Privacy Policy

Version: 2026-06-14 Effective: 14 June 2026

Macarthur Infusions ("we", "us", "our") is committed to protecting the privacy of your personal and health information. This policy explains what we collect, why, how we look after it, and the choices you have. It applies to the booking system at macarthurinfusions.com.au and the services we provide from our clinic at Suite 1, 67 Jacaranda Ave, Bradbury NSW 2560.

We handle your information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Health Records and Information Privacy Act 2002 (NSW). Because we provide healthcare services, information about you is treated as health information — the highest category of sensitive information under Australian law.

1. Who we are

2. What we collect

When you book an appointment with us, we collect:

• Identifiers and contact details: your name, email address, phone number.
• Health and service information: the service you book, any notes you provide about your health conditions, medications, allergies, or treatment goals.
• Booking and payment metadata: appointment date and time, payment method, payment reference, and timestamps related to your booking.
• Consent record: the version of this Privacy Policy and Collection Notice you agreed to, the date and time you agreed, your IP address, and your browser's user-agent string.
• Technical information: server logs (IP address, request path, timestamps) needed to operate and secure the site.

We do not deliberately collect more sensitive information (e.g. ethnicity, religious beliefs, sexual orientation). If you choose to mention such information in the "notes" field, we will treat it with the same protections as your health information.

We do not currently capture date of birth. If we add this later (for example, to apply minor-retention rules), we will update this policy.

3. Why we collect it

We collect your information for the following primary purposes:

• To provide the health service you book.
• To manage your booking — confirmations, reminders, rescheduling, cancellation.
• To process payment for your booking.
• To meet our legal and professional obligations (record-keeping, tax, complaint handling).
• To improve and secure the booking system.

We do not use your contact details for marketing.

4. Who we share it with

We share your information only with the providers we need to run the service. Each provider is bound by a written agreement and their own privacy obligations.

• Square (payment processor) — when you pay online, your card details are entered directly into Square's hosted payment page; we never see them. Square receives your name, email, and the booking reference for the transaction.
• Resend (transactional email provider) — sends booking confirmations, reminders, and cancellation notices on our behalf. Receives your name and email address.
• Amazon Web Services, Sydney region (ap-southeast-2) — hosts the booking system and database in Australia.

We do not sell your information, and we do not share it with marketing partners.

We may disclose information without your consent where we are required or permitted to by law — for example, under court order or to investigate suspected unlawful activity.

5. Where it's stored

All booking and patient data is stored on servers located in Australia (AWS Sydney region). Backups are encrypted and stored in the same region.

When you pay online, Square may process and store the transaction in accordance with its own privacy notice, which you should review at https://squareup.com/au/en/legal/general/privacy.

6. How we protect it

We apply security controls appropriate for health information, including:

• Encryption in transit: all traffic to the booking site is served over TLS (HTTPS).
• Encryption at rest: your name, email, phone, and notes are encrypted in our database with keys we control.
• Access control: clinical staff can see your information only through authenticated admin accounts; logins are rate-limited and password-protected.
• Audit logging of administrative access to bookings (rolling out — see our Privacy & Compliance Plan).
• Secure backups, tested for restoration.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

7. How long we keep it

When information is de-identified, we keep aggregate fields (service, date, status) that have no link to you, and we destroy the personal identifiers.

8. Your rights

Under the Privacy Act and NSW Health Records and Information Privacy Act, you have the right to:

• Access your personal and health information that we hold.
• Correct information that is inaccurate, out-of-date, incomplete, or misleading.
• Complain about how we have handled your information.

To make a request, email macarthurinfusions@gmail.com or write to us at the postal address above. We will respond within 30 days. There is no fee for making a request, though we may charge a small fee for the actual cost of producing copies of records.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Web: https://www.oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992

NSW residents can also complain to the NSW Information and Privacy Commission: https://www.ipc.nsw.gov.au.

9. Cookies and the website

The booking site uses a single session cookie to keep you logged in to your booking while you complete payment. We do not use third-party analytics or advertising cookies on this site.

10. Changes to this policy

We may update this policy from time to time. When we do, we publish a new version with a new effective date. Previous versions are retained so that we can show you the exact text of the policy you agreed to at the time of your booking.

The current published version is identified in the page footer and in our internal records.

11. Contact

For any privacy question or to make an access or correction request, contact our Privacy Officer:

• Email: macarthurinfusions@gmail.com
• Phone: 1300 205 970
• Post: Suite 1, 67 Jacaranda Ave, Bradbury NSW 2560