Privacy Policy

Effective 29 October 2026

Who we are

Beauty Blvd is operated by HAIRLAB BY GEORGE PTY. LTD., ACN 663 803 727. This policy covers our salon services and the Beauty Blvd websites, client profiles, booking platform and app. Our trading brands include h.AIRLAB, Nile & Reed Skin, ARC Brow Bar, Barber Commons and Betty Rose Nails.

Contact us about privacy, your records or a complaint at hello@beautyblvd.com.au, by telephone on (02) 5944 3464, or at 66 Darling St, Balmain East NSW 2041.

Information we collect

Depending on the services and features you use, we collect:

• Your name, contact details and information needed to identify your client record.
• Bookings, service preferences, treatment notes, consultation answers, consent records, signatures and relevant communications.
• Health information relevant to treatment suitability and safety, such as allergies, relevant medicines, scalp or skin concerns and treatment history.
• Treatment photographs where relevant and agreed. Permission to use images in marketing is separate from permission to use them for your care.
• Payment and transaction references, deposits, refunds, vouchers and rewards. Our payment providers process card payments; payment methods may be saved by the provider where you authorise this through the booking process.
• Technical and usage information needed to operate and protect our services, such as browser/device details, session information and service events.
• Information you choose to provide for an optional community activity, promotion or communication preference.

We seek information reasonably needed for the relevant purpose. Please avoid putting unrelated medical details or other people's private information into free-text fields. You may ask to discuss a sensitive treatment question privately.

How we collect information and your choices

We usually collect information directly from you when you book, complete a form, attend an appointment, contact us or use our platform. We may also receive relevant information from someone arranging your appointment, an authorised parent or guardian, a payment or booking provider, or a previous record we are lawfully entitled to use. We check authority where someone acts for another person.

We explain relevant health-information collection and seek consent where required. Treatment consent, privacy consent and permission for marketing are different choices. You can raise questions or withdraw consent for future optional uses by contacting us. Withdrawal does not undo lawful past handling or require destruction of records we must retain.

You can make a general enquiry without providing your full details where practical. If you do not provide information needed to identify your booking, process payment or assess treatment safety, we may be unable to provide that feature or service safely. We will explain the relevant limitation.

Why we use information

We use information to arrange and deliver services, assess suitability, obtain and record consent, keep accurate treatment records, manage profiles and appointments, communicate about care or bookings, process payments and refunds, administer vouchers and rewards, respond to requests and complaints, protect the platform, and meet legal obligations.

We use health information for the purposes explained when collected and other uses permitted by law. We do not treat a booking or treatment signature as permission for every marketing or unrelated use.

Who may receive information

Information may be accessed by authorised staff and practitioners who need it for their work, and by service providers helping us operate our business. These can include hosting and database services, payment processors, email/SMS and calendar services, technical support, and professional advisers. We limit disclosure to what is needed for the purpose and take reasonable steps to protect information handled by providers.

We may also disclose information with your consent or where required or authorised by law. A person booking or paying for someone else does not automatically gain access to that person's confidential treatment record.

Where information is stored and processed

Our main client and booking database is hosted with Google Cloud Firestore in Sydney, Australia. Our application servers are currently hosted with Cloudflare in Sydney. These locations do not mean that all information stays in Australia.

We use technology providers for different functions:

• Google Cloud and Google Workspace: our main database, email, calendar, documents and backups. Google Workspace uses international infrastructure; our current Workspace plan does not provide a selectable data-region restriction. Google may process information where it and its service providers operate, including the United States, United Kingdom, Ireland, Belgium, Denmark, Finland, Germany, the Netherlands, Japan, Singapore, Taiwan and Chile.
• Cloudflare: website/app delivery, hosting, security and operational services. Its international network and support arrangements can involve overseas processing, including in the United States, United Kingdom, Canada, Japan, Singapore and European countries such as Germany, France and the Netherlands.
• Square: payment processing and related transaction services. Square's Australian buyer notice identifies possible overseas processing in the United States, Canada, Japan, Ireland, France, Spain and the United Kingdom.
• Twilio and telecommunications carriers: text-message delivery. The platform's Twilio connection uses its United States processing endpoint. Carriers also handle messages for delivery to your number.
• Apple: delivery of notifications to Apple devices. Apple operates internationally and states that personal data it collects worldwide is generally stored in the United States.
• OpenAI, where AI-assisted features are used: preparation of report text, communications or service guidance. This can involve processing outside Australia, including in the United States. We do not represent that these features have Australia-only processing or zero provider retention.
• Resend, where used for email delivery: email content and delivery records are stored in the United States. A sending region does not change that storage location. A configured but unused email feature does not itself send your data.

These are processing locations that may apply to the relevant service, not a statement that every client's information is sent to every provider or country. Provider networks, support access and subprocessors can involve additional locations. We review relevant arrangements and update this policy when our practices change. You can ask us about the providers relevant to your records.

We take reasonable steps required by Australian privacy law in relation to providers handling information overseas. Using an overseas provider does not remove our own privacy responsibilities.

Assessments and AI-assisted features

The Hair Regeneration Assessment uses guided results and does not send its answers to an external AI service to write personalised assessment text.

Separate AI-assisted features may use information supplied for that feature, such as chat messages, consultation notes, relevant assessment details or images, to help prepare reports, communications or service guidance. These features can involve OpenAI as described above. We explain the relevant use and obtain consent where required, particularly for sensitive health information. This policy is not blanket permission for unrelated use of health records.

AI-generated content can be inaccurate. It does not replace a practitioner's consultation, professional judgment or medical diagnosis. Ask us about a person-led alternative if you do not want to use an optional AI-assisted feature.

Marketing and optional photographs

We send commercial email or SMS where we have the consent or other basis the law requires. You can opt out using the instructions in the message or by contacting us. Opting out of marketing does not stop necessary booking, payment or service communications. Those communications must not be used to bypass your marketing choice.

We seek separate permission before using identifiable treatment photographs or testimonials in marketing. Declining optional marketing permission does not prevent you from receiving ordinary services.

Cookies and technical information

Our platform uses session and similar technology for functions such as login, remembering steps in a journey, security and measuring service use. Your browser can control cookies, although blocking necessary cookies may stop some features working. We explain additional tracking and obtain consent where required; we do not send health-form answers or assessment participation to advertising platforms through the assessment and quiz submission features.

Security and retention

We take reasonable technical and organisational steps to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. Access controls are part of this protection. No internet service can guarantee absolute security.

We retain records for the purposes they are needed and for applicable legal requirements. Health, payment and transaction records can have different retention periods. Relevant NSW health records generally need to be retained for at least seven years from the last health service for adult records, or until age 25 for records collected while the person was under 18. We assess mixed histories and other legal requirements before disposal.

When information is no longer needed and no retention obligation applies, we take reasonable steps to securely destroy or de-identify it. Closing an account does not automatically erase records we lawfully need to retain. Backup copies are addressed through our retention and recovery procedures.

Access, correction and requests to remove information

Contact hello@beautyblvd.com.au to request access to or correction of your information, ask about retention, or request removal of information. We may need to verify your identity and any authority to act for someone else. We respond within the applicable time limits and explain any lawful refusal or retention requirement. We do not charge you to make a request; if a permitted access charge applies, we will explain it before proceeding.

Children and people acting for others

We consider the individual's ability to understand and consent, and the authority of a parent, guardian or representative where relevant. We keep the service recipient distinct from the booking contact and payer. A shared email address alone does not entitle someone to another person's private records.

Complaints and changes to this policy

Please send a privacy complaint to hello@beautyblvd.com.au with enough detail for us to investigate. We aim to respond within 30 days and will keep you informed if more time is needed. If you are dissatisfied, you can contact the Office of the Australian Information Commissioner or, for relevant NSW health-privacy matters, the Information and Privacy Commission NSW.

We update this policy when our practices or obligations change. The published version will show its effective date. A policy update does not itself provide consent for a new use that requires your consent.