Privacy Policy

Introduction

This privacy policy provides information to you, our patient, on how your personal information (which includes your health information) is collected and used within our practice, and the circumstances in which we may share it with third parties.

Why and when your consent is necessary

When you register as a patient of our practice, you provide consent for our dental practitioners and practice staff to access and use your personal information so they can provide you with the best possible dental care. Only staff who need to see your personal information will have access to it.  If we need to use your information for anything else, we will generally seek additional consent from you to do this, unless obtaining your consent is not practical or reasonable, and an exception under the Privacy Act 1988 (Cth) applies.

Why do we collect, use, hold and share your personal information?

Our practice will need to collect your personal information to provide dental services to you. Our main purpose for collecting, using, holding and sharing your personal information is to manage your dental health. We also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (e.g. staff training).

What personal information do we collect?

The information we will collect about you includes your:

• name/s, date of birth, address/es, contact details (e.g. telephone, email), family contact information
• details of your oral health condition and the treatment/s and service/s you have received
• details of your general health (e.g. medications, allergies, medical conditions) and medical history that may impact the dental treatment you receive
• private health insurance information
• Medicare number for claiming purposes where relevant
• information regarding other funding sources, where relevant (e.g. Department of Veterans’ Affairs)
• information on workers’ compensation, motor vehicle and other accident claims, where relevant
• healthcare identifiers, where relevant.

Dealing with us anonymously

We recognise your right, where lawful and practicable, to interact with us anonymously or by using a pseudonym, in accordance with the Australian Privacy Principles.

You may choose not to identify yourself, or to use a pseudonym, when making general enquiries, requesting information about our services, or interacting with us in ways that do not require us to verify your identity.

However, in most circumstances we will need to collect your full name and other identifying details in order to provide you with dental care and related services. This includes situations such as creating and maintaining accurate clinical records and bookings; communicating with you about your treatment; processing payments or private health insurance claims; and complying with legal and regulatory obligations.

If you choose to remain anonymous or use a pseudonym in circumstances where identification is required, we may be unable to provide you with certain services or may need to limit the assistance we offer.

If you have questions about when you can remain anonymous or use a pseudonym, please contact us and we will advise you based on your specific situation.

How do we collect your personal information?

Our practice may collect your personal information in several different ways.

1. When you make your first appointment our practice staff will collect your personal information via your registration.
2. During the course of providing dental services, we may collect further personal information.

We may also collect your personal information when you visit our website, send us an email or SMS, telephone us, make an online appointment or communicate with us using social media.

3. In some circumstances personal information may also be collected from other sources. Often this is because it is not practical or reasonable to collect it from you directly. This may include information from:

• your guardian or responsible person
• other involved healthcare providers, such as specialists and diagnostic imaging services
• your health fund, Medicare, or the Department of Veterans’ Affairs (as necessary).

When, why and with whom do we share your personal information?

We sometimes share your personal information:

• with third parties who work with our practice for business purposes, such as information technology providers – these third parties are required to comply with APPs
• with other healthcare providers
• when it is required or authorised by law (e.g. court subpoenas)
• when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
• to assist in locating a missing person
• to establish, exercise or defend an equitable claim
• for the purpose of confidential dispute resolution process
• when there is a statutory requirement to share certain personal information (e.g. some diseases require mandatory notification)

Only people who need to access your information will be able to do so. Other than in the course of providing dental services or as otherwise described in this policy, our practice will not share personal information with any third party without your consent.

Our practice will not use your personal information for marketing any of our goods or services directly to you without your express consent. If you do consent, you may opt out of direct marketing at any time by notifying our practice in writing.

How do we store and protect your personal information?

We take reasonable steps to protect the personal information that we hold from misuse, interference, loss, unauthorised access, modification, or disclosure, in accordance with the Australian Privacy Principles.

The personal information we store may include: identifying details, health information and clinical records (including medical and dental history, treatment plans, notes, x-rays, photographs and 3D models or scans), payment and billing information, private health insurance details and correspondence and communications with you (including email and appointment records).

Health information is considered sensitive information under Australian privacy law and is handled with a higher level of protection.

How Information is Stored

Your personal information may be stored in both electronic and physical formats, including:

• secure practice management software and electronic health record systems
• encrypted digital storage systems and backups
• paper-based records stored in secured filing systems
• third-party party service providers (such as IT support, cloud storage, or practice management platforms), who are required to comply with strict privacy and security obligations.

We implement a range of security measures, including password protection, user access controls, data encryption, secure premises and staff training to safeguard your information.

Staff and Contractor Confidentiality

All staff members, contractors and third-party service providers engaged by our practice are required to maintain confidentiality of personal information. This includes:

• signing confidentiality and privacy agreements as a condition of employment
• complying with our privacy and data protection policies
• accessing personal information only where necessary to perform their duties
• undertaking training in privacy obligation and the secure handling of personal and health information.

We take breaches of confidentiality seriously and will take appropriate action in the event of any unauthorised access, use or disclosure of personal information.

Retention and Disposal

We retain personal information for as long as required by law and professional standards (usually a minimum of 7 years). When it is no longer required, we take reasonable steps to securely destroy or de-identify the information.

Overseas Disclosure and Cloud Storage

We use reputable third-party service providers to assist with the operation of our practice, including cloud-based storage, data backup, email, and information technology services.

These providers may include Google and CrashPlan. As a result, personal information that we collect and hold may be stored, processed, or backed up on servers located outside of Australia. The countries in which such information is stored or processed may vary from time to time depending on the service provider’s infrastructure and business operations.

We take reasonable steps to ensure that any overseas recipients of personal information handle that information in a manner consistent with Australian privacy laws and maintain appropriate security measures (e.g. secure, encrypted data centres) to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

By providing your personal information to us, you acknowledge that your information may be disclosed to overseas service providers for storage, backup, and processing purposes in accordance with this Privacy Policy.

We do not sell patient information to third parties.

Website Analytics, Cookies and Digital Communications

Our practice is committed to protecting your privacy in all digital interactions, including when you visit our website, engage with us via social media, or communicate with us electronically.

• Website Usage and Analytics: When you visit our website, we may collect non-identifiable information about your interaction with the site. This may include your IP address, browser type, device information, pages visited, time spent on pages, and referring websites. This information is collected for the purpose of improving website functionality, user experience and service delivery.

We may use third-party analytics tools (such as Google Analytics or similar services) to assist in understanding website traffic and usage patterns. These services may use cookies and similar technologies to collect and analyse information. The data collected is generally aggregated and does not identify you personally.

• Cookies: Our website may use cookies to enhance your browsing experience. Cookies are small data files stored on your device that help us recognise repeat visitors, remember preferences and optimise site performance.

You can control or disable cookies through your browser settings. However, doing so may affect the functionality and performance of the website.

• Social Media Interactions: We may engage with patients and the public through social media platforms. Any information you choose to share on these platforms is subject to the privacy policies of the respective social media providers.

We advise that you do not share personal health information via social media messaging or public posts. While we may respond to general enquiries, we will not provide clinical advice or discuss personal health matters through these channels.

• Email and Electronic Communication: When you contact use via email or other electronic means, we may collect and store the information you provide, including your name, contact details and the content of your message. This information is used to respond to your enquiry and to provide services where appropriate.

While we take reasonable steps to protect information transmitted electronically, you acknowledge that email and other online communications may not be completely secure. We recommend that sensitive or confidential health information be communicated via more secure methods where possible.

How can you access and correct your personal information at our practice?

You have the right to request access to, and correction of, your personal information.

Our practice acknowledges patients may request access to their dental records. All requests for access (other than straightforward requests for copies of test or treatment results made to your dentist during your consultation) should be made in writing using a Request for Release of Dental Healthcare Records Form. These forms can be obtained in person at reception or sent to you via email. Please email reception@humptydoodental.com.au to request a form. Requests for access will be acknowledged by the practice within 7 days of receipt of the request. Records will be provided within 30 days of receipt of the request. Where it is not possible for access to be granted within 30 days, the patient will be notified/advised when and if access will be granted. Where access is refused, the patient will be advised in writing of the reasons for refusal. This will include any information about other means by which access may be facilitated.

Please note a fee may be charged to patients for access and release of health care records to cover costs of complying with the request.

Our practice will take reasonable steps to correct your personal information where the information is not accurate or up to date. From time to time, we will ask you to verify that your personal information held by our practice is correct and current. You may also request that we correct or update your information, and to assist us with attending to your request we would prefer you to make such requests in writing to the Privacy Officer (reception@humptydoodental.com.au ).

How can you lodge a privacy-related complaint, and how will the complaint be handled at our practice?

We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing. We will then attempt to resolve your issue/s in accordance with our resolution procedure. You may do so by contacting our Privacy Officer.

Email: reception@humptydoodental.com.au

Postal Address: Privacy Officer

Humpty Doo Dental

PO Box 119, Humpty Doo NT 0836

Phone: (08) 89885050

We will respond to your correspondence within 30 days.

You may also contact the Office of the Australian Information Commissioner (OAIC).  The OAIC may decide not to investigate your complaint if you have not raised it with the practice first.  If you have lodged a complaint with us, and we have not responded within 30 days or you are dissatisfied with our response, you may then take your complaint to the OAIC. For further information visit www.oaic.gov.au or call the OAIC on 1300 363 992.

Policy review statement

We are committed to ensuring that our Privacy Policy remains accurate, up to date, and reflective of our legal and operational obligations.  This Privacy Policy is reviewed periodically and may be updated from time to time to account for:

• Changes in applicable laws and regulations, including the Australian Privacy Principles.
• Updates to our business practices, systems, or services
• Developments in technology or information security standards.

Any updated version of this Privacy Policy will be made available on our website and at our practice. The revised version will take effect from the date of publication.

We encourage you to review our Privacy Policy regularly to stay informed about how we manage and protect your personal information.

If you have any questions about this Privacy Policy or any updates, you may contact the Privacy Officer using the details provided in this document.