Privacy and Client Records Policy

Purpose. This policy explains how Luxe collects, stores, uses and protects client personal and health information.

1.Information we collect

Luxe collects the information needed to provide a safe service and to run the appointment book: name, contact details, date of birth, service history, product formulas, allergies, medications, skin conditions and consent records. Photographs of hair and skin are taken only with the client's express agreement and are used only for treatment planning unless separate consent for marketing is given.

2.How information is used

Information must be used only to plan and deliver services, to contact clients about appointments, and to meet legal duties such as infection control tracing. Marketing messages will be sent only to clients who have opted in and every message will carry an unsubscribe option. Client formulas and treatment notes belong to the business and must not be copied or removed by staff.

3.Storage and security

Client records must be kept in the client record system and not on personal phones, paper notebooks or messaging apps. Every staff member has an individual login and must not share it. Screens must be locked when unattended and paper consent forms must be scanned to the client record on the day and shredded once uploaded.

• Individual logins, no shared passwords
• Screens locked when the desk is unattended
• Paper forms scanned and shredded on the day
• No client photos on personal devices

4.Access and correction

A client can ask to see the information Luxe holds about them and to correct it. Requests must be passed to the Client Services Coordinator, who will respond within 30 days. Identity must be verified before any information is released.

5.Breaches

Any loss, theft or unauthorised disclosure of client information must be reported to the General Manager immediately and recorded in the incident register. The General Manager will assess whether the breach is likely to result in serious harm and will notify affected clients and the Office of the Australian Information Commissioner where the law requires it.