XYZ DENTAL PTY LTD

Privacy Policy

ABN 70 602 591 480  |  8/52 Bakers Road, Coburg North VIC 3058  |  (03) 8538 5100

1. About this Privacy Policy

1.1     This Privacy Policy explains how XYZ Dental Pty Ltd (ABN 70 602 591 480) (“XYZ Dental”, “we”, “us” or “our”) collects, holds, uses and discloses personal information, and how you can access or correct your information or make a complaint.

1.2     We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs), and, where health information is involved, the Health Records Act 2001 (Vic) and its Health Privacy Principles.

1.3     This policy applies to everyone whose personal information we handle, including dental practitioners, clinic and laboratory staff, customers, website visitors, online shop users, suppliers, contractors and job applicants. It applies to information collected through our website, online shop, email, telephone, remote support sessions, trade shows, training and in person.

1.4     XYZ Dental supplies dental equipment, software, materials, consumables and spare parts, and provides installation, training, technical support and servicing. Our customers are mainly dental clinics, dental laboratories and other dental professionals. We do not provide clinical treatment to patients.

2. Key terms

2.1     Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. We treat online identifiers, such as IP addresses, device and advertising identifiers and cookie identifiers, as personal information where they can be used to recognise or single out an individual.

2.2     Sensitive information includes health information and certain other categories of information (such as racial or ethnic origin and criminal record). Health information includes information about an individual’s health or the health services provided to them, which can include dental scans, impressions, models, case files and similar records relating to a patient.

3. The kinds of personal information we collect

3.1     The personal information we collect depends on how you deal with us. It may include:

Customers and business contacts

•       name, job title, practice or business name, ABN, business and delivery addresses, email addresses and telephone numbers;

•       professional details, such as your profession and, where relevant to the products you order, your registration details;

•       order, quotation, invoice, delivery, warranty, installation, training and support history, including equipment models and serial numbers;

•       payment and billing details (card payments are processed by our payment service providers, and we do not store full card numbers);

•       for trading account and credit applications: details of directors, owners, guarantors and trade referees, and information needed to assess creditworthiness;

•       records of your communications with us, including emails, support tickets and notes of calls; and

•       your marketing preferences.

Website and online shop users

•       account login details and order history;

•       technical information such as IP address, device and browser type, pages viewed, referring pages and the time and date of visits; and

•       information collected through cookies, pixels and similar technologies, including analytics and advertising tools provided by Google and Meta (see clause 12).

Remote support and servicing

•       information about your computers, equipment, software and licences; and

•       information that is visible on screen or stored on equipment during a remote or onsite support session. This may occasionally include patient information held in your practice or laboratory software (see clause 7).

Patient-related information

•       where it is reasonably necessary for a product or service, we may receive limited patient-related information from dental practitioners or laboratories, such as a case name or reference, scan or design files (for example STL files), and records linking a patient case to the batch or serial number of a product we supplied (see clause 7).

Suppliers, contractors and job applicants

•       contact and business details, and for job applicants, information in your application, résumé, references and any checks you consent to.

3.2     You do not have to provide personal information to us. If you do not, we may not be able to process your order, open a trading account, provide warranty or technical support, or respond to your enquiry.

4. How we collect personal information

4.1     We collect personal information directly from you wherever reasonably practicable, for example when you place an order, request a quote, complete a form, contact us, attend training or a trade show, or use our website.

4.2     We may also collect personal information from third parties where it is unreasonable or impracticable to collect it from you, including from:

•       your employer or practice, or the person who placed an order on your behalf;

•       manufacturers, distributors and service partners (for example, for equipment registration, warranty claims and licensing);

•       credit reporting bodies, trade referees and our finance partners, when you apply for a trading account or finance;

•       publicly available sources, such as the ABN Lookup, ASIC registers, professional registers and business websites; and

•       our website and marketing systems, through cookies and similar technologies.

4.3     If we receive personal information that we did not ask for, we will decide whether we could have lawfully collected it. If not, we will destroy or de-identify it as soon as practicable, where lawful and reasonable to do so.

5. Why we collect, use and disclose personal information

5.1     We collect, hold, use and disclose personal information for the following purposes:

•       to provide quotes, process and deliver orders, and supply equipment, software, materials and parts;

•       to install equipment, provide training, technical support, servicing, repairs and warranty services, including liaising with manufacturers;

•       to activate, register and manage software licences and equipment registrations;

•       to assess and manage trading account and credit applications, issue invoices and collect payments (including through debt collection agencies where amounts are overdue);

•       to maintain product traceability records and to manage product recalls, safety notices and adverse event reporting, as required for medical devices supplied in Australia;

•       to communicate with you about your orders, account, equipment and services;

•       to send you information about our products, promotions, events and training (see clause 11);

•       to operate, secure and improve our website, systems, products and services;

•       to recruit staff and engage contractors and suppliers; and

•       to comply with our legal and regulatory obligations, including under tax, consumer, workplace and therapeutic goods laws, and to establish, exercise or defend legal claims.

5.2     We only collect, use and disclose personal information where it is lawful and fair and reasonable in the circumstances. We consider what you would reasonably expect, collect only the information we need, and use de-identified or less information where that would achieve the same purpose.

5.3     We will only use or disclose your personal information for another purpose if you consent, if it is a related purpose you would reasonably expect (or, for sensitive information, a directly related purpose), or if it is otherwise permitted or required by law.

6. Who we disclose personal information to

6.1     We may disclose personal information to the following kinds of organisations, where reasonably necessary for the purposes in clause 5:

•       our related businesses, AXIOS Medical and Dental and Giorgio Dental Lab, where needed to supply, manufacture or support products and services, or for shared administration;

•       equipment, software and material manufacturers, and their authorised service partners, for warranty, support, licensing, registration, recalls and safety matters;

•       freight, courier and logistics providers;

•       payment processors, banks, finance providers and insurers;

•       credit reporting bodies, trade referees and debt collection agencies;

•       advertising and analytics platforms, such as Google and Meta, but only through the cookies, pixels and tools described in clause 12 and, for marketing purposes, only with your consent;

•       IT, cloud hosting, software, website, email, customer relationship management (CRM), inventory and accounting service providers;

•       professional advisers, such as accountants, auditors and lawyers;

•       regulators and government authorities, such as the Therapeutic Goods Administration (TGA) and the Australian Taxation Office, and law enforcement agencies, where required or authorised by law; and

•       a prospective purchaser of all or part of our business, subject to confidentiality obligations.

6.2     We require our service providers to handle personal information securely and only for the purpose for which we provide it to them. We do not sell, rent or trade personal information, and we do not disclose it to anyone for money or other consideration.

7. Patient and health information

7.1     We are not a treating health provider and we aim to collect as little patient information as possible. Where we do receive patient-related or health information, it is usually provided by a dental practitioner or laboratory so that we can supply, support or investigate a product or service for them.

7.2     Dental practitioners and laboratories who give us patient information are responsible for making sure they are authorised to do so. Wherever possible, please identify cases by a case name or reference number only, and do not include patient names, dates of birth or other direct identifiers in file names, folder names or messages.

7.3     We only use patient-related information for the purpose for which it was provided (such as technical support, warranty investigation, product traceability, recalls or adverse event reporting), or as otherwise permitted or required by law.

7.4     Patient files must be sent to us securely, using an encrypted, access-controlled transfer method agreed with us, and not as unprotected email attachments or “anyone with the link” shares. We store patient-related information in access-restricted systems and delete or de-identify it once it is no longer needed, subject to our legal record-keeping obligations.

7.5     We only collect sensitive information, including health information, with consent or where otherwise permitted or required by law.

7.6     During remote or onsite support, our technicians may see patient information displayed in your software or stored on your equipment. They only access what is needed to perform the support task, and they do not copy, retain or disclose patient information unless it is needed for that task, or for a warranty claim with the manufacturer, and then only with your agreement.

8. Overseas disclosure

8.1     Many of the products we supply are made in Europe. We may disclose personal information to equipment, software and material manufacturers and their service partners located in Europe, including Germany, for warranty, support, licensing, registration, recall and safety purposes.

8.2     Some of the software, website, analytics and advertising services we use, such as Google, Meta and our CRM provider, are operated by companies that may store or process information in the United States and other countries where they or their data centres are located.

8.3     Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, for example through contractual terms and by choosing reputable providers. Where we disclose patient-related information to an overseas manufacturer (for example, for a warranty or safety investigation), we de-identify it wherever practicable.

9. Use of artificial intelligence and software tools

9.1     We use business software to run our operations, which may include features that use artificial intelligence (AI), for example to help draft communications, summarise support requests, transcribe or translate, or analyse sales and inventory data.

9.2     We do not enter patient information or other sensitive information into publicly available AI tools. Where we use AI features within our business systems, we use them in accordance with this policy and the APPs, we prefer tools that do not use our data to train their models, and staff remain responsible for checking any AI-generated output before it is relied on or sent to you.

10. Automated decision-making

10.1   This clause explains whether we arrange for computer programs to use personal information to make, or to do things that are substantially and directly related to making, decisions that could reasonably be expected to significantly affect an individual’s rights or interests.

10.2   Trading accounts and credit. Our inventory, ordering and accounting systems may automatically place a hold on orders, or flag an account for review, where a trading account is overdue or has reached its credit limit. The systems use account and payment information, such as the account’s credit limit, invoice due dates, payment history and outstanding balance. Decisions to open, close, suspend or change the credit limit of a trading account are made by our staff, who may consider information from credit reporting bodies and trade referees.

10.3   Online payments. When you pay online, our payment service providers may use automated fraud screening, which uses information such as payment details, billing and delivery address, IP address and device information, to decide whether to approve or decline a transaction.

10.4   Apart from the matters in clauses 10.2 and 10.3, we do not currently use computer programs to make decisions about individuals that could reasonably be expected to significantly affect their rights or interests. If this changes, we will update this policy. If you have a question about a decision, please contact us using the details in clause 18.

11. Direct marketing

11.1   We may send you information about our products, promotions, training and events by email, SMS, post or telephone where you would reasonably expect us to, or where you have consented. Our electronic marketing complies with the Spam Act 2003 (Cth).

11.2   Every marketing email and SMS we send includes a simple way to opt out. You can opt out at any time by using the unsubscribe link in our emails, replying STOP to SMS messages, or contacting us. We will action your request free of charge and within 5 business days. We may still send you service messages about your orders, account, equipment, safety notices or recalls.

11.3   Our email marketing system may record whether emails are opened and which links are clicked, so that we can measure and improve our communications.

11.4   We do not use sensitive information, including health or patient information, for direct marketing or targeted advertising.

11.5   We do not upload customer contact details or lists to advertising platforms such as Meta or Google. Any information those platforms receive from us comes only through the website cookies and pixels described in clause 12, and only if you consent to them.

12. Website, cookies and analytics

12.1   Our website uses cookies, pixels, tags and similar technologies. We group them as follows:

•       Essential: needed to make the website and online shop work, such as your shopping cart, login and security. These are always on.

•       Analytics: help us understand how the website is used so we can improve it, such as Google Analytics and our CRM provider’s tracking cookies.

•       Marketing: help us measure our advertising and show you relevant XYZ Dental advertising on other websites and social media, such as the Meta Pixel and Google Ads tags. These tools share information about your visit (such as pages viewed, actions taken and device identifiers) with Meta or Google.

12.2   We only use analytics and marketing cookies and pixels if you agree to them through the cookie banner on our website. You can change your choice at any time using the cookie settings link on our website. You can also manage cookies in your browser settings and control how Meta and Google use your information for advertising through your Meta and Google ad settings. Some parts of the website may not work properly if you block essential cookies.

12.3   Our website may contain links to third-party websites, including manufacturer websites. We are not responsible for the privacy practices of those websites.

12.4   Our website and products are intended for dental professionals and businesses, and are not directed at children.

13. Security and storage

13.1   We hold personal information in electronic and paper form, including in cloud-based systems operated by our service providers. We take reasonable technical and organisational steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include:

•       access controls, so that staff can only access the information they need for their role;

•       multi-factor authentication, strong passwords and secure device management;

•       encryption of data in transit and, where available, at rest;

•       secure, access-controlled file sharing for patient and case files;

•       privacy and security training for staff, and confidentiality obligations for staff and contractors; and

•       physical security at our premises.

13.2   We keep personal information only for as long as it is needed for the purposes in this policy or to meet our legal obligations. As a guide:

•       orders, invoices and accounting records: at least 5 years, as required by tax law;

•       equipment, warranty, support and product traceability records: for the life of the equipment or product and for as long as required by therapeutic goods and other laws, so that recalls and safety notices can be managed;

•       patient and case files received for support or warranty: only until the task, claim or investigation is finished, unless a longer period is required by law;

•       marketing records: until you opt out or the information is no longer current;

•       website analytics data: no longer than the retention period set in our analytics tools, which is generally no more than 26 months; and

•       unsuccessful job applications: up to 12 months, unless you ask us to delete your application sooner.

13.3   When information is no longer needed, we take reasonable steps to securely destroy or de-identify it.

13.4   No method of transmission over the internet or electronic storage is completely secure. Please help protect your information by keeping your online shop password confidential and telling us promptly if you think your account has been compromised.

14. Data breaches

14.1   If we suspect a data breach, we will act promptly to contain it, take reasonable steps to reduce any harm to affected people, and assess it. If an eligible data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act.

15. Anonymity and pseudonyms

15.1   You may deal with us anonymously or using a pseudonym for general enquiries. For most of our services, such as orders, trading accounts, warranty claims and technical support, it is impracticable to deal with you anonymously because we need to identify you and your business.

16. Accessing and correcting your personal information

16.1   You can ask to access the personal information we hold about you, or ask us to correct it, by contacting us using the details in clause 18. We may need to verify your identity before acting on your request.

16.2   We will respond within a reasonable period, usually within 30 days. We do not charge for making a request or for correcting information. We may charge a reasonable fee for the cost of providing access, and we will tell you of any fee in advance.

16.3   If we refuse access or correction, we will tell you why in writing (unless that would be unreasonable) and explain how to complain. If we refuse to correct information, you may ask us to attach a statement to the record noting that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

16.4   You can also ask us to delete personal information we hold about you. We will do so where we no longer need it and are not required by law to keep it, and we will explain if we cannot.

16.5   Requests about patient records should generally be directed to the patient’s treating dental practitioner, who holds the clinical record. We will assist the practitioner where we hold relevant information.

17. Complaints

17.1   If you have a concern about how we have handled your personal information, please contact us in writing using the details in clause 18, with “Privacy” in the subject line. Please give us enough detail to investigate.

17.2   We will acknowledge your complaint within 7 days, investigate it, and aim to give you a written response within 30 days. If the matter is complex, we will let you know if we need more time.

17.3   If you are not satisfied with our response, you may complain to:

•       the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au or 1300 363 992; or

•       for complaints about health information in Victoria, the Health Complaints Commissioner (Victoria): hcc.vic.gov.au or 1300 582 113.

18. Contact us

18.1   Please direct privacy questions, requests and complaints to our team, who will refer them to the General Manager to deal with:

Privacy enquiries, XYZ Dental Pty Ltd

Post: 8/52 Bakers Road, Coburg North VIC 3058

Email: xyz@xyzdental.com.au (subject line: “Privacy”)

Telephone: (03) 8538 5100

19. Changes to this policy

19.1   We review this policy regularly and may update it from time to time to reflect changes in the law (including the privacy law reforms currently proposed by the Australian Government), our business or our technology. The current version will always be available on our website, and the “last updated” date at the top shows when it was last changed. You can ask us for a free copy of this policy in another form.