Privacy Policy

1Who is responsible for your personal information

Smile Solutions Vietnam Pty Ltd (ACN: 699 292 405), an Australian company (“SSV”, “we”, “us”, “our”), is the entity responsible for the personal information you provide when engaging with our website, our team, or our coordination services.

SSV is the controller of your personal information for the purposes of the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

Our partnered dental clinic in Vietnam — Elite Dental Group (“EDG”) — is a separate, independent controller for the personal and clinical information it collects, uses, and stores when treating you. We share information with EDG so it can plan and deliver your treatment; how EDG handles that information after it reaches them is governed by EDG’s own privacy practices and by the laws of Vietnam.

2What we collect

We collect the following categories of personal information:

• Identification and contact details — full legal name, date of birth, residential address, phone number, email address, nationality, passport details (for travel coordination), and emergency contact details.
• Health and dental information (sensitive information) — dental history, current dental conditions, relevant medical history, medications, allergies, diagnostic photos and imaging (X-rays, panoramic radiographs, CBCT scans), and the treatment plans prepared by EDG.
• Financial information — payment method, transaction records for deposits and treatment payments, and bank details for any refunds. We do not store full card numbers; card payments are handled by our payment processor.
• Travel information — flight numbers, accommodation bookings, passport details where required, trip dates, and visa status.
• Communications — emails, WhatsApp and messaging app conversations, call recordings (where we have your consent), and notes from consultations with our coordinators.
• Next of kin / emergency contact details — name, relationship, phone number, and email.
• Device data, cookies, and tracking — we use cookies, pixels, and local storage identifiers to enhance user experience and measure marketing performance. You can block or delete cookies through your browser, though certain website features may not function properly.
• Signing audit trail — IP address, device fingerprint, timestamped signing record, email delivery receipt, and your name — collected for audit integrity and fraud prevention when you sign agreements electronically.

We collect most of this information directly from you. Some information (specifically clinical information generated after you arrive for treatment) is created by EDG and shared back with us for coordination purposes. We only collect data reasonably necessary for the purposes described in this policy.

3What we use your information for

• Coordinating your treatment journey — scheduling appointments with EDG, liaising with the clinic on your behalf, arranging in-country support, and communicating trip logistics.
• Providing pre-travel information — sharing EDG’s pre-travel health questionnaire with you, and relaying EDG’s treatment plan and warranty terms.
• Case management — ongoing support throughout your engagement, including the post-treatment coordination window and any Australian-side follow-up.
• Legal and regulatory compliance — responding to regulators, complying with our contractual obligations, defending any claims, and meeting our data retention obligations.
• Quality review (internal) — reviewing how our coordination service performs so we can improve it. This is performed on an anonymised basis where practicable. Where anonymisation is not practicable, we will seek your separate consent before using identifiable information.
• Marketing (opt-in only) — contacting you with updates about our services, case studies, or promotions. This requires your separate, explicit opt-in consent and you can withdraw it at any time.

We will not use your information for any purpose beyond those listed unless we ask for your separate consent first, or unless a new purpose is directly related to and compatible with the original purpose and you would reasonably expect it.

4Sensitive information and consent

Your health and dental information is “sensitive information” under Australian law and is subject to a higher standard of consent under the Privacy Act 1988 (Cth) and APP 3.

• We collect your health information only with your explicit, informed consent.
• Your health-information consent is separate from your general personal-information consent.
• Your marketing consent is separate from both and is strictly opt-in. You can withdraw marketing consent at any time without affecting the coordination service we provide you.

You can withdraw any consent at any time (subject to certain exceptions where the law requires us to retain information). Withdrawing your health-information consent will usually mean we can no longer coordinate your treatment, because sharing your health information with EDG is essential to treatment planning and delivery.

5Who we share your information with

• Elite Dental Group (EDG) — for treatment planning, clinical delivery, post-treatment care, and payment reconciliation. EDG is an independent controller of the information we share.
• Our in-country operations team — bilingual coordinators, logistics assistants, and consultants who handle your non-clinical support during your trip.
• Travel and accommodation suppliers — airlines, hotels, transfer providers, insurers, and visa services, but only to the extent necessary to arrange your trip.
• Case-management and administrative service providers — document storage providers, e-signing platforms, accounting services, and legal advisers. Each is contractually bound to handle your information consistently with this policy.
• Analytics and advertising partners — such as Meta and Google for hosting, analytics, and advertising, as described in our Cookie Policy.
• Regulators and authorities — where we are legally required to disclose (for example, under a valid court order, regulatory investigation, or tax authority request). We will notify you of any such disclosure unless the law prohibits us from doing so.
• Your next of kin / emergency contact — in a medical emergency. By providing us with your next-of-kin details, you explicitly consent to us contacting them and sharing relevant health and treatment information in a medical emergency.

We do not sell your personal information. We do not share your personal information with data brokers.

6Cross-border transfers

Because our business coordinates dental treatment in Vietnam for patients living in Australia, your personal information will cross international borders during the course of your engagement.

Australia to Vietnam. When we share your information with EDG, our in-country operations team, or a local service provider in Vietnam, it moves from Australia to Vietnam. Under APP 8.1 we remain accountable to you under the Australian Privacy Principles for how your information is handled by any overseas recipient, as if we had handled it ourselves in Australia. We satisfy our APP 8 obligations through written data processing agreements that bind recipients to a standard of protection comparable to the APPs.

Processing within Vietnam. Once your personal information is in Vietnam, it is also subject to local data protection laws, including the Vietnamese Personal Data Protection Decree (Decree 13/2023/ND-CP). Local compliance obligations rest on EDG and any Vietnamese service providers as local data handlers. Our agreements require them to maintain any filings, registrations, or assessments required by Vietnamese law.

Return transfers. When we send you information from Vietnam back to Australia (for example, your finalised treatment plan or post-treatment follow-up), we ensure the return transfer complies with APP 8.

7How long we keep your information

We retain your personal information only for as long as it is needed for the purposes in this policy, plus any additional period required by law.

Health information held by EDG is retained under EDG’s own retention schedule and is outside SSV’s control. When no longer required, data held by SSV is securely deleted or anonymised.

8Your rights

Under Australian privacy law, you have the following rights in relation to your personal information:

• Access — you can ask us for a copy of the personal information we hold about you.
• Correction — you can ask us to correct information that is inaccurate, out of date, incomplete, or misleading.
• Withdrawal of consent — you can withdraw any consent you have given us at any time. Withdrawal may prevent us from continuing to coordinate your treatment.
• Deletion — you can ask us to delete your information, subject to any legal retention obligations.
• Data portability — if you ask us to provide a copy of your information in a structured, commonly used format, we will do so where technically practicable.
• Objection — you can object to our processing of your information for marketing purposes.

To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days of receiving your request.

9Data breach notification

If we discover a personal data breach that is likely to result in serious harm to any affected individual, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth):

• we will notify affected individuals as soon as practicable after we have completed our assessment of the breach; and
• we will notify the Office of the Australian Information Commissioner (OAIC) as required.

Where a breach originates or affects records held in Vietnam, we will also coordinate with EDG and any relevant Vietnamese authorities to the extent required by Vietnamese law.

10How we protect your information

We use reasonable technical and organisational security measures appropriate to the sensitivity of the information, including:

• encrypted storage for health information and identification documents;
• TLS-encrypted data transmission;
• access controls so that only authorised staff can access your information on a need-to-know basis;
• firewalls, DDoS protection, and network isolation for our infrastructure;
• contractual obligations on all service providers to protect your information consistently with this policy;
• staff training on privacy and data protection; and
• an incident response plan for handling suspected breaches.

11Marketing and communications

• We may contact you by email, SMS, WhatsApp, Facebook Messenger, or phone following your submission of a contact form, quiz, or booking enquiry.
• All marketing messages include clear opt-out instructions.
• You may withdraw consent for marketing at any time; processing will cease within a reasonable timeframe.
• Outbound calls are made only to individuals who have expressed interest in our services.

12Children

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors and will delete any such information upon discovery.

13Complaints

If you believe we have mishandled your personal information, please contact our Privacy Officer at [email protected] and we will respond within 30 days.

If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14Changes to this policy

We may update this policy from time to time to reflect changes in law, our business practices, or our services. If we make material changes we will notify you at least 30 days before the change takes effect and give you a chance to withdraw your consent if you do not agree. The latest version is always available on this page.