lifts Sydney ("we", "us", "our") is committed to protecting the privacy of our clients in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains what personal information we collect, why we collect it, how we use and store it, and your rights regarding that information.

By booking an appointment or using our website, you agree to the practices described in this policy.

2. What information we collect

Contact and identity information

• Full name
• Email address (verified via one-time code)
• Phone number (optional)
• Date of birth (optional, used for client identification)

Health and treatment information

• Health declaration responses from our consent form (pregnancy status, eye conditions, allergies, recent eye surgery)
• Your handwritten digital signature on the consent form
• Appointment notes and treatment history

Booking information

• Appointment dates, times, and services booked
• Products added to bookings
• Booking reference codes and cancellation tokens

Photos

With your consent, before-and-after photos may be taken for documentation, record-keeping, and marketing purposes. You may decline this at the time of your appointment.

3. Why we collect your information

We collect your personal information for the following purposes:

• To book, confirm, and manage your appointments
• To verify your identity and match you to existing client records
• To obtain and record your informed consent before treatment
• To maintain a record of your treatment history for safety purposes
• To send you booking confirmation and reminder emails
• To comply with our duty of care obligations as a cosmetic treatment provider

We do not use your information for unsolicited marketing without your explicit consent.

4. How we store and protect your information

Your data is stored on a secure, encrypted server hosted by Railway (a US-based cloud infrastructure provider). Data is stored in Australia's time zone context but physically hosted in the United States on encrypted infrastructure. Railway's privacy policy is available at railway.app/legal/privacy.

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, including:

• Password-protected staff access
• Session-based authentication with secure, HTTP-only cookies
• Email verification (OTP) before booking confirmation
• Encrypted HTTPS connections
• Regular automated backups

No method of internet transmission is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security.

5. Email communications

We send the following emails, which are transactional and necessary to complete your booking:

• Verification code — sent when you make a new booking to confirm your email address
• Booking confirmation — sent after your appointment is confirmed, containing your booking details and unique booking ID

These emails are sent via Resend, a transactional email provider. We do not send unsolicited marketing emails. All emails include a note that the sending mailbox is unmonitored — please contact us directly if you need assistance.

6. Cookies

Our public booking pages do not use tracking cookies, analytics cookies, or advertising cookies.

The staff management area uses a single session cookie to maintain your logged-in state. This cookie is essential for the staff portal to function and is automatically deleted when you close your browser or log out. No consent banner is required for essential cookies under Australian law.

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking tools.

7. Sharing your information

We do not sell, trade, or rent your personal information to third parties.

Your information may be accessed by:

• Our staff — to manage your appointment and treatment records
• Railway — our hosting infrastructure provider (data processor)
• Resend — our email delivery provider (processes email address only)

We may disclose your information if required to do so by law, or in response to a valid request from a government authority.

8. Retention of your information

We retain your personal information for as long as necessary to provide our services and comply with our legal obligations:

• Consent forms — retained for 7 years from the date of signing, consistent with health records retention practices
• Booking records — retained for 7 years
• Photos — retained until you request deletion
• Email address — retained while you remain an active client

You may request deletion of your records at any time (see section 9).

9. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or outdated information
• Deletion — request that we delete your records (subject to our legal retention obligations)
• Complaint — lodge a complaint if you believe your privacy rights have been breached

To exercise any of these rights, please contact us directly. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of our booking system after changes constitutes acceptance of the updated policy.

11. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your personal information, please contact us via Instagram @lashliftssydney or through our booking page.