Patient Intake Forms: What APP 3 Lets Clinics Ask

Under Australian Privacy Principle 3 of the Privacy Act 1988, a cosmetic clinic or dental practice can only collect personal information that is “reasonably necessary” for the booking or treatment in front of it, and anything counted as health information needs the patient’s consent before it goes on the form at all. The Office of the Australian Information Commissioner last updated its guidance on this rule on 13 May 2026. It is not a style preference. It is the line between an intake form that holds up under audit and one that quietly collects more than the practice is allowed to keep.

Key takeaways

• APP 3 of the Privacy Act 1988 requires that any personal information a clinic collects be “reasonably necessary” for a stated function, per OAIC guidance updated 13 May 2026.
• Medical history, allergies, medications and clinical photos are “sensitive information” under APP 3.3, and need patient consent unless one of five APP 3.4 exceptions applies.
• APP 5 requires eight specific matters to be disclosed in a collection notice, at or before the point of collection.
• In June 2026 the OAIC found Monash IVF Pty Ltd and Medmate Australia Pty Ltd breached APP 3.3, 5.1, 5.2 and 7.1 by collecting sensitive health data through website tracking pixels without consent (determinations [2026] AICmr 40 and 41).
• OAIC recorded 1,205 data breach notifications across all sectors in 2025, with 225 from the health sector and 716 caused by malicious or criminal activity.
• Health service providers are covered by the Privacy Act regardless of annual turnover. The small business exemption has never applied to them.
• A form that splits collection into stages, enquiry, booking, clinical intake, only asks for sensitive fields once they are genuinely needed.

If you build or manage a clinic website, this is the rule your form actually has to satisfy, field by field. Here is what it says, what it means for the build, and where a real regulator has already enforced it against a health provider.

What APP 3 actually says about your intake form

APP 3.2 sets the baseline: an organisation “may only solicit and collect personal information that is reasonably necessary for one or more of its functions or activities,” according to the OAIC’s APP 3 guidance. “Reasonably necessary” is an objective test. The OAIC frames it as whether a reasonable, properly informed person would agree the collection is necessary, not whether it would be helpful, convenient or nice to have on file.

Health information sits under a stricter rule. APP 3.3 says an entity “may only solicit and collect sensitive information if the individual consents to the collection, unless an exception applies.” Medical history, current medications, allergies, clinical photos and anything else that reveals health status counts as sensitive information. Consent is the default requirement, and the collection still has to pass the reasonably necessary test on top of that.

The OAIC’s guidance lists five exceptions under APP 3.4 where sensitive information can be collected without consent, including where a permitted health situation exists, where collection is required or authorised by law, or where it relates to unlawful activity investigation. In practice, a cosmetic clinic or dental practice should not lean on these as a way around asking for consent. Build the consent step properly and the exceptions become a backstop, not a workaround.

Take-away: if a field on your form is not tied to a specific, statable function, it should not be on the form.

Health providers filed 225 of the 1,205 notifiable data breach reports lodged in 2025, and 716 of all notifications that year were traced to malicious or criminal activity, according to the OAIC’s 2025 Notifiable Data Breaches statistics. Every extra sensitive field on your intake form is another field that has to be protected against that number.

What APP 5 requires you to tell people before they submit anything

Collecting the right fields is only half the job. APP 5 requires a clinic to notify the individual, or otherwise make sure they are aware, of eight specific matters at or before the point of collection, or as soon as practicable after if that is not possible, per the OAIC’s APP 5 guidance:

1. The clinic’s identity and contact details.
2. The fact and circumstances of the collection.
3. Whether the collection is required or authorised by law.
4. The purposes for which the clinic collects the information.
5. The main consequences, if any, for the patient if the information is not collected.
6. The other entities, bodies or people the clinic usually discloses that kind of information to.
7. How to access and correct the information, via the clinic’s privacy policy.
8. Whether the information is likely to go to an overseas recipient, and if practicable, which countries.

That is a checklist, not a paragraph you can bury in a footer link. Most clinic forms handle it with a short collection notice above the submit button plus a link to a full privacy policy for the detail.

What this means for your form builder

Translate the rule into the actual form. A few concrete patterns:

• Stage the form. Public enquiry fields (name, email, mobile) should not sit on the same screen as clinical fields (medical history, allergies, current medications). Use a multi step form or a separate authenticated intake step once the appointment is confirmed, so sensitive fields only render once they are actually necessary.
• Put the collection notice where it is read. A short notice covering the eight APP 5 matters, with a link to the full privacy policy, immediately above the submit button on any step that collects personal information, not just the first one.
• Split consent checkboxes. Treatment consent and marketing consent are different purposes, so use two separate checkbox inputs, both unticked by default. Never pre-check a marketing opt-in.
• Name fields by function, not convenience. If a field like social_media_handle or how_did_you_hear_detailed cannot be tied to a stated function on your collection notice, drop it from the schema entirely rather than making it optional.
• Gate sensitive fields behind explicit consent copy. A generic “I agree to the terms” tickbox does not meet APP 3.3 for a medical_history or clinical_photos_upload field. Use a specific consent statement next to the field itself.
• Scope billing fields. Only request a medicare_number or health_fund_number on the booking step for a treatment where a rebate item genuinely applies, not on every form as a matter of routine.
• Keep the form usable. The Australian Human Rights Commission’s April 2025 guidance points to WCAG 2.2 AA as the benchmark a court would likely apply for digital accessibility under the Disability Discrimination Act. It is advisory guidance, not a standalone statutory requirement, but a form with unlabelled inputs and poor contrast is a second, separate problem sitting on top of your privacy fields.

Intake field decision matrix

Worked example: two intake forms, redesigned

Cosmetic clinic (anti-wrinkle injectable service). The public enquiry form asks for name, email, mobile and the treatment of interest, four fields. The booking step adds date of birth and an emergency contact. Only once the appointment is confirmed does the clinical intake step ask for medical history, current medications, allergies and a clinical photo consent field, each with its own consent statement, plus a collection notice restating why the clinic needs the information and who sees it (the treating nurse or practitioner, and the practice’s clinical record system).

Cosmetic dentistry (whitening and veneers consult). Same pattern. The enquiry form stays to name, email, mobile and preferred appointment time. Booking adds date of birth. The clinical intake step, shown only after booking, asks for current medications, allergy history and a Medicare or health fund field, shown only if the patient selects a treatment item that carries a rebate. A dental history field sits behind its own consent statement, separate from the general terms checkbox.

The chart above is an illustrative field count from the cosmetic clinic worked example, not a published statistic, and shows what a properly staged 18 field form looks like once fields are grouped by function rather than dumped onto one page.

Those before and after counts are illustrative worked example numbers, not a benchmark drawn from a published dataset. The point they make holds regardless: most of the reduction comes from moving sensitive fields off the public enquiry page, not from asking patients for less information overall.

What to check on your own site

• Open your public enquiry form. If it asks for medical history, allergies or medications before a booking exists, move those fields to a later, gated step.
• Confirm every field on the form maps to a stated purpose in your collection notice. If you cannot name the purpose in one sentence, remove the field.
• Check that treatment consent and marketing consent use two separate checkbox inputs, both unticked by default.
• Look for a collection notice above the submit button on every step that collects personal information, not just the first screen.
• Confirm your privacy policy link actually covers access and correction, and states whether data goes to an overseas recipient, such as an offshore hosted booking platform.
• Check that Medicare, health fund and photo ID fields only appear where a specific rebate item or Schedule 4 record keeping requirement applies.
• Run the form through a keyboard only pass and check labels are read correctly by a screen reader, against the WCAG 2.2 AA benchmark.

Enforcement anchor: the 2026 tracking pixel determinations

This is not a theoretical rule. In June 2026 the OAIC found that Monash IVF Pty Ltd and Medmate Australia Pty Ltd, a fertility service and a telehealth provider, had used third party tracking pixels on their websites to collect sensitive health information about visitors without consent, then used it to target them with social media advertising. The Commissioner’s 24 June 2026 media release states that this kind of tracking “amounts to a collection [of] sensitive information for which the website provider must obtain users’ consent.” The formal determinations are listed on the OAIC’s privacy determinations register as Commissioner initiated investigations into Monash IVF Pty Ltd, [2026] AICmr 40, and Medmate Australia Pty Ltd, [2026] AICmr 41, with breaches found against APP 3.3, 5.1, 5.2 and 7.1.

That case is about pixels on a health related website, not a paper or web intake form. The underlying finding is the same one this post is built on: collecting sensitive health information without consent breaches APP 3.3, whether it happens through a form field or through a tracking script running in the background. If your booking or intake flow runs on a page with a Meta Pixel or similar tag, the same reasoning applies to that page, not just the form on it.

Where this gets hard

An intake form for a cosmetic procedure has to satisfy two separate regimes at once, and they do not always line up. The privacy side is APP 3 and APP 5, covered above. The clinical side is informed consent for the procedure itself, and since 2 September 2025 that sits under a single consolidated AHPRA guideline for registered health practitioners who perform non-surgical cosmetic procedures, except for medical practitioners, who remain under the Medical Board’s 2023 cosmetic guidelines. In a clinic where a nurse injector and a cosmetic physician both see patients, the informed consent documentation each of them needs can differ even though the privacy consent step on the intake form stays the same for both. Building one form that satisfies both regimes for every practitioner type on staff is a genuinely fiddly piece of work, and it is worth a proper review rather than a guess.

The regulator says what the intake form has to disclose and what needs consent. The build consequence is a form structure with staged fields and separate consent checkboxes. Whether a specific field, or a specific practitioner’s consent documentation, satisfies both regimes in your clinic is a question for your medical defence organisation or your lawyer.

Status: is this rule already in force

APP 3 and APP 5 are already in force. They are not proposals and they are not pending commencement. They have applied to APP entities, including health service providers regardless of turnover, since the Privacy Act’s principles were consolidated in 2014, and the OAIC’s guidance on APP 3 was most recently updated 13 May 2026. This is a settled, currently enforced obligation, not something on a future commencement date.

Frequently Asked Questions

What is the “reasonably necessary” test in APP 3?

It is an objective test under Australian Privacy Principle 3, whether a reasonable, properly informed person would agree the collection is necessary for the clinic’s stated function. Being helpful, convenient or nice to have is not enough on its own.

Do I need consent for a medical history field on my intake form?

Yes. Medical history, allergies, medications and clinical photos are “sensitive information” under APP 3.3, and a clinic can only collect them with the patient’s consent unless one of the Privacy Act’s permitted health situation exceptions applies.

Does an intake form need a separate marketing consent checkbox?

Yes. Consent to treatment and consent to marketing are different purposes under the Privacy Act, so they need separate, unticked checkboxes. Bundling them into one “I agree” tickbox does not meet the consent standard for either.

Need a hand with your website?

If you want a second pair of eyes on how this applies to your own site, request a callback and we will talk it through.

Sources and references

1. OAIC, Australian Privacy Principles, oaic.gov.au/privacy/australian-privacy-principles. Date checked 15 August 2026.
2. OAIC, APP Guidelines, Chapter 3, APP 3 collection of solicited personal information, oaic.gov.au chapter 3. Updated 13 May 2026. Date checked 15 August 2026.
3. OAIC, APP Guidelines, Chapter 5, APP 5 notification of the collection of personal information, oaic.gov.au chapter 5. Version 1.2, 22 July 2019. Date checked 15 August 2026.
4. OAIC, Privacy determinations register, Monash IVF Pty Ltd [2026] AICmr 40 and Medmate Australia Pty Ltd [2026] AICmr 41, oaic.gov.au privacy determinations. Date checked 15 August 2026.
5. OAIC media release, Privacy Commissioner finds privacy breaches in third party tracking pixel investigation, 24 June 2026, oaic.gov.au media centre. Date checked 15 August 2026.
6. OAIC, Data breach notifications increase to all time high in 2025, new NDB stats show, oaic.gov.au NDB statistics. Date checked 15 August 2026.
7. AHPRA, New guidelines for cosmetic procedures, 2 September 2025, ahpra.gov.au. Date checked 15 August 2026.
8. Australian Human Rights Commission, Guidelines on equal access to digital goods and services, Chapter 3, digital accessibility, 2 April 2025, humanrights.gov.au. Date checked 15 August 2026.

Last reviewed: 15 August 2026.

If your intake flow needs a rebuild rather than a form audit, RockingWeb builds staged, consent-correct booking and intake flows for cosmetic clinics and dental practices. Start a project to get a scoped quote.