Introduction
Privacy is part of your care. As a specialist medical practice, Pure Visage is entrusted with health information, clinical photographs, private communications and other highly personal information. We protect this information through legal compliance, separate systems, Australian data storage where available, restricted access, provider assurance, managed cybersecurity and human clinical oversight.
This Policy explains how we handle personal and health information, the safeguards we use, and how you can access or correct your information or raise a privacy concern.
We review this Policy at least annually and whenever there is a material change to our legal obligations, systems or information-handling practices. The current version is available on our website and at the practice.
Effective: October 2026 | Version 1.3 | Policy owner: Privacy Officer, Pure Visage
This is the authoritative Pure Visage Privacy Policy. A shorter Privacy & Data Protection Notice may be provided at intake and published online as a plain-English summary. If there is any inconsistency, this full Policy prevails.
1. Purpose and scope
This Policy applies to Pure Visage – Dr Michael Kernohan and describes how we collect, hold, use, disclose, protect, provide access to, correct, retain and dispose of personal and health information. It covers patients, prospective patients, website users, referrers, authorised representatives, contractors and others who interact with the practice.
It also explains our systems, data storage and access arrangements, the separation of clinical images from media copies, our use of artificial intelligence (AI), and how we monitor and manage cybersecurity risks.
2. Legal and professional framework
We manage personal and health information in accordance with applicable Australian requirements. These include the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme, the Health Records and Information Privacy Act 2002 (NSW), the Health Privacy Principles and registered health practitioners' professional obligations. Where relevant, we also consider requirements relating to My Health Record, healthcare identifiers, direct marketing, electronic communications and advertising regulated health services.
Health information is sensitive information and attracts a higher level of protection. As a health service provider, Pure Visage is subject to privacy obligations that apply irrespective of the ordinary small-business exemption that may apply to some other organisations.
3. Our approach to privacy and information governance
We apply privacy by design. Before introducing or materially changing a system, integration, workflow or AI function, we assess what information is needed, where it will be stored, who needs access and how it will move between systems. We also consider what information should be excluded and the consequences of loss, misdirection, unauthorised access or compromise.
We seek to collect and use only the information reasonably necessary for the relevant purpose. We also keep our primary clinical record, customer relationship management (CRM) environment, restricted clinical photograph repository and prepared media library separate. These systems are not treated as an interchangeable pool of information.
Access is based on legitimate need. Staff and contractors do not automatically receive access to every system or category of information. We distinguish between providing information, obtaining acknowledgement and obtaining consent. Uses requiring a separate choice, such as media use of a patient image, have a specific consent process. Before Heidi is used, we explain its purpose and obtain and record patient permission, as described in section 7.3.
AI and automation may assist documentation, communications or administration. They do not replace our registered medical practitioners' professional judgement or accountability. We review data locations, provider certifications, assurance reports and system configuration where relevant to patient information.
4. The information we collect
Identification, contact and administrative information
We may collect a person's name, address, date of birth, telephone number, email address, emergency contact and authorised representative details. We may also collect appointment, referral, billing, account and payment-related information, Medicare or private health insurance details where relevant, healthcare identifiers where lawful, communication preferences, consent records, and information relating to enquiries, concerns or complaints.
Health and sensitive information
Because we provide specialist medical and surgical services, we may collect medical, surgical and treatment history, symptoms, diagnoses, medications, allergies, family history and clinically relevant lifestyle information. We may also collect referrals, pathology, radiology and other clinical reports, consultation and operative records, post-operative information, correspondence, clinical photographs and videos, and information relevant to treatment planning, suitability, safety and continuity of care.
Website and digital interaction information
When you use our website or digital services, we may receive information you submit through enquiry or appointment forms and technical information generated through use. Depending on the technology, this may include pages visited, referring source, device and browser information, approximate location, Internet Protocol (IP) addresses, cookies or similar identifiers, website performance, search ranking and traffic information.
5. How we collect information
We generally collect information directly from you: in person, by telephone, during consultation or treatment, through our website and digital forms, by email or secure messaging, through approved clinical documentation tools, or through clinical photography. Where lawful and clinically appropriate or necessary for care, we may also receive relevant information from referring or treating practitioners, hospitals, pathology or radiology providers, insurers, government services, authorised representatives or family members.
Where lawful and practicable, a person may make a general enquiry anonymously or by using a pseudonym. Accurate identification will ordinarily be required when we provide clinical assessment, treatment, surgery, prescriptions, billing, insurance-related services or continuity of healthcare.
A person's relationship with Pure Visage may begin before they become a patient. Information may be collected when a person visits or makes an enquiry through our website, telephones the practice, sends an email, completes an online form, contacts us through social media, downloads information or resources, books a consultation, attends the practice or otherwise communicates with our team. At this early stage, we may collect the person's name, contact details, the procedure or service they are interested in, questions, communication preferences and information they choose to provide. As the relationship progresses to consultation and treatment, the information collected may become more detailed and include the health and clinical information reasonably necessary to provide care.
6. Why we collect, use and disclose information
We collect, use and disclose information primarily to respond to enquiries, arrange consultations and provide healthcare. This includes planning and performing treatment or surgery, maintaining medical records, communicating with healthcare providers involved in care, managing appointments and accounts, and providing follow-up support. We may also use information for quality assurance, clinical governance, patient safety, complaints, legal and regulatory obligations, professional indemnity, secure business operations and appropriate practice communications.
Where permitted by law and consistent with the person's choices, we may also use contact information to provide educational or service information about Pure Visage. Sensitive health information is not used for direct marketing without the consent required by law. Where lawful service improvement, analysis or governance can be achieved using appropriately de-identified or minimised information, we seek to use information in that form.
An important part of our service is supporting patients and prospective patients to make informed decisions. We may use contact details and information about the procedures or services a person has expressed an interest in to provide relevant educational information, procedure information, practice resources, follow-up information and other material intended to support informed decision-making. This may begin after an enquiry through our website, telephone, email, social media or another approved communication channel.
Where permitted by law and consistent with communication preferences, we may also provide information about products, services, events, practice updates or special offers; invite opinions or comments about our services; and use appropriately limited information for service evaluation, statistical analysis, market research and understanding how people engage with our practice. Sensitive health information is not used for direct marketing without express consent where required by law.
7. The systems we use and how they are protected
Each system serves a different purpose. We keep the authoritative clinical record in our clinical system and seek to limit other systems to the information reasonably necessary for their function.
7.1 Xestro – primary clinical patient record
We use Xestro as our primary clinical patient management and medical record platform. Detailed clinical records are maintained in Xestro, separately from our Zoho CRM environment.
Xestro states that its information security management system, including its software as a service (SaaS) platform, is independently audited and certified to ISO/IEC 27001. It reports Australian data storage, protection of information in transit, additional authentication controls, multi-tiered backups, external penetration testing and ongoing security assessments. These provider controls support our own responsibilities for lawful use, access management and clinical record governance.
7.2 Zoho – Australian CRM and business environment
We use the Zoho business suite, including Zoho CRM and authorised related services, for enquiries, communications, workflow, administration, analytics and appropriately consented marketing. Xestro remains our primary medical record system.
Our Zoho environment is provisioned in its Australian region, with Sydney as the primary data centre and Melbourne as the secondary data centre. We hold documentary evidence of Zoho's certifications for information security (ISO/IEC 27001), cloud security (ISO/IEC 27017), protection of personal information in public cloud environments (ISO/IEC 27018), privacy information management (ISO/IEC 27701) and business continuity (ISO 22301). We also hold System and Organization Controls (SOC) 2 Type 2 assurance covering Australian-hosted applications and relevant security, availability, confidentiality, processing integrity and privacy controls.
These certifications and assurance reports belong to Zoho, not Pure Visage. They support our vendor selection and risk assessment. Supporting certificates and identifiers are retained in our internal due diligence records.
7.3 Heidi health – AI-assisted consultation documentation
Pure Visage uses Heidi health as an AI-assisted clinical documentation tool during consultations. Its purpose is to allow the doctor to focus more fully on the patient and the consultation, and document accurate notes, rather than spending the appointment typing, or writing notes after the patient has left the consultation. Heidi processes the consultation conversation to assist with the preparation of accurate and detailed clinical notes, letters and related correspondence. The treating doctor reviews the documentation and remains responsible for the accuracy of the final clinical record and for every clinical decision.
Heidi health states that Australian users have local data-residency arrangements, that consultation data, session transcriptions and generated notes are not used to train its AI model, and that its security and AI- governance program includes independent assurance against standards such as ISO 27001, ISO 42001 and SOC 2. Heidi also states that real-time consultation audio is not retained after processing in its standard transcription workflow. Pure Visage manages transcript or session retention through the approved account configuration and clinical workflow. Use of Heidi forms part of Pure Visage's usual consultation documentation process and is explained in the privacy information provided to patients. We obtain the patient's verbal or written permission and record it in the clinical record in accordance with our clinical workflow and applicable consent requirements. If a patient would prefer Heidi not to be used during their consultation, they may tell the doctor or a member of our team at any time. Choosing not to use AI-assisted consultation documentation will not affect the standard of care provided.
7.4 RingCentral – telephony and call recording
Pure Visage uses RingCentral for business telephone communications. Telephone metadata, voicemail, recordings and related communications can contain personal or health information. Relevant call logs may be linked to our Zoho CRM so authorised staff can understand previous communications and provide continuity of service. Where call recording is enabled, callers are informed that the call may be recorded for quality, training and continuity of care, and that they may ask not to be recorded where this is reasonably practicable. Recordings may assist with accurate understanding of communications, quality assurance, staff education, complaint management and patient safety.
Pure Visage’s RingCentral account is established in the Australian region. RingCentral states that, unless otherwise specified, it stores communication content, including voicemail, messages and recordings, in the region where the RingCentral account is established. RingCentral has confirmed to Pure Visage that our Australian account is associated with Australian data storage. RingCentral operates a global privacy and data-protection program incorporating privacy by design, data minimisation, data security and safeguards for data transfers. As a global technology provider, RingCentral may use authorised subprocessors or permit limited processing or access outside a customer’s home region where required to provide or support its services. RingCentral states that it applies contractual and other safeguards to these arrangements. Pure Visage contracts with RingCentral Australia Pty Ltd and remains responsible for controlling appropriate access to patient communications within our practice.
7.5 Microsoft 365 and OneDrive – restricted clinical photograph repository
We maintain our restricted clinical photograph repository in our organisational Microsoft 365 environment. In the Microsoft 365 Admin Centre, we have verified that OneDrive and SharePoint both show Australia as the Current Geography and Committed Geography for our tenant. This confirms the repository's Australian data- at-rest geography. Access to the identifiable clinical photograph repository is restricted to Dr Michael Kernohan and specifically authorised staff. External marketing, social media, website and design contractors are not given access to the underlying clinical photograph library. Microsoft provides encryption and identity and access management controls. We remain responsible for account access, sharing, lawful use and our internal photograph workflows.
7.6 Canva and approved design tools
We use Canva for approved design and communications work and may integrate it with authorised business workflows. Canva complies with GDPR, ISO 27001, AICPA SOC 2, SOC 3, PCI DSS and DPF frameworks. Canva is not our clinical medical record system. Staff and contractors must not upload unnecessary patient- identifiable clinical information. Patient images are supplied only after the separate media consent and image preparation process in section 8.
7.7 DMS IT – managed cybersecurity and practice IT protection
Pure Visage uses DMS IT, an Australian managed IT and cybersecurity provider experienced in supporting medical practices, as an additional security layer around our practice technology environment. DMS IT assists with monitoring, cybersecurity protection, network and internet security, backup and recovery, and technical investigation of unusual activity, system issues or cyber threats, such as malware, ransomware and unauthorised access. Its managed cybersecurity approach uses multiple layers of protection and is informed by recognised cybersecurity frameworks and standards. DMS may assist Pure Visage with technical investigation, containment, remediation and recovery where a potential security event occurs. Pure Visage remains responsible for privacy decisions, breach assessment, patient communication and regulatory notification where required.
8. Clinical photographs and patient images
Clinical purpose and restricted storage
Clinical photographs may be taken for assessment, treatment planning, clinical documentation, comparison and follow-up. Consent is obtained for the taking, use and storage of clinical images. Clinical photographs are health information and are protected accordingly. The identifiable clinical photograph repository is restricted to Dr Michael Kernohan and specifically authorised staff, and is separate from the material made available to external creative or marketing personnel.
Separate written consent for media, website and advertising use
Taking a photograph for clinical care does not authorise Pure Visage to publish or advertise that image. Written consent for website, social media, advertising, educational or other external use is obtained separately from consent to treatment. A patient may refuse media use without affecting their healthcare and may withdraw consent for future use where the law and practical circumstances permit.
Preparation before approved external use
Only after signed patient consent has been confirmed may a separate copy be prepared for the authorised external purpose. Pure Visage removes embedded metadata and direct identifiers and, where appropriate, crops the image or removes identifying marks or features. We also consider contextual features that could allow the patient to be reasonably identified. Removing a name alone is not treated as proof that an image is de-identified.
Separate media library and controlled contractor access
Prepared and consented media copies are placed into a separate media library. Authorised external personnel assisting with social media, website design, graphic design or marketing may receive limited access to selected material in that separate environment. They are not given access to the underlying clinical photograph repository merely because they provide marketing services.
External contractors with access to the media library must comply with our privacy, confidentiality and data- handling requirements. They may use information only for the authorised purpose and must maintain appropriate account security. Unauthorised onward sharing and AI upload or processing are prohibited. Contractors must promptly report suspected breaches and delete or return information when access ends.
Image integrity and professional advertising requirements
Images used to demonstrate cosmetic or surgical outcomes must not be digitally altered or enhanced in a way that misrepresents the clinical result. Cropping or removing identifying features for privacy must not distort the apparent outcome. We manage image use in accordance with the Australian Health Practitioner Regulation Agency (Ahpra) and Medical Board of Australia advertising requirements and the patient's documented consent.
Social media and online communication
We use social media, including Facebook, Instagram, TikTok, YouTube and LinkedIn, to provide information about our practice, procedures and services. Our social media and advertising are managed in accordance with Ahpra and Medical Board of Australia advertising requirements.
We obtain separate, specific written media consent before using identifiable patient photographs, videos or other patient information for educational, website or social media purposes. Refusing consent does not affect your care. We do not publish, republish, share, promote or otherwise use patient testimonials concerning clinical aspects of our services in advertising or social media marketing. Where such content appears in advertising or social media environments under our control, we take appropriate steps to remove or manage it in accordance with Ahpra requirements. Patients may independently leave reviews on third- party platforms. We do not reproduce those reviews or engage with them in a way that uses a clinical testimonial to advertise our services.
We do not provide personalised medical advice or discuss confidential patient information through social media. If you contact us through social media, we may acknowledge your enquiry and direct you to our team through an appropriate private communication channel.
9. Artificial intelligence and automated technology
Approved and limited use
Pure Visage may use approved AI-enabled tools for limited clinical documentation, administrative, communication, analysis and workflow functions. AI output is not automatically treated as fact. Identifiable patient information must not be entered into unapproved public or personal AI systems, and patient images must not be uploaded to AI tools by staff or contractors unless that use has been specifically assessed and authorised.
Responsibility for clinical judgement
We do not currently use AI or automated computer systems to independently decide whether a patient is suitable for treatment or surgery, or whether they may access healthcare. These systems do not replace our medical practitioners' clinical judgement. Appropriately qualified practitioners remain responsible for assessment and decision-making when technology assists with documentation or information processing.
Automated decision-making transparency from 10 December 2026
From 10 December 2026, additional APP 1 transparency obligations apply to certain decisions made or assisted by computer programs using personal information. They cover decisions that could reasonably be expected to significantly affect an individual's rights or interests, including where a program does something substantially and directly related to making the decision. We will review any proposed system of this kind before implementation. If introduced, this Policy will identify the kinds of personal information used and the kinds of decisions made or assisted by the program, as required by law.
Future internal AI development
We may evaluate an internal AI assistant or other AI-supported tools in future. Identifiable patient recordings or clinical records will not simply be transferred into a general-purpose AI model for training. Any secondary use of patient-derived information for AI development will require privacy, security and clinical governance assessment, data minimisation, effective de-identification where appropriate, vendor due diligence and specific consent where required. Removing a name does not de-identify a recorded call: a voice or contextual information may still identify the patient.
10. Website analytics, search performance and cookies
We currently use Google Analytics, Zoho analytics tools, and search engine optimisation and ranking tools to understand website use and improve its information, performance and functionality. Depending on the technology, information may include pages visited, date and time, referring source, browser or device details, approximate location, IP addresses, cookies or similar identifiers, and website performance information.
Information submitted through website enquiry or contact forms may be transferred to our Australian-hosted Zoho CRM so we can respond and manage the enquiry. Please avoid entering unnecessary sensitive medical information in general website fields. We periodically review our website's trackers, cookies, pixels and analytics tools to keep our public privacy notice accurate.
11. Direct marketing and communication preferences
Pure Visage may communicate about services, educational information, events or practice updates where permitted by law, and consistent with the individual's preferences. Sensitive health information is not used for direct marketing without the consent required by law. Marketing communications include an appropriate way to unsubscribe. Choosing not to receive marketing does not prevent communications that are reasonably necessary for clinical care, appointments, accounts, safety, consent or administration.
Electronic communications may include educational email sequences, eNews, procedure information, practice updates and other relevant communications. Each marketing email provides an appropriate unsubscribe mechanism, and individuals may also opt out by contacting Pure Visage directly. An opt-out from marketing does not prevent us from sending communications that are reasonably necessary to respond to an active enquiry or to manage appointments, treatment, accounts, safety, consent, follow-up or ongoing healthcare.
Pure Visage may use appropriately selected companies or service providers to assist with communications and related functions, including email distribution, mail-house services, market research, analysis, website and digital services, consulting, product or service development and marketing support. Where a provider requires access to personal information to perform an authorised function for Pure Visage, access is limited to what is reasonably necessary for that function and the information must not be used for an unrelated purpose.
12. Disclosure to healthcare providers and other recipients
Where relevant and lawful, we may disclose personal or health information to healthcare providers involved in care, including referring or treating practitioners, hospitals, day surgeries, anaesthetists, pathology or radiology providers, pharmacies and allied health providers. Other recipients may include Medicare, private health and professional indemnity insurers, legal advisers, regulators, courts, law enforcement bodies, government authorities, debt recovery providers, and technology or professional service providers acting for us. We seek to disclose only the information reasonably necessary for the purpose.
Information may also be used or disclosed without consent where Australian law permits or requires this, including certain serious-threat situations, permitted health situations, enforcement activities, legal claims or circumstances involving a person who lacks capacity. These situations are assessed according to the applicable law and the circumstances at the time.
13. Overseas access, processing and disclosure
Pure Visage gives preference to Australian data regions or Australian storage for sensitive information where appropriate and available. Xestro states that customer data is stored in Australia. Our Zoho regional environment uses Sydney as the primary data centre and Melbourne as the secondary data centre. Our Microsoft 365 tenant has been directly verified as Australia for the current and committed data-at-rest geography of OneDrive and SharePoint.
Some technology providers operate globally, and limited support, corporate, security, subprocessor or technical processing may occur outside Australia. Where overseas access or disclosure is relevant, Pure Visage considers the requirements of APP 8 and applicable NSW health privacy requirements and uses contractual, technical and organisational safeguards appropriate to the circumstances. We do not describe a service as exclusively Australian-hosted unless that specific arrangement has been verified.
14. Information security and managed cybersecurity
We use a layered approach to information security. Access is limited by role and legitimate purpose, with individual accounts, appropriate authentication and multi-factor authentication where supported and appropriate. Other safeguards include platform encryption, endpoint and network security controls, access reviews where appropriate, backup and recovery arrangements, and managed cybersecurity support through DMS IT.
Our organisational measures are equally important. Staff and contractors are subject to confidentiality requirements and privacy and security expectations. Access is reviewed when responsibilities change and is removed when it is no longer required. New providers and integrations are subject to due diligence appropriate to the information and risk involved. Suspected security incidents are escalated promptly so they can be contained, investigated and assessed.
For security reasons, this public Policy does not disclose passwords, network architecture, detailed technical configurations, security-monitoring thresholds or other information that could reasonably undermine the effectiveness of our controls.
15. Retention and secure disposal
Health information is retained for the periods required by NSW law and applicable professional requirements. For private NSW health service providers, adult health records are generally retained for at least seven years from the last occasion on which a health service was provided. Where health information was collected while the patient was under 18, records are generally retained until the patient reaches 25 years of age.
Other categories of information, such as enquiries, recorded calls, administrative communications, consented media copies and system logs, may have different retention requirements. Pure Visage maintains internal retention rules and seeks not to retain personal information indefinitely merely because storage is technically available. Where information is no longer required and there is no legal, clinical or business reason to retain it, we take reasonable steps to securely destroy it or appropriately de-identify it.
16. Data quality, access and correction
Pure Visage takes reasonable steps to keep personal information accurate, up to date, complete and relevant. Patients may be asked to confirm contact details, medications, allergies, medical history or other information where accuracy matters to care or administration.
Individuals may request access to personal information we hold about them and may ask for correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify identity before providing access. Access may only be refused or limited where the law permits this. Where access or correction is refused, we will provide the reasons and available complaint avenues required by law.
17. Consent, acknowledgement and withdrawal
Where Pure Visage relies on consent, we seek consent that is informed, voluntary, current and sufficiently specific for the relevant purpose. Depending on the circumstances, Pure Visage may ask for consent or acknowledgement relating to communication preferences and permission to leave telephone or voicemail messages; collection and sharing of information relevant to care; clinical photography; separate media use of photographs or video; treatment and surgical consent; hospital documentation and consent; informed financial consent (IFC); and payment and billing arrangements. Heidi-assisted consultation documentation is addressed through clear prior notice and an opt-out choice rather than a separate written consent form. A person may withdraw consent where the law permits. Withdrawal does not invalidate lawful handling that occurred before the withdrawal and does not require Pure Visage to destroy information that we are legally or professionally required to retain.
These permissions are not treated as interchangeable. For example, consent to clinical photography for assessment, treatment planning or the medical record does not authorise publication of those photographs. Website, social-media, educational or advertising use of patient images requires the separate media-consent process described in this Policy. Similarly, acknowledgement of this Privacy Policy does not replace the clinical, surgical, hospital or financial consent processes that may be required during care. Where consent for future promotional image use is withdrawn, we will cease future use and take reasonable steps to remove material from platforms and repositories within our control, while recognising that material previously published online may have been copied, cached, archived or shared by third parties outside our control.
18. Children, young people and decision-making capacity
Additional care is taken where a patient may have limited capacity to make privacy decisions. Capacity is considered with knowledge of age, maturity, understanding, the nature of the information and applicable law. Where appropriate, a parent, guardian or responsible person may be involved, while the patient is included in decision-making as far as practicable.
19. Privacy incidents, cyber incidents and data breaches
We maintain procedures to identify, contain, investigate and respond to suspected privacy or cybersecurity incidents. DMS IT may assist with technical investigation, containment, remediation and restoration. We remain responsible for assessing privacy consequences and affected information, communicating with patients and making any required regulatory notifications. Where an incident may constitute an eligible data breach, we assess it under the Notifiable Data Breaches scheme and notify affected individuals and the Office of the Australian Information Commissioner where required. Other mandatory health-record, My Health Record or professional notification requirements are considered where applicable. The objective is not only to respond to the immediate incident but also to identify corrective actions that reduce the likelihood of recurrence.
20. Privacy complaints
Privacy complaints should first be directed to our Privacy Officer. We will acknowledge and investigate the concern and aim to provide a substantive response within a reasonable period, generally within 30 days where practicable. If a person remains dissatisfied, they may be able to complain to the Office of the Australian Information Commissioner and, for matters within its jurisdiction, the Information and Privacy Commission NSW. Other health-practitioner complaint avenues may also apply depending on the nature of the concern.
21. Contacting our Privacy Officer
Privacy enquiries, access requests, correction requests, complaints and questions about this Policy may be directed to:
The Privacy Officer, Pure Visage – Dr Michael Kernohan, Gregory Hills Health and Business Centre, U17/13 Digitaria Drive, Gledswood Hills NSW 2557.
The practice can be contacted by telephone on 02 8310 4576 or by email at [email protected].
A copy of this Policy is available on our website or by request. If an individual requires the Policy in another reasonably available format, they may contact our Privacy Officer. A shorter Patient Privacy & Health Information Notice is also available.
More information about the APPs and HPPs can be found on the Australian Information Commissioner’s website www.oaic.gov.au.
22. Privacy and security assurance – evidence behind our controls
Provider assurance and data location evidence support our due diligence. These include Zoho's ISO/IEC 27001, 27017, 27018 and 27701 certifications, ISO 22301 certification and SOC 2 Type 2 assurance; Xestro's reported ISO/IEC 27001 certification and Australian storage; our verified Microsoft 365 data-at-rest geography; Heidi's published security and AI governance assurance; and DMS IT's managed cybersecurity support. Section 7 describes these arrangements in more detail.
Provider certifications and controls do not mean that Pure Visage itself is certified to those standards.
We remain accountable for choosing appropriate systems, limiting information flows, controlling access, obtaining consent where required, training staff, supervising contractors, managing incidents and reviewing our arrangements as technology and laws change.
23. Review and changes to this Policy
We review this Policy at least annually and whenever there is a material change to legislation, regulatory guidance, clinical operations, technology, AI use, data residency, security controls, marketing practices or information flows. We have addressed the APP 1 automated decision-making transparency amendments commencing on 10 December 2026 in section 9. Updated versions are available on our website and at the practice.
