Praktika Privacy Policy
1
Praktika is an Internet-based online dental practice management software package developed by Lizard Software Pty Ltd (We/Us).
2
This policy sets out how We manage the collection, use, disclosure and handling of personal information. Personal information is information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained from the information or opinion. Personal information includes sensitive information and health information. Personal information may directly or indirectly identify a person.
We are committed to protecting the privacy of personal information which We handle. We recognise that privacy principles protect personal information as a matter of individual right. We recognise the essential right of individuals to have their information handled in ways which they would reasonably expect — protected on the one hand, and made accessible to them on the other.
3
In this policy: “Practice” means a health practitioner, or their employees or contractors, who uses Praktika; “patient” means an individual who receives care from a Practice and whose personal information is entered into Praktika; and references to “you” mean the Practice or its staff, as the user of Praktika, unless a clause makes clear that it addresses patients directly. This policy applies both to Practices and to their patients. Practices are responsible for making this policy (or an equivalent notice) available to their patients — see clause 15.8.
Collection of personal information
4
We collect personal and health information about patients from health practitioners (practices) or their employees/contractors (staff) who use Praktika. We store and handle a range of personal information items for the purposes of providing services to dental practices. We also collect and store personal information of Praktika users for the purposes of providing online service to Praktika users. This information may include:
4.1
name, address and contact details (including phone number and email);
4.2
date of birth;
4.3
information relating to private health insurance;
4.4
employment and financial information;
4.5
information regarding ongoing medical treatment and medical conditions;
4.6
any other health and personal information that practices may want to collect about their patients, staff members or other relevant entities like other organisations, their staff, etc.
5
We only collect personal information to the extent necessary to provide Our services. If we do not collect this information, we could not provide those services effectively or at all.
6
We generally only collect personal information that a practice, its staff or patients enter into the Praktika online system.
7
We are bound by Australian and Victorian privacy laws, and the Health Records Act 2001, and, where a Practice operates outside Victoria, the equivalent health privacy legislation of that State or Territory (such as the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT)), as well as other laws which impose specific obligations in regard to storing and handling personal and health information.
8
We have adopted the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) as minimum standards in relation to handling personal information.
In broad terms this means that We:
- store and handle only information which We need for our specified primary purpose, i.e. provision of services to practices and their patients;
- ensure that the clients know how We handle, store and provide access to that information;
- use and disclose it only for the primary or a directly related purpose, or for another purpose with the practice's or person's consent (unless otherwise authorised by law);
- store it securely, protecting it from unauthorised access; and
- retain it for the period authorised by the Health Records Act 2001 or according to the practice's specific requests;
- provide practices and their staff with secure access to the information they store in Praktika.
- provide practices, staff and patients with information about how to access and correct their personal information, and how to make a complaint (see clauses 18 and 19).
Collection of information via Praktika online software
9
Information about computers or web devices that access Praktika is automatically recorded. Information recorded includes IP addresses, date and time of Praktika service accessed or files downloaded, operating system and type of browser used and user actions performed. This information may be collected for statistical and system administration purposes, and to improve Our services. It may identify individuals by means of their username, password and their recorded IP address.
10
We also use cookies to assign a device a user ID. Cookies contain information that allows us to identify a device. We use this information to help Us determine whether or not to allow access to Praktika system. If your Internet browser is not configured to use cookies, you will not be able to access Praktika.
Use and disclosure of personal information
11
Where we collect personal information via Praktika online software and store it, we may only use or disclose that personal information for purposes including the following:
- for the purpose that We have collected the information, i.e. securely storing it and providing secure access to it by the authorised Praktika users;
- purposes connected with the operation, administration, development or enhancement of Praktika online software and the services it is used to provide;
- any other purposes required or authorised by law.
12
We may also disclose personal information if required by law to do so. This may include disclosure to regulatory agencies, to courts or tribunals.
Transfer of information outside of Australia
13
Our services are compliant with the current Australian legislation, and all the personal and health information we collect is stored on the servers owned and controlled by us located within the Australian mainland. We will not pass any personal or medical information to 3rd party organisations or persons in Australia or overseas unless it is explicitly requested by the owner of the information we store. The request must come from the data owners or their authorised officers, and it must be presented in a written form as a hardcopy document or come in an electronic form from the practice's authorised email.
14
Despite clause 13 above, certain services that we provide, such as AI-Scribing, may utilise third-party services, whose servers are in the United States of America. If in the course of providing our service to you we are required to transfer personal and/or health information to overseas persons or entities (Overseas Disclosure), we shall take reasonable steps to ensure contractual measures are in place to protect the information in accordance with Australian law, or otherwise take reasonable steps to ensure the recipient country has privacy protections substantially similar to the Australian Privacy Principles (APPs). You acknowledge and consent to us making such Overseas Disclosure so that we may provide you with our service. As a condition of providing you access to such services requiring Overseas Disclosure, you must ensure that the relevant patient's informed consent for the Overseas Disclosure has been obtained before that patient's information is submitted to the relevant overseas service, including such consent to the non-application of any relevant APP to the Overseas Disclosure, for example, APP 8.1. Currently, this includes DeepGram, Google, and Anthropic, whose servers are located in the United States of America. We will update this policy if We engage additional overseas service providers, or providers located in other countries.
Practice responsibilities
15
When a practice provides us with personal information about a patient, we require that the practice:
15.1
collect personal information in accordance with relevant privacy laws;
15.2
obtain the informed consent of the patient for the disclosure of personal information to other parties involved with the patient's medical treatment, to organisations/contractors which we engage for the administration of Praktika on behalf of the practice, or to organisations/contractors which we engage to assist with Praktika providing its services to the practice;
15.3
inform the patient of all matters of which they must be informed as required by relevant privacy laws;
15.4
ensure that personal information is managed and retained in accordance with relevant privacy laws;
15.5
not use or disclose personal information except in accordance with relevant privacy laws;
15.6
take reasonable steps to ensure that personal information is protected from misuse or loss, and from unauthorised access, modification or disclosure; and
15.7
generally, comply with all relevant privacy laws.
15.8
provide a copy of this policy (or make it available, including by way of a link) to patients at or before the time personal information about them is first collected for entry into Praktika, and otherwise satisfy the notification requirements of Australian Privacy Principle 5;
15.9
ensure that any patient consent obtained in connection with an Overseas Disclosure (see clause 14) is informed, current, specific to that disclosure, and properly recorded, and provide evidence of that consent to Us on request;
15.10
direct patients to contact the practice in the first instance for any request to access or correct their personal information, or to make a complaint (see clauses 18 and 19), and cooperate promptly with any such request We refer to the practice.
Security of personal information
16
We may store personal information we hold in hard copy documents or as electronic data. We endeavour to protect all personal information that we hold from misuse and loss, and to protect it from unauthorised access, modification and disclosure.
We have implemented technology and security policies, rules and measures to protect the personal information that We have under our control. However, you should be aware that there are risks in transmitting information across the Internet. So, while We strive to protect such information, We cannot ensure or warrant the security of any information transmitted online, and practices do so at their own risk. Once any personal information comes into Our possession, We will take reasonable steps to protect that information from misuse and loss and from unauthorised access, modification and disclosure. We may remove personal information from its system where it is no longer required (except where archiving is required and in order to fulfil our obligations under the Health Records Act 2001). See also clause 20 for what happens in the event of a data breach.
We take additional steps to protect the security of the information we store and transmit, such as strong 256-bit SSL encryption.
The level of access to this information, i.e. rights to read, write or modify it, for users belonging to your practice is regulated and authorised by you. We only make sure that there is no unauthorised access to the information that is stored on our servers. Cross-account access to the information is categorically not allowed.
All the information is stored on our dedicated web servers that are located in high-level of security data centres.
Retention of personal and health information
17
We retain personal and health information for as long as it is necessary to provide services to practices that subscribe to Praktika online services. If the practice no longer subscribes to Praktika we will return all personal and health information to the practice, and may choose to destroy or de-identify that information within a reasonable time after we have verified that the responsible practice has received a copy of that information. However, the information will still be kept in archived backups for as long as it is required by Our operational necessities. As a general guide, and unless a practice specifies a longer period or applicable law requires otherwise, We retain health records for a minimum of 7 years from the date of the last entry and, for a patient who was a minor at the time of treatment, until that patient turns 25 years of age, consistent with the Health Records Act 2001 (Vic) and equivalent legislation in other States and Territories.
Accessing personal and health information
18
We try to ensure that personal information We hold is accurate, complete and up to date. All requests to access or correct personal information will be referred to the practice that provided the information to us. Where the practice that provided the information to Us is unable to respond, has ceased operating, or has ceased using Praktika, We will use reasonable endeavours to deal directly with the request within a reasonable time, in accordance with Our obligations under the Privacy Act 1988 (Cth).
Complaints
19
If you have a concern about how personal information has been handled, We encourage you to raise it with your practice in the first instance, as the practice manages the direct relationship with patients. If your complaint concerns Our own handling of personal information via Praktika, or the practice is unable to resolve your complaint, you may contact Us using the details below. We will acknowledge your complaint within a reasonable time, investigate it, and provide you with a response setting out the outcome and any steps We propose to take. If you are not satisfied with Our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
Data breaches
20
We have procedures in place to detect, respond to and, where required, notify eligible data breaches in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). Where a data breach involving personal information We hold is likely to result in serious harm, We will notify the OAIC and, working with the relevant practice, take reasonable steps to notify affected individuals.
Contact information
If you are a patient, please contact your practice in the first instance. If you are unable to reach your practice, or your enquiry concerns Our own handling of information, you can contact Us at support@praktika.com.au