Privacy policy

CosMedic Clinic
Last updated: 12 October 2026

Introduction

CosMedic Clinic is committed to protecting the privacy, confidentiality and security of personal and health information.

This Privacy Policy explains how we collect, use, store, share and protect information when you visit our website, request an appointment, receive treatment, purchase products or gift vouchers, or communicate with the clinic.

CosMedic Clinic operates in New Zealand and handles personal information in accordance with the Privacy Act 2020, the Health Information Privacy Code 2020 and other applicable legal and professional obligations.

Our website is www.cosmedicclinic.co.nz, and our online store is hosted by Shopify.

1. Information We Collect

We collect information that is reasonably necessary to provide clinical services, manage appointments, fulfil purchases, communicate with patients and operate the clinic.

Personal and Contact Information

This may include:

• Full name and date of birth.

• Residential, postal or delivery address.

• Email address and telephone number.

• Appointment details and communication preferences.

• Product orders, gift voucher purchases and purchase history.

• Enquiries, correspondence and other information you provide to us.

Health and Clinical Information

When you request or receive treatment, we may collect health information relevant to your assessment, treatment suitability, safety and ongoing care.

This may include:

• Medical history and current or previous health conditions.

• Medications, supplements and allergies.

• Pregnancy, possible pregnancy or breastfeeding status.

• Previous cosmetic, medical or skin treatments.

• Recent or upcoming surgery, medical procedures or hospital treatment.

• Skin concerns, treatment goals and relevant lifestyle information.

• Clinical assessments, consultation notes and treatment records.

• Treatment details, products administered and follow-up information.

• Clinical photographs taken for assessment or treatment documentation.

• Information about treatment responses, complications or adverse reactions.

Patients may be asked to update their health information before each treatment or whenever their circumstances change.

This information helps us identify contraindications, assess treatment risks, determine clinical suitability and provide appropriate care.

Website and Online Store Information

When you use our website or online store, Shopify and any enabled website services may collect technical and usage information, including:

• IP address and approximate location derived from technical information.

• Browser, device and operating system information.

• Pages visited and website interactions.

• Shopping cart, checkout and order information.

• Cookies and similar technology identifiers.

• Referral sources and advertising interactions, where applicable.

The information collected depends on the website features and integrations in use.

2. How We Use Your Information

CosMedic Clinic may use personal information to:

• Respond to enquiries and communicate with patients.

• Review, approve and manage appointment requests.

• Conduct consultations and clinical assessments.

• Assess treatment suitability, safety and contraindications.

• Provide treatments and appropriate follow-up care.

• Maintain accurate clinical and administrative records.

• Process product orders, payments, booking fees, gift vouchers and clinic credit.

• Send appointment confirmations, reminders and relevant clinic communications.

• Manage cancellations, rescheduling and refunds.

• Meet legal, professional, accounting and recordkeeping obligations.

• Respond to concerns, complaints and requests for information.

• Maintain and improve our website and services.

• Send marketing communications where permitted by law.

We use health information primarily for patient care, safety and related clinic administration.

We do not sell patient clinical records or confidential health information to advertisers.

3. How We Collect Information

We generally collect personal and health information directly from you, including when you:

• Complete consultation or medical history forms.

• Request or attend an appointment.

• Speak with us, send a text message or email, or make an enquiry.

• Purchase products or gift vouchers.

• Make an advance payment or request a refund.

• Subscribe to marketing communications.

• Interact with our website or online store.

We may also obtain relevant information from another healthcare professional, a person authorised to act on your behalf or another lawful source where appropriate.

Where information is collected from another source, we will comply with applicable notification, privacy and confidentiality requirements.

You may choose not to provide certain information. However, if essential health or contact information is unavailable, we may be unable to safely assess or provide a requested treatment or complete a particular service.

4. Clinical Records and Patient Photographs

Clinical Records

CosMedic Clinic currently maintains clinical notes in paper form.

We are planning a transition to Cloud Appointments for electronic clinical recordkeeping, including the possible migration of existing records.

Cloud Appointments is not currently used as our established clinical record system.

Before transferring records to an electronic platform, we will consider the provider's privacy and security arrangements, access controls, data storage and applicable legal obligations.

Clinical Photographs

Clinical photographs may be taken for assessment, treatment planning, documenting progress and follow-up care.

Photographs are currently stored on a passcode-protected clinic iPad in individual patient folders, with access restricted to authorised CosMedic Clinic personnel.

Clinical photographs are treated as confidential health information.

They will not be published on our website, social media or in advertising without appropriate consent.

Consent for promotional use is separate from consent for clinical photography or treatment.

5. Appointment Requests and Communications

CosMedic Clinic uses Timely to manage appointment requests, booking details and appointment-related communications.

Submitting an online booking request does not automatically confirm an appointment.

Requests are reviewed by CosMedic Clinic, and an appointment is confirmed only after approval and an email confirmation has been issued.

Information collected through the booking process may be used to:

• Assess and approve appointment requests.

• Confirm or change appointment details.

• Recommend a suitable appointment type.

• Collect and administer new patient booking fees.

• Send appointment confirmations and reminders.

• Record cancellations, rescheduling and attendance information.

We may also contact you by email, telephone or text message about appointment preparation, treatment follow-up, product orders or other necessary clinic matters.

Please notify us if your contact details change.

6. Payments, Booking Fees and Clinic Credit

CosMedic Clinic uses the following providers and payment arrangements:

• Shopify for online purchases and associated payment processing.

• Shift4 for applicable in-clinic electronic card payments.

• Afterpay, where available.

• Timely for collection of new patient booking fees.

• Direct bank transfer for eligible payments and advance credit arrangements.

Payment providers process relevant transaction information under their own privacy and security arrangements.

CosMedic Clinic may receive transaction confirmations, amounts paid, payment references, refund details and other information required for accounting and administration.

We do not ordinarily receive or store complete payment card details processed by third-party payment providers.

New Patient Booking Fees

New patient booking fees are collected through Timely and recorded against the relevant appointment.

These fees may be credited towards treatment or skincare products purchased at the clinic on the appointment day.

Where an appointment cannot be attended, a booking fee may be recorded as credit towards a rescheduled appointment in accordance with our Refund, Returns & Cancellation Policy.

We maintain the information needed to administer these payments, credits and any applicable refunds.

Advance Payments

Patients may make advance payments towards future treatments or skincare purchases.

For bank transfers, patients are asked to use their name as the payment reference so funds can be allocated correctly.

We record payments, available clinic credit, purchases and any refund requests for accounting and administration.

7. Email Marketing

CosMedic Clinic uses Mailchimp to send newsletters, clinic updates, treatment information, promotions and other marketing communications.

Where permitted by law, we may use your name, email address and communication preferences for these purposes.

Mailchimp may provide information about email delivery, opens, clicks and engagement with campaigns.

We may use this information to understand the effectiveness of our communications and improve future messages.

Marketing emails include an unsubscribe option.

You can unsubscribe using the link in a marketing email or by contacting info@cosmedicclinic.co.nz.

Unsubscribing from marketing will not prevent necessary appointment, payment or clinical communications.

8. Social Media, Advertising and Analytics

CosMedic Clinic uses Facebook and Instagram, operated by Meta, to share clinic information, communicate with the public and promote services.

We may use advertising and engagement information provided by Meta to assess the performance of posts and promotional campaigns.

Our Shopify website may also use analytics, advertising or measurement technologies where these have been enabled.

Such technologies may collect information about website visits, device identifiers, interactions and referrals.

The presence and operation of particular tracking technologies depend on the services and integrations enabled on our website.

We have not confirmed whether optional tracking services such as Google Analytics or the Meta Pixel are currently enabled.

Where applicable, third-party providers process information under their own privacy policies.

We do not intentionally provide confidential patient clinical records or treatment photographs to advertising platforms for targeted advertising.

9. Cookies and Similar Technologies

Our Shopify website uses or may use cookies and similar technologies to support:

• Essential website functions.

• Shopping cart and checkout processes.

• Website security and performance.

• Remembering certain preferences.

• Website usage measurement.

• Marketing and advertising functions, where enabled.

Some technologies may be operated by Shopify or third-party services.

You may be able to manage cookies through your browser settings and any privacy or cookie controls available on the website.

Disabling certain cookies may affect shopping cart, checkout or other website functionality.

10. Sharing Personal Information

We may share personal information with third parties where reasonably necessary for patient care, clinic operations, transactions or compliance with legal obligations.

These may include:

• Timely for appointment and booking administration.

• Shopify for website, online store and order services.

• Shift4, Afterpay and relevant financial institutions for payment processing.

• Mailchimp for permitted email communications.

• NZ Couriers or NZ Post for delivery of purchased products.

• Cloud Appointments if and when electronic clinical recordkeeping is introduced.

• Other healthcare professionals where appropriate and legally permitted.

• Accountants, professional advisers or service providers assisting with legitimate business functions.

• Government, regulatory or legal authorities where disclosure is required or authorised by law.

We aim to share only the information reasonably necessary for the relevant purpose.

For product delivery, this may include the recipient's name, delivery address, contact details and information necessary to fulfil the shipment.

Health information is not disclosed for unrelated purposes without an appropriate legal basis or authorisation.

11. Overseas Storage and Processing

Some third-party service providers may store or process personal information outside New Zealand.

This may include providers involved in website hosting, bookings, payments, marketing communications or future electronic recordkeeping.

Where overseas service providers handle information on our behalf, we remain responsible for considering the privacy and security protections applicable to that information.

Where a disclosure to an overseas recipient is subject to New Zealand privacy requirements, CosMedic Clinic will take the steps required by the Privacy Act 2020 and Health Information Privacy Code 2020.

We do not assume that information held by an overseas provider is automatically protected to the same standard as information held in New Zealand.

12. Information Security

CosMedic Clinic takes reasonable steps to protect personal and health information against loss, unauthorised access, misuse, modification and inappropriate disclosure.

Access to confidential clinical information is restricted to authorised CosMedic Clinic personnel.

Paper Records

Paper clinical records are stored securely, with access restricted to authorised CosMedic Clinic personnel.

Reasonable physical and administrative safeguards are maintained to protect confidential patient information from unauthorised access, loss or inappropriate disclosure.

Electronic Information and Clinic Devices

Clinical photographs are currently stored on a passcode-protected clinic iPad in individual patient folders, with access restricted to authorised CosMedic Clinic personnel.

CosMedic Clinic takes reasonable steps to protect electronic information, including appropriate device security, access restrictions and ongoing review of storage and backup arrangements.

No electronic storage or transmission method can be guaranteed to be completely secure.

If a privacy breach occurs, we will assess and respond to it in accordance with applicable New Zealand law, including notification obligations where required.

13. Retention and Disposal of Information

CosMedic Clinic retains information for as long as reasonably necessary for its lawful purpose and for any period required by applicable legislation or professional obligations.

Health records are generally required to be retained for at least 10 years from the last patient encounter, subject to applicable legal exceptions and requirements.

Financial, transaction and business records are retained for the periods required by relevant laws.

When information is no longer required and no legal obligation requires its continued retention, reasonable steps will be taken to securely dispose of it or de-identify it, where appropriate.

This applies to both paper and electronic information, including information held by service providers where relevant.

14. Accessing and Correcting Your Information

Under New Zealand privacy law, individuals generally have the right to request access to their personal and health information and to request corrections.

To request access or correction, please contact:

info@cosmedicclinic.co.nz

We may need to verify your identity before releasing personal or health information.

Requests will be assessed and responded to within applicable legal timeframes.

Where a requested correction is not made, you may have the right to have a statement of correction attached to the information.

15. Third-Party Websites and Services

Our website may contain links to external websites, booking platforms, payment providers and social media services.

These services may collect and process information under their own privacy policies.

CosMedic Clinic does not control the privacy practices of independent third-party websites.

We encourage you to review their privacy policies before providing personal information.

16. Privacy Concerns and Complaints

If you have concerns about how CosMedic Clinic collects, uses, stores or discloses your personal or health information, please contact us in the first instance.

We will review concerns and respond in accordance with our legal obligations.

You may also contact the Office of the Privacy Commissioner in New Zealand if you believe your privacy rights have been breached.

Privacy concerns relating to health services may also involve rights under the Code of Health and Disability Services Consumers' Rights.

17. Changes to This Privacy Policy

CosMedic Clinic may update this Privacy Policy to reflect changes in clinic operations, technology, service providers or legal requirements.

The current version will be published on our website with its last updated date.

Where changes materially affect how personal information is handled, we will take any additional steps required by law.

18. Contact Information

For privacy enquiries, access or correction requests, or concerns about how information is handled, please contact:

CosMedic Clinic
Inside HQ Health
80 Arena Avenue
Invercargill 9810
New Zealand

Email: info@cosmedicclinic.co.nz
Phone / Text: 027 387 6393
Website: www.cosmedicclinic.co.nz