Vikas Thakur / / 13 min readAPP 3 of the Privacy Act limits what a cosmetic clinic or dental practice can put on an intake form. Here is the field by field breakdown, plus the fields to drop before your next form redesign.
Vikas Thakur / / 6 min readThe Privacy Act 1988 treats a business with annual turnover of $3 million or less as a small business, and most are not covered. Here is who is still caught, what the OAIC says a policy must do, and what to put on your site.
Vikas Thakur / / 12 min readFrom 10 December 2026, clinics using automated booking, triage or pricing logic must disclose it in their privacy policy under new APP 1 rules. Here is what the OAIC's own Issues Paper says counts.
Vikas Thakur / / 13 min readA booking link that pre-selects a treatment, or a referral URL that pre-fills a medical reason, both collect and use personal information before the patient has said a word. Here is exactly which intake fields a compliant build can pre-fill, and which ones it cannot.
Vikas Thakur / / 9 min readThree 2026 ACMA enforcement actions against Lululemon, Latitude Finance and TAB total more than $7.36 million in Spam Act penalties. Cosmetic clinics running email lists sit under the same law, plus two extra layers most businesses never face.
Vikas Thakur / / 13 min readAPP 8 does not require an Australian web host. It requires that before your website discloses a patient's details to an overseas recipient, you take reasonable steps, and the OAIC treats some hosting arrangements as a use rather than a disclosure at all. This guide explains that test and what to check before you sign a hosting agreement.
