Cookies Policy

1. Purpose and Scope of this Policy

1.1. This Cookie Policy explains how Holistic Smiles Kids Pty Ltd (ABN 41 699 123 138) (we, us, or our) uses cookies, pixel tags, local storage identifiers, and related digital tracking technologies on our website and through our associated web and mobile applications (collectively, the Platform).

1.2. The Platform provides digital screening assessments, appointment coordination, secure patient portal access, and a virtual airway and pre-orthodontic health program for children aged 3 to 12. Clinical assessments and treatment decisions are conducted by registered dental practitioners. Because our services involve the collection of family contact details, administrative intake submissions, and sensitive paediatric health information, we are committed to maintaining the highest standards of digital transparency, information governance, and data security.

1.3. This Policy applies to all individuals who interact with the Platform, including parents, legal guardians, and authorised family representatives (you or your) who access our public informational pages, complete online screening assessments, register user accounts, manage telehealth appointments, or process program fees.

1.4. This Policy operates alongside, and must be read in conjunction with, our Terms of Use and our Privacy Policy. By continuing to navigate our Platform, registering an account, or enrolling your child in our programs, you acknowledge the deployment of digital tracking technologies in accordance with the terms set out below.

2. Understanding Cookies and Digital Tracking Technologies

2.1. A cookie is a compact digital text file placed on your computer, tablet, smartphone, or other web-enabled device when you access a website or online application. Cookies allow a web server to transfer small amounts of data to your web browser. This data can be retrieved by the originating server on subsequent visits to identify your device, recall your session state, and provide consistent platform functionality.

2.2. In addition to standard browser cookies, the Platform may employ complementary digital tracking mechanisms, including:

• Local Storage and Session Storage: HTML5 browser storage mechanisms that hold data locally within your web browser. These mechanisms operate similarly to cookies but offer greater capacity and do not transmit data back to the web server with every single page request, making them well-suited for holding multi-step questionnaire progress and client-side interface settings securely.
• Web Beacons and Pixel Tags: Minute electronic image files embedded within web pages or system-generated email communications. These tools assist us in verifying whether an informational page has been viewed or whether an account verification message has been opened.
• Cryptographic Session Tokens: Secure, encrypted alpha-numeric strings generated upon your entry into our password-protected patient portal. These tokens permit your browser to authenticate secure requests across different sections of the portal without requiring you to re-enter your parental login credentials on every page.

2.3. Digital tracking technologies are categorised by their operational lifespan:

• Session Cookies: Temporary identifiers that operate only during your active browsing session. A session cookie is initiated when you open your browser and navigate our Platform, and it is automatically deleted from your device memory when you log out of your account or close your web browser.
• Persistent Cookies: Durable identifiers that remain stored on your device's hard drive or internal memory after you terminate your browser session. Persistent cookies remain dormant until you revisit the Platform, at which point they reactivate to recognise your device and recall your saved preferences. Every persistent cookie contains a predetermined expiry timestamp, after which it is automatically deleted by your browser.

2.4. Cookies and local storage identifiers are plain data files. They do not execute executable code, cannot run background software applications independently, and cannot deliver viruses, malware, or destructive payloads to your computer or mobile device.

3. Why We Deploy Cookies on Our Platform

3.1. Operating a specialised paediatric health and telehealth portal requires robust technical architecture, rigorous user authentication, and dependable connectivity. We deploy cookies and tracking mechanisms strictly to advance legitimate technical, operational, and security functions, including:

• Protecting Sensitive Records: Verifying the authenticity of authenticated user sessions to prevent unauthorised third parties from intercepting or accessing paediatric screening records, appointment schedules, and confidential family communications.
• Safeguarding Multi-Step Intake Workflows: Preserving the entries made by parents across comprehensive screening questionnaires and intake forms, ensuring that detailed observations regarding a child's breathing patterns, sleep behaviours, and oral posture are not lost if an internet connection drops or if a page is refreshed.
• Facilitating Telehealth Video Connections: Establishing encrypted communication pathways for live myofunctional therapy consultations and clinical reviews, monitoring packet transmission and streaming quality to avoid clinical disruptions.
• Streamlining Administrative Interactions: Remembering parental interface preferences, such as text scaling, timezone settings for appointment calendars, and acknowledgment confirmations for platform notices.
• Assessing Technical Reliability: Evaluating server loading speeds, detecting routing errors, identifying failed transactions, and optimising user experience across desktop and mobile devices.

3.2. We do not sell, rent, lease, or commercialise your personal browsing history, your child's data, or your digital identifiers to advertising brokers, data aggregators, or external commercial enterprises. Cookies are deployed solely to support platform integrity, security, and healthcare delivery.

4. Categories of Cookies Used

4.1. The digital tracking mechanisms deployed across our Platform are classified into four defined categories: strictly necessary cookies, functional cookies, analytics cookies, and third-party telehealth integration cookies.

4.2. Each category performs a distinct technical function and is managed under strict information governance protocols aligned with Australian privacy standards.

4.1 Strictly Necessary and Essential Cookies

4.3. Strictly necessary cookies are foundational to the operation, security, and structural integrity of the Platform. These cookies enable core functionality, user authentication, and system protection. The Platform cannot function properly without these technologies, and they cannot be deactivated within our systems.

4.4. The operational functions served by strictly necessary cookies include:

• Parental Authentication: Identifying your secure credentials when you log into the patient portal, ensuring you remain securely connected while reviewing your child's treatment schedule, accessing prescribed exercise guides, or downloading clinical instructions.
• Session Security and Cross-Site Forgery Protection: Generating unique cryptographic tokens for each active user session. These tokens verify that commands and form submissions originate from your authorised browser, preventing malicious cross-site request forgery attacks and unauthorised account manipulation.
• Intake Form State Management: Holding temporary state indicators as you navigate multi-part online screening assessments, ensuring that entered dental history, developmental indicators, and family observations are maintained accurately from one section to the next.
• Appointment and Deposit Processing: Maintaining your booking selection through the consultation scheduling gateway, reserving your allocated appointment time, and connecting securely with our payment processing infrastructure for the required booking deposit.
• Load Balancing: Distributing web server traffic across redundant network infrastructure to ensure continuous availability, prevent server crashes during peak hours, and maintain portal stability.

4.2 Functional and Preference Cookies

4.5. Functional cookies allow our Platform to remember your past configurations and selections, tailoring your ongoing digital interactions to your specific requirements. These cookies enhance usability and platform responsiveness.

4.6. The operational functions served by functional cookies include:

• Calendar and Timezone Synchronisation: Storing your designated Australian state or territorial timezone, ensuring that automated calendar invites and live myofunctional session times display accurately according to your local time.
• User Interface Customisation: Retaining your preferred visual configurations, such as high-contrast display modes, font scaling, or accessibility enhancements across subsequent visits.
• Notification and Consent Status: Recording whether you have reviewed and acknowledged policy notices, informational banners, or platform guidance notes, preventing repetitive pop-up banners from interrupting your workflow.
• Draft Form Retention: Temporarily retaining unsubmitted non-clinical questionnaire drafts on your local browser cache, allowing you to resume completing family contact details or administrative questionnaires at a convenient time.

4.7. Functional cookies collect purely operational and preference information. They are not used to track your browsing behaviour across unrelated third-party websites, and they do not store clinical diagnostic determinations or sensitive medical findings.

4.3 Analytics and Performance Cookies

4.4. Analytics and performance cookies collect information regarding how visitors interact with our public website and patient portal. These tools assist us in measuring platform telemetry, diagnosing performance bottlenecks, and improving our digital service delivery.

4.8. The operational functions served by analytics and performance cookies include:

• Page Loading Speed and Latency Monitoring: Recording the time required for informational pages, exercise demonstration videos, and clinical intake forms to load across various internet service providers and Australian regional telecommunication networks.
• Navigation Flow and Drop-Off Analysis: Evaluating navigation patterns to identify pages where parents encounter technical errors, unclear instructions, or broken links, allowing our engineering team to streamline the intake process.
• Video Connection Diagnostics: Aggregating telemetry data regarding audio-visual streaming latency, frame rates, and packet loss during live telehealth consultations, ensuring that our video infrastructure functions reliably for families across metropolitan, regional, and remote Australia.
• Device and Browser Compatibility: Assessing which web browsers, operating systems, and device viewport sizes are most commonly utilised by our families, ensuring that our user interface remains accessible across all contemporary hardware.

4.9. Information collected via analytics and performance tools is processed on an aggregated, de-identified basis. We configure our analytics tools to minimise identifiers, including Internet Protocol (IP) address anonymisation where the tool supports it, and no clinical information is ever sent to analytics tools. We do not use performance analytics to build individualised behavioural profiles of parents or participating children.

4.4 Third-Party and Telehealth Integration Cookies

4.10. To provide specialized clinical telehealth services and secure financial transactions, our Platform integrates technical infrastructure from carefully vetted third-party service providers. When you access these specific integrated modules, third-party cookies may be placed on your device by these service partners.

4.11. Third-party integrations operating on our Platform include:

• Secure Payment Gateways: Payment transactions, including initial consultation deposits and monthly program instalments, are processed directly through an integrated, PCI-DSS compliant payment provider. Our payment provider deploys cookies and fraud-detection identifiers to authenticate your credit or debit card, verify security credentials, identify anomalous transactions, and maintain transaction security. Sensitive payment card numbers are processed directly within the encrypted gateway and are never stored on our core platform servers.
• Encrypted Telehealth Video Infrastructure: Live myofunctional therapy consultations and clinician reviews are delivered through secure WebRTC video conferencing modules. Our video infrastructure partners deploy temporary technical tokens to establish real-time, end-to-end encrypted audio-visual streams between your device and your treating clinician. In accordance with our clinical operating procedures, live therapy sessions are never recorded by us, and our video technology partners are contractually prohibited from recording, scraping, or indexing consultation audio or video streams.
• System Messaging and Transactional Communications: We utilise enterprise communications infrastructure to deliver automated appointment reminders, verification emails, and clinical notices. These providers employ cryptographic tokens to confirm delivery and ensure that critical clinical communications reach your nominated inbox reliably.

4.12. All third-party technical providers engaged by Holistic Smiles Kids Pty Ltd are subject to rigorous confidentiality, security, and data protection agreements. They are legally restricted from utilising tracking information collected via our Platform for their own commercial, promotional, or advertising endeavours.

5. Managing, Blocking, and Deleting Cookies

5.1. You have the right to control, manage, restrict, or delete cookies deployed on your device. You may exercise this control at any time by modifying the privacy and security settings within your web browser or mobile operating system.

5.2. Most modern web browsers allow you to:

• Inspect the cookies and local storage items stored on your device on a site-by-site basis;
• Block all cookies from being placed on your device;
• Block only third-party tracking cookies while permitting first-party essential cookies;
• Configure your browser to prompt you for permission whenever a website attempts to deploy a cookie; or
• Clear all existing cookies, cached files, and local storage data whenever you close your browser or at designated intervals.

5.3. To manage your cookie configurations in common desktop and mobile web browsers, follow the operational pathways below:

• Google Chrome: Navigate to Settings > Privacy and Security > Third-party cookies (or Cookies and other site data). From this menu, you can select your preferred blocking level, manage site-specific permissions, or clear accumulated browsing data.
• Apple Safari (macOS): Navigate to Safari > Settings (or Preferences) > Privacy. You may check the option to Prevent cross-site tracking and manage stored website data via the Manage Website Data button.
• Apple Safari (iOS/iPadOS): Open device Settings > Safari. Scroll down to Privacy & Security to toggle Prevent Cross-Site Tracking and Block All Cookies, or select Clear History and Website Data.
• Mozilla Firefox: Navigate to Settings > Privacy & Security. Under the Enhanced Tracking Protection section, select your preferred protection tier (Standard, Strict, or Custom) and manage cookie exceptions.
• Microsoft Edge: Navigate to Settings > Cookies and site permissions > Manage and delete cookies and site data. You can configure global blocking rules, block third-party cookies, or inspect active site permissions.

5.4. If you prefer to opt out of de-identified performance and analytical tracking across the web, you may install dedicated browser add-ons that disable measurement tags, or activate the "Do Not Track" or "Global Privacy Control" flags supported by your browser software. Our Platform respects standard browser privacy signals where technically compatible.

6. Functional Impact of Restricting Cookies

6.1. While you are fully entitled to restrict or disable cookies through your browser settings, you should be aware that doing so will directly impact the technical operation, performance, and accessibility of our Platform.

6.2. If you configure your browser to block strictly necessary or functional cookies, you may experience the following operational disruptions:

• Authentication and Login Failures: The secure patient portal requires session tokens to verify your parental identity. Blocking essential cookies will prevent you from logging into your account, viewing your child's exercise portal, or accessing clinical program resources.
• Loss of Intake Form Progress: Our online screening assessments and developmental questionnaires rely on local storage to preserve multi-part inputs. If local storage and session cookies are blocked, navigating between form steps or refreshing the page will cause entered observations and dental history to be cleared, requiring you to restart the intake form.
• Inability to Book Appointments: Our scheduling calendar requires temporary session cookies to coordinate available clinical consultation times with our registered dentists. Disabling these identifiers will prevent the calendar interface from confirming your chosen appointment slot.
• Failure of Telehealth Video Modules: The encrypted video consultation room relies on real-time token exchanges to establish peer-to-peer audio and video streams. Restricting functional third-party integration cookies will prevent the video interface from establishing a connection with your treating clinician, rendering virtual appointments inaccessible.
• Repetitive Interface Prompts: Without functional cookies to record your preferences, the Platform will be unable to remember your display configurations, requiring you to re-acknowledge system notices and reconfigure settings on every visit.

6.3. If you do not wish to enable cookies within your web browser but still require clinical care or information for your child, please contact our administrative team directly using the contact details set out in Section 9. Our staff can provide alternative administrative pathways, such as coordinating intake questionnaires, program bookings, and account management via telephone or secure electronic mail.

7. Protection of Children's Privacy and Health Data

7.1. Holistic Smiles Kids Pty Ltd provides virtual airway and pre-orthodontic health programs specifically designed for children aged 3 to 12. Protecting the confidentiality, dignity, and digital privacy of participating children is our paramount priority.

7.2. We enforce stringent safeguards across all digital interactions involving minors:

• No Behavioural Profiling or Commercial Advertising: We never deploy advertising cookies, cross-site trackers, behavioural monitoring pixels, or data profiling mechanisms directed at children. The Platform contains no third-party commercial advertising, sponsored promotional placements, or commercial ad networks.
• Parental Account Ownership: Accounts on our Platform may only be established by adults aged 18 years or older who hold legal parental responsibility for the participating child, as stipulated in our Terms of Use. All cookie management, portal logins, and data submissions must be managed directly by the parent or legal guardian.
• Strict Isolation of Clinical Health Records: Clinical records, clinical photographs, myofunctional therapy exercise logs, and clinician progress notes are maintained within an encrypted, access-controlled healthcare database environment. These sensitive clinical records are entirely isolated from general website tracking files and are never accessible to, or processed by, analytical tracking cookies.
• Adherence to Australian Privacy Standards: All personal and health information collected through our digital touchpoints is processed in strict compliance with Australian privacy and health records principles. We collect only the data necessary to provide safe, effective paediatric airway and pre-orthodontic care.

8. Updates and Changes to this Policy

8.1. We may review, update, or amend this Cookie Policy from time to time to reflect changes in our technological systems, clinical workflows, service provider integrations, or legal obligations under Australian privacy standards.

8.2. When changes are made, we will update the "Effective Date" displayed at the end of this Policy. If we implement material modifications that alter how we deploy tracking technologies, collect information, or manage your personal data, we will provide clear notification by:

• Publishing a prominent advisory banner on the Platform's primary landing page;
• Displaying an advisory notice within the secure patient portal; or
• Transmitting direct written notification to the email address registered to your active account.

8.3. We encourage parents and guardians to review this Policy periodically to remain informed about how we maintain digital security and safeguard family records. We maintain an archive of prior policy versions, which can be made available upon written request to our Privacy Officer.

9. Contact Details and Privacy Inquiries

9.1. If you have any questions, concerns, or feedback regarding this Cookie Policy, the specific tracking technologies deployed on our Platform, or the manner in which your digital information is handled, please contact our Privacy Officer:

Attention: Privacy Officer Entity: Holistic Smiles Kids Pty Ltd (ABN 41 699 123 138)

Email: hello@holisticsmileskids.com.au

9.2. Our Privacy Officer will review your inquiry with due care. We aim to acknowledge receipt of all written privacy inquiries within five (5) business days and to provide a comprehensive substantive response within thirty (30) calendar days of receipt.

9.3. If an inquiry relates to technical difficulties experienced when accessing the patient portal or managing browser cookie permissions, our administrative team will assist you in resolving technical barriers or establishing an alternative clinical coordination pathway.