Privacy Policy

1. Who we are

D'ORA LABS is a private medical practice. Privacy enquiries, access requests and complaints should be directed to Ruvi Ratnayake, Privacy Officer, using the contact details above.

2. Why the Privacy Act applies

D'ORA LABS is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), irrespective of annual turnover, because it is a private-sector health service provider that holds health information. The usual small-business exemption does not apply.

As a health service provider operating in New South Wales, we are also bound by the Health Records and Information Privacy Act 2002 (NSW) and the Health Privacy Principles (HPPs).

3. What personal information we collect

Depending on your interaction with the practice, we may collect:

• Identity and contact details, including name, date of birth, address, phone number and email.
• Appointment details, including the service requested, preferred date and time, and referring practitioner.
• Health information, including medical history, medications, allergies, previous treatments, clinical notes, treatment plans and consent forms.
• Payment and billing information. We do not store full card details; these are handled by splose's payment processor.
• Records of calls, emails or messages between you and the practice.

Where practical, we only collect health information with your consent and where it is reasonably necessary for, or directly related to, providing your care.

4. How we collect information

• Directly from you through the splose online booking form embedded on our booking page, by phone, email or in person. This website does not itself process or store appointment bookings. When you book online, you submit information to splose.
• From other treating practitioners, with your consent, where relevant to continuity of care.
• Automatically, as limited technical information needed for this website's security and functionality (for example, server logs).

5. Why we collect, hold, use and disclose information

We use your information to:

• Assess suitability for, and provide, wrinkle or skin rejuvenation treatment.
• Manage bookings, reminders and follow-up care.
• Maintain accurate clinical records as required by law and good clinical practice.
• Process payments and manage billing.
• Meet legal, regulatory and professional obligations, including AHPRA requirements.
• Handle complaints, incidents or medico-legal matters.

We do not use health information for marketing. Promotional communications are only sent where you have separately opted in, and you may opt out at any time.

6. Who we may share information with

• Other health professionals involved in your care, with your consent.
• SPLOSE PTY LTD (ACN 614 286 636), trading as splose, which provides our practice-management system, online bookings, clinical records, reminders and related practice administration. Booking, clinical and billing records are held in our splose workspace. splose's handling of personal information is described in its Privacy Policy and Security information.
• Regulatory and government bodies where required by law.
• Professional advisors, including lawyers, accountants and medical indemnity insurers, where necessary.

We do not sell, rent or trade personal information.

7. Sensitive and health information

Health information is sensitive information under the Privacy Act and receives a higher level of protection. We collect it with your consent, or where otherwise permitted by law, and only use it for your care, legal obligations and proper practice administration unless you separately agree.

8. How we store and protect information

We do not operate our own booking or clinical-record database. Patient information collected for care, including online bookings, is stored and processed by splose on our behalf.

According to splose's published security information, for Australian users data is stored in Australia, held redundantly at Amazon Web Services (AWS) data centres, encrypted in transit (SSL/TLS) and at rest (AES-256), and backed up hourly in encrypted form off-site. Access to our workspace is limited to Dr. Mestiyage (Sue) Gunatilake and authorised administrative staff who need it to perform their role, using splose user permissions. Two-factor authentication is available.

Any paper records created at the practice are stored securely at the clinic and accessed only by those staff. We take reasonable steps to destroy or de-identify information when it is no longer required, subject to health-record retention duties.

Further detail is in splose's Security page and Privacy Policy.

9. Overseas storage or disclosure

splose states that data for Australian users is stored in Australia. We rely on that residency for the primary location of booking and clinical records.

splose may still use overseas service providers (for example group companies, cloud subprocessors, or optional AI features powered by OpenAI) as described in its privacy policy. Where that occurs, information may be disclosed outside Australia. We cannot guarantee that every overseas recipient is bound by the Australian Privacy Principles in the same way an Australian organisation is. By booking with us you consent to that disclosure where it is reasonably necessary for splose to provide the platform.

Read splose's Privacy Policy for its current overseas-transfer and subprocessor arrangements.

10. How long we keep information

Health records are retained for the minimum periods required by law. Under the Health Records and Information Privacy Act 2002 (NSW):

• Adult patient records are retained for at least 7 years from the last occasion on which a health service was provided.
• Records relating to patients who were under 18 when the information was collected are retained until the patient turns 25.

Clinical records generally cannot be fully deleted while a legal retention period applies. Non-clinical records, such as marketing opt-ins, are deleted on request.

11. Access and correction

You may request access to personal information we hold about you or correction of information that is inaccurate, out of date, incomplete or misleading. Contact the Privacy Officer listed above. We will respond within a reasonable period, ordinarily within 30 days. A reasonable retrieval fee may apply, but there is no fee to make a request. Access may be limited where permitted by law.

12. Complaints

Contact our Privacy Officer first if you believe we have breached the APPs or mishandled your information. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner:

• oaic.gov.au
• 1300 363 992

13. Changes to this policy

We may update this policy as laws or our practices change. The current version will be available on this page, and we will take reasonable steps to notify existing patients of significant changes.

Last updated: 28 August 2026