Privacy Policy

1. Purpose and Scope of this Policy

1.1 This Privacy Policy (Policy) sets out how Holistic Smiles Kids Pty Ltd (ABN 41 699 123 138), trading as Holistic Smiles Kids (referred to in this Policy as we, us, or our), collects, manages, stores, uses, discloses, and protects personal information and sensitive health information.

1.2 We operate a specialised telehealth practice delivering paediatric oral health assessments, orofacial myology programs, and developmental support tailored for children aged three (3) to twelve (12) years. Our clinical services include (without limitation) virtual oral examinations, resting posture analysis, airway and breathing habit screening, swallowing pattern evaluations, and programs delivered remotely via secure digital platforms.

1.3 Because our patients are young children, all interactions with our digital platforms, assessment portals, clinical consultations, and ongoing therapy programs are conducted through parents, legal guardians, or authorised carers holding lawful parental responsibility (referred to as parents, guardians, or you). This Policy governs the collection and handling of information regarding both you and your child.

1.4 This Policy applies to all interactions with us, including accessing our public website, completing online intake questionnaires, participating in consultations (including via telehealth), submitting intra-oral photographs and video recordings, utilising our secure patient portal, communicating via electronic messaging, and engaging with our clinical care team.

1.5 We are committed to safeguarding the privacy and confidentiality of your family's personal data. Health information relating to children is recognised as sensitive information requiring the highest standard of technical, physical, and administrative protection. By registering an account, submitting an online assessment, or accessing our services, you acknowledge that you have read, understood, and agreed to the practices described in this Policy on your own behalf and on behalf of your child.

2. Dealing with Us Anonymously or by Pseudonym

2.1 We recognise that individuals often prefer to protect their identity when interacting online. You may browse the publicly accessible pages of our website, read general educational materials, or make initial inquiries regarding our clinical fee structures and program formats anonymously or by adopting a pseudonym.

2.2 However, once you choose to register an account, book a consultation, submit clinical questionnaires, or enrol your child in a program, dealing with us anonymously or under a pseudonym is neither practicable nor legally permissible. As a registered healthcare service delivering clinical assessments and therapeutic interventions to paediatric patients, our clinicians require verified, accurate, and comprehensive identity information.

2.3 Positive patient identification is essential for the following clinical, safety, and regulatory reasons:

• Clinical Patient Safety: Our treating practitioners must definitively match clinical records, diagnostic photographs, exercise histories, and clinical notes to the correct child to prevent misdiagnosis, inappropriate treatment recommendations, or dangerous clinical errors;
• Emergency and Duty of Care Obligations: In the event that a clinical consultation reveals acute airway obstruction, severe dental infection, or an urgent medical emergency, our practitioners have an overriding professional duty of care to direct emergency medical services to the child's precise physical location;
• Verifiable Legal Authority: We must confirm that the adult providing medical consent and authorising clinical treatment holds the lawful parental responsibility or legal guardianship required to make healthcare decisions for the child; and
• Healthcare Records and Billing Compliance: Accurate legal identification is mandatory to issue valid itemised invoices, support private health insurance claims, facilitate National Disability Insurance Scheme (NDIS) billing, and satisfy statutory health record-keeping standards.

2.4 Where you decline to provide accurate, complete, and verifiable identification details for yourself and your child, we reserve the right to decline, suspend, or terminate the provision of clinical services.

3. Types of Personal and Sensitive Information We Collect

3.1 Parent and Guardian Identification and Contact Details

3.1.1 To establish an administrative account, to book the child’s free assessment, verify your legal capacity to consent on behalf of a minor, and manage billing and appointment communications, we collect personal information directly from parents and legal guardians, including:

• Full legal name, title, and preferred form of address;
• Residential address, postal address, and physical location during virtual consultations;
• Direct telephone numbers and email addresses;
• Emergency contact details, including full names, relationship to the child, and active telephone numbers;
• Financial and billing data, including credit card numbers, card expiration dates, billing addresses, and payment transaction identifiers processed through our encrypted third-party payment gateway.

3.2 Paediatric Health Information and Developmental Records

3.2.1 To conduct meaningful clinical evaluations and design safe, effective programs, we collect sensitive health information regarding your child, including:

• Child's full legal name, preferred name, chronological age, date of birth, and biological sex;
• Comprehensive dental history, including past dental trauma, caries experience, restorations, orthodontic extractions, frenectomy or tongue-tie releases, and previous orthodontic interventions;
• Comprehensive medical history, including known allergies, chronic medical conditions, medications, ear, nose, and throat (ENT) surgical history (such as adenoidectomy or tonsillectomy), and sleep-disordered breathing symptoms;
• Airway, respiratory, and sleep indicators, including snoring, mouth breathing, sleep apnoea diagnoses, restless sleep patterns, and daytime fatigue;
• Speech, language, and feeding developmental milestones, including chewing difficulties, food texture aversions, open-mouth resting posture, and past speech pathology interventions;
• Neurodevelopmental diagnoses and behavioural profiles disclosed by parents to tailor the therapy pathway, including Autism Spectrum Disorder (ASD), Attention Deficit Hyperactivity Disorder (ADHD), sensory processing sensitivities, and motor planning difficulties; and
• Healthcare funding identifiers, including private health insurance membership details, Medicare card numbers and individual reference numbers where applicable, and NDIS plan details, participant numbers, and support coordinator contact information.

3.3 Clinical Photographs, Habit Tracking, and Orofacial Metrics

3.3.1 Orofacial myology and remote paediatric dental screening depend upon visual assessment and longitudinal habit tracking. We collect visual, acoustic, and behavioural biometric metrics submitted through our secure portal, including:

• High-resolution intra-oral photographs depicting dental occlusion, arch development, palatal vault height, soft tissue attachments (lingual and labial frenula), and hard tissue integrity;
• Extra-oral facial photographs capturing resting facial posture, lip incompetence, mentalis muscle strain, facial symmetry, and head-and-neck posture;
• Short clinical video recordings submitted by parents demonstrating swallowing mechanics, tongue range of motion, speech articulation, and execution of assigned neuromuscular exercises;
• Longitudinal habit tracking logs recorded by parents, monitoring daytime mouth breathing, non-nutritive sucking habits (thumb, finger, or dummy sucking), nail-biting, and bruxism (teeth grinding); and
• Objective developmental metrics, including inter-incisal maximum mouth opening measurements, lip strength scores, and therapy exercise compliance logs.

3.3.2 We treat all photographic and video materials displaying the face, mouth, or physical characteristics of a child as sensitive health information subject to our highest level of security and access restriction.

3.4 Technical, Device, and Platform Telemetry

3.4.1 When you access our digital ecosystem, website, or secure patient portal, our systems automatically log technical telemetry data to maintain session security, ensure platform stability, and optimize telehealth video streams. This data includes:

• Internet Protocol (IP) addresses, approximate geographic location, and Internet Service Provider (ISP) network parameters;
• Device hardware specifications, unique device identifiers, operating system version, browser type, and display resolution;
• Telehealth video stream quality metrics, including packet latency, jitter, frame rates, and dropped connection logs;
• Access timestamps, session duration, pages viewed, portal features accessed, and referring website addresses; and
• Cryptographic authentication tokens and security cookie identifiers utilised strictly to maintain authenticated user sessions and safeguard against unauthorised account access.

4. How We Collect Information and Verify Parental Authority

4.1 Direct Collection via Online Assessments and Secure Portals

4.1.1 We collect personal and sensitive health information directly from you through digital interfaces specifically engineered for parental use. These collection touchpoints include:

• Initial intake questionnaires and digital health history forms completed upon account creation;
• Pre-consultation online assessment modules where parents upload structured baseline data regarding their child's habits and dental development;
• The authenticated, password-protected patient portal where parents submit progress updates, exercise completion logs, and follow-up clinical photographs; and
• Direct electronic communications with our clinical care team via secure portal messaging, encrypted email, and structured consultation interviews.

4.1.2 When completing digital assessment forms, you must review the submitted information to confirm that all disclosures regarding your child's medical background, medications, and physical symptoms are true, accurate, and complete to the best of your knowledge.

4.2 Verifiable Parental Consent on Behalf of Minors

4.2.1 Our clinical services are directed exclusively to children aged three (3) to twelve (12) years who lack the legal capacity to independently evaluate healthcare decisions or provide lawful consent to the collection and handling of sensitive personal data. Accordingly, children are not permitted to register accounts, submit information, or manage portal profiles independently.

4.2.2 Before we collect any personal or sensitive information regarding a child, we require the parent or legal guardian to complete a robust, verifiable consent process. This process includes:

• A formal digital declaration that the individual registering the account holds lawful parental responsibility or legal guardianship under applicable family law;
• Two-factor authentication or one-time passcode verification linked to the parent's verified mobile phone number or email address;
• Clear, separate digital acknowledgments authorising the collection of health information, participation in telehealth consultations, photographic recording for clinical analysis, and virtual treatment delivery; and
• Where parents are separated or subject to formal parenting orders governing medical decisions, the provision of relevant documentation confirming the registering parent's authority to engage healthcare providers on behalf of the child.

4.2.3 We reserve the right to suspend clinical services, withhold assessment reports, and seek independent verification where conflicting instructions are received from different parents or where parental authority cannot be verified to our reasonable satisfaction.

4.3 Information Received from External Practitioners and Referrers

4.3.1 To ensure collaborative, multidisciplinary care, we may receive personal and sensitive health information regarding your child from external healthcare providers. These external referrers commonly include general dental practitioners, specialist paediatric dentists, orthodontists, general medical practitioners, paediatricians, ear, nose, and throat (ENT) surgeons, speech pathologists, occupational therapists, and lactation consultants.

4.3.2 External information received may include formal clinical referral letters, dental records, radiographic imaging, sleep study reports, and allied health assessment summaries.

4.3.3 Where we receive personal or sensitive health data from a third-party healthcare provider, we will notify you at or before your child's initial consultation, specify the nature of the records received, and formally associate those records with your child's secure clinical profile within our patient management system.

5. Clinical Telehealth Consultations and Automated Medical Transcription

5.1 Purpose and Operation of the Heidi AI Medical Scribe

5.1.1 To maintain the highest standard of direct clinical engagement during virtual consultations, our treating practitioners utilise an automated clinical documentation and ambient transcription tool currently known as Heidi AI (the AI Medical Scribe). Virtual paediatric consultations require clinicians to maintain continuous visual attention on the child's oral postures, motor exercises, and behavioural responses, which is significantly impeded by manual contemporaneous typing.

5.1.2 The AI Medical Scribe operates strictly as an administrative and clinical documentation assistant. During a live telehealth consultation, the tool captures the spoken dialogue between the clinician, the parent, and the child, converting the audio stream into real-time text transcription and drafting structured clinical consultation notes, progress summaries, and therapeutic exercise recommendations.

5.1.3 You are advised of the following foundational technical and operational parameters governing the AI Medical Scribe:

• No Automated Clinical Decision-Making: The AI Medical Scribe is an administrative documentation tool and does not possess diagnostic capabilities. It does not evaluate clinical imagery, formulate diagnoses, make treatment decisions, or override the independent professional judgment of your treating clinician;
• Mandatory Human Clinical Review: Every draft clinical note, summary, and recommendation generated by the software is rigorously reviewed, edited, verified, and approved by the treating dental practitioner or orofacial myologist before being entered into your child's permanent medical record; and
• No Public Model Training: Audio streams, raw transcripts, and patient identifiable data processed by the AI Medical Scribe are strictly segregated and are never used, shared, or processed to train, fine-tune, or develop public artificial intelligence models, open-source language models, or third-party commercial algorithms.

5.2 Explicit Parental Consent and Opt-In Mechanics

5.2.1 Automated audio transcription is never activated by default. The AI Medical Scribe is deployed solely where a parent or legal guardian has provided express, informed, and verifiable opt-in consent prior to the commencement of the clinical consultation.

5.2.2 Participation in automated transcription is entirely voluntary. You maintain the absolute right to decline consent or withdraw your consent at any time, including during an active consultation, by instructing your clinician to disable the tool.

5.2.3 If you choose not to consent to the use of the AI Medical Scribe, your child's clinical care will not be compromised, delayed, or prejudiced in any manner. In such circumstances, your treating clinician will document the consultation manually using conventional keyboard entry and contemporaneous written notes.

5.3 Audio Processing, Data Transmission, and Transcript Retention

5.3.1 Where parental consent has been granted, consultation audio captured during the telehealth session is processed subject to strict technical safeguards:

• Encryption in Transit: Audio streams transmitted between your device, the telehealth platform, and the transcription processing environment are encrypted using industry-standard security protocols;
• Ephemeral Audio Processing: Voice audio is held in temporary, volatile server memory strictly for the brief duration necessary to generate the written textual transcript. Once the speech-to-text transcription is completed, the raw audio recording is automatically and permanently expunged from the processing environment;
• Transcript Review and Purging: The preliminary text transcript generated by the tool is accessible solely to your assigned treating clinician within a secure, authenticated interface. Once the clinician reviews, edits, and transfers the finalised clinical summary into our permanent Australian patient management system, the draft transcript is permanently deleted from the transcription cache; and
• Permanent Record Storage: Only the finalised, clinician-approved consultation note is retained, forming part of your child's confidential clinical health record within our primary Australian data centre infrastructure.

6. How We Use and Disclose Collected Health Data

6.1 Clinical Delivery and Care Management

6.1.1 We collect, hold, and use your and your child's personal and sensitive health data primarily to deliver safe, effective, and personalised paediatric clinical care. Specific clinical and operational purposes include:

• Conducting comprehensive virtual assessments of (without limitation) dental occlusion, arch form, palatal architecture, and orofacial myofunctional status;
• Formulating custom, staged orofacial therapy programs, habit-elimination protocols, and neuromuscular exercise routines;
• Monitoring your child's developmental progress, reviewing submitted exercise videos, and evaluating longitudinal photographic records;
• Scheduling appointments, conducting consultations, and delivering secure clinical progress communications to parents;
• Processing billing transactions, issuing tax invoices, generating itemised receipts for private health fund rebates, and administering NDIS funding claims; and
• Complying with mandatory clinical governance standards, internal peer review, clinical auditing, and quality improvement processes.

6.2 Collaborative Care and External Referrals

6.2.1 Paediatric orofacial myology achieves optimal therapeutic outcomes when integrated with a child's broader healthcare team. With your express consent, we may disclose relevant clinical notes, assessment reports, and diagnostic photographs to external healthcare practitioners involved in your child's care, including:

• Your child's nominated general dentist, paediatric dentist, or orthodontist;
• Your child's general medical practitioner, paediatrician, or ENT surgeon; and
• Allied health professionals treating your child, including speech pathologists, occupational therapists, physiotherapists, and osteopaths.

6.2.2 We will not disclose your child's clinical records to external practitioners without your prior written or digitally recorded authorisation, except in the following limited and critical circumstances:

• Where we reasonably believe that disclosure is necessary to lessen or prevent a serious threat to the life, health, or safety of your child or another individual, and obtaining timely parental consent is impracticable;
• Where our clinical staff are subject to mandatory statutory child protection reporting obligations regarding suspected abuse, neglect, or imminent harm; or
• Where disclosure is expressly commanded or authorised by law, including in response to a valid court order, subpoena, or statutory warrant.

6.3 Third-Party Technology Vendors and Operational Infrastructure

6.3.1 To operate an advanced, highly reliable digital health practice, we engage trusted third-party technology contractors and infrastructure service providers. These entities process data on our behalf and include:

• Cloud infrastructure, database, and private object storage providers hosting our web servers, databases, and media repositories;
• Practice management software vendors maintaining our electronic clinical records, charting interfaces, and clinical scheduling calendars;
• Specialised healthcare communication platforms facilitating encrypted transactional SMS alerts, video consultation links, and secure email dispatches;
• PCI-DSS compliant payment gateways managing credit card tokenisation and payment processing without storing raw card data on our local systems; and
• Specialised clinical software providers, including the Heidi AI medical transcription platform operating under strict non-disclosure terms.

6.3.2 Each vendor is contractually bound to maintain strict confidentiality, enforce industry-standard security safeguards, and refrain from accessing, using, selling, or disclosing your personal or health data for any purpose other than providing the contracted operational service to us.

7. Storage, Hosting, and Cross-Border Transfers

7.1 We apply a strict structural separation between your child's sensitive clinical records and non-clinical administrative operational data:

• Primary Clinical Data Resides in Australia: Your child's electronic health records, including intake assessments, clinical consultation notes, dentist charting, treatment plans, habit tracking logs, intra-oral photographs, and clinical video submissions, are hosted exclusively on secure cloud servers located within Australia (currently within the Sydney AWS/Azure data centre regions); and
• Private, Encrypted Media Storage: All patient photographs and video recordings are stored in private, access-restricted cloud object storage buckets. Photographic media is never indexed publicly, is never accessible via static web links, and can only be viewed by assigned clinical staff using temporary URLs.

7.2 Certain non-clinical administrative tools, practice management integrations, and communications infrastructure operate cloud infrastructure that may route or store non-sensitive personal data overseas. The categories of overseas processing include:

• Payment processing and billing administration services operating infrastructure primarily located within the USA;
• Transactional email dispatch services utilising server infrastructure operating within the USA and Japan; and
• Website analytics and performance monitoring systems operating across distributed global cloud networks;
• Telehealth video sessions, which are delivered through a video platform operating infrastructure primarily located within the USA;
• SMS appointment notifications and two-way texting delivered through a communications platform operating within the USA; and
• Mobile app push notifications delivered through Apple and Google notification services.

7.3 These overseas service providers process administrative contact details, billing identifiers, appointment details, video and audio streams for the duration of a live session, and technical telemetry. Documents you request or that form part of your agreement with us (your signed treatment plan and consent, tax invoices, a referral letter, or a copy of your child's assessment report) are sent to your nominated email address. We actively exclude sensitive clinical records, photographic assessments, and medical consultation summaries from overseas email and administrative tools; all clinical exchanges are confined strictly to our Australian-hosted secure patient portal.

7.4 Whenever personal data is transferred across international borders to overseas service providers, we take reasonable commercial and legal steps to ensure that the overseas recipient handles the information with an equivalent standard of protection to Australian privacy requirements, including executing enforceable data protection agreements, technical standard contractual clauses, and mandatory encryption covenants.

8. Data Security and Technical Safeguards

8.1 We implement comprehensive administrative, physical, and technical controls designed to protect personal and sensitive health information from misuse, interference, loss, unauthorised access, modification, or unlawful disclosure.

8.2 Our technical security architecture includes:

• End-to-End Cryptography
• Strict Role-Based Access Controls
• Parent Account Authentication
• Short-Lived Signed Media Links
• Continuous Logging and Auditing
• Regular Security Assessments

8.3 All our employees, clinical contractors, and administrative personnel undergo comprehensive background checks and receive formal training regarding health data privacy, clinical confidentiality obligations, and data breach prevention. All staff members are bound by legally enforceable confidentiality agreements.

8.4 While we implement rigorous technical safeguards, no internet-based data transmission or electronic storage architecture can be guaranteed to be entirely impenetrable. We maintain comprehensive business continuity, backup, and disaster recovery procedures to safeguard clinical data integrity against unforeseen technical events.

9. Retention and Disposal of Children's Clinical Records

9.1 In accordance with Australian health record-keeping standards and clinical governance requirements, paediatric dental and medical records are subject to extended statutory retention schedules.

9.2 Because our patients are minors at the time of clinical care, all clinical files, including intake forms, diagnostic photographs, clinical notes, therapy plans, exercise video submissions, and billing records must be retained for a mandatory minimum statutory retention period:

• Clinical records must be retained for at least seven (7) years from the date of the last clinical service provided to the patient; or
• Clinical records must be retained until the paediatric patient attains the age of twenty-five (25) years,

whichever milestone occurs later in time.

9.3 Where a parent requests account closure, deregistration, or deletion of personal data from our active portal, such deletion is executed as an administrative "soft-delete". The patient profile is disabled from active marketing, portal access is locked, and billing profiles are closed, but the underlying clinical and photographic records are retained in restricted, encrypted storage until the expiry of the mandatory statutory retention period. Information entered into an online assessment that is never completed (no account created and no photos submitted) is not a clinical record and is deleted automatically after thirty (30) days of inactivity.

9.4 Upon the expiration of the mandatory retention milestone, archived records are permanently and securely destroyed in accordance with our records disposal schedule, so that patient data cannot be recovered or accessed thereafter.

10. Parent and Guardian Rights of Access and Correction

10.1 As a parent or legal guardian holding lawful authority, you possess the right to request access to the personal information and sensitive health records we hold regarding you and your child, and to request corrections where you believe that information is inaccurate, out-of-date, incomplete, irrelevant, or misleading.

10.2 To submit a formal request for access or correction, you must contact our Privacy Officer in writing using the contact details provided in Section 13 of this Policy. Your request must clearly state the specific records requested or the precise corrections sought.

10.3 To protect the privacy and safety of our paediatric patients, we enforce a strict identity verification process before releasing any medical files. We may require you to provide certified photographic identification, confirm secondary security factors, or present legal documentation establishing your ongoing parental responsibility or guardianship.

10.4 We will acknowledge your request within seven (7) calendar days of receipt and provide a substantive written response within thirty (30) calendar days. In accordance with applicable Australian privacy principles, we will not charge any fee for lodging an access or correction request. We reserve the right to levy a reasonable, cost-reflective administrative fee to cover the physical reproduction, digital media compilation, or postage costs associated with complex file transfers, but we will notify you of any applicable costs prior to processing the request.

10.5 In limited circumstances established under privacy standards, we may refuse access to health records.

10.6 If we refuse your request for access or correction, we will provide you with a written notice outlining the legal and factual reasons for the refusal and explaining the avenues available to complain about the decision.

10.7 Where we agree that health information requires correction, we will take all reasonable steps to update our active databases and inform relevant external healthcare practitioners to whom the erroneous data was previously disclosed. Where we disagree with a requested clinical correction (for example, regarding a practitioner's clinical diagnosis or clinical observations), we will, upon your request, attach an explanatory statement to the permanent medical file recording your perspective.

11. Marketing Communications and Commercial Opt-Outs

11.1 We maintain a strict separation between essential clinical and operational communications and optional marketing or promotional messages:

• Essential Clinical and Transactional Messages: Communications directly relating to your child's clinical care such as appointment confirmations, telehealth video access links, therapy check-in reminders, exercise review alerts, clinical progress reports, portal security alerts, and billing receipts, are classified as essential service messages. These messages are delivered via secure portal alerts, SMS, or email, and cannot be opted out of while your child is actively enrolled in a clinical program; and
• Marketing and Promotional Communications: Marketing communications encompass practice newsletters, educational updates regarding paediatric dental development, information regarding new orofacial therapy services, and seasonal practice promotions. We will never send you marketing materials unless you have provided express opt-in consent to receive them.

11.2 We strictly respect your commercial communication preferences. Every marketing or promotional email or SMS we dispatch includes an immediate, prominent, and functional opt-out mechanism (such as an electronic "Unsubscribe" hyperlink or SMS reply stop command). You may also opt out of promotional communications at any time by contacting our Privacy Officer or updating your notification preferences directly within your secure patient portal settings.

11.3 Once an opt-out request is submitted, we will action the instruction across our marketing distribution lists promptly and within no more than five (5) business days. Opting out of promotional messages will not impact, diminish, or alter the delivery of essential clinical messages regarding your child's therapy.

11.4 We do not sell, rent, or commercialise personal or health data to third-party marketing brokers, advertising networks, or commercial enterprises under any circumstances. Furthermore, we maintain a strict policy prohibiting the publication of patient testimonials or clinical before-and-after photographs of minors for commercial advertising purposes.

12. Incident Response and Mandatory Data Breach Management

12.1 We take the security of paediatric health data with paramount seriousness and maintain a comprehensive Data Breach Response Plan. An eligible data breach occurs where there is unauthorised access to, unauthorised disclosure of, or loss of personal or health information held by us, and where a reasonable person would conclude that such breach is likely to result in serious harm to any of the individuals to whom the information relates.

12.2 Where an assessment confirms that an eligible data breach has occurred that is likely to cause serious harm, and we have not been able to remediate the harm through immediate containment measures, we will promptly notify:

• The Office of the Australian Information Commissioner (OAIC), detailing the nature of the breach, the classes of information involved, and our remediation actions; and
• The affected parents, guardians, and carers directly, via email and secure portal alerts.

12.3 Our breach notification to parents will provide clear, transparent, and actionable information, including:

• A detailed description of the incident and the date or period of occurrence;
• The specific types of personal and health data involved (for example, parent contact details, child assessment answers, or clinical photographs);
• The proactive remediation steps we have taken to secure our platforms; and
• Practical, protective recommendations parents can adopt to safeguard their family's privacy and reduce the risk of secondary harm.

13. Inquiries, Feedback, and Complaints Resolution

13.1 We are deeply committed to resolving any privacy concerns, complaints, or disputes promptly, fairly, and transparently. If you have any inquiries regarding this Policy, wish to exercise your access or correction rights, or believe that we have mishandled your family's personal or health information, we encourage you to contact our designated Privacy Officer.

13.2 Formal privacy inquiries and complaints must be directed to:

• Attention: The Privacy Officer
• Practice Name: Holistic Smiles Kids Pty Ltd
• Electronic Mail: hello@holisticsmileskids.com.au
• Postal Address: Privacy Officer, Holistic Smiles Kids, Suite 1600, Level 16, Westfield Tower 1, 520 Oxford Street, Bondi Junction NSW 2022

13.3 We follow a structured, multi-stage dispute resolution protocol:

• Stage 1: Acknowledgment: Our Privacy Officer will formally acknowledge receipt of your complaint in writing within seven (7) calendar days, providing you with a unique complaint tracking reference and the contact details of the investigating officer;
• Stage 2: Investigation: The Privacy Officer will conduct an independent internal review of our records, audit logs, staff conduct, and technical systems to investigate the matters raised in your complaint;
• Stage 3: Resolution: Within thirty (30) calendar days of receiving your complaint, we will provide you with a comprehensive written response detailing our findings, the reasons for our decision, and any corrective or remedial actions we have implemented to address your concerns; and
• Stage 4: External Escalation: If you are not satisfied with our internal resolution, or if we fail to provide a substantive response within thirty (30) days, you have the right to escalate your complaint to the independent national privacy regulator:

Office of the Australian Information Commissioner (OAIC) Online Portal: www.oaic.gov.au Telephone: 1300 363 992 Post: GPO Box 5218, Sydney NSW 2001

14. Document Governance and Policy Updates

14.1 This Policy is governed by our clinical governance board and undergoes regular review to ensure continuous alignment with technological advancements, clinical telehealth standards, and legal requirements.

14.2 This Policy is effective and operational as of 14 September 2026 and supersedes all prior privacy policies, notices, and clinical data handling statements issued by Holistic Smiles Kids Pty Ltd.

14.3 We reserve the right to amend, modify, or update this Policy from time to time. The current, authoritative version of this Policy will always be published on our public website with its designated effective date clearly displayed.

14.4 Where we introduce material changes that significantly affect how we collect, process, store, or disclose your child's sensitive health information, clinical photographs, or AI transcription records, we will notify you directly. Such notification will be delivered via email to your registered account address or displayed prominently as a mandatory acknowledgment notice upon your next sign-in to the secure patient portal.

14.5 Your continued use of our website, participation in consultations, or access to the secure patient portal following notification of an updated Policy constitutes your informed acceptance of the amended terms on your own behalf and on behalf of your child.