Privacy Policy

Dental Story is an Australian social media agency working with dental practices nationwide. We are the entity responsible for the personal information described in this policy.

Contact for all privacy matters, including access, correction and deletion requests: hello@dentalstory.au, or 0435 501 693.

We collect three distinct kinds of information.

Enquiry information. If you call, email, use the contact page or message us on Instagram, we receive your name, contact details, practice name and whatever you choose to tell us about your practice.

Client information. For practices we work with, we hold business contact details, brand materials, and the photography and video produced at content sessions, which may include images of practice owners and team members.

Platform information from Meta and other social networks. When a client connects their Facebook Page or Instagram professional account to us, we receive, on their authorisation: the account or Page name and ID, the profile picture, an access token, the posts and media we publish or schedule on their behalf, the comments and direct messages we are engaged to respond to, and aggregate engagement and reach statistics for those accounts.

We do not collect health information, and we do not ask practices to send us patient records. Please do not send us patient information.

Enquiry information is used only to reply to you and to scope the work you have asked about.

Client and platform information is used solely to deliver the service the client has engaged us for: creating, scheduling and publishing content to their own accounts, responding to comments and direct messages on their behalf, and reporting back on how that content is performing.

We do not sell personal information. We do not share it for anyone else’s advertising. We do not use data obtained from Meta to build profiles, to enrich other datasets, or for any purpose other than operating the account we were authorised to operate.

This website sets no analytics cookies, no tracking pixels and no advertising identifiers. Nothing you do here is used to target you with advertising, on this site or anywhere else.

Our hosting provider keeps standard server logs (IP address, request time, page requested, user agent) for security and reliability. These are not used to identify individual visitors.

We share information only with the service providers we need to deliver the work, and only to the extent required:

• Meta Platforms, to publish content to, and read engagement data from, the client’s own Facebook Page and Instagram account.
• Hosting and infrastructure providers , to run this website and our scheduling system.
• Email and file storage providers , to correspond with clients and store content deliverables.

Some of these providers store data outside Australia. We take reasonable steps to ensure any overseas recipient handles personal information consistently with the APPs. We otherwise disclose information only where required by law.

Access tokens for connected social accounts are encrypted at rest and are never displayed, exported or shared. Access to client accounts is limited to the people working on that account. We publish only what a client has authorised us to publish.

No system is perfectly secure, but if a data breach ever occurred that was likely to cause serious harm, we would notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Enquiry correspondence is kept while there is an active conversation and for a reasonable period afterwards, then deleted.

Client information and content are kept for the term of the engagement and for as long as we are required to keep business records afterwards.

Access tokens are deleted as soon as an account is disconnected or an engagement ends, whichever is first. Disconnecting also immediately ends our ability to see or post anything to that account.

You can ask us at any time for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. There is no charge, and no reason needs to be given.

To delete data associated with a connected Facebook or Instagram account:

• Remove our access from the account itself, in Facebook via Settings & Privacy → Settings → Business integrations, or in Instagram via Settings → Website permissions → Apps and websites. This revokes our access token immediately.
• Or email hello@dentalstory.au with the account name and the words “delete my data”. We will delete the stored token, the account profile details and any cached posts or messages, and confirm in writing within 30 days.

Content already published to the client’s own accounts belongs to the client and remains under their control; it can be removed from those accounts at any time.

Everything we publish for a dental practice is produced to comply with the AHPRA Guidelines for advertising a regulated health service and section 133 of the National Law. In practice that means: no testimonials or reviews about clinical care used in advertising, no misleading or deceptive content, no claims of guaranteed outcomes, no comparative or superlative claims, no content that could encourage indiscriminate or unnecessary use of a health service, and no offers without their full terms and conditions.

Before-and-after imagery is tightly restricted rather than banned. We only use it where the conditions of the guidelines are met, including consistent lighting, angle and framing, no editing that overstates the result, and clear information about the treatment and its risks.

Patients are not our subject matter. Content sessions are photographed and filmed so that patients are not identifiable. Where any identifiable person appears in content we produce, team member or patient, it is published only with their written consent, obtained before publication, and that consent can be withdrawn at any time by contacting the practice or us.

If you appear in content we have published and want it removed, email hello@dentalstory.au and we will take it down.

Our services are directed at dental practices, not at children. We do not knowingly collect personal information from anyone under 18. Where a child appears in practice content, it is published only with the written consent of a parent or guardian.

If you think we have mishandled your personal information, please contact us first at hello@dentalstory.au, we will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We may update this policy as our services change. The effective date at the top of this page always reflects the current version. Material changes affecting existing clients will be communicated directly.