1. About This Policy

HONE Studios Pty Ltd ("HONE", "we", "us", "our") operates premium aesthetics, wellness and longevity studios at Salon Lane, Studio 12 & 13, 63 Ann Street, Surry Hills NSW 2010 + Suite 604, Level 6, 28 Spring Street, Bondi Junction NSW 2022 and the website honestudios.com.au.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and because we provide health services by the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles.

This policy explains what personal information we collect, why we collect it, who we share it with, and how you can access, correct or complain about it. By using our website, booking with us, or receiving a treatment, you agree to the handling of your information as described here.

2. The Information We Collect

Personal information

• Name, date of birth, gender

• Email address, phone number, postal address

• Emergency contact details

• Payment and billing details

• Booking history, appointment preferences, communication history

• Photographs taken for clinical records

• Website and device data (see section 10)

Health information (sensitive information)

Health information receives a higher level of protection under Australian privacy law. In the course of providing treatment we collect:

• Medical history, current health conditions and prior surgeries

• Current medications, supplements and allergies

• Prior cosmetic, aesthetic or clinical treatments

• Skin assessments, treatment records, dosages, batch and lot numbers

• Clinical photographs (before, during and after treatment)

• Consent forms and treatment plans

• Adverse reactions, complications and follow-up notes

• Pathology or test results where relevant to your care

• For peptide and telehealth services: pre-consultation questionnaires, prescriber correspondence and dispensing records

We collect sensitive information only with your consent, or where the law otherwise permits or requires it.

3. How We Collect Information

We collect information:

• Directly from you - in person, by phone, email, SMS, our website enquiry forms, our booking system, and intake and consent forms

• From our booking and client management platform (Timely), and our prescribing and clinical audit platform (EsterRx)

• From your treating practitioner during consultation and treatment

• From third parties involved in your care - for example compounding pharmacies, pathology providers or your referring practitioner - where you have consented

• From publicly available sources, and from your interactions with our social media accounts

Where it is reasonable and practicable, we collect information directly from you. If someone else provides your information to us (for example a referring practitioner), we will treat it under this policy.

4. Why We Collect + Use Your Information

We use your information to:

• Assess your suitability for treatment and provide safe clinical care

• Obtain and record informed consent

• Manage bookings, deposits, payments, packages and vouchers

• Maintain accurate and complete health records as required by law and by our practitioners' professional obligations

• Contact you about appointments, aftercare, results and follow-up

• Respond to enquiries, feedback and complaints

• Coordinate prescriptions, dispensing and delivery for peptide and Telehealth services

• Meet our obligations to regulators, insurers, professional indemnity providers and product suppliers, including adverse event reporting

• Improve our services, train our team and manage our business

• Send you marketing communications, where you have consented (see section 7)

We will not use your information for a purpose other than the one it was collected for unless you would reasonably expect it, you have consented, or the law permits or requires it.

If you don't provide your information. We may be unable to treat you. Complete and accurate health information is a clinical safety requirement, not an administrative preference - incomplete disclosure can result in serious harm. Our practitioners may decline to proceed with treatment if we do not hold the information we need.

5. Who We Share Your Information With

We disclose your information only where necessary, and only to:

• Our practitioners and contractors - the registered nurses, doctors, therapists and administrative staff involved in your care, each of whom is bound by confidentiality obligations and professional standards

• Prescribing practitioners - the doctors and nurse practitioners who prescribe for your treatment, whether engaged by HONE or, where required for a particular service, an external prescribing service

• Compounding and dispensing pharmacies - where medication is prepared or dispensed for you. We work with a number of licensed Australian compounding pharmacies and disclose only the information each needs to prepare and deliver your prescription

• Our booking and client management provider (Timely), our prescribing and clinical audit provider (EsterRx), and our payment processors

• Emergency and medical services - including your GP, specialist or a hospital, where required to manage a medical emergency or complication

• Product suppliers and the Therapeutic Goods Administration - for adverse event reporting, which we are required to make

• Our professional advisers - accountants, bookkeepers, lawyers and insurers

• Regulators and law enforcement - where required or authorised by law, including AHPRA and the Nursing and Midwifery Board of Australia

• A purchaser - if we sell or transfer part or all of our business, subject to equivalent privacy protections

We do not sell your personal information. We do not disclose your health information for marketing purposes.

6. Overseas Disclosure

Some of our service providers store or process data outside Australia. This includes our booking platform, our website and email infrastructure, our cloud storage and our payment processors (primarily New Zealand, the United States and the European Union). Our prescribing platform and our compounding pharmacies operate within Australia.

Before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. By providing your information to us, you consent to this disclosure. Where you consent to an overseas disclosure, APP 8.1 may not apply and we may not be accountable under the Privacy Act if the recipient mishandles your information.

7. Marketing Communications

With your consent, we may send you information about our services, treatments, events and offers by email, SMS or post.

You can opt out at any time - use the unsubscribe link in any email, reply STOP to any SMS, or email admin@honestudios.com.au. We will action your request promptly. You will still receive appointment confirmations, reminders, aftercare instructions and other communications necessary for your care.

We do not use your health information to target marketing to you.

8. Photography + Clinical Images

Clinical photographs form part of your health record and are used to plan treatment, track outcomes and support clinical safety.

We will only use your images for marketing, our website or social media with your separate, specific and written consent. That consent is entirely optional and refusing it will never affect your care or the way you are treated.

Where you do consent, we will tell you where the images will appear and for how long, and you may view the images before they are used. You may withdraw your consent at any time by contacting us, and we will remove the images from our own platforms promptly. We cannot always recover images that have been shared, downloaded or reposted by others.

Our advertising complies with the AHPRA Guidelines for registered health practitioners who advertise higher risk non-surgical cosmetic procedures. We do not publish testimonials for higher-risk cosmetic procedures, do not use images of anyone under 18, and do not alter, filter or retouch clinical images.

9. Security + Storage

Your information is held in electronic form in access-controlled, encrypted systems, and in physical form in secured premises where hard copies exist.

Our safeguards include role-based access limited to staff who need it, multi-factor authentication, encryption in transit and at rest, confidentiality obligations in every contractor agreement, and secure destruction of records at the end of their retention period.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

10. Website, Cookies + Analytics

Our website collects standard technical data - IP address, browser type, device, pages visited and referring site - through cookies and similar technologies. We use this to operate the site, understand how it is used, and improve it.

We may use third-party analytics and advertising tools, including Google Analytics and Meta advertising tools. These providers may set their own cookies and handle data under their own privacy policies.

You can disable cookies in your browser settings. Some parts of our site may not function properly if you do.

Our website may link to third-party sites, including our booking portal. We are not responsible for the privacy practices of those sites.

11. How Long We Keep Your Records

We retain health records as required by law and professional standards:

• Adults - a minimum of seven years from the date of the last entry in your record

• Anyone under 18 - until that person turns 25

We provide services to adults only. The under-18 period is stated because NSW law requires it wherever we hold health information about a person under 18 - for example, information given to us in an enquiry before we established that the person was not eligible for treatment.

Financial records are retained for at least seven years as required by the Corporations Act 2001 (Cth) and Australian taxation law. Marketing and general enquiry records are retained only as long as needed for the purpose they were collected.

When information is no longer needed and we are not required to keep it, we destroy or de-identify it securely.

12. Accessing + Correcting Your Information

You may request access to the personal and health information we hold about you, and ask us to correct anything inaccurate, out of date or incomplete.

Email admin@honestudios.com.au with your request. We may ask you to verify your identity. We will respond within 30 days.

Access is free. Where a request requires significant time to compile for example a full clinical file we may charge a reasonable fee for retrieval and copying, and will tell you the amount before proceeding.

In limited circumstances we may refuse access, for example where it would pose a serious threat to someone's life, health or safety, or unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and explain how to complain.

13. Complaints

If you believe we have mishandled your personal or health information, contact us first:

Privacy Officer HONE Studios Pty Ltd · Salon Lane, Studio 12 & 13, 63 Ann Street, Surry Hills NSW 2010 + Suite 604, Level 6, 28 Spring Street, Bondi Junction NSW 2022 · Ph 0423 270 516 · Email admin@honestudios.com.au

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can escalate to:

• Office of the Australian Information Commissioner - oaic.gov.au | 1300 363 992

• NSW Health Care Complaints Commission (for health service complaints) - hccc.nsw.gov.au | 1800 043 159

• AHPRA (for concerns about a registered practitioner) - ahpra.gov.au | 1300 419 495

14. Changes To This Policy

We may update this policy from time to time. The current version will always be available at honestudios.com.au. Material changes will be notified on our website. The "last updated" date at the top of this policy tells you when it was last revised.

15. Contact Us

Salon Lane, Studio 12 & 13, 63 Ann Street, Surry Hills NSW 2010

Suite 604, Level 6, 28 Spring Street, Bondi Junction NSW 2022

0423270516

admin@honestudios.com.au

HONE Studios Pty Ltd · ABN 60 688 850 884