Privacy Notice

Wats and Co (ABN 58 630 117 645), trading as CNAesthetic Academy, is the data controller responsible for your personal information in the Aesthetic Passport. We handle it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Much of what you record is health information, which is sensitive information under the Privacy Act; we collect it only with your consent and only to provide the Service.

What we collect and why

• Account details (name, email, login credentials) — to create and secure your account. Basis: to provide the Service you signed up for.
• Passport content (treatment records, journal entries, photos, documents, questions, appointments) — to store and display your private record. Basis: your consent.
• Support messages — to respond to you. Basis: to provide the Service.
• Technical data (IP address, device and browser information, usage logs) — for security, fraud prevention and fixing problems. Basis: our legitimate interest in running a safe service.

We do not sell your information, use it for advertising, or use your photos to train AI.

Who we share it with

• Service providers that host and operate the Service (cloud hosting, database and storage, email delivery), under confidentiality obligations.
• Paddle, our Merchant of Record, for the sale of the product, payments, tax compliance and invoicing. Paddle collects your payment details directly.
• Professional advisers (legal, accounting) where needed.
• Authorities, where required or authorised by law.

Overseas disclosure

Some of our providers, including Paddle and our hosting providers, may store or process information outside Australia (for example in the United States, United Kingdom or European Union). We take reasonable steps to ensure they handle it consistently with the APPs.

Retention

We keep your information while your account is active. If you delete your account in Settings, your Passport content and files are deleted. We may keep limited records where required by law (e.g. transaction records), then delete or de-identify them.

Security

We use encryption in transit, per-account access controls, private file storage with expiring links, and restricted staff access. No system is completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

Cookies

We use only essential cookies and local storage needed to keep you signed in. We do not use advertising or tracking cookies.

Your rights

You can access, correct, export or delete your information at any time in the app, or by contacting us. If you have a concern about how we've handled your information, contact us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Contact

Privacy Officer, Wats and Co trading as CNAesthetic Academy — support@cnaestheticacademy.com