1. Who we are

ELKA CLINIC is a cosmetic tattoo and advanced skin clinic in Subiaco, Perth, established in 2015 and operating from 3/29 Hood Street, Subiaco WA 6008.

In this policy, “ELKA CLINIC”, “we”, “us” and “our” refer to this business. We treat the health information you share with us as sensitive information, and we manage it to the standard set out in the Australian Privacy Principles under the Privacy Act 1988 (Cth), regardless of the size of our business.

3. Information we collect

Depending on how you interact with us, we may collect the following identity and contact information:

• Full name
• Mobile telephone number
• Email address
• Date of birth (optional)
• Appointment and booking information
• Treatment and communication history with ELKA CLINIC
• An emergency contact name, relationship and telephone number, which we require before treatment

We do not routinely collect home addresses. If you choose not to provide required information, such as an emergency contact, we may be unable to complete the consent process or safely proceed with your treatment.

5. Treatment photography and optional marketing consent

We take before-and-after photographs or videos at every treatment, as part of your clinical and treatment record. These record photographs are taken regardless of whether you consent to marketing use, because they help us to:

• Document the treatment provided and its result
• Support treatment planning
• Compare healing progress against the healed result
• Respond appropriately if you raise a concern during or after healing
• Maintain an accurate reference if you contact us during or after treatment
• Support complaints handling, insurance matters, or other legitimate clinical and business requirements

You may also choose to send us photographs voluntarily, for example through WhatsApp, Instagram or email — typically to show healing progress or ask a question.

Two separate permissions

We keep these permissions clearly separate:

• Photographs required for treatment documentation and your clinical record — always taken, and not optional.
• Optional permission for marketing, website, social-media or advertising use — entirely your choice.

If you agree to marketing use, you choose how your image is used: full-face use, treatment-area-only use, or no public or marketing use at all. We use an image on our website, social media or in advertising only within the permission you have selected. Please note that treatment-area-only images are not necessarily anonymous — distinctive features, skin characteristics or context may still make you identifiable.

You can withdraw your permission for future marketing use at any time by contacting us (see Contact ELKA CLINIC Management). Withdrawing marketing consent does not require us to delete a treatment photograph that must reasonably remain in your private clinical record.

7. Why we collect and use information

We collect and use personal information to:

• Respond to your enquiries
• Provide consultations
• Manage bookings and appointment changes
• Assess whether a treatment is suitable for you
• Provide cosmetic tattoo and skin treatments
• Maintain clinical and consent records
• Monitor healing and respond to any concerns you raise
• Contact your emergency contact where reasonably necessary
• Provide aftercare and client support
• Process payments, deposits and refunds
• Manage complaints, insurance matters and legal obligations
• Improve our services
• Protect our clients, staff and clinic
• Send appointment reminders and service-related communications
• Send marketing communications, only where you have consented or the law otherwise permits
• Keep a record of marketing opt-outs and withdrawn permissions

9. Third-party providers

We rely on a small number of service providers to operate the clinic and website. Depending on how you interact with us, your information may be handled by:

• Fresha — our booking, client records, consultation-form, consent-form, appointment-communication and payment platform
• Payment and buy-now-pay-later providers, such as Afterpay, where you choose to use them
• Email, telephone and messaging providers that carry our communications with you
• WhatsApp and Instagram (Meta), where you choose to contact us or send photographs through those channels
• Website hosting, security and maintenance providers that keep our website running
• Analytics and advertising providers, currently Google (Analytics, Tag Manager and Ads), Meta (Pixel) and Fastbase — see Website cookies and analytics
• Review platforms, including Google, TripAdvisor and Yelp, where you choose to leave a public review
• Accountants, insurers, legal advisers and other professional consultants who support our business
• Regulators, law-enforcement bodies or emergency services, where we are authorised or required to disclose information to them
• Other providers reasonably necessary to operate the clinic

We do not store complete payment card numbers. Where you pay online or in clinic, your payment information is processed by our payment or buy-now-pay-later provider under their own privacy policy, and we only receive confirmation and transaction details necessary for your booking.

11. Storage and security

Your records are held electronically through restricted-access, clinic-managed devices, systems and service providers. Access is limited to authorised personnel. Treatment photographs may be transmitted internally between clinic management and your treating practitioner through private, password-protected communication services, for the purpose of coordinating your care.

We take reasonable administrative, technical and physical steps to protect the personal and health information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. Depending on the system, these steps may include:

• Limiting access to authorised personnel only
• Password or device access controls
• Using service providers who maintain their own security measures
• Confidentiality expectations for anyone working at ELKA CLINIC
• Keeping systems and software reasonably up to date
• Responding promptly to any suspected privacy or security incident

No system can be guaranteed completely secure, and we do not represent that our systems are immune from all risk. We do, however, take privacy and security seriously and act promptly if an issue is identified.

13. Website cookies and analytics

Our website uses cookies and similar technologies, which are small files or scripts that help a site function and help us understand how it is used. Based on the tools currently active on our site, these fall into the following categories:

• Essential — technologies needed for the website and its booking links to work correctly.
• Analytics — including Google Analytics, Google Tag Manager and Fastbase, which help us understand how visitors use our site.
• Advertising and remarketing — including the Meta Pixel and Google Ads, which help us measure and improve our advertising.
• Other technologies — including Google reCAPTCHA, which protects our contact form from spam, and embedded YouTube video, which may set its own cookies if you choose to play a video.

These tools may collect your IP address, browser and device information, and general usage data, such as which pages you visit. You can manage or block cookies through your own browser settings; most browsers let you view, delete or block cookies, including on a site-by-site basis. Doing so may affect how some parts of our website function.

We are currently reviewing whether a dedicated cookie-consent notice is required for our website, in addition to the browser-level controls described above. This policy will be updated if a dedicated notice or control is introduced.

15. Access and correction

You may contact ELKA CLINIC Management at contact@elkaclinic.com.au to:

• Request access to the personal information we hold about you
• Request correction of information you believe is inaccurate
• Ask questions about how we collect, use or disclose your information
• Withdraw future marketing consent
• Raise a privacy complaint (see below)

We may need to verify your identity before providing access to your information. We aim to respond to access and correction requests within approximately 30 days, though this may take longer for complex requests, or where a lawful exception applies. If we refuse a request for access or correction where the law permits us to, we will explain our reasons where we are required to do so.

17. Data breaches

We assess and manage any suspected data breach appropriately. Where the Notifiable Data Breaches scheme applies — that is, where a breach is likely to result in serious harm to one or more individuals — we will notify affected individuals and the OAIC, as required by law. No organisation can guarantee that a data breach will never occur; our focus is on preventing breaches where reasonably possible, and responding quickly and appropriately if one does.

19. Changes to this policy

We may update this policy from time to time, including to reflect changes in our services or in privacy law. The current version will always be available on this page, with the date it was last updated shown at the top. From 10 December 2026, Australian privacy law will require privacy policies to describe any use of computer programs in significant decisions about individuals. Treatment suitability at ELKA CLINIC is always assessed personally by a practitioner, not decided automatically, and we will update this policy if that changes.