Privacy policy

Information we collect

Depending on your interaction with us, information may include:

• Your name, date of birth, contact details, emergency contact and relevant identification or health-fund details.
• Medical and dental history, medicines, allergies, symptoms, examination findings, diagnoses, treatment plans, consent records and correspondence about your care.
• Clinical photographs, radiographs, intra-oral images and digital scans when relevant to assessment, treatment planning or monitoring.
• Appointments, accounts, payments, insurance claims and communications with the practice.
• Information you provide through an enquiry, online booking, job application or other direct interaction with us.

We usually collect information from you or a person you authorise. With your consent, or another lawful basis, we may obtain relevant records from a previous dentist, specialist or other treating practitioner. We collect sensitive health information with consent where required, or where a legal exception applies, such as a serious threat to health or safety.

You can make a general enquiry without identifying yourself where practical. For treatment, we need sufficient accurate information to identify you, maintain a clinical record and provide safe care. Choosing not to provide relevant information may limit the care or assistance we can offer.

How we use & share information

We use information to assess and treat you, coordinate care, manage appointments and accounts, process claims, maintain records and meet our legal and professional responsibilities.

Relevant information may be shared with your treating dentist, other practitioners involved in your care, dental laboratories, imaging providers, insurers or payment and technology providers where necessary and lawfully permitted. We aim to share only what is reasonably needed for the purpose. We seek consent where required, including for disclosures outside the purposes for which information was collected and your reasonable expectations.

Information may also be disclosed where required or authorised by law, for example under a valid court order, mandatory reporting obligation or a permitted response to a serious health or safety threat. We do not sell patient health information.

Clinical photographs & consent

Photographs, radiographs and digital scans taken for your care form part of your confidential health record. They can help explain findings, plan treatment and monitor changes over time.

Consent to treatment or clinical imaging is not consent to publish your images. Before using an identifiable patient image for our website, social media or other promotional material, we seek separate, specific written informed consent. Choosing not to participate does not affect your care.

You can withdraw consent for future promotional use by contacting us. We will discuss what can be removed from channels we control and any practical limits, such as printed material already distributed or copies shared by others. Withdrawal does not require deletion of images that must remain in your clinical record.

Security, storage & retention

We use Dental4Web (D4W), provided by Centaur Software, for our practice’s cloud-based patient records. Centaur’s published D4W security information confirms that its D4W patient data and backups are hosted in Australia.

We take reasonable steps to protect information against loss, misuse and unauthorised access, alteration or disclosure. These include access controls, staff confidentiality obligations, secure handling of paper records and appropriate technology and backup arrangements. Authorised service providers may need access to support the systems we use. No system can guarantee absolute security.

Under Victorian health-record requirements, adult patient records are generally retained for at least seven years after the last health service provided. Records collected while a patient was under 18 are retained at least until that person turns 25. Records may need to be kept longer to meet other legal, professional or legitimate requirements. When information is no longer required and it is lawful to do so, we take reasonable steps to securely destroy or de-identify it.

Access to & correction of records

You can ask for access to your personal or health information, a copy of your records, or correction of information you believe is inaccurate, incomplete, out of date or misleading. Contact our Privacy Officer using the details below. A written request can help us understand what you need, but you may also telephone us for assistance.

We may need to verify your identity and the authority of anyone acting for you. We aim to respond within 30 days and will meet applicable legal timeframes. If an access request involves permitted copying or processing charges, we will explain these in advance. There is no charge for making a request or for correcting information.

Access may be limited in circumstances allowed by law, for example to protect another person’s privacy. If we refuse access or a correction, we will explain the reason in writing where required and tell you how to complain. If we do not agree to amend a record, you can ask us to attach a statement of your requested correction. Where required, we will also take reasonable steps to notify relevant recipients of a correction.

Website, booking & overseas services

When you browse our website, technical information such as your IP address, browser type, device, pages visited and interactions may be processed through website hosting, security and analytics services. Our website uses Google Analytics and Google Tag Manager, and may load Google Maps links, YouTube content or thumbnails and Cloudflare services. Cookies and similar technologies can support these functions.

You can manage cookies through your browser settings. Blocking some cookies may affect website features. Following a Google Maps or reviews link takes you to Google’s service. Playing an embedded video or loading associated media may also share technical information with the provider.

Our online booking links open Centaur’s booking portal. Information you enter there is handled through that service and used to arrange your appointment. Please avoid including unnecessary sensitive details in website enquiries; telephone us if you need to discuss how to send clinical information securely.

Our Australian D4W hosting does not mean every website or communications service processes data only in Australia. Providers such as Google may process website-related information in the United States and other countries where they operate. Locations can vary with the service. Where we disclose personal information overseas, we take the steps required by applicable privacy law. Please contact us if you need more information about a particular disclosure.

Read the Centaur privacy policy, D4W security information and Google privacy policy for their respective services.

Reminders & marketing choices

We may contact you about appointments, recalls, treatment follow-up, accounts and other matters connected with your care. Please tell reception if your contact details change or you have a preferred way to receive messages.

Promotional communications are separate from clinical and administrative messages. We seek consent where required, including before using sensitive health information for direct marketing. You can opt out of marketing at any time through an available unsubscribe option or by contacting us. Opting out of marketing does not prevent necessary communications about your care or account.

Children & authorised representatives

We consider a young person’s capacity, circumstances and applicable law when obtaining consent and responding to requests for information. A parent, guardian, carer or family member does not automatically have unrestricted access to another person’s records.

If someone acts on your behalf, we may ask for your consent or evidence of their legal authority. Please let us know who you authorise us to speak with and any limits on that permission.

Contact & privacy complaints

If you have a question, want to exercise your privacy rights or believe your information has been mishandled, please contact our Privacy Officer. We will listen to your concern, investigate and explain our response. Raising a concern will not affect your access to appropriate care.

Speak with our team

Privacy Officer, Enhance Dental
Telephone: (03) 9533 8488
Ask reception to direct your enquiry to the Privacy Officer. Our Contact page provides our location and enquiry form.

Contact Enhance Dental

For an initial enquiry, a brief description is enough. We can help arrange a suitable way to provide any sensitive supporting information.

We aim to respond to a privacy complaint within 30 days. If you are dissatisfied with our response, or have not received a response within a reasonable period, you can contact an independent regulator:

• Office of the Australian Information Commissioner (OAIC): privacy complaints information or 1300 363 992. The OAIC generally asks you to complain to the organisation first and allow 30 days for a response.
• Health Complaints Commissioner, Victoria: make a complaint or 1300 582 113, including concerns about Victorian health information handling.

Data breaches & policy updates

If a suspected data breach occurs, we will take steps to contain it, assess the risk and respond. Where a breach meets the notification requirements of the Privacy Act’s Notifiable Data Breaches scheme, we will notify the OAIC and affected individuals as soon as practicable, with relevant information and recommended protective steps.

We review this policy when our practices or legal obligations change. The current version and its update date are available on this page. You can ask us for a copy in another accessible format.