Privacy policy.

Last updated 23 July 2026

This explains what I collect about you, why I need it, where it is kept and what you can ask me to do with it. If anything here isn’t clear, ask me — I’d rather explain it than have you guess.

Who I am

ellyvate is operated by Elly Chandler, Registered Nurse, ABN 40 752 705 459, of Tyabb, Victoria 3913.

As a health service provider I am bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the Health Records Act 2001 (Vic). These apply to me regardless of the size of my business.

What I collect

Contact details — your name, date of birth, phone number, email address, and your home address if you book a mobile visit.
Health information — your medical history, medications, supplements, allergies, previous reactions, and anything else you tell me on the intake form or in conversation. This is sensitive information under the Privacy Act and is handled with the extra care that requires.
Appointment and payment records — what you booked, when, what was administered, and what you paid.
Correspondence — emails and messages between us.

I only collect health information with your consent, and only what I actually need to treat you safely.

Why I need it

To assess whether a treatment is safe and suitable for you.
To provide your treatment, and to keep the clinical record I am professionally required to keep.
To give the prescribing doctor what they need to decide whether to write your script.
To contact you about your appointment.

If you don’t want to give me some of this, tell me. You are free to decline — but if I don’t have enough to judge that a treatment is safe for you, I won’t be able to provide it.

Who I share it with

The prescribing doctor — every treatment is given under a prescriber’s orders, so they see what they need to make that decision.
Your GP or another practitioner — only with your permission, or where I am required or permitted by law.
In an emergency — with paramedics or hospital staff, if your safety depends on it.

I do not sell your information, and I do not use your health information for marketing.

Where it is kept, including overseas

Some of the tools I use to run the clinic store information on servers outside Australia:

Netlify (United States) — hosts this website and receives intake form submissions.
Square (United States) — handles bookings and card payments, and stores your appointment and payment records.
MailerLite — sends email, and stores your email address if you have signed up to hear from me.
Microsoft Clarity (United States) – measures how this website is used. See "How this website is measured" below.

By giving me your information you consent to it being stored and processed by these providers, including outside Australia. I choose providers that publish their own security and privacy terms, but information held overseas may not have the same protections as it would here.

How this website is measured

I use a tool called Microsoft Clarity to understand how people use this website, so I can make it easier to find things. It records which pages are opened, how far down a page people scroll, what they click, and how long they stay. It also saves anonymous replays of those visits as a moving picture of mouse and scroll movement.

It is set to hide text, so the words on the screen are masked in those replays. It does not know who you are, and I do not use it to identify anyone. It uses cookies to tell one visit from another, and the information is held by Microsoft, including outside Australia.

The intake form is left out of this completely. That page carries no measuring code at all, so nothing you type into it is ever recorded or replayed.

You can stop this by turning on Do Not Track or Global Privacy Control in your browser, or by blocking cookies for this site. Nothing on this website stops working if you do.

How long I keep it

I am required to keep health records for seven years from your last appointment. For anyone treated under the age of 18, records are kept until they turn 25. After that they are securely destroyed.

Keeping it safe

Your information is kept confidential and only accessible to me and, where relevant, the prescribing doctor. Accounts are protected by passwords and, where the provider supports it, two-factor authentication. No system is perfect — if a breach ever occurred that was likely to cause you serious harm, I am required to tell you and to notify the Office of the Australian Information Commissioner.

Seeing or correcting your record

You can ask me for a copy of what I hold about you, and you can ask me to correct anything that is wrong. Just ask — in writing is easiest. I’ll respond within 30 days. There are limited situations where I may not be able to give you access, and if that happens I’ll explain why.

If you’re unhappy

Tell me first — most things are a misunderstanding and I’d like the chance to fix it. Email me and I’ll respond within 30 days.

If you’re not satisfied with how I’ve handled it, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or the Health Complaints Commissioner (Victoria) at hcc.vic.gov.au.

Changes

If I change how I handle your information, I’ll update this page and change the date at the top.