Privacy Policy

1. Overview

This Privacy Policy applies to the dermal, skin longevity, and aesthetic services provided by MH Health Group Pty Ltd (ACN 701 267 549), trading as Kutis Aesthetics ("we", "our", or "us"). We are committed to protecting your privacy and managing your personal and health information with high standards of care, confidentiality, and security.

We strictly adhere to the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and applicable Victorian statutory requirements regarding health records management. This document sets out how we collect, hold, use, disclose, and protect your information.

2. Personal and Sensitive Health Information We Collect

To safely perform dermal treatments, skin penetration procedures, and prescription-aligned protocols, we collect personal and sensitive health information, including:

• Identity & Contact Information: Full name, date of birth, mobile phone number, email address, physical address, and emergency contact details.
• Health & Clinical Records: Comprehensive medical history, underlying health conditions, skin concerns, allergies, active medications, previous treatment history, clinical progress notes, and mandatory Body Dysmorphic Disorder (BDD) pre-screening assessments.
• Consultation & Prescribing Data: Documentation gathered during real-time synchronous telehealth consultations with collaborating Doctor/Nurse Practitioner prescribers for Schedule 4 (S4) clinical protocols.
• Clinical Imagery: Standardized pre- and post-procedure clinical photographs captured strictly for objective treatment tracking, skin mapping, and clinical record compliance.
• Financial & Billing Details: Transaction histories, deposit processing details, tax invoices, and payment records.
• Website & Technical Data: Technical logs collected via the Kutis Aesthetics website, including IP address, browser type, device metadata, and the pages viewed, collected through our website platform's analytics.

3. How We Collect and Communicate Information

We collect your information directly from you through digital intake platforms, clinical consultations, and website interactions:

• Online Bookings: Appointment scheduling and deposit processing integrated via Timely.
• Digital Intakes & Clinical Files: Health histories, consent forms, mandatory pre-screening tools, and progress notes completed via Timely Consult (and, where applicable in expanded operations, secure clinical platforms including Fresh Clinics).
• SMS Notifications & Direct Care: Pre-procedure skin preparation instructions, appointment confirmations, and aftercare protocols dispatched directly to your mobile phone via Timely Consult.
• Clinical Photography: High-standard medical photography taken in-clinic during pre-treatment intake and post-treatment evaluation, stored within your encrypted clinical profile (Timely / Fresh Clinics).

4. Use and Disclosure of Information

Your personal and health information is used and disclosed strictly for legitimate clinical, administrative, and legal purposes:

• To design, tailor, and safely administer nurse-led dermal treatments and skin barrier restoration protocols.
• To facilitate mandatory synchronous consultations with qualified Doctor/NP prescribers for S4 prescription protocols.
• To dispatch critical clinical instructions, including pre-care preparation and aftercare guidance via SMS.
• To maintain financial accounting, invoicing, tax compliance, and payment records via Xero and ANZ dual business operating systems.
• To fulfill legal obligations, defend medical indemnity claims, and maintain compliance with Victorian public health laws and professional registration requirements.

Regulatory Safeguard (AHPRA & TGA Compliance):

In accordance with mandatory regulatory rules set by the Therapeutic Goods Administration (TGA) and the Australian Health Practitioner Regulation Agency (AHPRA), Kutis Aesthetics strictly prohibits the public display or commercial marketing use of client testimonials, ratings, or clinical before-and-after photographs. All clinical photography is maintained strictly within confidential medical files.

5. Third-Party Tech Stack & Service Providers

We engage trusted third-party cloud service providers to support operations. Data shared with these entities is strictly limited to what is necessary for service execution:

• Timely & Timely Consult: Booking Engine, Digital Intakes, BDD Pre-Screening, Progress Notes, and SMS Clinical Instructions.
• Fresh Clinics (As Applicable): Secure Clinical Records Engine, Prescribing Protocols, Progress Notes, and Medical Photography Archiving.
• Xero: Cloud Accounting, Tax Invoicing, and Financial Operations.
• Telehealth Medical Prescribers: Independent registered Medical Practitioners and Nurse Practitioners providing real-time consultations.
• Infrastructure & Banking: Official Website Hosting Engine and Australia and New Zealand Banking Group (ANZ Operating Accounts).

Overseas Data Disclosure:

Some of our third-party software and cloud service providers store or process data on encrypted servers located outside Australia (such as in New Zealand, the United States, or the European Union). By using our booking systems and clinical services, you acknowledge and consent to the transfer and processing of your encrypted information across these overseas cloud platforms in accordance with Australian Privacy Principle 8.1.

6. Data Security and Record Retention

Your health and personal records are maintained digitally within encrypted, password-protected cloud platforms (Timely, Xero, Fresh Clinics). We enforce strict administrative, physical, and digital access controls to safeguard against unauthorized access, loss, or disclosure.

Health records are retained in compliance with Victorian statutory requirements (retained for a minimum of 7 years from the date of last health service provision, or until a minor reaches 25 years of age).

7. Access, Corrections, and Enquiries

You have the right to request access to the personal and health information held by Kutis Aesthetics, or to request corrections if your details are out of date or incorrect.

If you are not satisfied with our response to a privacy concern or record request, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) and/or Victorian Health Complaints Commissioner (HCC):

8. VIP List and Marketing Emails

If you join our VIP list on this website, we collect your name and email address to send you a welcome email, your VIP rewards, and occasional clinic news and updates. Your details are stored on our website platform (Base44), and the welcome email is sent through Google's Gmail service, so your information may be processed by these providers, including outside Australia. You can unsubscribe at any time by emailing promotion@kutisaesthetics.com.au. We keep VIP list details until you unsubscribe or ask us to delete them.