Privacy Policy

1. About this policy

In this policy, “DermDesk”, “we”, “us” and “our” mean DermDesk (ABN 68 462 811 099). This policy explains how we handle personal information when you visit our website, create an account, book or attend a consultation, apply to join as a dermal professional, or contact us.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we handle health information in line with applicable state and territory health records laws.

By using DermDesk you acknowledge that your information will be handled as described in this policy.

2. What we collect

If you are a client

• Account details: your name, email address, phone number, date of birth, country of residence, postcode, password and account preferences.
• Health information: what you share in your intake form and consultations, such as your skin concerns, goals, skin type, medical history, medications, allergies and sensitivities, and the products you use.
• Photos and files: skin photos, progress photos and any documents you upload or send in messages.
• Consultation records: booking details, notes and treatment plans written by your dermal professional, and messages between you.
• Payment information: payments are processed by Stripe. We receive confirmation of payment and limited details (such as card type and last four digits), but we do not store your full card number.

If you are a dermal professional

• Your name, contact details, clinic or business name, qualifications, registrations, areas of focus and profile information.
• Supporting documents you upload when you apply, such as registration certificates.
• Information needed to pay you, which you provide to Stripe when you connect your account.

If you visit our website or use our app

• Technical information such as your IP address, device and browser type, pages viewed and the date and time of your visit, collected through cookies and similar technologies.

Video consultations take place within DermDesk. Consultations are not recorded, and we do not store the audio or video of your consultation.

3. How we collect it

We collect most information directly from you, for example when you sign up, complete an intake form, upload photos, book or attend a consult, send a message or contact us. We also receive information from your dermal professional (such as consultation notes and treatment plans), from Stripe (payment status), and automatically through your use of our website and app.

You can choose not to give us certain information, but we may then be unable to provide the service. For example, a dermal professional can’t give you useful advice without your intake information and photos.

4. How we use it

We use your personal information to:

• create and manage your account and verify your identity;
• let you book consultations and connect you with the dermal professional you choose;
• run video consultations, messaging, treatment plans and progress tracking;
• take payments and pay dermal professionals;
• review applications and verify the qualifications of dermal professionals;
• send you service messages, such as booking confirmations and reminders;
• respond to your questions, requests and complaints;
• keep DermDesk safe and secure, and prevent fraud and misuse;
• improve our services, using de-identified or aggregated information where we can; and
• meet our legal and regulatory obligations.

We will only send you marketing messages if you have agreed to receive them, and you can unsubscribe at any time using the link in the message or by contacting us.

5. Your health information

Health information is sensitive information under the Privacy Act, and we treat it with extra care. We collect it only with your consent and only to provide your consultations and ongoing care.

Your intake, photos, consultation notes and treatment plans are shared only with the dermal professional you book with, and with DermDesk staff only where needed to run the service, provide support or meet a legal obligation. We do not use your health information or photos for advertising, and we do not sell it.

Dermal professionals on DermDesk are independent practitioners. They are responsible for their own professional obligations, including how they use the information you share with them in the course of your care.

6. Who we share it with

We may disclose personal information to:

• the dermal professional you book with, so they can provide your consultation and care;
• service providers who help us run DermDesk, such as cloud hosting, video, email and messaging, analytics and customer support providers, under contracts that require them to protect it;
• Stripe, to process payments and payouts;
• our professional advisers, such as lawyers, accountants and insurers;
• a purchaser or successor if our business is sold or restructured, subject to this policy; and
• government agencies, regulators or law enforcement where required or authorised by law, or where we reasonably believe it is necessary to lessen or prevent a serious threat to someone’s life, health or safety.

We do not sell your personal information.

7. Overseas disclosure

Your personal information, including health information, is stored on servers located in the United States. Some of our service providers, including Stripe, may store or access information outside Australia, including in the United States. Where we disclose information overseas, we take reasonable steps to make sure it is handled in a way that is consistent with the Australian Privacy Principles.

8. How we protect and keep it

We use administrative, technical and physical safeguards to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include encryption of data in transit and at rest, access controls so that staff and dermal professionals can only see the information they need, and secure handling of professional documents by our verification team.

We keep personal information only for as long as we need it for the purposes in this policy or as required by law. Health records are generally kept for at least seven years after your last consultation, or until you turn 25 if you were under 18 at the time, in line with health records laws. When information is no longer needed we securely delete or de-identify it.

9. Accessing and correcting your information

You can view and update most of your account details in your DermDesk account. You can also ask us for access to the personal information we hold about you, or ask us to correct it, by contacting us using the details below. We will respond within 30 days. In limited cases the law allows us to refuse access, and if so we will tell you why.

You can ask us to close your account at any time. We may need to keep some information, such as health records and payment records, for the periods required by law.

10. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep DermDesk secure and understand how our website is used. You can control cookies through your browser settings, but some parts of DermDesk may not work properly without them.

11. Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

12. Children

DermDesk is intended for people aged 18 and over. If you are under 18, please don’t create an account or book a consultation.

13. Questions and complaints

If you have a question about this policy or a complaint about how we have handled your personal information, please contact our Privacy Officer:

Email: hello@dermdesk.com.au
Postal address: available on request. Email hello@dermdesk.com.au

We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new “last updated” date, and if the changes are significant we will let you know by email or in the app.