Patient privacy policy

How we collect, use, protect and share your personal and health information. Version 1.1.

Your privacy at a glance

We collect the personal and health information we need to provide safe dental care, keep accurate records and process claims and payments.
We share information only where it is needed for your care or our services, where you agree, or where the law requires or allows it. We do not sell your personal information.
You can ask to access or correct your records. We aim to respond within 30 days, subject to applicable legal timeframes.
We describe our website analytics, advertising measurement and your privacy choices in section 10.
Some service providers we use store information outside Australia (see section 11).
Questions or concerns? Contact our Privacy Officer (section 17).

1. Who we are and what this policy covers

White & Bright Family Dental ("we", "us", "our") is a private dental practice operated by The Trustee for The S.L.F.D Discretionary Trust (ABN 17 565 331 723). This policy applies to all of our clinics.

It explains how we collect, use, store and share personal information and health information about our patients, their parents, guardians and authorised representatives, and people who contact us or use our website.

We handle this information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and the Health Records and Information Privacy Act 2002 (NSW), including the Health Privacy Principles.

2. What information we collect

We collect only the information we reasonably need to care for you and run our practice. Depending on your care, this may include:

Personal and contact details: name, date of birth, address, phone number, email address, emergency contact and preferred contact method.
Health information: medical history, medications, allergies and relevant health conditions.
Dental and clinical records: examination findings, diagnoses, clinical notes, treatment plans, treatment history and consent records.
Clinical imaging: dental X-rays, OPGs, intra-oral and other clinical photographs, and other imaging.
Records from others involved in your care: referrals, specialist correspondence and dental laboratory records.
Claiming and payment information: Medicare number, Child Dental Benefits Schedule (CDBS) eligibility, health fund details, invoices, receipts and payment transaction records.
Appointment information: bookings, attendance, cancellations, recalls, reminders and our communications with you.
Parent, guardian or representative details: name, contact details, relationship to the patient and authority to act.
Website information: details you enter in our online booking or enquiry forms, and the technical information described in section 10.

You can make general enquiries without giving your name or by using a different name where practicable. For treatment, claiming and safe care, we generally need to identify you. If you do not provide information we reasonably need, we may be unable to treat you safely, process claims or contact you about your care.

3. How we collect information

We usually collect information directly from you or your authorised representative, for example through registration and medical history forms, in person, by phone, email or SMS, through online booking and our website enquiry form, and during your appointments (including examinations, X-rays and clinical photographs).

Sometimes we collect information from others where this is reasonable and necessary, such as:

other dentists, specialists, doctors or health services who refer you or are involved in your care;
a parent, guardian, carer or other authorised representative;
Services Australia (Medicare) or your health fund, for example to confirm eligibility;
dental laboratories and imaging providers involved in your treatment;
family members or others in an emergency.

If we collect information about you from someone else, we will take reasonable steps to make sure you are aware of it.

4. Why we collect, use and hold your information

Our main purpose is to provide you with safe and appropriate dental care. We use your information to:

assess, diagnose, plan and provide treatment, and keep accurate clinical records;
contact you about appointments, treatment, recalls, follow-up and your account;
coordinate your care with other health practitioners;
process Medicare, CDBS and health fund claims, invoices and payments;
run our practice, including administration, quality and safety review, clinical audit, staff training, complaint handling and insurance;
meet our legal and professional obligations.

We use or disclose information for another purpose only when you have consented or when the use or disclosure is otherwise permitted or required by law. This may include a directly related purpose you would reasonably expect, or circumstances involving a serious threat to life, health or safety.

5. Who we share your information with

We share information only to the extent needed. Depending on your care, we may share it with:

Our dental team: dentists (including contracted dentists) and authorised clinical and support staff who need information for their work. Our clinics operate as one practice. Team members involved in your care may need to access your records across both locations, subject to applicable confidentiality and access requirements.
Other health practitioners: specialists, doctors, hospitals or other health services involved in your care or to whom you are referred.
Dental laboratories and imaging providers: the details needed to make appliances or provide imaging for your treatment.
Services Australia (Medicare) and health funds: to process claims and confirm eligibility (see section 6).
Payment and transaction providers: to process payments.
Our service providers: practice-management, clinical imaging, IT support, hosting, email, SMS and website service providers who support our operations. We seek to limit the information made available to what is needed for the relevant service and manage disclosures as required by law.
Professional advisers and insurers: where reasonably necessary, for example to manage a complaint or claim.
Regulators and government authorities: where required or authorised by law, such as under a court order, subpoena, mandatory reporting obligation or a request from a health regulator.

Some information sharing is expected as part of your care, such as a referral you have agreed to or work by a dental laboratory. We seek your consent when required and otherwise rely only on grounds for use or disclosure permitted by law. We do not sell your personal information.

6. Medicare, CDBS, health funds and payments

When we claim on your behalf, or you ask us to process a claim, we collect and disclose the details needed for that claim, such as your Medicare or health fund membership details, eligibility, the services provided, dates and fees, to Services Australia or your health fund.

Payments are processed through payment terminals and transaction providers. We keep records of invoices, receipts and payments for our accounting, tax and record-keeping obligations.

7. Your dental records, imaging and our electronic systems

White & Bright Family Dental maintains patient records for care provided at our clinics. Each treating dentist is responsible for making appropriate clinical records and contributes information about the care they provide. Where needed for your care, records may be available to authorised team members at either clinic.

We keep records mainly in electronic form, in our practice-management system (Praktika) and clinical imaging software. Some records, such as signed forms or correspondence, may also be held in paper form.

8. How we protect and store your information

We take reasonable steps to protect your information against misuse, interference, loss and unauthorised access, modification or disclosure. Our safeguards include confidentiality requirements for our team, arrangements intended to restrict access to those with a legitimate work need, and security measures appropriate to the systems and information involved. We regularly review these arrangements.

No system is completely secure. Email and SMS may carry privacy risks; let us know if you prefer another contact method. We assess suspected data breaches and notify affected people and the Office of the Australian Information Commissioner (OAIC) when the Notifiable Data Breaches scheme requires it.

9. How long we keep records

NSW law sets minimum periods for keeping health records. We keep your health information for at least:

Adults: 7 years from the last time we provided you with a health service, if the information was collected when you were 18 or over.
Children: until you turn 25, if the information was collected when you were under 18.

We may retain records for longer when needed for ongoing care or required by another law. Records must be disposed of securely when lawful to do so. NSW law also requires certain details to be recorded when health information is disposed of or transferred to another provider.

We keep website enquiries and other non-clinical information only for as long as reasonably necessary for the relevant purpose and any applicable legal or record-keeping requirements.

10. Our website, online booking, enquiries and cookies

Website hosting. Our website is hosted by Netlify, which keeps short-term technical records of visits (such as IP address and browser) to run the site and keep it secure.

Online booking. Our booking buttons take you to the Praktika online booking system. The booking information you provide is used to arrange and manage your appointment. After booking, you may be directed back to a confirmation page on our website.

Enquiry and callback forms. If you submit a website enquiry, the details you provide are processed by a form service in Sydney, Australia, run for us by our website developer, which keeps no copy and delivers them to our practice email (Google Gmail). Please avoid including detailed medical or dental information in the enquiry form; we can discuss your needs directly when we contact you.

Website measurement. Our website may use Google Tag Manager, Google Analytics and Google Ads conversion measurement to help us understand website use and assess whether advertising leads to enquiries or appointments. These tools can receive information such as pages visited, device and browser details, approximate location and referral sources. Visits to treatment pages may reveal an interest in a health service, which is why we consider privacy carefully when configuring these tools.

Your privacy choices. We seek consent where required before using optional website tracking technologies and provide relevant information about how they operate. You may control cookies through available website controls and your browser. If you have questions about website tracking, please contact our Privacy Officer.

Information minimisation. We take steps to limit the information provided to analytics and advertising services and do not deliberately send patient names, contact details, clinical records, free-text enquiry contents or booking details through our measurement tags. We do not use visits to treatment pages to create treatment-specific remarketing audiences. We review these arrangements as our website changes.

Our website may link to other websites, such as social media pages. We are not responsible for the privacy practices of those websites.

11. Information handled outside Australia

Some external providers may store or process personal information outside Australia. Examples of website and communication services we use include:

Website hosting: Netlify, based in the United States, hosts our website and keeps short-term technical records of visits. Website enquiries are not stored by Netlify; they are processed in Sydney, Australia, and delivered to our practice email.
Practice email and website measurement: Gmail and Google website measurement services may process information in the United States and other countries in which Google operates. The information involved depends on the particular service and settings in use.

We assess overseas information handling by our service providers, including clinical systems, and take the steps required by applicable privacy laws. Where countries of overseas disclosure can reasonably be identified, we update this policy accordingly. You may contact our Privacy Officer for further information.

12. Appointments, reminders and patient communications

We may contact you by phone, SMS, email or letter about appointments and confirmations, check-up and recall reminders, treatment follow-up, care after treatment and accounts. Communications genuinely connected with your care are distinguished from promotional marketing, described in section 13.

We may leave a brief voicemail or SMS with limited details. Please tell us if you prefer a particular contact method, would rather we did not leave messages, or do not wish to receive recall reminders.

13. Marketing, clinical photographs and your consent

Promotional marketing. We seek appropriate consent before sending promotional communications such as offers, newsletters or practice news, and provide a way to opt out. Opting out of promotional communications does not prevent necessary communications about your dental care. We do not use sensitive health information for direct marketing unless permitted by law, including any required consent.

Clinical photographs and images. Clinical photographs and imaging may form part of your dental record and be used for diagnosis, treatment planning, professional communication and monitoring care. We seek separate, informed written consent before using identifiable patient photographs, video or clinical images for website content, social media, advertising or other non-clinical purposes. If an image would be processed by an external AI or editing service, the proposed use and any relevant disclosure must be covered by appropriate consent and privacy arrangements. You may withdraw marketing consent; we will stop future uses and take reasonable steps to remove material from channels we control where practicable.

14. Accessing and correcting your records

Access. You can request access to the personal and health information we hold about you through reception, by phone, email or in writing. We may ask for a written request and will verify your identity before releasing records. We aim to respond within 30 days, and in all cases within any applicable statutory timeframe. If clarification or further time is needed, we will explain the process to you.

Access may be given by viewing your records, receiving copies (including copies of X-rays or images), or a summary. There is no charge to make a request. We may charge a reasonable fee to cover the cost of providing access, such as copying or transferring images; we will tell you about any fee before we proceed, and it will not be excessive.

In limited circumstances allowed by law, we may refuse or limit access, for example where giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect another person's privacy. If so, we will explain why in writing and tell you how to make a complaint.

Transferring records. If you move to another dental practice, we can send copies of your records to your new provider at your written request.

Correction. If you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please tell us. We will take reasonable steps to consider and action your request within a reasonable period. Where correction is refused, we will explain the decision and how you can ask for a statement reflecting your view to be associated with the record.

15. Children, guardians and authorised representatives

A parent or guardian with parental responsibility usually provides information, makes decisions and can request access to records on behalf of a child. We may ask for evidence of parental responsibility, and we ask you to tell us about any court orders that affect who can make decisions or access information for a child.

As young people mature, they may be able to make their own decisions about their care and their information. Where appropriate and lawful, we may speak with a young patient privately and seek their views or consent before sharing their information with a parent or guardian.

For adults who cannot make their own decisions, we deal with a lawfully authorised representative, such as a guardian, person responsible or attorney. We may ask for evidence of that authority.

16. Privacy concerns and complaints

If you have a privacy concern, please contact our Privacy Officer (section 17). Raising it in writing can help us investigate. We will acknowledge and assess the complaint, aim to respond in writing within 30 days, and explain any further steps if it needs more time.

If you are not satisfied with our response, you can contact:

Office of the Australian Information Commissioner (OAIC): oaic.gov.au · 1300 363 992. The OAIC generally expects you to raise your complaint with us first.
Information and Privacy Commission NSW (NSW Privacy Commissioner): ipc.nsw.gov.au · 1800 472 679 · ipcinfo@ipc.nsw.gov.au

For concerns about your dental care that are not about privacy, you can also contact the Health Care Complaints Commission (NSW): hccc.nsw.gov.au · 1800 043 159.

17. Contact us and changes to this policy

Privacy Officer (Practice Manager), White & Bright Family Dental

Email: a.whitebrightfamilydental@gmail.com

Moorebank clinic
95 Nuwarra Road, Moorebank NSW 2170
(02) 9601 5031

Prestons clinic
Shop 6, 1975-1985 Camden Valley Way, Prestons NSW 2170
(02) 9825 0807

A copy of this policy is available free of charge on our website and at reception, and in another format on request. If you need an interpreter, contact the Translating and Interpreting Service (TIS National) on 131 450 and ask them to call us.

We review this policy at least every 12 months and when our information-handling practices materially change. The current approved version will be available on our website and at reception.