Privacy policy

About this policy

Last updated: 2 November 2026

This policy explains how Sunshine Coast Oral, Facial & Implant Specialists ([CONFIRM: legal entity name], ABN [CONFIRM: ABN]) collects, uses, discloses and protects your personal information, including your health information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

In this policy, "we", "us" and "our" mean our practice, including our surgeons and staff. Our rooms are at Suite 5, Nucleus Medical Suites, 23 Elsa Wilson Drive, Buderim QLD 4556.

What information we collect

We collect only the information we need to provide your care and run our practice. This may include:

• your name, date of birth, gender, address, phone numbers and email address
• your medical and dental history, medications, allergies and other health information
• referral letters, clinical notes, test results, photographs, x-rays, CBCT scans and other images
• your Medicare number, Department of Veterans' Affairs number and private health insurance details
• the name and contact details of your referring practitioner, your general practitioner and your next of kin or emergency contact
• billing and payment information
• information you send us through our website forms, by email or by phone

You can ask to deal with us anonymously or using a pseudonym, but in most cases this is not practical for providing clinical care, issuing referrals or claiming Medicare or health fund benefits.

How we collect it

We collect most information directly from you, at your consultation, through our patient information form, by phone or email, or through our website.

We also collect information from other people when this is needed for your care and you would reasonably expect it, for example from your referring dentist, doctor or specialist, hospitals, radiology and pathology providers, your health fund, or a parent, guardian or carer.

Why we collect, use and disclose it

We use and disclose your information to provide your care and for directly related purposes you would reasonably expect, including to:

• assess, diagnose, plan and provide your treatment
• communicate with you about appointments, treatment and follow-up care
• report to and correspond with your referring practitioner, your general practitioner and other practitioners involved in your care
• arrange surgery with hospitals, day surgeries and anaesthetists
• request and receive imaging, pathology and other test results
• process Medicare, Department of Veterans' Affairs and private health fund claims, and manage billing
• meet our legal, regulatory, professional and insurance obligations
• improve the quality and safety of our services, including through audits and accreditation

We disclose information for other purposes only with your consent, or where the law requires or allows it, for example to lessen a serious threat to someone's life, health or safety.

Photographs and images

Clinical photographs, x-rays and scans are part of your health record and are used for your care. With the consent you give on our patient information form, de-identified photographs and x-rays may also be used for teaching, scientific papers or presentations. We do not use your clinical images in advertising, and we will not use any image that could identify you without your separate written consent, which you can decline or withdraw at any time without it affecting your care.

Direct marketing

We do not sell or share your personal information for marketing. We may send you information about your own care, such as appointment reminders. If we ever send other information, you can opt out at any time.

Storage and security

We store your information in our practice management system [CONFIRM: name of practice management system and whether it is hosted in Australia] and in secure paper or electronic records. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, modification or disclosure, including staff confidentiality obligations, password and access controls, and secure storage and disposal.

We keep health records for as long as the law requires [CONFIRM: retention period, for example at least 7 years after the last contact for adults, and until a patient who was a child turns 25], then destroy or de-identify them securely.

Access and correction

You can ask to see or receive a copy of the personal information we hold about you, and ask us to correct anything you believe is inaccurate, out of date, incomplete or misleading.

Please make your request in writing to our privacy officer. We will respond within 30 days. We may charge a reasonable fee for providing copies, but not for making the request or correcting your information. If we refuse access or correction, we will tell you why in writing, as the law allows.

Our website, analytics and cookies

Our website is hosted by Vercel. When you send a form on our website (Contact us, Online doctor referral, Patient information form or Feedback), the details you enter are emailed to our practice team through SMTP2GO, an email delivery service. Contact details and messages are also kept in our website dashboard so our team can follow up your enquiry; the medical details from the patient information form are emailed only and are not kept in the dashboard.

We may use Google Analytics and Google Tag Manager to understand how our website is used, for example which pages are visited and how people find us. These services use cookies and collect information such as your IP address, device, browser and pages viewed. We do not use them to identify you. You can block cookies in your browser settings or use the Google Analytics opt-out add-on.

Some pages include content from other services, such as Google Maps, a Vimeo video and a Matterport virtual tour, which may set their own cookies under their own privacy policies.

Overseas disclosure

We do not send your health records overseas. Some of the services that support our website may store or process information outside Australia, including Google (website analytics) in the United States and other countries, and SMTP2GO (website form emails) [CONFIRM: the countries where SMTP2GO stores data for this account]. Our website hosting and dashboard database are located in Sydney, Australia.

Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Questions and complaints

If you have a question or concern about how we handle your personal information, please contact our privacy officer first. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992. For concerns about a health service in Queensland, you can also contact the Office of the Health Ombudsman on 133 646.

Contact our privacy officer

Privacy officer: [CONFIRM: privacy officer name]
Email: [CONFIRM: privacy officer email, for example reception@sunshinecoastofis.com.au]
Phone: (07) 5406 0586
Post: Suite 5, Nucleus Medical Suites, 23 Elsa Wilson Drive, Buderim QLD 4556

Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated at the top.