How we look after your information.

This is the privacy policy for The Bali Method (thebalimethod.com), a marketing-and-concierge service that arranges hair-restoration trips from Australia to our independent partner clinic, ETERNAL Clinic, in Bali. It applies to anyone who fills in our free assessment quiz, contacts us via WhatsApp or email, books a consultation, pays a deposit, or otherwise interacts with us through this website.

The Bali Method is the entity collecting your information. We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Where you are based in the European Union or the United Kingdom, we treat the General Data Protection Regulation (GDPR) and UK GDPR as the operating standard.

The amount of information we collect depends on how far you take the process. The categories below cover everything we may have on file.

We do not knowingly collect information from people under 18. The procedures we facilitate are not appropriate for minors.

• To match you to a package and send you a non-binding estimate.
• To prepare for your video consultation with the surgeon at ETERNAL Clinic.
• To arrange your trip - flights from your selected airport, hotel, transfers, recovery logistics.
• To send you nurture emails with information that may help you decide whether the program is right for you. You can unsubscribe from these at any time.
• To improve the website and our service using aggregate analytics.
• To meet legal obligations (such as anti-fraud measures, financial-record keeping, and responding to lawful requests).

Under Australian law, we rely on your consent when you submit the quiz and on the performance of a contract or service when you ask us to organise consultations, deposits or travel. Marketing communications are sent on the basis of your consent and our legitimate interest in keeping interested patients informed; you can withdraw at any time.

For visitors based in the EU or UK, we rely on the equivalent GDPR lawful bases: consent, contract performance, and legitimate interest, depending on the activity.

The Bali Method is a marketing-and-concierge service. The medical procedure itself is provided by our independent partner clinic. To do our job we share targeted slices of your information with the following parties.

We do not sell your personal information. We never share photographs for marketing purposes without your explicit, separate written consent.

Some of the parties listed above store data outside Australia. ETERNAL Clinic operates from Indonesia. Several of our software vendors operate data centres in the United States and the European Union. When your information is transferred internationally we take reasonable steps to ensure that the recipient is bound by obligations equivalent to APP 8.

• Quiz answers and contact details - kept while you are an active prospect or patient, plus seven years from your last interaction (to meet AU record-keeping obligations for medical-tourism arrangements).
• Photos - deleted on request, or 12 months after your trip if no further booking is made.
• Mira chat transcripts - kept for 12 months for service improvement; older sessions are deleted automatically.
• Marketing-list email - kept until you unsubscribe.
• Aggregate analytics - kept indefinitely; cannot be used to identify you.

Under the Australian Privacy Act and (where applicable) the GDPR, you can:

• Ask for a copy of the personal information we hold about you.
• Correct anything that is inaccurate or out of date.
• Delete your information (subject to any record-keeping obligations we have).
• Withdraw consent for marketing communications by clicking the unsubscribe link in any email or by writing to us at info@thebalimethod.com.
• Object to processing based on legitimate interest.
• Request data portability (a machine-readable copy of the information you provided).

To exercise any of these rights, email info@thebalimethod.com from the address we have on file. We will respond within 30 days.

We use industry-standard measures to keep your information safe. Passwords (where applicable) are hashed; transport is encrypted via TLS; the photo storage bucket is private and read access is granted only via short-lived signed URLs to authorised parties. Internal access to lead data is restricted to team members who need it.

No system is perfect. If a security incident occurs that materially affects your information, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

We use a small number of strictly-necessary cookies (for example, to keep your quiz answers in place between steps). When marketing analytics tools are enabled, we will request your consent before firing them, in line with the GDPR ePrivacy Directive and the guidance of the OAIC.

We may update this policy from time to time. The date at the top of the page reflects the most recent change. Material changes will be flagged via email to active prospects and patients before they take effect.

For privacy questions or requests, email us at info@thebalimethod.com.

If you are not satisfied with how we have handled your privacy, you can lodge a complaint with the Office of the Australian Information Commissioner. If you are based in the EU or UK, you may also lodge a complaint with your local data-protection authority.