Privacy policy

Who we are

Flinders Dental Practice, at 3/33 Cook Street, Flinders VIC 3929, is operated by Sorrento Dental Pty Ltd (ACN 613 387 036) as trustee for the Sorrento Dental Trust (ABN 53 223 159 971). In this policy, “we”, “us” and “the practice” mean Flinders Dental Practice.

We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, as a private health service provider in Victoria, by the Health Privacy Principles in the Health Records Act 2001 (Vic). Our clinicians are also bound by the Dental Board of Australia's code of conduct and Ahpra's advertising guidelines, and we follow Australian Dental Association guidance on patient records and confidentiality.

What we collect

We collect only what we need in order to provide safe dental care and to run the practice. That generally includes:

• Your name, date of birth, address, phone number and email address
• Medicare, health fund, DVA or concession details where relevant to your account
• Your medical and dental history, medicines, allergies and relevant health conditions
• Clinical records, treatment notes, photographs, scans and radiographs taken as part of your care
• Appointment history, correspondence with us, and payment and account records
• Where you contact us by phone or email, the content of that contact

How we collect it

Usually directly from you: in person, over the phone, by email, or on the health history form you complete as a new patient. Where you are a child or where you have asked someone to act for you, we may collect information from a parent, guardian or authorised representative.

Sometimes we receive information from others involved in your care, such as a referring dentist or doctor, a specialist, your health fund or Medicare. We will only do this where it is reasonably necessary for your care or your account, and with your consent or where the law otherwise allows it.

Why we use it

• To assess, plan, provide and review your dental treatment
• To communicate with you about appointments, recalls, results and treatment
• To process payments and health fund, Medicare or DVA claims
• To meet our legal, professional, insurance and record-keeping obligations
• To manage complaints, feedback and the day-to-day running of the practice

Who we may share it with

We do not sell your information and we do not share it for marketing by others. We may disclose it:

• To clinicians and staff involved in your care, including the team at our sister practice, Red Hill Dental Practice (run by the same business), when part of your care takes place there, such as a 3D scan, a panoramic X-ray or making a crown
• To dental laboratories and technicians who make appliances, crowns or dentures for you
• To Diagnocat, the AI radiology service described under “AI tools we use”, which processes copies of X-rays and scans to produce reports our dentists review
• To specialists, other dentists, your doctor or a hospital where you are referred, or where they refer you to us
• To your health fund, Medicare, DVA or a government scheme in order to process a claim you have made
• To our payment processors and terminals (including HICAPS) to complete a transaction
• To our IT and software providers, who may access records incidentally while supporting the systems that hold them, under confidentiality obligations
• To our accountants, insurers or lawyers, or a debt recovery agency, where reasonably necessary
• Where we are required or permitted by law, including where there is a serious threat to someone's life, health or safety

Overseas handling

Your information is stored in our practice management system, provided by CareStack (Good Methods Pty Ltd). CareStack hosts our records, images and backups on Microsoft Azure servers in Australia. CareStack's support and engineering teams, who may be able to access records when they help us with the system, are mainly in India, with some in the United States. CareStack and some of the service providers it uses, for example to send appointment emails and text messages, and for support and monitoring tools, may store or process some of your information in India and the United States. Our agreement with CareStack requires it to handle your information consistently with the Australian Privacy Principles, and we take reasonable steps to make sure anyone else outside Australia who can access your information does the same. Diagnocat, the AI radiology service described under “AI tools we use”, is provided by DGNCT LLC, a company based in the United States. Its published data processing terms say patient images are hosted on Google Cloud servers in the European Union, so copies of your X-rays and scans are likely to be stored in the European Union and may be accessed from the United States. We have asked Diagnocat to confirm in writing where our patients' images are stored and who can access them, and will update this policy when it replies.

This website is hosted by Lovable, a company based in the United States and Sweden. Technical information about your visit (described under “This website”) may be processed outside Australia, including in the United States and Europe. Google may also process the map requests described under “This website” outside Australia, including in the United States.

This website

This website does not include a contact or booking form, and we do not ask you to submit health information through it. The way to reach us is by phone.

Our website host, Lovable, records standard technical information such as your IP address, browser type and the pages requested, in order to serve the site and keep it secure. Our host also sets two technical cookies: one protects the site from automated traffic and expires after 30 minutes, and the other is used by our host to deliver the site and expires after 24 hours. Neither is used for advertising.

Lovable also gives us visitor statistics for this site: the number of visitors and page views, how long visits last, and summaries by page, referring website, device type and country. We see these only as totals, and we use them to understand how the site is used and to improve it. Lovable says its analytics measures overall traffic rather than individual people and does not build profiles of visitors. To group page views into a single visit, the statistics feature sets a cookie containing a random visit number, which expires after 30 minutes. The statistics we see contain no health information and do not identify anyone. Our host still processes the technical information described above, including your IP address and the pages you request, in order to serve the site.

The site carries no advertising and uses no advertising cookies, and we do not use your browsing of this site to build a profile of you.

Our typefaces are served from this website itself, so opening a page does not contact Google. The map on the contact page loads from Google only if you select “Show map”. Once it loads, Google receives your IP address and standard request details, and may set cookies in your browser. Google handles this information under its own privacy policy. If you would rather not load the map, our address is in the footer of every page, and you can call us for directions.

Photographs

Clinical photographs and radiographs form part of your record and are used for your diagnosis, treatment and review. We do not publish any image in which a patient is identifiable without that person's separate, documented consent, which you are free to decline or later withdraw.

AI tools we use

With your permission, some of our clinicians use an AI note-taking tool that's part of our practice management system, CareStack. It listens during your appointment and drafts clinical notes, which your clinician checks and corrects before they're saved to your record. We'll always ask you first. You can say no, or ask us to stop at any time, and it won't affect your care. The recording is processed by Microsoft's Azure OpenAI service in Australia, and recordings and transcripts are stored in Australia. CareStack's support staff can access them only to fix a technical problem, and that access is logged. If you withdraw consent part-way through an appointment, that session's recording is deleted.

Some of our clinicians also use Voice Perio, another CareStack tool, which turns spoken gum measurements into chart entries during an examination. We ask your permission in the same way, and the clinician checks every entry before it is saved.

We also use Diagnocat, an AI service built for dental radiology, to analyse X-rays and 3D scans. It produces a report that your dentist reviews alongside the images; your dentist, not the software, makes every diagnosis and treatment decision. Copies of your images are sent to Diagnocat to produce the report, which becomes part of your record. Diagnocat's published terms say patient images are hosted in the European Union (see “Overseas handling”). Its standard terms also allow it to use anonymised images for research and development; we have asked it in writing not to use any of our patients' images in this way. You can ask us not to use Diagnocat on your images, and this will not affect your care.

There is more detail about these tools, in plain language, on our How we use AI page.

Keeping it secure

Patient records are held in our practice management software, CareStack, which is access-controlled and backed up. Any paper records are kept securely on the premises. Access is limited to staff who need it for your care or your account, and everyone at the practice is bound by confidentiality.

If a data breach is likely to cause serious harm to anyone whose information is involved, we will notify them and the Office of the Australian Information Commissioner, as required under the Notifiable Data Breaches scheme.

How long we keep it

We retain patient health records for at least seven years after we last provide you with a health service. For health information collected while you were under 18, we retain it until at least your 25th birthday or the end of that seven-year period, whichever is later. We may retain records for longer where this is clinically appropriate or required for legal reasons. When we no longer need information and the law no longer requires us to keep it, we take reasonable steps to destroy it securely or de-identify it.

Access and correction

You may ask to see the personal and health information we hold about you. If you believe any of it is inaccurate, out of date, incomplete, irrelevant or misleading, you can ask us to correct it. Please speak to our practice manager on 03 5989 1129, or write to us at 3/33 Cook Street, Flinders VIC 3929.

We will respond as soon as we can, and within 30 days. In limited circumstances permitted by law we may need to decline a request, or provide the information in another form such as a summary or a supervised viewing; if so, we will explain why in writing. There is no charge for making a request. If giving you access involves copying records or supervising a viewing, we may charge a fee, which will not exceed the maximum allowed under the Health Records Act 2001 (Vic), and we will tell you the cost first. We do not charge for correcting your information.

If we correct your health information, we will take reasonable steps to tell any health service providers we gave it to before the correction, and who may rely on it in future. If you ask, we will also tell other organisations we gave it to, unless that is impracticable or unlawful. If we decide not to make a correction you have asked for, we will tell you why in writing and how you can complain. You can also ask us to attach a statement to your record setting out the correction you requested, and we will take reasonable steps to do so.

Complaints

If you are concerned about how we have handled your information, please tell us first. Call 03 5989 1129 and ask for the practice manager, or write to us at 3/33 Cook Street, Flinders VIC 3929. We will acknowledge your complaint, look into it, and aim to give you a written response within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our response, you can contact the Health Complaints Commissioner (Victoria) on 1300 582 113 or at hcc.vic.gov.au, or the Office of the Australian Information Commissioner on 1300 363 992 or at oaic.gov.au.

About the information on this website

Everything written about treatment on this site is general information only. It is not a diagnosis, a recommendation or a substitute for an examination and a conversation with a dentist or doctor. Whether any treatment is suitable for you, and what it may achieve, can only be determined individually.

If you see anything on this site that appears inaccurate or out of date, please tell us and we will correct it.

Changes to this policy

We review this policy from time to time. The current version is always the one published on this page. Last updated: October 2026.