Privacy policy

This Privacy Policy explains how this dental practice (the Practice, we, us, our), operated by Averra Dental Pty Ltd, collects, holds, uses and discloses personal information, including health information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and by the health records legislation that applies in the state or territory where the Practice is located, including the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Health Records (Privacy and Access) Act 1997 (ACT) where applicable. Because we are a health service provider, the Privacy Act applies to us regardless of our annual turnover.

1. What personal information we collect

We collect only the information we reasonably need to provide you with safe dental care and to run the Practice. This may include:

• Identity and contact details: your name, date of birth, gender, address, phone number, email address and emergency contact details.
• Health information: your dental and medical history, current medications, allergies, clinical notes, radiographs (x-rays), photographs, scans, impressions and 3D models, treatment plans, referrals, specialist reports, consent forms and details of treatment provided.
• Government identifiers: your Medicare card number (only for Child Dental Benefits Schedule claims or Medicare-related services), Department of Veterans' Affairs number and, where relevant, NDIS participant number. We do not use these identifiers as our own patient identifiers.
• Payment and insurance details: private health fund name and member number, payment history, invoices, receipts and, where you use a payment plan provider, the information needed to process that arrangement.
• Communication records: emails, SMS, web form submissions, phone call notes and feedback or complaints.
• Website and technical data: IP address, device and browser type, pages visited and referring site, collected through cookies and similar technologies as described in our Cookie and Tracking Statement.
• Security footage: some clinics use CCTV in reception and common areas for safety and security. Signs are displayed where cameras operate.

2. How we collect personal information

We collect personal information directly from you wherever reasonable and practicable: when you book an appointment (online, by phone or in person), complete our new patient and medical history forms, attend appointments, speak with our team, pay for services, or contact us through this website. We may also collect information from other sources where necessary for your care, including other health practitioners who refer you or treat you, your health fund or Medicare for claiming purposes, a parent, guardian or carer where you are a child or unable to provide information yourself, and the My Health Record system where you have one and have not restricted our access.

If you give us personal information about another person (for example, a family member or emergency contact), you confirm that you are authorised to do so and that they are aware of this Privacy Policy.

3. Why we collect, use and disclose your information

We collect, hold, use and disclose your personal information for the primary purpose of providing you with dental care, and for directly related purposes that you would reasonably expect. These include:

• Assessing, diagnosing, planning, delivering and reviewing your dental treatment.
• Communicating with you about appointments, recalls, treatment plans, results and account matters.
• Referring you to, and receiving reports from, dental specialists, general practitioners, pathology and radiology providers, dental laboratories and other health professionals involved in your care.
• Processing payments, health fund claims (including through HICAPS or similar electronic claiming terminals), Medicare claims, DVA claims and payment plan arrangements.
• Managing our practice, including quality assurance, clinical audit, accreditation, staff training and supervision, infection control records and incident investigation.
• Meeting our legal and professional obligations, including record keeping under the Dental Board of Australia guidelines, mandatory notifications, responding to subpoenas, court orders or lawful requests from regulators, and notifiable disease reporting.
• Managing complaints, claims and legal proceedings, including liaising with our professional indemnity insurer and legal advisers.
• Sending you practice updates, oral health information and service offers where you have agreed to receive them (see section 7).

We will not use or disclose your health information for any other purpose unless you consent, we are required or authorised by law, or a permitted general situation or permitted health situation under the Privacy Act applies (for example, to lessen or prevent a serious threat to life, health or safety).

4. Who we disclose your information to

Depending on your care, we may disclose relevant personal information to:

• Other dental practitioners, dental specialists, hygienists, oral health therapists and health practitioners involved in your care, including other clinics within the Averra Dental group when your care is shared or transferred between them.
• Dental laboratories and 3D printing or aligner manufacturers that fabricate crowns, bridges, dentures, splints, aligners and other appliances for you.
• Medicare, the Department of Veterans' Affairs, your private health fund and the NDIS, for the purpose of claiming and verifying benefits.
• Payment processors, banks and payment plan providers, where you choose to pay by those methods.
• Our practice management software, cloud hosting, imaging, online booking, secure messaging, SMS and email service providers, who store or process information on our behalf under contractual confidentiality and security obligations.
• Our professional advisers, including lawyers, accountants, auditors and our professional indemnity insurer.
• Regulators, courts, tribunals, the Australian Health Practitioner Regulation Agency (AHPRA), health complaints commissioners and government agencies where required or authorised by law.
• A person responsible for you (such as a parent, guardian or carer) where you are unable to consent and the disclosure is necessary for your care.

We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes.

5. Overseas disclosure

Your clinical records are stored in Australia. Some of the technology providers we use (for example cloud backup, email, website hosting, online forms and analytics) may store or process limited data on servers located outside Australia, including in the United States, the United Kingdom, Singapore and the European Union. Where this occurs, we take reasonable steps to ensure the provider is bound by contractual obligations to protect your information in a way that is substantially similar to the Australian Privacy Principles, or we obtain your consent. Where a dental laboratory outside Australia is used to manufacture an appliance for you, only the information necessary for fabrication is sent, and we will tell you before treatment if that applies.

6. Data quality and security

We take reasonable steps to ensure the personal information we hold is accurate, complete and up to date, and we ask you to confirm your details at appointments. We protect your information from misuse, interference, loss, unauthorised access, modification or disclosure through measures including: access controls and unique logins for each team member, role-based access to clinical systems, encryption of data in transit and at rest where supported, secure cloud backups, multi-factor authentication on key systems, confidentiality obligations for all staff and contractors, secure storage and destruction of paper records, and regular review of our security practices.

No method of transmission over the internet or electronic storage is completely secure. If you contact us by email or web form, be aware that unencrypted email can be intercepted; please do not send detailed health information by email unless you are comfortable with that risk.

7. Marketing and communications

We may send you appointment reminders, recall notices and information directly related to your care by SMS, email, phone or post. These are service messages, not marketing, and you can tell us your preferred channel at any time. We will only send you marketing communications (such as newsletters, oral health tips or special offers) where you have opted in, or where you would reasonably expect it and we obtained the information directly from you. Every marketing email or SMS includes a simple way to unsubscribe, and you can also opt out by emailing privacy@averradental.com.au. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

8. Data retention

We keep dental records for at least the period required by the Dental Board of Australia guidelines and applicable state and territory law. In general this means at least 7 years from the date of your last treatment, or, for patients who were under 18 at the time of treatment, until they turn 25, whichever is longer. Radiographs, models, photographs and consent forms are kept as part of your record. When records are no longer required, we destroy or permanently de-identify them securely.

9. Access to and correction of your information

You have the right to request access to the personal information we hold about you and to ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, email privacy@averradental.com.au or ask our reception team. We will need to verify your identity before releasing information. We will respond within 30 days. We may charge a reasonable fee to cover the cost of copying and providing records (for example, printing radiographs or transferring a full record to another practice), and we will tell you the fee before we proceed. In limited circumstances permitted by law we may refuse access (for example, where access would pose a serious threat to someone's life, health or safety); if so, we will tell you why in writing and how you can complain.

If you move to another practice, we can send a copy of your record directly to that practice on your written authority. The original record remains with us as required by law.

10. My Health Record

Where you have a My Health Record and our clinical systems are connected, we may view relevant information in it and upload a dental event summary unless you ask us not to. You can control what is uploaded and who can see your record through the My Health Record system itself. Tell us if you do not want us to upload information.

11. Children and people unable to consent

Where a patient is under 18, we generally deal with a parent or guardian, but we also respect the growing capacity of young people to make decisions about their own health care and their own privacy. Where a patient of any age does not have the capacity to consent, we deal with a person responsible for them as permitted by law. We take particular care with children's information and do not use it for marketing.

12. Automated decision-making

We do not use computer programs to make decisions that significantly affect your rights or interests without a human involved. Automated tools we use are limited to functions such as appointment scheduling, reminder messaging, recall scheduling based on your recommended review interval, and claim processing with your health fund. All clinical decisions about your diagnosis and treatment are made by a registered dental practitioner.

13. Notifiable data breaches

If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and we will tell you what happened and what you can do to protect yourself.

14. Website, cookies and third-party links

Our website uses cookies and similar technologies as described in our Cookie and Tracking Statement. The website may contain links to third-party sites, including online booking platforms, health funds and payment plan providers. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

15. Anonymity and pseudonymity

You may deal with us anonymously or under a pseudonym when making general enquiries. Because we must keep accurate clinical records and verify identity for Medicare and health fund claims, it is not practicable for us to provide dental treatment to you anonymously.

16. How to make a privacy complaint

If you are concerned about how we have handled your personal information, email privacy@averradental.com.au with details of your concern. We will acknowledge your complaint promptly, investigate it, and respond in writing within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by phone on 1300 363 992, or to the health or privacy complaints body in your state or territory (such as the NSW Information and Privacy Commission, the Health Complaints Commissioner in Victoria, or the Office of the Health Ombudsman in Queensland).

17. Changes to this policy

We review this Privacy Policy at least every 12 months and may update it from time to time. The current version is always available on this website, and material changes will be displayed in the Practice and notified on the website at least 30 days before they take effect where practicable.

18. Contact

Privacy enquiries, access and correction requests and complaints: privacy@averradental.com.au. The Practice's street address and phone number appear on the Contact page of this website.