Privacy Policy

1. Introduction

School Smile Australia (“School Smile Australia”, “we”, “our” or “us”) is committed to protecting the privacy, confidentiality and security of personal information, including health information, that we collect, hold, use and disclose in connection with our website, school-based dental programs and dental services.

This Privacy Policy explains how we manage personal information and health information in accordance with applicable Australian privacy and health records laws, including:

• the Privacy Act 1988 (Cth);
• the Australian Privacy Principles (“APPs”);
• the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth);
• the Health Records Act 2001 (Vic), where applicable;
• other applicable State and Territory health records legislation, where relevant;
• the My Health Records Act 2012 (Cth), where applicable;
• the Spam Act 2003 (Cth);
• the Competition and Consumer Act 2010 (Cth), including the Australian Consumer Law; and
• applicable professional standards, codes and guidelines issued by the Dental Board of Australia and the Australian Health Practitioner Regulation Agency.

2. What Information We Collect

We collect personal information and health information that is reasonably necessary for our business functions, healthcare services and legal obligations.

The information we collect may include:

• the name, date of birth and contact details of a student or patient;
• parent, guardian or authorised representative details;
• emergency contact details;
• school details and class or year level information;
• Medicare details;
• Child Dental Benefits Schedule (“CDBS”) eligibility and claiming information;
• private health insurance details, where applicable;
• medical history;
• dental history;
• allergy information;
• medication information;
• treatment notes and clinical records;
• dental charts;
• radiographs, including X-rays;
• clinical photographs;
• consent forms;
• appointment and attendance records;
• billing and payment information;
• correspondence with parents, guardians, schools, healthcare providers or government agencies; and
• website usage information, including cookies and analytics data.

Health information is sensitive information under the Privacy Act 1988 (Cth). We collect sensitive information only where we are permitted to do so by law, including where consent has been provided or where collection is reasonably necessary for the provision of dental or healthcare services.

3. How We Collect Information

We may collect personal information and health information directly from:

• parents or legal guardians;
• patients, including children where appropriate;
• authorised representatives;
• online forms;
• paper consent forms;
• electronic consent forms;
• telephone, email or SMS communications;
• dental examinations and treatment appointments; and
• our website.

We may also collect information from third parties where it is lawful and reasonably necessary, including from:

• schools, for administrative and logistical purposes;
• Services Australia, Medicare or CDBS systems;
• referring or treating healthcare providers;
• dental specialists;
• dental laboratories;
• insurers;
• payment providers; and
• government agencies, where required or authorised by law.

Where practicable, we collect personal information directly from the individual, parent or legal guardian.

4. Children’s Information

Our services are often provided to children in school settings. We take additional care when collecting, using, storing and disclosing information about children.

Information about a child is generally collected from a parent or legal guardian. In some circumstances, information may also be collected directly from the child where appropriate, having regard to the child’s age, maturity and capacity to understand the circumstances.

We may collect limited information from schools for administrative purposes connected with the delivery of dental services, such as student name, class, attendance arrangements and logistical information. We will not disclose detailed clinical information to a school unless:

• a parent, legal guardian or authorised person has consented;
• disclosure is required or authorised by law;
• disclosure is necessary to prevent or lessen a serious risk to health or safety; or
• another lawful basis applies.

5. Consent

We generally provide dental treatment to children only after informed consent has been obtained from a parent or legal guardian, unless treatment is otherwise permitted by law.

Consent may be obtained through:

• electronic forms;
• paper forms;
• secure online forms;
• written email confirmation; or
• another appropriate written method.

Consent to dental treatment is separate from consent for other uses of information. We will obtain separate consent where required, including for:

• use of identifiable clinical photographs for non-clinical purposes;
• testimonials or promotional material;
• disclosure of clinical information to schools, except where otherwise permitted by law;
• direct marketing, where required; and
• participation in any additional program or service not covered by the original consent.

A parent, guardian or patient may withdraw consent where permitted by law. Withdrawal of consent may affect our ability to provide some services.

6. Purposes for Which We Use Information

We may use personal information and health information for purposes including:

• providing dental examinations, advice and treatment;
• assessing oral health and treatment needs;
• maintaining clinical records;
• communicating with parents, guardians, patients and schools;
• arranging school-based dental visits;
• confirming appointments and attendance;
• processing Medicare and CDBS claims;
• processing private health insurance claims;
• billing and payment administration;
• referrals to dental specialists or other healthcare providers;
• obtaining advice from professional advisers;
• managing complaints, incidents or clinical concerns;
• complying with legal, regulatory and professional obligations;
• participating in audits, quality assurance and risk management;
• improving our services and systems;
• protecting patient safety; and
• responding to lawful requests from courts, tribunals, regulators or government agencies.

We will not use personal information for a purpose unrelated to the purpose for which it was collected unless the individual has consented or the use is otherwise permitted by law.

7. Disclosure of Information

We may disclose personal information and health information where reasonably necessary for the provision of dental services, business administration or compliance with legal obligations.

This may include disclosure to:

• treating dentists, oral health therapists, dental hygienists and dental assistants;
• dental specialists;
• medical practitioners or other healthcare providers;
• dental laboratories;
• radiology providers;
• Services Australia, Medicare and CDBS;
• private health insurers, where applicable;
• schools, for administrative purposes only, unless further disclosure is authorised;
• parents, legal guardians or authorised representatives;
• IT, cloud storage, software and practice management system providers;
• payment processors;
• professional advisers, including lawyers, accountants and insurers;
• regulators, including AHPRA or the Dental Board of Australia, where required;
• government agencies, where required or authorised by law;
• courts, tribunals or dispute resolution bodies; and
• emergency services or other persons where necessary to prevent or lessen a serious risk to health or safety.

We do not sell personal information.

8. Information Shared with Schools

Where we provide dental services in a school setting, we may communicate with the relevant school for administrative and logistical purposes, including:

• arranging visit dates;
• coordinating appointment times;
• confirming attendance;
• distributing or collecting consent forms;
• ensuring student supervision and safety during attendance; and
• managing practical arrangements for the delivery of services.

Unless authorised, we will not provide schools with detailed clinical information, treatment records, diagnostic information, radiographs, clinical photographs or Medicare/CDBS claim details.

9. Medicare, CDBS and Government Claims

Where a patient is eligible for Medicare-funded or CDBS-funded services, we may collect, use and disclose relevant information to:

• verify eligibility;
• process claims;
• submit payment requests;
• respond to audits;
• correct claiming errors;
• comply with Services Australia, Medicare or CDBS requirements; and
• meet legal and regulatory obligations.

This may include disclosure of identifying information, treatment details, provider details and claim information.

10. My Health Record

Where applicable, we may access, use or disclose information through the My Health Record system in accordance with the My Health Records Act 2012 (Cth) and applicable access controls.

We will only access or upload information to My Health Record where permitted by law and where it is relevant to the patient’s healthcare.

11. Website, Cookies and Analytics

Our website may use cookies and similar technologies to improve functionality, measure website traffic and understand how users interact with our website.

We may use services such as:

• Google Analytics;
• Google Tag Manager; and
• other website analytics or performance tools.

Cookies may collect information such as browser type, device information, pages visited, time spent on the website and general location information.

Users may disable cookies through their browser settings. Some website functions may not operate properly if cookies are disabled.

12. Direct Marketing and Electronic Communications

We may send service-related communications, including appointment reminders, consent form reminders, treatment follow-up messages and administrative notices.

We will only send direct marketing communications where permitted by the APPs and the Spam Act 2003 (Cth). Individuals may opt out of marketing communications at any time by using the unsubscribe function or contacting us.

We will not use a child’s health information for marketing purposes without appropriate consent.

13. Storage and Security of Information

We take reasonable steps to protect personal information and health information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.

Our security measures may include:

• secure electronic practice management systems;
• encrypted cloud storage;
• password-protected systems;
• multi-factor authentication where available;
• restricted staff access;
• staff confidentiality obligations;
• secure backups;
• antivirus and malware protection;
• secure disposal of hard copy records;
• secure deletion or de-identification of electronic records; and
• internal privacy and confidentiality procedures.

No method of electronic transmission or storage is completely secure. However, we take reasonable steps to maintain appropriate safeguards having regard to the nature and sensitivity of the information we hold.

14. Overseas Disclosure

Some of our technology, cloud storage, email, analytics, payment or practice management service providers may store or process information outside Australia.

Where personal information is disclosed to an overseas recipient, we will take reasonable steps to ensure that the recipient handles the information in a manner consistent with the APPs, unless an exception applies under the Privacy Act 1988 (Cth).

Where practicable, we will identify the countries in which overseas recipients are likely to be located. These countries may depend on the service providers used from time to time.

15. Data Retention

We retain clinical records, personal information and health information for as long as required by law, professional obligations and legitimate business purposes.

Retention periods may differ depending on:

• the State or Territory in which services are provided;
• whether the patient is a child or an adult;
• applicable limitation periods;
• health records legislation;
• Medicare, CDBS or audit requirements; and
• professional obligations applying to dental practitioners.

Records relating to children may need to be retained for longer periods, including after the child reaches adulthood.

When information is no longer required, we will take reasonable steps to securely destroy it or permanently de-identify it, unless we are required or permitted by law to retain it.

16. Access to Personal Information

An individual may request access to personal information or health information that we hold about them.

For children, access may be requested by a parent or legal guardian. In some circumstances, we may need to consider the child’s age, maturity, capacity, privacy interests and any applicable legal requirements before providing access.

We may refuse access in limited circumstances permitted by law, including where:

• providing access would pose a serious risk to health or safety;
• access would unreasonably impact another person’s privacy;
• the request is frivolous or vexatious;
• the information relates to existing or anticipated legal proceedings;
• access would reveal commercially sensitive decision-making information; or
• another legal basis for refusal applies.

We may require proof of identity before providing access.

17. Correction of Personal Information

We take reasonable steps to ensure that the personal information and health information we hold is accurate, up to date, complete, relevant and not misleading.

An individual may request correction of their information if they believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

If we refuse to correct information, we will provide reasons where required by law and may attach a statement to the record noting that correction was requested.

18. Data Breaches

If we become aware of a suspected or actual data breach involving personal information or health information, we will assess the incident in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

Where we determine that an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

We may also take steps to contain the breach, reduce potential harm, investigate the cause and improve our systems or procedures.

19. Complaints

If an individual believes that we have breached privacy obligations or mishandled personal information, they may contact us using the details below.

We will:

• acknowledge the complaint within a reasonable time;
• investigate the complaint;
• request further information if required;
• provide a response within a reasonable period; and
• take appropriate corrective action where necessary.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, technology or business practices.

The updated version will be published on our website or otherwise made available. The effective date at the beginning of the policy will indicate when the policy was last updated.

21. Contact Us

Privacy Officer

School Smile Australia

Email: info@schoolsmilesaustralia.com.au

Phone: 0494 585 885