Privacy Policy

Who We Are

The Information We Collect

In the course of providing dental care, we collect personal information and health information — health information is treated as "sensitive information" under the Privacy Act and is separately protected under the Health Records Act 2001 (Vic). Depending on your dealings with us, this may include:

• Identity and contact details — name, date of birth, address, phone number, email
• Health information — medical and dental history, current medications and allergies, clinical and treatment notes, X-rays and clinical images, referral and specialist correspondence
• Medicare, DVA and private health fund details, and payment/billing information
• Appointment and booking details, including SMS, email and web chat communications
• Enquiry information submitted through our website's contact or booking forms, or in reply to a missed-call text-back message

We only collect health information that is reasonably necessary to provide safe and effective dental care and to run the Practice.

How We Collect Information

Wherever practicable, we collect information directly from you — for example, when you make a booking, complete a new patient form, attend an appointment, or contact us by phone, SMS, email or our website. Occasionally we may collect information about you from a third party, such as a referring practitioner, your health fund, or Medicare, generally with your consent or as otherwise permitted by law.

Why We Collect, Use and Disclose Your Information

We collect, hold, use and disclose personal and health information for the primary purpose of providing dental treatment and running the Practice, including to:

• assess, diagnose and treat your dental and oral health needs
• make and manage appointments, including reminders and missed-call follow-up
• process payments and Medicare, DVA or private health fund claims
• communicate with you about your care, appointments and recalls
• refer you to, or receive referrals from, other health practitioners involved in your care
• meet our legal, regulatory and professional obligations (for example, to AHPRA and the Dental Board of Australia)
• administer and improve the Practice and our services

We will only use or disclose your health information for a secondary purpose where you would reasonably expect it, where you consent, or where the law otherwise permits or requires it — for example, to lessen or prevent a serious threat to someone's health or safety, or to meet a mandatory reporting obligation.

We do not sell your personal or health information, and we do not disclose it to third parties for their own marketing purposes without your consent.

Sensitive and Health Information — Victorian Health Privacy Principles

Because the Practice is based in Victoria, our handling of your health information is also governed by the Health Records Act 2001 (Vic) and its 11 Health Privacy Principles (HPPs), which operate alongside — not instead of — the APPs. Broadly, the HPPs cover collection, use and disclosure, data quality, data security and retention, openness about our information-handling practices, access and correction, anonymity where practicable, and the interstate/overseas transfer of health information.

Two Victorian-specific rights are worth noting in particular:

• If you ask us to, we will make your health information available to another health service provider you nominate (HPP 11).
• If Preston Dentures is ever sold, transferred, or closes without a successor continuing to provide services, we will take reasonable steps to notify past patients so records can be requested or transferred (HPP 10).

Overseas Disclosure

We use customer relationship and communications platforms to manage bookings, appointment reminders, missed-call text-back and enquiry follow-up. This means personal information you provide — such as your name, phone number, email address and appointment details — may be stored or processed on secure servers located overseas. Clinical health information, such as treatment notes and X-rays, is held only in our dedicated clinical/practice management software, not on these platforms.

Australian Privacy Principle 8 requires us, before disclosing information to an overseas recipient, to take reasonable steps to ensure that recipient does not breach the APPs in relation to your information, unless an exception applies. We have arrangements in place with our service providers directed at protecting your information to a standard consistent with Australian privacy law. By providing your information to us — including through our website, phone system or booking tools — you acknowledge this overseas storage and processing.

Data Quality

We take reasonable steps to ensure the personal and health information we collect, use and disclose is accurate, complete and up to date. Please let us know if your contact or health details change.

Data Security and Retention

We take reasonable steps to protect personal and health information from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes physical security for paper records, access controls and encryption for electronic systems, and confidentiality obligations for our staff.

We retain dental records for a minimum of 7 years from your last appointment. If you were under 18 years of age at your last appointment, we retain your records until you turn — or would have turned — 25. These are minimum periods that apply to health records held in Victoria; we may retain information for longer where the law requires it or there is a genuine clinical or business reason to do so. When records are no longer required, we destroy or de-identify them securely.

Access and Correction

You may ask to access the personal and health information we hold about you, and to have it corrected if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact our Privacy Officer, Dragan Flajnik, using the details above. We will respond within 30 days.

We may charge a reasonable fee to cover the cost of retrieving and copying records, but we will not charge you simply for making the request. There are limited circumstances in which we may need to refuse a request — for example, where giving access would pose a serious threat to someone's health or safety, or as otherwise permitted by law — and if that occurs, we will explain why.

Marketing Communications

From time to time we may send appointment reminders, recall notices, or promotional messages (for example, about new services) by SMS or email. Promotional messages will identify the Practice and provide a way to opt out. If you ask us to stop marketing messages, we will action that request within 5 business days, consistent with the Spam Act 2003 (Cth). Transactional messages, such as appointment confirmations and reminders, may continue after you opt out of marketing unless you ask us to stop these as well.

Anonymity and Pseudonymity

Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym — for example, for a general enquiry. Because dental treatment requires accurate identification for clinical safety, Medicare or health fund claims, and record-keeping, we are generally not able to provide clinical treatment on an anonymous basis.

Data Breaches

Preston Dentures has processes in place to identify, assess and respond to data breaches. As a health service provider, we are covered by the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act regardless of our turnover. If a data breach involving your personal or health information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

Automated Tools and Decision-Making

We may use software tools — including automated messaging and booking systems — to help manage appointments and respond to enquiries. From 10 December 2026, new transparency obligations under APP 1.7 to 1.9 of the Privacy Act will require businesses to disclose, in their privacy policy, any use of personal information in automated decision-making that could reasonably be expected to significantly affect an individual's rights or interests. We will review this policy, and update it if these obligations apply to any tools we use, before that date.

Cookies and Website Analytics

Our website may use cookies and third-party tools, such as Google Analytics and Google Maps, to help us understand how the site is used and to provide directions to our Practice. These tools collect information in accordance with their own privacy policies, which we encourage you to review.

How to Make a Complaint

If you have concerns about how we have handled your personal or health information, please contact our Privacy Officer, Dragan Flajnik, using the details above. We will acknowledge your complaint and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to:

• Office of the Australian Information Commissioner (OAIC) — oaic.gov.au — 1300 363 992
• Health Complaints Commissioner, Victoria (for the handling of health information or care provided in Victoria) — hcc.vic.gov.au — 1300 582 113

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available on our website, and the "last updated" date at the top of this document reflects the most recent revision.

Contact Us

Preston Dentures

324 High Street, Preston VIC 3072, Australia

Email: info@prestondentures.com.au

Phone: (03) 9041 6443