Glow Medical Collective Privacy Policy
Last updated: 2 November 2026
About this policy
Glow Medical Collective (Glow Medical Collective Pty Ltd), ABN 13 702 117 922, provides scripting supervision and product supply to registered health practitioners working in cosmetic injecting. This policy explains what personal information we collect, why we collect it, who may access it, and how you can request access to or correction of it.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. In this policy, “we”, “us” and “our” mean Glow Medical Collective. “You” means anyone who visits our website, applies to work with us or whose information is handled through our services.
The information we collect
When you apply
• Your name, preferred name, email address and mobile number.
• Your AHPRA registration number, registration type, renewal date and registration certificate.
• Your practice name and address, your ABN, and whether you work from commercial premises or a home clinic.
• Your professional indemnity insurer, policy number, expiry date and certificate of currency, and whether your policy covers cosmetic injecting.
• If you are an RN practising in Victoria or Western Australia, your poisons permit number, expiry date and certificate.
• Your driver licence or passport number and expiry date, together with an image of the document.
• If you practise outside Victoria or Western Australia, a video or photographs of your premises showing the entrance, treatment bed, sharps container, locked fridge and locked cupboard.
• How long you have been injecting and how you heard about us, if you choose to tell us.
• The consents and declarations you provide, and the date and time of submission.
During your consultation, and if we work together
• Notes from your consultation with Dr Staves, including a live walkthrough of your premises if you provided photographs rather than a video.
• Patient medical histories, consent forms, treatment records, scripting-supervision records, product orders and supply records held within DappleOS.
• Renewal dates for your registration, insurance and, if you practise in Victoria or Western Australia, your poisons permit.
When you visit our website or contact us
• Information about how you use our website, collected through cookies (see Cookies and analytics below).
• Information you provide when contacting us by email or phone.
The Zoho practitioner onboarding form does not ask for health information about you. It collects professional credentials, identity information and premises evidence for application and compliance purposes. We treat identity documents and premises videos or photographs as particularly sensitive records.
How we collect it
We collect most practitioner information directly from you through our Zoho application form, during your consultation and through our correspondence with you. We also verify your registration using AHPRA’s public register of practitioners. Patient health information, consent forms and treatment records are collected and stored within DappleOS as part of the prescribing and treatment workflow. Orders for Schedule 4 medicines, including dispensing and delivery, are also processed through DappleOS.
Why we collect it
• To assess your application, including verifying your identity, registration, insurance and medicine-storage arrangements.
• To conduct your consultation and decide whether we will supervise you and, if so, on what terms.
• To provide scripting supervision and arrange product supply through DappleOS.
• To monitor renewal dates and contact you before a registration, policy or permit expires.
• To keep records required by our professional, legal and regulatory obligations.
• To understand how our website is used, so we can improve it.
We will not use your information for another purpose unless you consent or the law allows or requires us to do so. We do not sell personal information. We will send you marketing only if you have agreed to receive it, and you may unsubscribe at any time.
If you do not give us your information
We cannot assess your application unless you provide the information requested in the form. Questions marked as optional are genuinely optional.
Every application is reviewed by a person
We do not use automated decision-making. A member of our team checks your documents and premises evidence. Dr Staves decides whether to work with you after meeting you.
Who can see your information
• Dr Sally Staves and designated staff who verify applications. Only Dr Staves and these staff may view videos or photographs of your premises. Administration, fulfilment and support staff do not have access to them.
• Service providers that support our systems. These include Zoho, which hosts our application form and records; our website host; Google Analytics; and our email provider. They may use your information only to provide services to us.
• DappleOS and authorised doctors or other prescribers working with Glow Medical Collective. DappleOS powers the telehealth scripting application used to access patient health information, consent forms and treatment records. Authorised prescribers may access the patient information they reasonably need to assess a patient, prescribe treatment or support the treatment workflow. DappleOS stores and protects information held within the application.
• Other parties where the law requires or allows disclosure. These may include AHPRA, the Therapeutic Goods Administration or a court. We may also disclose information to our indemnity insurer or professional advisers when necessary to manage a claim or obtain advice.
DappleOS telehealth scripting application
DappleOS is the software provider that powers the telehealth scripting application used in our prescribing workflow. The application may hold patient health information, medical histories, consent forms, treatment records and other information needed to assess a patient and issue a prescription.
Access to the application is limited to authorised users. Doctors and other authorised prescribers working with Glow Medical Collective may view patient information that is reasonably necessary to assess a patient, make prescribing decisions and support the treatment workflow. Other Glow Medical Collective personnel may access records only when required for their role.
DappleOS stores and protects patient information held within the application and is responsible for the operation and security of its platform. Glow Medical Collective and each authorised user remain responsible for using and disclosing information only for permitted clinical, legal and operational purposes, and for keeping their access credentials secure.
Information stored outside Australia
Your application, documents and premises evidence are stored in Australia. Our website and analytics providers may store information about website visits overseas, including in the United States. If information is disclosed outside Australia, we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles.
How we protect your information
• Access is limited to the people who need it, each with their own login.
• Identity documents, certificates and premises evidence are encrypted and are never stored at a publicly accessible address.
• We do not send your documents or premises evidence by email.
• DappleOS stores and protects patient records held within the telehealth scripting application and manages the platform’s security. Authorised users must keep their login details secure and access records only when required for their role.
How long we keep it
• Video or photographs of your premises: 12 months after your last contact with us.
• Records for practitioners we work with: seven years after our working relationship ends, where required by applicable record-keeping obligations.
• Patient records held in DappleOS: retained within the platform in accordance with applicable medical-record obligations and DappleOS retention arrangements. If a seven-year retention period applies, it is calculated from the relevant clinical or legal event, rather than solely from the end of our relationship with a practitioner.
• Applications that do not proceed: 12 months after the decision.
When the relevant retention period ends, we securely delete or de-identify the information, where permitted and within our control.
Cookies and analytics
Our website uses Google Analytics to help us understand how visitors use the site, including which pages they view and the type of device they use. Google Analytics does not collect information you enter or upload into our application form. You can block or delete cookies through your browser settings. Google also provides a browser add-on that allows you to opt out of Google Analytics.
Accessing and correcting your information
You may ask to access the personal information we hold about you or request that we correct it by contacting us using the details below. We will respond within 30 days and may first need to verify your identity. There is no charge for making a request. If we cannot provide access or make a correction, we will explain why.
If something goes wrong
If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Complaints
If you are concerned about how we have handled your information, please contact us in writing using the details below. We will respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
Contact us
Privacy contact: Dr Sally Staves Email: glowmedco@gmail.com Post: 90 Wheatsheaf Road, Glenroy VIC 3046