Privacy policy

About this policy

Mount Druitt Dental (we, us and our) respects your privacy. This policy explains how we collect, hold, use and disclose personal information, including sensitive health information, when you visit mountdruittdental.com.au, contact us, book an appointment or receive dental care. It also explains how to access or correct your information and make a privacy complaint.

Our privacy obligations include the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records and Information Privacy Act 2002 (NSW). You can ask us for a free copy of this policy.

Information we collect

We collect information reasonably necessary to provide dental care and operate our practice. Depending on your interaction with us, this may include:

• Identity and contact details: your name, date of birth, address, telephone number, email address, emergency contact and details of an authorised representative.
• Health information: medical and dental history, medications, allergies, symptoms, examination findings, treatment plans, clinical notes, dental images, X-rays, referrals and consent records.
• Appointment and payment information: bookings, attendance, invoices, payment transactions, relevant Medicare or health fund details, and eligibility information for dental benefit programs.
• Communications and website information: enquiries, feedback, complaints, communication preferences, IP address, browser and device information, pages visited and interactions with our website.

How we collect information

We usually collect information directly from you during consultations, telephone conversations, correspondence, patient forms and online bookings. Where appropriate and lawful, we may also obtain relevant information from an authorised representative, referring practitioner, previous treating practitioner, specialist, diagnostic provider, health insurer or government agency.

We generally collect health information with your consent, unless collection without consent is required or permitted by law. Where necessary, we provide additional information when collecting your details. Simply visiting our website does not give blanket consent to unrelated uses of your health information.

You can make general enquiries anonymously or using a pseudonym where lawful and practicable. We usually need accurate identity, contact and health information to provide safe treatment, maintain records and process claims. If you withhold necessary information, we may be unable to provide some services or process a booking or claim.

Why we use your information

We use your information to assess your dental needs, provide and coordinate treatment, arrange referrals, manage appointments, send care reminders and follow up treatment. We also use relevant information to process payments and claims, maintain records, respond to enquiries and complaints, manage practice quality and security, and meet legal and professional obligations.

We use health information for the purpose for which it was collected, a directly related purpose you would reasonably expect, or another purpose with your consent or where the law permits.

Who we share information with

Where necessary and lawful, relevant information may be shared with:

• Our treating practitioners and authorised staff; other healthcare providers, specialists, diagnostic services and dental laboratories involved in your care.
• Service providers supporting our practice, such as booking, practice software, IT, hosting, communications, payment and claims providers.
• Your health fund, Medicare or another government program administrator for an authorised claim or benefit.
• A person you authorise, or a representative legally entitled to act for you.
• Professional advisers, insurers, regulators, courts or other authorities where disclosure is required or permitted by law.

We limit disclosures to information needed for the relevant purpose and require appropriate confidentiality and privacy protections from service providers. Family members do not automatically have access to your information. Other disclosures require your consent unless a legal exception applies, such as a qualifying serious threat to health or safety.

Online bookings and external services

Our website links to Centaur Portal for online bookings. Information you enter into the booking service is handled to arrange and manage your appointment. A booking or payment provider may also collect information directly from you under its own privacy policy.

You can read Centaur Software's privacy policy at centaursoftware.com.au/privacy-policy. Other external websites and services have their own privacy terms. Please review them before providing information. Using an external provider does not remove our obligations for information we collect or control.

Please contact the practice about the appropriate way to send sensitive documents. Avoid sending detailed health information through public comments or social media messages.

Cookies and website tracking

Our website uses Google Tag Manager to manage website tags. Cookies, server logs and similar technologies can support website functionality, security, usage measurement and advertising measurement, depending on the tools enabled.

The services active on this website are:

• Google Analytics (Google) measures how the website is used: pages viewed, referral source, device, browser and approximate location. You can opt out with the Google Analytics opt-out browser add-on.
• Google Ads (Google) measures whether our ads lead to website visits and bookings. A conversion is recorded when a booking link is clicked; it records the click only, not anything you enter in the booking form. Google Ads may also be used to show our ads to people who have visited the website. You can manage ad personalisation in Google's My Ad Center.
• Search Atlas is a website optimisation service. It receives the address of the page you are viewing and can adjust page titles, descriptions and similar page details.
• Cloudflare hosts the website, protects it against attacks and measures page performance (Cloudflare Web Analytics).
• Google Maps shows our location on some pages. When the map loads, Google receives your IP address and browser information.

Website data can include device and cookie identifiers, IP addresses, pages visited, referral sources and actions such as clicking a booking or telephone link. This information is not necessarily anonymous and may reveal an interest in a health service.

Where consent is required for tracking or the collection, use or disclosure of sensitive information, we seek that consent separately. We do not treat acceptance of this policy as consent to all tracking. You can manage cookies through your browser and use available provider privacy controls. Blocking cookies may affect some website features; it does not necessarily stop every form of tracking.

Communications and marketing

We may contact you about bookings, treatment, recalls, accounts and other matters connected with your care. Tell us if you have a preferred contact method or concerns about messages being seen by someone else.

Promotional communications are separate from care communications. We seek your consent before using or disclosing health information for direct marketing. You can withdraw marketing consent using the unsubscribe option provided or by contacting us. This does not prevent you from receiving care. Separate express consent is sought before using identifiable clinical photographs for promotional purposes.

Storage and security

We hold information in electronic systems and, where used, paper records at our practice or with service providers. We take reasonable technical and organisational steps to protect it against misuse, interference, loss and unauthorised access, modification or disclosure. These include restricting access to people who need it for their role, protecting records and systems, and requiring confidentiality from staff and relevant service providers.

If a data breach occurs, we assess and respond to it and notify affected individuals and regulators where required by law.

Information handled outside Australia

Some of the services our website uses store or process information outside Australia:

• Google (Google Analytics, Google Ads and Google Maps) may store and process website usage data, such as pages visited and clicks on booking or telephone links, outside Australia.
• Cloudflare runs a global network, so website traffic may pass through servers outside Australia.
• Search Atlas receives the addresses of pages viewed and may process them outside Australia.

Where we disclose personal information overseas, we take reasonable steps required by Australian privacy law to protect it, unless a lawful exception applies. Transfers of health information outside NSW must also meet the applicable NSW requirements. Publishing this policy does not, by itself, amount to your consent to an overseas disclosure.

How long we keep information

We retain information for as long as needed for its lawful purpose and applicable recordkeeping requirements. For NSW health records, the minimum periods generally include seven years from the last health service where information was collected when the patient was an adult, and until the patient turns 25 where information was collected while they were under 18.

Records may need to be kept longer for ongoing care, other legal obligations or legal proceedings. When information is no longer needed and retention is not required, we take reasonable steps to securely destroy or de-identify it, subject to applicable disposal requirements. We cannot delete records we are legally required to keep.

Accessing and correcting information

Contact us using the details below to request access to information we hold about you or to request a correction. We may need to verify your identity and a representative's authority. We respond within the applicable legal timeframe, generally within 30 calendar days.

There is no fee to make a request or to correct your information. A reasonable fee for providing access or copies may apply where lawful; we will explain any fee in advance. If we refuse access or a correction, we provide written reasons, except where the law allows otherwise, and explain your complaint options. If we decline a correction, you can ask us to attach a statement of your position to the record.

Children and authorised representatives

We consider a young person's capacity to understand and make privacy decisions. Where appropriate, we work with a parent, guardian or legally authorised representative. Access and consent decisions take account of the patient's capacity, the representative's authority, any relevant court orders and applicable law.

Privacy questions and complaints

For privacy questions, access or correction requests, or complaints, contact:

Practice Manager
Mount Druitt Dental
8 Mount Druitt Road, Mount Druitt NSW 2770
Telephone: (02) 9677 1172
Website: https://mountdruittdental.com.au/

Please describe what happened, when it happened and the outcome you are seeking. We will acknowledge your complaint, review the relevant records and speak with the people involved as needed. We aim to provide a written response within 30 days and will explain any delay.

If you are dissatisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints or call 1300 363 992 for assistance. You can also contact the Information and Privacy Commission NSW about health privacy concerns at ipc.nsw.gov.au or on 1800 472 679.

Changes to this policy

We review this policy as our services, practices or legal obligations change. The current version will be available on our website and from the practice. Where a change requires your consent or an additional notice, we will address that separately.