Privacy Policy

DentX is a service of Next Healthcare Pty Ltd (ABN 14 169 018 937) (“DentX”, “we”, “us”) of 227 Abbotsford St, North Melbourne VIC 3051, providing teleradiology reporting services to registered dental practitioners internationally. This policy explains what personal information we collect, why we collect it, how we hold it, and the choices available to you. We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and where applicable by state and territory health records legislation.

What we collect

We collect two categories of personal information, plus a record of how you first found DentX and website analytics on our public pages:

• Practitioner account information. When a practitioner registers, we collect their name, practice name, email address, practice country and time zone, phone number, professional registration details, agreement acceptance versions and timestamps, and billing records associated with their use of the service.
• Patient health information. Practitioners upload imaging studies for reporting together with the patient details needed to report them safely: the patient’s name, date of birth, sex, country and relevant state or province, relevant clinical notes and the imaging itself (for example OPG, ceph, intraoral or CBCT studies). This is health information and sensitive information under the Privacy Act, and we treat it accordingly.
• How you first found DentX. When you first open one of our public pages, we record the campaign tags in the link you followed, the referring website’s domain, the first page and the date, in a DentX cookie (dentx_ft) kept for 90 days. If you then register, we keep that record with your account. It is not sent to Google or anyone else. We do not set it when your browser sends Global Privacy Control.

Why we collect it

We collect, hold and use practitioner and patient information to provide radiology reporting services. That includes receiving and storing uploaded studies, having them reported by radiologists, returning the report to the referring practitioner and, when they ask us to, sending a copy to another practitioner they name, communicating about a study, processing payment, and meeting our legal and professional record-keeping obligations. We do not sell personal information, and we do not use patient health information for marketing.

We also use practitioner account and billing records, never patient information, to produce aggregated reports on how practitioners find DentX and how many go on to verify their account, start a case and pay, so we can improve our website and onboarding.

Website analytics

On our public web pages — the home, dental reporting, export guide, about, contact, privacy and terms pages — we use Google Analytics, a service of Google, to understand how people find and use our website. Google Analytics does not run on the sign-in, sign-up, portal, administration or radiologist pages, or on any page used for uploads, reports, feedback or payments, so it never receives patient or case information.

When you visit a public page, Google Analytics sets cookies (named _ga and _ga_…) so it can recognise a returning browser, and collects:

• the public page you viewed and any campaign tags in the link you followed (such as utm_source=newsletter). We remove every other part of the web address before it is sent;
• the website that sent you, shortened to its domain (for example google.com, linkedin.com or chatgpt.com);
• your browser, device type, screen size and language, and your approximate location (country and city or region), which Google works out from your IP address without storing the address in Analytics;
• when you visited, how long you stayed and which public pages you viewed;
• whether you clicked a Sign up button on those pages, but nothing about what happens after you leave them.

We use this information in aggregated reports to see which channels — search, social media, AI assistants, email and direct visits — bring practitioners to DentX, and to improve the website. Google Signals and Google’s advertising features are turned off: we do not use Google Analytics to identify you or to advertise to you. Google processes this information for us and may store it outside Australia, including in the United States. Detailed analytics data is kept for no more than 14 months. Google explains how it uses information from websites that use its services at policies.google.com/technologies/partner-sites.

You can opt out at any time by installing Google’s Google Analytics opt-out browser add-on, or by turning on Global Privacy Control in your browser (we do not load Google Analytics when your browser sends that signal). Deleting or blocking cookies stops Google Analytics recognising your browser as a returning visitor, but does not by itself stop visits being counted. Our public pages work the same without Google Analytics.

How we handle information — the APPs

We manage personal information in accordance with the Australian Privacy Principles. We collect only what is reasonably necessary to report a study, we collect patient information from the treating practitioner rather than from the patient directly (as permitted for health service provision), and we use and disclose it only for the purpose it was provided or as otherwise permitted by law — for example, disclosure to the reporting radiologist, to another practitioner the referring practitioner asks us to send the report to, or where required by a court or regulator.

Storage and security

Our primary imaging and document storage uses Amazon Web Services (AWS) infrastructure in Sydney; our application database is hosted with Neon in Sydney. Australian storage does not mean exclusively Australian processing or access. Data is encrypted in transit and at rest, access is restricted to personnel who need it to deliver the service, and access is logged and auditable.

Overseas disclosure

Overseas radiologists may access patient imaging and clinical information to prepare preliminary interpretations, followed by final review and authorisation by a radiologist in Australia. Service providers may also process information outside Australia for reporting workflow, hosting, delivery, payments, communications and optional dictation. Information may therefore be accessed or processed outside the patient’s home country. We require appropriate confidentiality, security, permitted-use and onward-disclosure safeguards and remain responsible for our own legal duties. We do not use identifiable patient information for advertising or general-purpose AI training.

Before sharing information, practitioners must explain these arrangements, provide this notice and establish the lawful basis and any required consent. Contact us for relevant provider and processing-country information or questions about alternatives before uploading. Practitioner acceptance is not patient consent and does not waive patient rights. Material changes require advance notice and any additional legal steps.

Payments

Payments are processed by Stripe. Card details are provided directly to Stripe and never touch our servers. To create the requested invoice we send Stripe billing details, the dentist’s name and provider or registration number, and the patient’s name. We retain payment references and billing records. Stripe handles card information under its own privacy policy and PCI-DSS obligations.

Retention

We retain imaging studies, reports and associated patient information for the periods required by applicable clinical and health record-keeping laws, and practitioner account and billing records as required by tax and corporations law. When information is no longer required, we destroy or de-identify it securely.

Retention depends on the record and applicable jurisdiction, including additional requirements for children and legal holds. Closing an account does not delete records that must be retained. Contact us for the requirements applicable to your records.

Access and correction

Practitioners can access and correct their account information at any time through the portal, or by contacting us. Patients seeking access to or correction of health information we hold about them may contact us directly or via their treating practitioner; we will respond within a reasonable period and in accordance with the APPs and other applicable local requirements. There is no charge for making a request.

Data breaches

If a data breach involving personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act. Concerns about a possible breach can be reported to support@dentx.co.

Complaints

If you believe we have mishandled your personal information, please contact us first using the details below — we take complaints seriously and will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992, or the competent privacy regulator in your jurisdiction.

Contact

Privacy questions, requests and complaints: support@dentx.co, or write to DentX — a service of Next Healthcare Pty Ltd (ABN 14 169 018 937), 227 Abbotsford St, North Melbourne VIC 3051.

We may update this policy from time to time; the current version will always be published on this page with its last-updated date.

Changes to this policy

• 27 October 2026 (version 2026-10-27.v1). Added that when the referring practitioner asks us to, we send a copy of the report to another practitioner they name, such as a specialist. The copy is sent only on their request, so acceptances of earlier versions remain valid.
• 8 October 2026 (version 2026-10-08.v2). Added how you first found DentX (our own first-party cookie, kept with your account if you register), our use of practitioner account and billing records for aggregated reports on how practitioners find DentX and go on to use it, and Sign up clicks in the Website analytics section. Patient information is not used for these reports and nothing changed about how we handle it, so acceptances of earlier versions remain valid.
• 8 October 2026 (version 2026-10-08.v1). Added the Website analytics section about Google Analytics on our public web pages. Nothing changed about how we handle practitioner or patient information, so acceptances of the 30 September 2026 version remain valid.
• 30 September 2026 (version 2026-09-30.v1). Version in force from 30 September 2026. On the afternoon of 8 October the Website analytics section appeared under this version number for a few hours, before the version was updated.

Earlier versions of this policy are available on request.