Privacy Policy — Cosmetic Tattoo by Lorraine, Runaway Bay

Last updated: 15 July 2026

1. About this policy

This policy applies to Cosmetic Tattoo by Lorraine ("we", "us", "our"), operated by Lorraine Nugent at 465 Oxley Drive, Runaway Bay QLD 4216, and to this website. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Because we collect health information in the course of providing treatments, we treat that information as sensitive information and give it the higher level of protection the APPs require.

2. What we collect

When you enquire through this website — your name, email address, phone number (optional), the treatment you're interested in, and whatever you write in your message. We also record the IP address the enquiry came from, to prevent spam and abuse.

When you book — the details you provide to our online booking system, such as your name, contact details, the service booked and your appointment time.

When you attend a consultation or treatment — health information relevant to your treatment and safety. This can include your medical history, medications, allergies, skin conditions, previous treatments or tattoo work, and whether you are pregnant or breastfeeding. We also keep treatment records such as pigment colours used, techniques, and aftercare given.

Clinical photographs — before, during and after photographs to document your treatment and plan follow-up work.

When you browse this website — standard technical and usage information such as your IP address, browser and device type, pages viewed and how you arrived at the site, collected through cookies and analytics (see section 5).

You can contact us anonymously or under a pseudonym for a general question. However, we cannot provide a treatment, assess your suitability, or keep you safe without knowing who you are and your relevant health information.

3. Health and sensitive information

We only collect health information that is reasonably necessary for your treatment and safety, and we collect it with your consent — by asking you directly and explaining why we need it.

We use it to assess whether a treatment is safe and suitable for you, to decide whether to proceed, defer, or refer you to your doctor, to plan and perform your treatment, and to keep an accurate treatment record. We do not use your health information for marketing.

4. How we use your information

To answer your enquiry and to contact you about it.
To arrange, confirm, change and remind you about appointments.
To assess suitability, plan and deliver your treatment safely, and to provide aftercare.
To keep accurate clinical and business records.
To take payment and meet our tax, insurance and legal obligations.
To understand how our website is used, and to measure our advertising, so we can improve both.
To send you information about our services — only where you'd expect it or have agreed, and you can opt out at any time.

5. Cookies, analytics and advertising

This website uses cookies and similar technologies:

Essential — a session cookie (PHPSESSID) that makes the site and the enquiry form work securely. It does not track you across other sites.
Google Analytics (GA4) — to understand how visitors find and use the site (pages viewed, time on site, general location, device). This is aggregated and used to improve the website.
Google Ads — to measure whether our advertising leads to enquiries and calls (conversion tracking).
Cloudflare Turnstile — on our enquiry form, to confirm you're a person and not a bot. It's a privacy-focused alternative to a traditional CAPTCHA.

You can control or delete cookies through your browser settings, and you can opt out of Google Analytics using Google's opt-out browser add-on. Blocking cookies may affect how parts of the site work. You can also manage ad personalisation in your Google account settings.

6. Who we share it with

We do not sell your personal information, and we do not share your health information for marketing. We share information only where it's necessary:

Service providers who help us operate — our website and IT provider, web hosting and email provider, and our online booking system. Enquiries sent through this website are delivered to our email and copied to our website provider so that enquiries are not lost.
Google and Cloudflare — through the analytics, advertising and bot-protection tools described above.
Your medical practitioners — only where you ask us to, or where you've given written consent (for example, coordinating with your GP, surgeon or oncology team before paramedical treatment).
Where required or authorised by law.

Overseas disclosure: some of these providers — including Google and Cloudflare — store and process information on servers outside Australia, including in the United States. By using this website you consent to that disclosure. We take reasonable steps to use reputable providers who protect your information.

7. Photographs and your consent

Clinical photographs form part of your treatment record. We only use your photographs publicly — on this website, in our gallery, or on social media — with your specific consent.

You may decline, and you may withdraw consent for future use at any time by contacting us. Declining will never affect your treatment or the care you receive. If you withdraw consent, we'll stop using the photograph going forward, though we may be unable to recover copies already shared or reposted by others.

8. How we store and protect it

We take reasonable steps to protect your information from misuse, loss, and unauthorised access or disclosure. Our website is served over a secure (HTTPS) connection, enquiry data is transmitted securely, and access to client records is limited to Lorraine and anyone who genuinely needs it to help run the clinic.

We keep treatment and health records for at least 7 years after your last treatment, consistent with common practice for health records, and longer where the law requires. When information is no longer needed and we're not required to keep it, we take reasonable steps to destroy or de-identify it.

9. Accessing and correcting your information

You have the right to ask for access to the personal and health information we hold about you, and to ask us to correct it if it's inaccurate, out of date or incomplete. Contact us using the details in section 12.

We'll respond within a reasonable time. We may need to verify your identity first. There are limited situations where we may not be able to give access — if so, we'll explain why in writing.

10. Opting out

If you'd rather not hear from us, tell us and we'll stop. You can opt out of any marketing message by replying to it or contacting us directly. We'll still need to contact you about appointments you've booked.

11. Complaints

If you think we've mishandled your personal information, please tell us first — contact Lorraine using the details below and we'll investigate and respond to you.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

12. Contact us

Cosmetic Tattoo by Lorraine
465 Oxley Drive, Runaway Bay QLD 4216
0401 847 167
info@bylorraineclinic.com.au

13. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, with the date it was last updated shown at the top.