Privacy Policy
Holistic Smiles Kidsis operated by Holistic Smiles Kids Pty Ltd (ABN 41 699 123 138). In this policy, "we", "us" and "our" refer to Holistic Smiles Kids.
Our Commitment
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health information about your child is treated as sensitive information, which carries additional protections under the Act.
Because we provide a clinical service, it is not practicable for you to deal with us anonymously or under a pseudonym. We need accurate identifying information to provide safe care.
What We Collect and How
We collect information directly from you, through your account, the online assessment, and the secure portal. This includes:
- Parent contact details and account information
- Your child's name, date of birth and relevant history
- Assessment answers and the photos you submit for clinical review
- Where you tell us about them, diagnoses relevant to tailoring care (such as an Autism Spectrum Disorder diagnosis) and whether your family receives NDIS funding, used only to shape your child's care pathway
- Program data such as check-ins, photo submissions and messages
- Payment information, processed securely by our payment provider
- Technical information collected automatically when you use our website, such as device and usage data (see Cookies and Analytics below)
If a referring practitioner shares information about your child with us, we will tell you at or before your first assessment.
Where Your Data Is Stored
Your child's clinical records (assessment answers, photos, dentist notes and program data) are hosted in Australia (Sydney region). Photos and videos are kept in private storage and are only ever accessed through short-lived, signed links; they are never publicly available.
Some supporting services operate overseas. Payment processing, appointment scheduling, email, and website hosting are provided by reputable providers that may process personal information overseas, primarily in the United States (and, for email, Japan). These providers handle contact, account, booking and payment information, not your child's clinical records. Where we disclose personal information to an overseas provider, we take reasonable steps under Australian Privacy Principle 8 to ensure it is handled consistently with the Australian Privacy Principles. We keep clinical detail out of email and scheduling tools: sensitive information is exchanged only in the secure portal.
How We Use It
We use your information to provide the assessment and program, to let your assigned clinicians review your child's case, to issue invoices and receipts, and to communicate with you about your child's care.
We do not sell your information. We do not use patient testimonials. We will only send you marketing communications if you have opted in, and every marketing message will include a working unsubscribe option. Messages about your child's active program (appointment reminders, check-in prompts, invoices) are not marketing and will be sent as part of the service.
Who We Share It With
We share personal information only as needed to run the service:
- Your assigned clinicians, for the purpose of your child's care
- Our payment provider, to process payments
- Our scheduling, SMS and email providers, to manage bookings and communications
- Our hosting and infrastructure providers, who store data on our behalf
- Anyone else with your consent, or where required or authorised by law
Consent
We ask for explicit, versioned consent at the point we collect health information, including a privacy collection notice, telehealth consent, and consent to use photos for clinical purposes. You can withdraw consent at any time, subject to our record-keeping obligations. As the parent or guardian, you provide consent and exercise privacy rights on your child's behalf.
Cookies and Analytics
Our website uses cookies and similar technologies to keep you signed in and to understand how the site is used. On our public pages we use Google Tag Manager to load analytics and conversion tools (including Google Analytics). We do not run any third-party analytics or tracking inside the patient app or the secure portal.
Security
We protect personal information with measures including encryption in transit and at rest, access controls limiting clinical records to your assigned care team, one-time-code verification for parent sign-in, and private storage for all photos and videos. No system is perfectly secure, but we treat your child's information with the care sensitive health information requires. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.
Access, Correction and Retention
You can request access to or correction of your (or your child's) information at any time by contacting our Privacy Officer. We will respond within 30 days and will not charge you for making a request.
Because our patients are children, clinical records are retained for seven years from the last entry or until your child turns 25, whichever is later, in line with health record-keeping obligations. After that period they may be securely destroyed. Account deletion is handled as a soft-delete subject to those retention rules.
Complaints
If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact our Privacy Officer (details below). We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.
Changes to This Policy
We may update this policy from time to time. The current version will always be available on our website with its effective date. If we make material changes to how we handle your child's health information, we will notify you directly.
Effective date: 16 August 2026
Contact
For any privacy request, contact our Privacy Officer at hello@holisticsmileskids.com.au.