Privacy Policy

Dr Wasana Kulathunga
Unit 9 / 162 Wanneroo Road, Yokine WA 6060
Last Updated: July 2026

1. Purpose

Your privacy is important to us. BSA Mediaesthetics (also referred to as “we”, “us” and “our”) is committed to protecting your personal and sensitive information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, store and disclose your personal information, including your rights to access, correct or complain about our handling of that information.

This policy applies to BSA Mediaesthetics and the medical services provided by Dr Wasana Kulathunga at our Yokine clinic. It does not apply to the personal information of employees, contractors or other practitioners.

2. Obtaining Your Consent

When you register as a patient of BSA Mediaesthetics, you provide consent for us to collect, use and disclose your personal information for the purposes set out in this policy. You will be informed of this through our Privacy Notice and Consent Form at or before the time of collection.

In limited circumstances permitted by law (for example, emergencies or serious threats to life, health or safety), we may collect or use information without obtaining explicit consent.

3. What Personal Information We Collect

We may collect the following types of information about you:

• Name, date of birth, address and contact details (including emergency contacts and next of kin);
• Demographic information such as gender and cultural background;
• Medical information including medical history, current treatments, medications, allergies, adverse events, immunisations, social and family history, risk factors and diagnostic results;
• Clinical photographs and before-and-after images of skin, lesions or treatment areas (taken only with your consent);
• Medicare number (where available) and private health insurance details;
• Payment and billing information;
• Details of your attendance and health service usage; and
• Your preferences regarding communication and data use.

We may also collect de-identified or aggregated data for internal quality improvement, service development and analytics.

4. How We Collect Your Personal Information

We collect personal information in the following ways:

• Directly from you when you register, attend a consultation, complete forms, provide feedback or contact us;
• From other healthcare providers, specialists, pathology or imaging services involved in your care;
• Through our electronic practice management systems, secure messaging and website;
• By taking clinical photographs during your consultation (with your consent); and
• From other sources where it is not practical or reasonable to collect the information directly from you, including:
• your guardian or responsible person;
• other healthcare providers, hospitals or community health services; and
• Medicare, your health fund or the Department of Veterans’ Affairs (as necessary).

5. Why We Collect, Hold and Use Your Information

We collect, hold and use your personal information primarily to:

• Provide clinical and aesthetic medical services to you;
• Manage your care, including treatment planning, follow-up and reminders;
• Support the day-to-day operation of the practice (billing, appointments, record-keeping);
• Improve the quality and safety of our services through audits, quality assurance and staff training;
• Notify you of relevant services or offerings related to your care, where you have consented to receive such communications and have not withdrawn that consent; and
• Invite you to participate in ethically approved research or clinical activities that may be relevant to your condition (separate express consent will be obtained).

We may use de-identified and aggregated data to improve our services and clinical tools. Please let us know if you prefer that your de-identified data not be used for this purpose.

6. Who We Disclose Information To

We may disclose your personal information to:

• Other healthcare professionals involved in your care;
• Your authorised representatives or any party you instruct us to disclose information to;
• Third-party software and service providers that support our practice systems (these providers are required to comply with the APPs);
• Research bodies (using de-identified data, or identifiable data only with your consent); and
• Other parties when required or authorised by law (for example, courts, regulators, auditors or enforcement agencies).

We will not disclose your personal information to anyone outside Australia without your consent, except in exceptional circumstances permitted by law.

A reasonable administrative fee may be charged to cover the costs of locating, retrieving, reproducing or transferring your medical records to another provider. This fee will not exceed the reasonable costs incurred.

7. Use of AI Tools

Your doctor may, at their discretion, use AI-assisted tools (for example, clinical documentation or decision-support software) to assist in providing care. Where an AI dictation or documentation tool is used, your consent will be sought.

AI tools are used only in a supportive capacity and do not replace professional medical judgement, which remains the sole responsibility of your treating doctor.

Any use of AI tools complies with current AHPRA guidance and relevant professional standards.

8. Storage and Security of Your Information

Your personal information may be stored as electronic records, clinical photographs and (where applicable) paper records. We store information securely using Australian-hosted or approved cloud platforms with appropriate safeguards, including:

• Encryption and access controls;
• Audit trails and multi-factor authentication where available;
• Staff training and confidentiality obligations;
• Regular software updates, antivirus protection and firewalls;
• Restricted physical and electronic access to authorised personnel only; and
• Regular secure backups to protect against data loss.

We retain health information for a minimum of seven (7) years from the date of last contact, or until the patient reaches 25 years of age (whichever is later), unless a longer period is required by law.

9. Research and Service Improvement

We may use or contribute aggregated, de-identified data for quality improvement, service development or ethically approved research. Patients may be invited by their doctor to participate in studies relevant to their clinical condition; separate express consent will be obtained before any identifiable involvement.

Data used in external publications will be fully de-identified unless prior written consent has been obtained.

10. Dealing with Us Anonymously

You have the right to deal with us anonymously or under a pseudonym unless it is impracticable for us to do so, or we are required or authorised by law to deal only with identified individuals.

Please note that Medicare or private health insurance rebates generally require identification. If you choose to remain anonymous or use a pseudonym, you may be required to pay the full consultation fee without rebate.

11. Accessing and Correcting Your Information

You may request access to, or correction of, your personal or health information at any time. Requests can be made by email to bsamediaesthetics@gmail.com or by telephone on 08 8923 6477.

We will verify your identity and respond within a reasonable time (usually within 30 days). Information may be provided by post or secure email as requested. A reasonable fee may apply for the administrative costs of providing copies of records.

We will take reasonable steps to correct information that is inaccurate, out of date or incomplete. There is no fee for requesting a correction.

In limited circumstances we may refuse a request for access or correction in accordance with the Privacy Act and relevant health records legislation. If we refuse a request, we will provide written reasons.

12. Complaints and Contact Details

If you have questions or concerns about privacy or the way we handle your information, please contact us:

Phone: 08 8923 6477
Email: bsamediaesthetics@gmail.com
In person: BSA Mediaesthetics, Unit 9 / 162 Wanneroo Road, Yokine WA 6060

We will aim to respond to privacy complaints within thirty (30) business days.

You may also contact the Office of the Australian Information Commissioner (OAIC). The OAIC generally expects you to raise the matter with us first. For further information visit www.oaic.gov.au or call 1300 363 992.

13. Privacy and Our Website / Digital Communications

If you interact with our social media pages (for example by liking or commenting), we may receive your social media name or profile information.

Our website may use cookies and similar technologies to manage settings and understand how the site is used. Information collected (such as device type, browser type, IP address and pages visited) does not identify you personally. You can control cookies through your browser settings, although some website features may be affected.

Our website may contain links to third-party websites. We are not responsible for the content or privacy practices of those external sites.

14. Definitions

AI tools: Artificial intelligence tools that assist with natural language processing, documentation, search or clinical decision support.

Health Record Laws: Any relevant state or territory legislation governing the creation, retention and management of health records.

Personal Information: Has the meaning given in the Privacy Act 1988 (Cth).

Privacy Act: Privacy Act 1988 (Cth).

15. Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in legal, clinical or technological requirements. The current version will be available on our website and at reception. The date of the latest update is shown at the top of this document.