AI Tool Register — Fill-In Template

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

The AI tool register for Example Dental Clinic (practice name). Maintained by ________________________. Last reviewed: __________.

How to use this: list every AI tool that touches the practice — including AI features inside other software (your PMS, your email, your marketing platform) and tools your agency or suppliers use on your behalf. One row each. Review the register quarterly and whenever a new tool arrives. Print it, or keep it wherever your policies live.

Why keep a register

• You can't manage what you haven't listed. The riskiest AI tool in the practice is the one nobody wrote down.
• It turns "are we okay?" into a five-minute check: every tool, its data, its approval — one page.
• When something goes wrong (or a patient, insurer or adviser asks), the register is the first thing you'll wish you had.

The register

Don't forget: AI scribes · chatbots/AI receptionists · browser extensions · AI features in your PMS or email · transcription/dictation · marketing/social tools (yours and your agency's) · backup or document tools with AI review.

How to read your own register (the patterns that matter)

• Any row with "identifiable" + "overseas/unknown" → that's a cross-border disclosure question (APP 8). Confirm where the data goes before relying on the tool. (Review trigger, not a declared breach.)
• Any row with "acts alone" → the highest-risk pattern. Ask the vendor for an approval gate, or reconsider. A tool that only reads and suggests is a different risk class from one that acts.
• Any row you couldn't fill in → that's not a gap in the form; it's a question for the vendor. The vendor questions guide is the script.
• A tool nobody remembers approving → decide now: approve it properly, or remove it.

Keep it alive

This is a general template for practice workflow governance. It is not legal advice and completing it does not establish compliance with the Privacy Act, the Australian Privacy Principles, state laws (such as the NSW HRIP Act), or any other obligation. Adapt it to your practice and seek qualified advice for your circumstances.

AI Vendor Scorecard — Fill-In Template

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

The AI vendor scorecard for Example Dental Clinic (practice name). Completed by ________________________. Vendor assessed: ________________________. Date: __________.

How to use this: before any AI tool goes live — and before renewal of anything already live — sit down with the vendor's answers (or their privacy policy and your sales rep) and fill in one column per vendor. If the vendor can't or won't answer a question, that is the answer: score it red. Keep the completed scorecard with your practice policies and add the vendor to your AI Tool Register.

The six questions that decide it

Score each: Green (clear, written, acceptable answer) · Amber (vague, verbal-only, or "on the roadmap") · Red (no, unknown, or refused).

The verdict

Verdict for this vendor: ______________ Review date: __________ Owner sign-off: ______________

Three habits that make this work

• Ask in writing, keep the writing. A sales call answer is amber at best. An email from the vendor is evidence.
• Score the contract, not the demo. The demo shows what the tool does; the contract shows what happens to your data. They are often different stories.
• Re-score on renewal and on any "new AI feature" announcement. Vendors change models, sub-processors and training defaults — your last scorecard may already be stale.

Where this fits

This scorecard is the worked version of the seven questions guide — read that first if a vendor pitch is sitting in your inbox. Tools that pass still belong on your AI Tool Register, and if the tool touches clinical notes or patient conversations, walk through the AI Scribe Consent Checklist before go-live.

General template, not legal advice. Review and adapt before use; scoring a vendor green here is your practice's own assessment, not a certification.

Marketing Agency & AI Governance Checklist

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

The agency governance page for Example Dental Clinic (practice name), covering ________________________ (agency / freelancer). Completed together on __________. Review yearly and whenever the agency or scope changes.

How to use this: sit down with your agency (or send it to them), fill in every row, and have both sides sign. Anything you can't answer is not a gap in the form — it's a question for the agency. Keep it wherever your practice policies live.

Why this page matters

• The practice carries the responsibility. Advertising rules for regulated health services apply to what appears under your name — whoever wrote it, however it was generated. "The agency did it" is not a defence you want to test.
• AI has changed agency output. Drafts arrive faster, in greater volume, and sound confident — including wording that can trip advertising rules (testimonials, outcome promises, "best in…" claims). Volume makes the approval step matter more, not less.
• Access is risk. An agency that can edit your website, booking system or forms without sign-off can introduce a problem faster than you can spot it.

1. What the agency can touch

Any row with edit access + "yes" is your highest-risk combination — decide deliberately, not by default.

2. Who approves patient-facing claims

3. When AI writes the copy

4. Evidence and review cadence

• Keep the approvals. A simple email trail ("approved — Scott, 12/6") is enough; the point is that approval happened and can be shown.
• Quarterly skim: open your own homepage, Google profile and latest posts as a patient would. Anything that reads like a testimonial, outcome promise or superlative goes on the review list.
• Annual re-sign: review this page with the agency once a year and whenever scope, staff or tools change.

Sign-off

This is a general governance template for practice–agency workflows. It is not legal advice, and completing it does not establish compliance with AHPRA advertising requirements, the Privacy Act, the Australian Privacy Principles, or any other obligation. Items flagged here are review prompts, not findings. Adapt it to your practice and seek qualified advice for your circumstances.

Staff AI Use Policy — Starter Template

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

A ready-to-adopt starter for Example Dental Clinic (practice name). Review and adapt before use. General template, not legal advice.

How to use this: read it, fill in the blanks, adjust anything that doesn't fit your practice, and add it to your staff handbook. Have each team member read and sign the acknowledgement at the bottom.

1. Why we have this policy

AI tools (like ChatGPT, Copilot, Gemini and AI features built into other software) can be genuinely useful. But used carelessly they can put patient privacy, our AHPRA obligations, and the practice's reputation at risk. This policy sets the simple rules so the whole team is working the same way.

2. The one rule that matters most

Never enter patient-identifiable information into a public AI tool.

That means no patient names, dates of birth, addresses, phone numbers, Medicare or health-fund numbers, clinical notes, treatment details, X-rays, photos, or anything that could identify a patient — even partially, even "just to draft something quickly." If you wouldn't post it publicly, don't paste it into a public AI tool.

3. What's generally OK

• Using AI for general, non-patient tasks: drafting a generic email template, rewording a generic policy, brainstorming social post ideas (to be reviewed before posting), summarising a public article.
• Learning and "how do I…" questions that contain no patient information.
• Tasks where every specific detail has been removed or replaced with placeholders.

4. What's not OK

• Pasting any patient information into a public AI tool — for notes, letters, summaries, or "just checking".
• Using AI to make or imply a clinical judgement (triage, diagnosis, urgency) — that is a clinician's role.
• Publishing AI-written content (website, social, reviews replies) about the practice without a human review for accuracy and AHPRA advertising rules.
• Connecting a new AI tool or browser extension to our practice systems without owner approval.

5. Approved tools (owner to complete)

Only these AI tools are approved for use in the practice, for the uses noted:

Anything not on this list needs owner approval before use.

6. If you're not sure — stop and ask

If you're ever unsure whether something is OK, don't do it — ask ________________________ (nominated person) first. There is never a problem with asking. The only problem is patient information ending up somewhere it shouldn't.

7. If something goes wrong

If patient information may have been entered into an AI tool, tell ________________________ (nominated person) straight away. Acting quickly protects our patients and the practice. You will not be in trouble for reporting an honest mistake promptly.

Acknowledgement

I have read and understood the Staff AI Use Policy and agree to follow it.

This is a general starter template for practice workflow education. It is not legal advice and does not guarantee compliance with the Privacy Act, the Australian Privacy Principles, state laws (such as the NSW HRIP Act), or AHPRA advertising requirements. Adapt it to your practice and seek qualified advice for your specific circumstances.

What changed in 2025–26 — and what to check on your site this week

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

This guide flags items for your own review. It is not legal advice, and reading it (or running our checks) does not determine whether your practice is compliant or non-compliant with any law or guideline. For specific concerns, get independent legal or regulatory advice.

Four separate changes landed between September 2025 and December 2026. None of them were aimed at dentists specifically — and that's exactly why dental websites keep tripping over them: the copy was written before the rules existed, and nobody has been back to look.

Here they are in date order, each with the practical check.

1. September 2025 — cosmetic-procedure advertising guidelines (and yes, veneers are on the list)

Ahpra and the National Boards' guidelines for practitioners who advertise higher-risk non-surgical cosmetic procedures took effect on 2 September 2025. The list of higher-risk procedures explicitly includes dental veneers, alongside injectables and thread lifts.

For advertising those procedures, the guidelines require:

• Real, unedited images only. Filtered, airbrushed or otherwise enhanced photos should be replaced with unaltered ones — and "after" photos should be taken in similar conditions (lighting, angle, distance) to the "before".
• A visible "results may vary" warning wherever such imagery is used in advertising.
• No influencer promotion. The ban on testimonials from social-media influencers was strengthened — gifted-treatment posts promoted on your channels are a review item in themselves.
• Protections for under-18s, including targeted-advertising bans and a mandatory seven-day cooling-off period.

Check this week: open your veneers and smile-makeover pages. If there's a before/after gallery, ask three questions — are these images unedited, do they carry an individual-results warning, and is there any influencer or gifted content linked from the page? Remember the long-standing baseline still applies on top: testimonials about clinical outcomes have been prohibited in regulated health advertising under the National Law all along.

2. January 2026 — the TGA names cosmetic-procedure goods a priority

The Therapeutic Goods Administration's compliance principles for 2026–27 set out twelve priority focus areas, and one of them is therapeutic goods used in cosmetic procedures. Teeth-whitening gels, kits and strips are therapeutic goods — so the product side of your whitening page is regulated separately from the Ahpra side.

The TGA's advertising rules for therapeutic goods don't allow testimonials about the goods, and the regulator has flagged fake or misleading reviews — including AI-generated "deep fake" endorsements — as an enforcement focus, with particular scrutiny of websites and social media.

Check this week: look at your whitening page as two layers. The service (your clinical care) sits under Ahpra's advertising rules; the product (the gel, the branded kit you sell or name) sits under the TGA Advertising Code. Product testimonials, comparative product claims, and product before/afters are the items worth a careful look.

3. March 2026 — consumer-law penalties doubled

The penalties for misleading or deceptive conduct under the Australian Consumer Law were doubled with effect from 28 March 2026 — for companies, now up to $100 million per contravention. The ACCC's 2026–27 priorities include manipulative and false practices in digital markets, and online reviews are squarely in scope:

• Offering an incentive for a review ("leave us a 5-star review for 10% off your next clean") risks being misleading conduct — incentives, if offered at all, must apply equally to negative reviews and be clearly disclosed.
• The health-booking sector already has its precedent: the Federal Court ordered HealthEngine to pay $2.9 million, partly over misleading patient reviews.
• For Ahpra-regulated practices there's a second layer: clinical-outcome reviews republished on your own website can read as testimonials under the National Law — even though the same reviews sitting on Google's platform are fine.

Check this week: any "leave us a review" card, SMS or email — does it offer anything in return? And if your website embeds a Google-reviews widget, check what the quoted reviews actually say: star ratings alone are lower-risk than quoted clinical praise.

4. December 2026 — your privacy policy must disclose automated decision-making

From 10 December 2026, the Privacy Act's new transparency obligations require privacy policies to disclose the kinds of personal information used by computer programs that make decisions significantly affecting individuals — wording broad enough to capture AI-enabled systems, rule-based tools and automated assessments.

For a dental practice, think about what's already automated or about to be: an AI receptionist that triages "is this urgent?", a booking system that auto-allocates appointment types, a recall system that decides who gets contacted. If a tool like that uses personal information to make decisions that significantly affect a patient, your privacy policy will need to say so.

The OAIC is already running a compliance sweep of privacy policies, with compliance notices and civil penalties available for policies that don't meet the Act's requirements.

Check this week: find the date on your privacy policy. If it predates your booking system, your website chat, or any AI tool you've added — it almost certainly doesn't describe what those tools do with patient information. Listing your tools first (our free AI Tool Register template does this) makes the policy update mechanical rather than daunting.

The one-hour version

1. Veneers/whitening pages — unedited images, results-may-vary warnings, no influencer content (15 min).
2. Whitening products — no product testimonials or comparative product claims (10 min).
3. Review prompts — no incentives; check what any embedded reviews actually quote (10 min).
4. Privacy policy — date it, list your automated tools, flag the December 2026 disclosure deadline in your practice calendar (25 min).

Or let the machine do the first pass: our free website check reads your public pages against exactly these review triggers — testimonials and republished reviews, cosmetic-procedure imagery, inducements, whitening-product claims, and missing or thin privacy notices — and shows you what's worth a human look. Review triggers, not findings of non-compliance.

Sources: Ahpra's cosmetic-procedure advertising guidelines and September 2025 announcement; the TGA's 2026–27 compliance principles and testimonials guidance; the ACCC on online reviews; the March 2026 ACL penalty increase; and analysis of the Privacy Act automated-decision-making amendments. All accessed June 2026.

The 11pm test

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

General educational material for practice owners and managers — practice operations and website guidance, not clinical, legal or financial advice.

Here's the test: it's 11pm. A patient with a throbbing tooth searches, finds your website, and lands on your home page. What happens next?

For most practices, the honest answer is: nothing. The page shows office hours that ended at 5pm, a phone number that rings out or hits a full voicemail box, and no hint of what an urgent patient should do. So they hit Back and try the practice up the road.

This isn't a rare failure. In our June 2026 audit of 969 Sydney dental practice websites, 87% scored below "adequate" on their after-hours path — by far the most-failed signal of everything we measure. Which is exactly why it's worth fixing: the bar is on the floor, and the patient standing at it is the most motivated patient you'll ever meet.

What "an after-hours path" actually means

It does not mean being open at 11pm, employing an answering service, or promising emergency care you don't provide. It means the website answers the question the patient is asking: "what do I do right now?"

A complete path has three layers — you need at least one, and the first is mostly wording:

1. Tell them what to do (one honest box of text). A visible block — home page and contact page — that says what an urgent patient should do tonight. Even if your honest answer is "we open at 8am, book the first emergency slot online and here's how to manage tonight", that is an after-hours path. The patient who knows they're booked for 8am stops searching. The one staring at a closed-hours table keeps shopping.

2. Let them book while you sleep. If you run online booking, make sure urgent/emergency appointment types are bookable out of hours and the booking link is visible from the home page — not buried behind "Contact". In our availability monitoring, practices on observable booking systems routinely take bookings overnight; the chairs fill while nobody's at the desk. This is the empty-chair leak in reverse.

3. Say when severe symptoms mean "don't wait for us." One sentence directing facial swelling, uncontrolled bleeding or trauma to emergency care protects patients and shows a regulator-grade duty of care. (If you're considering an AI chatbot to handle any of this triage, that's a different decision with real boundaries — see the AI receptionist guide before switching anything on.)

What good looks like (steal this structure)

In pain after hours? Book the first emergency appointment online — we keep 8am slots for urgent cases: [Book now] Can't see a time that works? Call (02) 9XXX XXXX and leave your name — we return calls from 7:30am. Facial swelling, uncontrolled bleeding, or trauma? Go to your nearest emergency department now.

Four lines. No new staff, no answering service, no technology you don't already have. The whole job is: decide your honest after-hours offer, write it down, put it where the 11pm patient will see it (home page, contact page, and your Google Business Profile description), and make sure the booking link works at midnight.

The checklist

1. Decide the offer — held morning emergency slots? Online booking 24/7? A monitored voicemail? Pick what's true.
2. Write the box — the four-line structure above, in your words. No promises you can't keep.
3. Place it — home page (visible without scrolling on a phone), contact page, Google Business Profile.
4. Test it at night, on a phone — tap the booking link at 10pm; ring the number; read the page as a stranger in pain would.
5. Check the hours everywhere match — website footer, GBP, booking system. Mismatched hours at 11pm read as "this practice doesn't have its act together."

Find out where you stand

Our free booking-path check walks your site like that 11pm patient — booking visibility, tap-to-call, form friction, and the after-hours path — and scores you against the 969 Sydney practice sites in the audit. Two minutes, no patient data. And if you want the revenue picture, the leakage calculator turns your missed urgent enquiries into a monthly number.

The maths of this one is simple: nearly nine in ten of your competitors fail the 11pm test. You can pass it by Friday.

When a Patient Asks ChatGPT for a Dentist, Do You Show Up?

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

This is general educational material for dental practice owners and managers, not legal, marketing or technical advice. No one can guarantee that an AI assistant will recommend any particular practice — these systems change constantly. This guide is about making your practice credible and readable to them, not about gaming anything.

A patient with a sore tooth used to open Google, type "dentist near me", and scroll. A growing number now open ChatGPT, Perplexity, or Google's AI answers and ask: "Find me a good dentist in [suburb] who can see me this week." The assistant reads the web, names two or three practices, and gives a one-line reason for each.

It didn't pick them at random, and it didn't pick them by who paid. It picked the practices it could trust — the ones whose expertise it could actually see and verify. That, underneath the jargon, is what "AEO" is about.

SEO got you ranked. AEO gets you trusted.

For twenty years, being found online meant ranking on Google's blue links — that's SEO. AI assistants play a different game: they read pages, decide which sources are credible, and quote a few in the answer. Getting quoted isn't about keywords. It's about authority.

Google's framework for this is E-E-A-T — Experience, Expertise, Authoritativeness, Trustworthiness. And because dentistry is "Your Money or Your Life" (health) content, the bar is set deliberately high. AI systems lean on the same signals.

The single biggest lever: put a real dentist's name on it

The most important — and most overlooked — discoverability signal in 2026 is authorship. AI assistants and Google strongly favour content written or reviewed by a named, credentialed person they can verify. Google added a dedicated "Authors" section to its own documentation in early 2026; for health content, a named expert author is now treated as a primary trust signal.

In practice, this means:

• Every clinical or advice page carries a byline — "Reviewed by Dr Jane Smith, BDS (Syd), AHPRA DEN0001234" — not just "the practice team".
• That dentist has a real bio page: qualifications, AHPRA registration, years of experience, special interests.
• The name is verifiable across the web — the AHPRA register, the ADA find-a-dentist directory, LinkedIn. AI systems actually cross-check whether the author named on your page resolves to a real, credentialed person elsewhere. An anonymous page tends to get filtered out of the answer; a verifiable expert page survives.

If you do one thing after reading this: stop publishing dental advice under a faceless brand name, and start attributing it to your actual dentists, with their credentials.

Your name has to travel — mentions beat links

Old-school SEO was won with backlinks. AI visibility is won more by being talked about. Research across tens of thousands of brands found that brand mentions line up with appearing in AI answers roughly three times more strongly than backlinks do — and how often people search your practice by name is one of the single strongest predictors of being cited.

For a practice, that means:

• Be present, and accurate, everywhere an AI reads about dentists: Google Business Profile, HealthEngine, HotDoc, the ADA directory, the AHPRA listing, local press.
• Earn genuine mentions — community involvement, being quoted, real local coverage — rather than buying links.

Fresh pages get quoted; stale ones get skipped

AI assistants prefer current information. The large majority of AI citations come from pages updated in the last 6–12 months, and some engines (Perplexity especially) effectively won't quote content that looks old. Show a real "last reviewed" date on your key pages — and actually keep them current.

Answer the real question — first

An assistant quotes the part of your page that directly answers the patient. Structure for that:

• Make headings the questions patients actually ask: "How long does a root canal take?", "What does an implant consultation cost?"
• Put a direct 40–60 word answer right under the heading, before the detail. That short, self-contained answer is the chunk an assistant can lift.
• Be specific and first-hand — your real process, real cost ranges, real recovery times. Copy that's identical to a hundred other dental sites doesn't get cited; original detail does.

The plumbing still has to work (table stakes)

None of the above replaces the basics — it sits on top of them:

• The same name, address and phone everywhere — your website, Google Business Profile, and every directory.
• Machine-readable schema (a Dentist profile plus FAQ markup) — a quick job for whoever maintains your site, and one of the easiest ways to stand out: in our June 2026 audit of 1,156 live Sydney dental practice websites, only about a third exposed any machine-readable practice identity, and roughly one in seven had FAQ markup.
• A complete, claimed Google Business Profile with recent reviews you respond to.
• Pages that load well on mobile and aren't thin or near-duplicates of each other.

Where you'll actually appear — the assistants differ

A quick reality check, because they don't behave the same way:

• ChatGPT leans on Bing's top results and favours established, authoritative sources.
• Perplexity fetches fresh content on every question and leans heavily on forums and reviews — recency and real discussion matter most here.
• Google AI Overviews mostly quote pages that already rank on Google — so baseline SEO is still the price of entry.

One caution before you chase reviews and testimonials

Building authority with named dentists and patient reviews is exactly the right instinct — with one dental-specific line you can't cross. Encouraging patients to leave an honest Google review is fine. Republishing patient testimonials about clinical care or outcomes in your own advertising is treated differently under Ahpra's advertising rules. Build authority; just don't let it tip into advertising that creates a regulatory problem. See the companion guide, Website Advertising AI Review.

See how an AI reads your site

The fastest way to find out where you stand is to look at your website the way an assistant does. Our free discoverability scanner reads your public pages — including whether your content carries real author authority — and gives you a plain red, amber or green read on whether patients and AI assistants can find and trust you, across Google search, AI answer engines, and Maps. No patient data, no cost.

For the fuller picture — discoverability alongside your website advertising-risk, privacy edge and booking friction — request your free practice Blueprint.

This guide is educational material only. It is not legal, marketing or technical advice, and it is not a guarantee of any search or AI-assistant outcome. Confirm advertising-related questions against Ahpra's guidance, and seek qualified advice for your specific circumstances.

Someone Pasted Patient Data Into ChatGPT — What Now?

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

The worst time to work out what to do about an AI privacy incident is during one. Decide the steps now, while it's calm.

This is general educational material for dental practice owners and staff, not legal advice. It is a first-response guide, not a substitute for qualified privacy or legal advice when an incident occurs.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Why this matters

If staff use computers, this will happen eventually — a name pasted into ChatGPT to draft a letter, a patient list dropped into a tool to "tidy it up", an AI feature found to be storing data offshore. The damage is usually made worse by two reactions: panic, or pretending it didn't happen. A short, prepared process avoids both.

This connects to the extraction cycle: once data has left the system, the question becomes what to do about the copy that's now out there.

First response — the steps

Work through these calmly. Identifying an incident is not the same as declaring a breach — it is gathering the facts so the right people can decide.

1. Identify what was involved. What information (names, health details, images, contact details)? Which tool? Which patient(s)? Roughly when?
2. Contain it. Stop the workflow. Where possible, delete the content from the tool, clear its history, and stop any sync. Change a password or revoke access if an account was involved.
3. Document it factually. Write down what happened, when, who was involved and what data — a plain record, not blame. This record matters later.
4. Escalate. Tell the practice owner / privacy officer straight away. One person should own the response.
5. Assess whether it may be notifiable — with help. The Notifiable Data Breaches scheme can require notifying affected people and the regulator for serious breaches. Do not self-assess the threshold. Whether an incident is an "eligible data breach" is a legal assessment — get qualified privacy/legal advice promptly.
6. Act on advice without delay. If notification is required, the scheme has timing expectations — move on advice quickly rather than sitting on it.
7. Close the loop. Update the staff AI policy and training so the same thing doesn't recur. Most incidents point to a gap that's easy to fix.

Two things not to do

• Don't quietly delete and move on as if it didn't happen — the documentation and the assessment still matter.
• Don't ask an AI tool whether it's a notifiable breach. That assessment requires qualified human review, not a chatbot's opinion.

Be ready before it happens

• Decide who the incident owner is.
• Keep this checklist somewhere staff can find it.
• Make sure staff know they should report an AI slip immediately — and won't be punished for owning up. The earlier it's reported, the more containable it is.
• Pair this with the Can I Paste This Into AI? guide so fewer incidents happen in the first place.

This guide is educational material only. It is not legal advice and does not determine whether any incident is a notifiable data breach. Seek qualified privacy or legal advice for a specific incident.

When Dental AI Is a Medical Device (TGA)

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Not all dental AI is admin. Some of it reads an X-ray, flags decay or decides how urgent a patient is — and software that makes a clinical call can be a regulated medical device.

This is general educational material for dental practice owners, not legal or regulatory advice. Whether a specific product is a regulated medical device, and whether it is approved for use in Australia, should be confirmed with the vendor and a qualified adviser.

Two privacy laws apply in NSW — the Commonwealth Privacy Act 1988 (APPs) and the NSW Health Records and Information Privacy Act 2002 (HRIP Act, HPPs). This guide is about a different regulator again: the TGA. General information, not legal advice.

The line that matters: admin AI vs clinical AI

There are two very different kinds of AI being sold to dental practices:

• Admin / workflow AI — scheduling, summarising reports, drafting copy, transcribing notes. The risks here are mostly privacy and accuracy.
• Clinical AI — software that reads radiographs, detects caries or pathology, measures bone levels, screens images, or triages how urgent a patient is. This kind of software is making, or supporting, a clinical assessment.

The second kind is where a different regulator can apply: the Therapeutic Goods Administration (TGA).

Software can be a "medical device"

Under Australia's therapeutic goods framework, software that is intended for purposes such as diagnosis, screening, monitoring or prediction of disease can fall within the definition of a medical device — often called Software as a Medical Device (SaMD). Medical devices generally need to be included in the Australian Register of Therapeutic Goods (ARTG) before they are supplied or used in Australia, and they carry obligations around their declared intended purpose and safety.

(The exact classification rules and what counts as a regulated medical device are technical and should be confirmed with the TGA or a qualified adviser — this guide flags the question, it does not answer it for a specific product.)

What to check before switching on a clinical AI tool

Before a practice relies on an AI tool that detects, diagnoses, measures or triages:

• Is it included in the ARTG? Ask the vendor directly and look for the ARTG number. "It's used overseas" or "it's FDA-cleared in the US" does not mean it is approved for use in Australia.
• What is its declared intended purpose? A tool approved as a "decision support" aid is not the same as one cleared to make a diagnosis. Using a tool beyond its intended purpose is a risk.
• Who is responsible for the clinical decision? The treating dentist remains clinically responsible for diagnosis and treatment. AI output is an input to the clinician's judgement, not a substitute for it.
• Does it also move patient data? Clinical AI usually sends images or records to be processed — often overseas. So the privacy questions in the rest of this library (extraction, APP 8 / overseas disclosure, HRIP) apply on top of the device question.

Why owners should care

Switching on a clinical AI tool that should have been a registered medical device, or using one beyond its approved purpose, is a regulatory exposure that sits outside privacy law — and it is exactly the kind of thing a busy practice adopts without asking. It is worth a short check before purchase, not after.

See Where Patient Data Is Protected — and Where It Escapes for the privacy side of the same tools.

This guide is educational material only. It is not legal or regulatory advice and does not determine whether any product is, or is not, a regulated medical device. Confirm a product's regulatory status with the vendor and the TGA, and seek qualified advice for your circumstances.

Before You Switch On an AI Receptionist or Chatbot

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

An AI receptionist is the most-pitched AI in dentistry, and frequently the least safe first project. It collects patient health details and stores them — the only question is where, and who can see them.

This is general educational material for dental practice owners and managers, not legal or clinical advice. This guide is the pre-purchase readiness check; the Emergency Booking and the AI Boundary guide covers the urgent-patient handling boundary in depth.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Why this matters

AI receptionists, booking bots and website chat widgets are being sold to practices as an easy win. But unlike an internal tool, this one talks directly to patients and collects health information — a patient describing a toothache, swelling or symptoms is providing health data, often after hours, into a system you may not have vetted.

That makes it a poor first AI project for many practices: it sits at the most sensitive point (a patient in distress sharing symptoms) and the data flows straight out to a vendor — the extraction problem, but with the patient doing the typing.

Readiness questions — ask before you sign

Data and storage

• Where are conversations stored, and for how long?
• Is storage or processing overseas? (If so, treat it as an APP 8 / HPP review item.)
• Who at the vendor can access the conversations? Can the practice delete them?
• Does the vendor's contract or data-processing agreement actually address this, or just reassure you verbally?

The clinical boundary (the big one)

• Does the tool ever assess urgency or symptoms? It must not make clinical assessments or tell a patient whether their symptoms are serious — that is a clinician's job.
• Is there a clear, fast escalation to a human, especially for anything that sounds urgent?

Consent and notice

• Are patients told their conversation is collected and how it's used (a privacy notice that covers this channel)?
• Does the tool collect more than it needs (full symptom descriptions when a name and callback number would do)?

These are the receptionist-specific version of the questions every AI vendor should answer. For the general seven-question checklist to run against any AI tool before you sign, see What to Ask an AI Vendor Before You Say Yes.

What good looks like

• Don't make it your first AI project. Start somewhere lower-stakes; come to patient-facing AI once the basics are in place.
• Scope it tightly. Booking and admin — not triage, not clinical advice.
• Check the data flow before go-live, not after: storage location, access, deletion, overseas processing.
• Guarantee human escalation for urgent or symptom-heavy messages.
• Cover it in your privacy notice and collect the minimum.

This guide is educational material only. It is not legal or clinical advice. Identifying a risky workflow indicates possible exposure, not a declared breach. Seek qualified advice for your specific circumstances.

AI Scribe Consent Checklist

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

An AI scribe is not just a note-taking feature. It is a patient-data workflow.

This checklist is not legal advice and is provided for general educational purposes only. It does not certify that an AI scribe is compliant. It is designed to identify consent, storage, privacy, security and workflow review items before a practice uses AI scribing.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Quick decision: eleven questions before you switch on

Do not switch on an AI scribe until the practice can answer these questions:

1. What patient data does it collect?
2. Where is audio processed and stored?
3. Where is the transcript processed and stored?
4. Is generative AI used?
5. Is patient data used to train models?
6. Can patients opt out?
7. Is informed consent obtained before use?
8. Is consent recorded?
9. Does the dentist review the note before it enters the patient record?
10. Can the practice delete audio and transcripts?
11. Is any processing or storage overseas, and has the practice assessed that separately from recording consent?

Checklist

1. Intended use

2. Patient data involved

3. Consent process

Sample consent scripts

Use as a starting point only. Review before use.

Recording consent is not the same as addressing overseas disclosure. The scripts below obtain a patient's consent to being scribed. That is a separate matter from any APP 8 consideration that may arise if the tool processes data overseas. If the practice intends to rely on patient consent as any part of its overseas-disclosure approach, that requires specific, informed consent beyond "is that okay today?" — see the APP 8 section below. Seek independent legal advice on the mechanics.

Full version:

We use an AI-supported scribing tool to help prepare clinical notes from the consultation.
It may process personal information discussed during your appointment.
The dentist reviews the note before it is finalised.

You can choose not to use the scribe today. Your care will not be affected.

Are you comfortable with us using the AI-supported scribe for this appointment?

Shorter chairside version:

We use an AI-supported scribe to help draft notes. It may process information from this
consultation, and I review the note before saving it. You can opt out and your care will
not be affected. Is that okay today?

Patient refusal script:

No problem. We will not use the AI-supported scribe for this appointment.
I will take notes manually.

Consent record template

AI scribe discussed with patient.
Patient informed that AI-supported scribe may process consultation information
and that dentist reviews note before finalisation.
Patient consented / declined.
Date:
Clinician:
Tool:

Vendor review

Data handling

Model and training

Access and support

Contract and policy

The note still has to be right (APP 10 — data quality)

An AI scribe can mishear, paraphrase loosely, or hallucinate — inventing a symptom, the wrong tooth, an allergy the patient never mentioned, or a medication that was not discussed. In a clinical record that is not a typo; it is a record-integrity and patient-safety problem.

Under APP 10 (data quality), a practice must take reasonable steps to ensure the personal information it holds is accurate, up to date and complete. So reviewing the scribe's output is not an optional nicety — it is part of how the practice meets that obligation.

• The dentist reviews and corrects every note before it enters the record. The clinician — not the AI — is responsible for what the record says.
• Watch for confident-but-wrong detail. Hallucinated allergies, medications, dosages, tooth numbers and history are the dangerous errors, because they read as authentic.
• Keep the authoritative note; the raw audio is separate. Once reviewed and saved, the note becomes the patient record and must be retained for the required period. The raw audio and transcript are a separate copy — confirm with the vendor what can be deleted, and when.

Overseas processing and APP 8 consideration

This section identifies a possible privacy-review trigger. It does not determine whether the practice is compliant or non-compliant, and it is not legal advice. The applicable framework is nuanced — seek independent legal advice on the practice's specific situation.

Many AI scribes use generative AI infrastructure that processes and stores data overseas — commonly in the United States. When patient information is sent to, or made accessible by, an overseas recipient, APP 8 of the Australian Privacy Principles may apply.

APP 8 is not a ban on overseas services. Under the Australian privacy framework, before disclosing personal information to an overseas recipient, an APP entity is generally required to take reasonable steps to ensure the overseas recipient handles the information consistently with the APPs. The Australian entity may also remain accountable for what the overseas recipient does with that information. Whether a given AI scribe arrangement constitutes a "disclosure" to an overseas recipient (rather than a "use") is a fact-specific question — but where a practice sends private health conversations to a US-based model provider, this consideration is a strong review trigger.

This consideration is separate from recording consent. A patient agreeing to be scribed — "is that okay today?" — addresses recording and clinical note-taking. It does not, by itself, address any APP 8 obligation the practice may have regarding overseas processing. If the practice intends to rely on patient consent as any part of its approach to cross-border disclosure, that consent must be specific and informed about overseas disclosure, and the mechanics of any such consent pathway should be reviewed with a legal adviser.

Ahpra's AI case study guidance notes that generative AI tools such as ChatGPT may store data outside Australia, and that personal information entered into an AI tool that stores data offshore could lead to unintentional breaches of Australian privacy laws. OAIC guidance similarly states that entities must take reasonable steps before cross-border disclosure and may remain accountable for the overseas recipient's handling of the information.

APP 8 vendor assessment questions

An AI scribe is one example of a broader decision. For the general seven questions to ask any AI vendor before you sign — data residency, access, read-only vs acting, deletion, liability, medical-device status and safe piloting — see What to Ask an AI Vendor Before You Say Yes.

Ask these questions specifically about overseas processing — they go beyond general data handling:

If the practice cannot answer these questions, the scribe should not be used with patient data until it can.

Workflow review

Red flags

High-review signals to watch for:

• Tool records audio without explicit patient explanation
• Patient cannot opt out
• Data used to train models by default
• Storage or processing location unclear
• Vendor cannot explain retention
• No deletion process
• No audit logs
• Tool writes notes without dentist review
• Tool suggests diagnosis or treatment
• Tool sends patient-facing summaries automatically
• Staff do not know when the scribe is on
• Processing is overseas and the practice has not assessed what that may mean for APP 8
• Vendor cannot confirm where overseas sub-processors are located or what data they receive
• Practice assumes chairside recording consent covers all privacy obligations including cross-border disclosure

Minimum practice policy

AI scribing may only be used with approved tools.
Patients must be informed before use.
Patients may opt out without affecting care.
Consent or refusal must be recorded.
The dentist must review and approve the note before it enters the patient record.
Audio, transcript, prompt and generated-note handling must be reviewed before use.
Public AI tools must not be used to create patient-identifiable clinical notes.

Owner sign-off template

Practice:
Tool:
Approved for use: yes / no / pilot only
Approved users:
Consent script approved: yes / no
Vendor review completed: yes / no
Staff trained: yes / no
Review date:
Owner / principal dentist:

Sources: Ahpra AI guidance · Ahpra AI case studies · OAIC commercial AI privacy guidance · OAIC APP 8 cross-border disclosure guidance

An AI Vendor Just Pitched Your Practice — What to Ask Before You Say Yes

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

This is general educational material for dental practice owners and managers, not legal advice. The regulatory points below are things to review and confirm with a qualified adviser for your situation — not determinations about any specific product.

Every week, another AI tool is pitched to dental practices: a scribe that writes your clinical notes, an "AI receptionist" that answers calls and books patients, a recall bot, a marketing assistant that writes your website and social posts. The demos are slick and the time-savings are real.

But the demo only answers one question: does it work? The questions that actually decide whether your practice can use it are different — and the vendor's salesperson is rarely the person who can answer them. The core principle is the one that should sit behind every AI decision in the practice:

Just because an AI feature exists doesn't mean your practice can safely use it. Whatever the tool does, you remain responsible for patient privacy, for the clinical record, and for anything published under the practice's name.

Here is the seven-question script to run before you sign anything.

1. Where does our patient data go — and does it leave Australia?

Ask exactly where data is stored and processed, and whether any of it — or any sub-processor they use — sits overseas. Sending patient information to an overseas service is a cross-border disclosure question under the Privacy Act (APP 8), and it doesn't stop being your responsibility because a vendor is in the middle. Also ask the quieter question: is our data used to train their models? "Your data improves the product" can mean patient information becomes part of a model you can't claw back.

A good answer: clear data-residency information, named sub-processors, and a plain "no, your data is not used to train shared models."

2. Who can see it — and can you show me?

Who at the vendor can access practice or patient data, under what controls, and can you see an access log? A tool that can show you who accessed what, and when, is in a different league from one that can't. This is the security-and-accountability question (APP 11), and it's also the difference between "trust us" and "here's the audit trail."

A good answer: role-based access, encryption, and an audit log you can actually inspect.

3. Is it read-only, or does it act?

This is the single most important safety question. A tool that reads and suggests — and leaves a human to approve — is far safer than one that writes, sends, books, or posts on its own. Autonomous action is where the real risk lives: an AI that sends a message, books a patient, or publishes a post without sign-off can cause a privacy, clinical, or advertising problem before anyone notices.

A good answer: read-only by default, with explicit human approval gates before anything is sent, written, or published.

4. What happens to our data if we leave?

Ask how you export everything and how you get it deleted if you cancel — and whether they keep a copy. Health information has destruction and retention obligations (APP 11), and "we'll keep it on our servers indefinitely" is the wrong answer. (Note the flip side: your own clinical records still have legally required minimum retention periods — deleting the vendor's copy is not the same as deleting the record in your dental system.)

A good answer: a clean export, a defined deletion process and timeframe, and confirmation no residual copy is retained.

5. Who's liable when it gets something wrong?

AI gets things wrong. A scribe can put a wrong figure in a clinical note (a data-quality issue under APP 10), a chatbot can mishandle a patient's information, a marketing tool can publish a testimonial or outcome claim that breaches AHPRA's advertising rules. When that happens, the practice is usually still the responsible party — the advertiser, the record-keeper, the registered provider — not the vendor. Get the responsibilities in writing, and never assume the vendor's contract shifts the regulatory duty off you.

A good answer: the vendor is transparent that you remain the responsible party, and helps you put review steps in place rather than promising the problem away.

6. Is it — or does it act like — a medical device?

If a tool does anything that looks like triage, diagnosis, or clinical decision-making ("our AI assesses urgency", "it screens symptoms"), that can stray into Software as a Medical Device territory, which the TGA regulates. A booking or admin tool generally isn't a medical device; something that makes or guides a clinical judgement might be. Worth confirming before you rely on it.

A good answer: the vendor knows the distinction and can tell you, plainly, which side of it their tool sits on.

7. Can we try it without real patient data first?

The safest way to evaluate any tool is a reversible pilot that doesn't expose patient information — public data, synthetic/test data, read-only, easy to switch off. If a vendor can't let you trial it safely, that itself is a signal.

A good answer: a real way to pilot on non-patient data before anything live is connected.

Green flags vs red flags

The safest first AI is usually the one you control

Notice what these questions reward: tools that are read-only, owner-approved, auditable, and don't take patient data somewhere you can't see. That's not an accident — it's the shape of safe AI in a dental practice.

It's also why the safest first AI project is rarely the patient-facing one. An AI receptionist or chatbot is the highest-stakes thing to switch on. A private, read-only assistant that reads your own data and reports back to the owner — finding the recalls and treatment plans you're leaving on the table — sits on much safer ground, because nothing happens to a patient without a human deciding.

Before you sign — and before you switch on

• Run the relevant free public checks first — e.g. if it's a marketing or website tool, our website and advertising scanners review what's already public.
• For the full picture across privacy, advertising, discoverability and booking, request your free practice Blueprint — public information only, no patient data.
• See the foundational guide, Where Patient Data Is Protected — and Where It Escapes, and Is This AI Tool a Medical Device? for the TGA question.

When you want AI working inside the practice that you fully control — read-only first, owner-approved, fully auditable — that's the kind of system worth building rather than renting.

This guide is educational material only. It is not legal advice and does not assess any specific product. Confirm privacy (Privacy Act / APPs, and state laws like the NSW HRIP Act), AHPRA advertising, and TGA questions with qualified advisers for your circumstances.

Browser Extensions Are Reading Your Patient Data

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Many browser extensions ask to "read and change all data on all websites". When the PMS is one of those websites, the extension can read patient information — and you never decided to share it.

This is general educational material for dental practice owners and staff, not legal advice.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Why this matters

If your practice opens its PMS, booking system or email in a web browser (Chrome, Edge, Safari), then every extension installed in that browser is a piece of software with potential access to what's on the screen.

Many popular extensions request the permission "read and change all data on all websites you visit". With that permission, the extension can read the page content of your PMS — patient names, notes, treatment details — and send it back to the extension's own servers, often overseas. This is the extraction problem again, except no one chose to extract anything; an installed tool does it silently.

The everyday culprits

These are the kinds of extensions staff install without thinking:

• AI writing assistants and grammar tools (e.g. Grammarly-style tools) — they read text fields to "improve" them.
• AI chat / "summarise this page" assistants — they read the whole page.
• Screenshot and screen-recording extensions.
• Transcription and meeting tools.
• PDF, coupon, shopping and "free" utility extensions — often the riskiest, with broad permissions and unclear owners.

The danger is not that the staff member is careless — it is that a tool installed for a personal reason quietly gets access to patient data the moment the PMS is open.

How to check what's installed

1. Open the browser's Extensions / Add-ons page on each practice machine.
2. For each extension, look at its permissions — flag anything that can "read and change all data on all websites".
3. Ask: do we know who makes this, and do we need it on a machine that opens the PMS?
4. Remove anything not needed. Be especially wary of extensions that read or rewrite text, capture the screen, or have vague ownership.

Managed vs personal browsers

• A practice-managed browser can restrict which extensions are allowed (an allowlist) so staff cannot install risky ones on PMS machines.
• A personal / unmanaged browser lets anyone install anything — which is why the PMS should not be opened in a browser full of personal extensions.

What good looks like

• An approved-extensions allowlist on machines that open the PMS; remove broad "read all data" extensions.
• A clear rule that staff do not install browser extensions on practice machines without approval.
• Consider a separate browser or profile used only for the PMS, with no extensions.
• Treat an extension that sends data overseas as an APP 8 / HPP review item, and the access itself as an APP 11 security question.

This guide is educational material only. It is not legal advice. Identifying a risky workflow indicates possible exposure, not a declared breach. Seek qualified advice for your specific circumstances.

Can I Paste This Into AI?

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

If it identifies a patient or describes their care, do not paste it into public AI.

This guide is not legal advice. It is a practical staff safety guide for public AI tools. When unsure, do not paste the information. Ask the practice owner or manager.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

What is public AI?

Public AI includes:

• ChatGPT (free or paid personal account)
• Gemini (free or paid personal account)
• Claude (public web version)
• Canva AI
• Social media AI tools
• Word or email AI features not approved by the practice
• Browser AI assistants and writing tools
• Any tool not approved by the practice for patient data

It also leaves the country

Pasting patient information into a public AI tool does not just expose it on a screen — it likely sends it overseas.

Public AI tools such as ChatGPT, Gemini and Claude are processed on servers outside Australia. When a practice pastes identifiable patient information into one of these tools, that may constitute a cross-border disclosure of personal information under APP 8 of the Privacy Act. APP 8 requires an APP entity to take reasonable steps before disclosing personal information to an overseas recipient, and the Australian practice can generally remain accountable for what the overseas recipient does with that information.

This is a separate consideration on top of the "don't expose patient data" message — not a replacement for it.

Practice manager note: Whether a specific act of pasting is characterised as a disclosure (APP 8) or a use (APP 6) of personal information is a nuanced legal question. What is clear is that pasting identifiable patient information into a public AI tool is a possible cross-border disclosure and a review trigger for the practice, not a safe default. Ahpra's AI case studies note that generative AI tools such as ChatGPT may store data outside Australia, and that patient data entered into offshore AI tools could lead to unintentional privacy breaches. The OAIC recommends not entering personal or sensitive information into publicly available generative AI tools.

This guide is not legal advice. If a practice is unsure about its obligations, seek qualified privacy or legal advice.

Green: Usually OK

Use public AI for generic, non-patient, non-confidential tasks.

Green prompt template

Write generic patient education copy for an Australian dental practice.
Do not include patient-specific advice, guarantees, testimonials or claims of painless or risk-free outcomes.

Amber: Check first

These may be OK only if de-identified, generic and approved by the practice.

Amber rule

Before using AI, remove:

1. Names
2. Contact details
3. Dates of birth
4. Appointment dates
5. Clinical specifics
6. Unique details
7. X-rays, photos, invoices and treatment plans

Ask the practice manager if unsure.

Red: Do not paste

Do not paste these into public AI.

Red examples

Do not paste:

Rewrite this treatment plan for John Smith. He needs two crowns and an implant...

Do not paste:

Summarise this patient email. She says she has swelling around her wisdom tooth and takes blood thinners...

Do not paste:

Make this complaint response nicer. The patient was unhappy after root canal treatment...

Do not paste:

Here is our overdue recall list. Write SMS messages for each person...

Do not paste:

Can you identify which of these Google reviewers are patients from our PMS?

Staff decision guide

1. Does it identify a patient?
   Yes → do not paste.
   No → continue.

2. Does it describe someone's health, treatment, appointment or payment?
   Yes → do not paste unless approved and de-identified.
   No → continue.

3. Is it a real patient story, review, complaint, email, treatment plan or image?
   Yes → do not paste.
   No → continue.

4. Is it generic education, admin or marketing wording with no patient data?
   Yes → usually okay.
   Unsure → ask first.

Safer alternatives

Practice policy insert

Staff may use approved AI tools for generic, non-patient content only.

Staff must not enter patient-identifiable information, treatment plans, clinical notes, X-rays, photos,
invoices, appointment records, patient emails or patient lists into public AI tools.

Any AI tool that reads patient data, emails, calls, treatment plans or clinical records must be
reviewed and approved by the practice owner before use.

Sources: Ahpra AI guidance · Ahpra AI case studies · OAIC commercial AI privacy guidance · OAIC APP 8 cross-border disclosure

Dental Privacy Edge Map

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Your PMS is not the only patient system.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

The edge problem

Most dental practices have a good PMS. The privacy risk in the AI era often moves to the systems around the PMS: booking widgets, contact forms, email inboxes, AI scribes, cloud drives, call tools, chat widgets, marketing platforms, and AI tools.

This guide maps the common edges so practices can review them before switching on AI tools.

Where patient information may move

A day in the practice: invisible privacy edges

APP 8 and overseas processing: what to look for

Many common dental tools — booking widgets, chat platforms, call-transcription services, AI scribes, email systems, cloud drives and analytics tools — are provided by vendors whose servers, AI subprocessors, support infrastructure or backups may be located outside Australia.

Under APP 8 of the Privacy Act, when an APP entity discloses personal information to an overseas recipient, it must take reasonable steps before that disclosure to ensure the overseas recipient does not breach the Australian Privacy Principles. The entity may also remain accountable for what the overseas recipient does with the information.

This is a review trigger, not a compliance determination. Whether a given data flow amounts to a "disclosure" under APP 8 depends on factors including the nature of the flow, contractual controls, effective access and consent — a nuanced question best resolved with qualified legal or privacy advice. The purpose of this guide is to surface possible APP 8 exposure, not to declare a breach.

For each tool the practice uses, ask:

1. Where is this system hosted, processed or stored? Check the vendor's privacy policy and data processing terms.
2. Do any overseas servers, AI subprocessors, support staff or backups receive or access patient information? Even a tool marketed as "secure" may have overseas components.
3. What contracts or data-processing agreements govern the overseas component? APP 8 and APP 11 require more than vendor assurances.
4. What were patients told? If the practice's privacy notice does not mention overseas processing, that is a separate review consideration.

The formula for possible APP 8 exposure: overseas processing + patient information + no clear disclosure, contract, effective control or consent = cross-border review trigger requiring qualified review before proceeding.

Offshore storage or processing is not automatically a breach. But patient information that reaches overseas recipients without a clear basis reviewed against the APPs is a possible APP 8 exposure that should be assessed — not assumed away.

Purpose-fit: collected for one purpose, used for another (APP 6)

The quietest privacy edge isn't a system — it's a purpose. Patient information collected for clinical care doesn't automatically become available for marketing, "win-back" campaigns, training an AI tool, or a spreadsheet someone wants to analyse. Under the Australian Privacy Principles, using health information for a secondary purpose generally needs consent or a closely related, reasonably expected use — and health information is held to the stricter "directly related" standard.

A 30-second purpose-fit check before reusing patient data anywhere new:

1. What was this information collected FOR? (clinical care, billing, bookings)
2. Is the new use the same purpose — or something else? Recall reminders sit close to care; marketing campaigns, lookalike audiences and AI experiments do not.
3. Where is it going? The same question gets sharper when the destination is a public AI tool, a marketing platform, or any system outside the practice's control — that combination (sensitive data + new purpose + external destination) is the strongest review trigger of all.

If the new use fails any of the three, stop and check before proceeding — consent, your privacy notice wording, or qualified advice. A classic example: a bad Google review arrives, and someone looks the reviewer up in the PMS to "check their history" before replying. That's clinical-care data used for reputation management — a purpose it was never collected for.

As everywhere in this guide: these are review questions and triggers, not compliance determinations.

Six edge questions for practice owners

Before switching on any AI tool, ask:

1. What patient data does this tool read, process or store?
2. Where does that data go, including overseas processing?
3. Who can access it inside the vendor's systems?
4. Can the practice delete it if needed?
5. Is the practice's privacy notice current for this use?
6. Were patients told this is how their information may be used?

These are review questions, not compliance determinations. When unsure, treat the workflow as high-review and get advice before proceeding.

Red flags

High-review signals that warrant closer look:

• AI tool that connects to email, PMS, bookings, Xero or multiple systems at once
• Booking or contact form that routes health details to a marketing platform
• Cloud backup that syncs everything including the PMS folder or email
• Public AI used for patient-facing documents, notes or communications
• Marketing agency with access to patient lists or contact records
• AI scribe with unclear audio storage, retention and deletion rules
• Analytics or ad scripts loading on pages where patients enter health information
• Booking widget, chat tool, call-transcription service or AI feature with overseas hosting, AI subprocessors or support staff — possible APP 8 cross-border review trigger
• Privacy notice or vendor terms that make no mention of overseas processing or cross-border disclosure

Safer approach

A high-review workflow is not the same as a prohibited one. Use this framing:

• "This workflow should be reviewed before patient data is entered." (not "it is illegal")
• "The vendor offers the feature, but the practice remains responsible for how patient information is handled." (not "the vendor made you breach")
• "Any scanner or audit tool used should access only public pages and visible signals, not patient records." (confirm scope with any scanner vendor before use)

When a workflow is high-review, document the review, get vendor confirmation in writing, and check whether the practice privacy notice covers the use.

This guide is educational practice workflow material only. It does not constitute legal or compliance advice. When uncertain about a specific tool or workflow, seek qualified legal or privacy guidance.

Your First Safe AI Project: the 30-Day, Read-Only Roadmap

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Most practices meet AI through a vendor pitch for the most dangerous starting point there is: an AI receptionist that talks to patients and collects health details after hours. It might belong in your practice eventually — as the last project, once everything underneath it is proven. The right first project is the opposite: an AI that can only read, never act. This guide is the 30-day sequence.

The one principle behind the whole roadmap

An AI that can't act, can't act wrongly. A read-only AI can't message a patient, can't change an appointment, can't publish a word. The worst it can do is be wrong in a report a human reads — and a wrong sentence in a report is a Tuesday, not an incident. Every step below exists to keep that property true for 30 days while you learn what AI is actually worth to your practice.

Days 1–5: put the boundaries in writing first

Before any tool is switched on:

• Adopt a staff AI policy — one page, signed, so "what's allowed" isn't a guess. (A ready-to-adopt starter is in our free library.)
• Start the AI tool register — list what's already touching the practice, including AI features inside software you didn't choose. (Fill-in template.)
• Name one accountable person. Every question, incident or vendor pitch routes to them.

Nothing here costs money, and all of it survives whichever vendor you eventually pick.

Days 6–10: choose the narrowest useful data

The pilot reads the minimum data that answers an owner's questions — typically appointment, recall and treatment-plan summaries. Three rules:

• Read-only access, granted formally, revocable in one step.
• No patient-facing systems in scope. No inbox. No website chat.
• Know where the data is processed (Australia or overseas) before it flows — that's an APP 8 question worth asking out loud.

If a vendor can't grant read-only access, that is the answer to whether they're the right first vendor.

Days 11–28: the nightly report earns its keep

Now the AI does one job: a short owner report each morning. Lapsed recalls. Accepted treatment never booked. Tomorrow's gaps. The questions an owner would ask a sharp practice manager — answered from data the practice already has, checked against reality by someone who knows the practice. You're testing two things at once: whether the numbers are right, and whether they change what you do on a Monday morning.

Days 29–30: decide with evidence, not a demo

At the end of the month you'll know what a month of AI attention found, what it got wrong, and what acting on it would be worth. Then — and only then — decide what earns write access, what stays read-only, and what (like the receptionist) still waits. That's the decision a demo can never give you, made with your own numbers.

What this roadmap deliberately leaves out

No patient-facing AI. No clinical AI (X-ray reading and triage tools carry their own regulatory weight — see the TGA guide). No whole-inbox AI. Not because those are forbidden forever — because they should be earned by the boring, safe month that proves the foundations.

General practice-workflow education, not legal, clinical or compliance advice. The roadmap describes a risk-ordered sequence, not a guarantee of outcomes — adapt it to your practice.

Most Patients Find You on Google Maps Before Your Website — Here's How to Win There

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

This is general educational material for dental practice owners and managers, not legal or marketing advice. The one regulatory caution (about reviews and testimonials) is a review trigger to confirm, not a determination.

A patient wakes up with a throbbing tooth. They don't browse dental websites — they pick up their phone and search "dentist near me" or "emergency dentist [suburb]". Before a single website loads, Google answers with a map and three practices (the "map pack" or "3-pack"): name, stars, hours, a call button, directions.

For a huge share of local searches, the decision happens right there — on a free Google surface most practices never properly set up. Your Google Business Profile (GBP) is, for "near me" searches, doing more work than your website. Here's how to make it win.

Why the map pack matters more than your homepage

• It appears above the normal results for local searches, and it's where high-intent, ready-to-book patients look first.
• It's increasingly a zero-click destination: the patient calls, gets directions, or checks hours without ever visiting your website.
• AI search leans on it too: Google's AI answers and assistants pull practice details, hours and reviews straight from your Business Profile.

You can have the best website in the suburb and still lose the patient at the map — because the map is a different game, and it's the one being played first.

What actually moves the map pack

These are the levers, in roughly the order they matter for a single-location dental practice.

1. Claim it and complete every field

An incomplete profile is the most common, most fixable problem. Claim the profile and fill in everything: exact business name, address, phone, website, opening hours, and your services. A complete profile is shown more and trusted more.

2. Get the primary category right

Set your primary category to "Dentist" — not the vaguer "Health" or "Medical clinic". The primary category is one of the strongest signals Google uses to decide which searches you show up for. Add relevant secondary categories (e.g. Cosmetic Dentist, Emergency Dental Service, Dental Clinic) where they genuinely apply.

3. Reviews — volume, recency, and your replies

Reviews are one of the biggest drivers of the map pack, and a recent 4.7 beats an old 3.8. Invite happy patients to leave an honest Google review, respond to all of them (positive and negative, professionally), and keep them flowing — a steady trickle of recent reviews signals an active, trusted practice.

One Ahpra caution. Encouraging patients to leave an honest review on Google is generally fine. What's treated differently is republishing patient testimonials about clinical care or outcomes in your own advertising — on your website or in your own words. Keep the reviews on Google; don't lift them into your marketing without checking the rules. See Website Advertising AI Review.

4. Make your details identical everywhere (NAP)

Your name, address and phone should be exactly the same on your website, your Google profile, and every directory that lists you (HealthEngine, HotDoc, the ADA find-a-dentist directory, the Ahpra listing, your socials). Inconsistencies — "St" vs "Street", an old phone number, a former address — confuse Google about which listing is really you, and weaken all of them.

5. Real photos, accurate hours, after-hours signal

• Photos of the real reception, the chair, and the team (not stock imagery) earn more clicks and direction requests.
• Hours must be accurate, including public holidays — wrong hours send a patient to your door for nothing and erode trust.
• Add an after-hours / emergency signal: the highest-intent searcher is the one looking at 9pm. Make it obvious what to do — an emergency number, an after-hours message, or 24/7 online booking.

6. Keep it alive — posts and Q&A

Post occasional updates, and seed the Q&A section with the questions patients actually ask (parking, new patients, payment plans, what to do in an emergency). An active profile signals a real, current practice.

The quick audit

Where this connects

• The map pack is the local (GEO) half of being found. The other half — being cited by AI assistants — runs on authority and content: see When a Patient Asks ChatGPT for a Dentist, Do You Show Up?.
• The after-hours angle is also a booking question — if an urgent patient finds you at 9pm, can they actually book? That's the booking-conversion scan.

See where you stand

Our free discoverability scanner reviews your public site for local/Maps signals (the GEO axis) alongside Google search and AI-assistant readiness — a plain red, amber or green read. For the fuller picture across discoverability, advertising-risk, privacy and booking, request your free practice Blueprint. Public information only, no patient data.

This guide is educational material only. It is not legal or marketing advice and is not a guarantee of any search outcome. Confirm review/advertising questions against Ahpra's guidance for your circumstances.

The NSW Privacy Law Dental Practices Forget (HRIP Act)

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Most AI privacy guidance talks about the Commonwealth Privacy Act. If you practise in NSW, there is a second rulebook that also applies — and many practices have never heard of it.

This is general educational material for dental practice owners and managers, not legal advice. The specifics of the HRIP Act should be confirmed with a qualified adviser for your situation.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

The short version

There are two privacy laws over your practice, at the same time:

• Federal: the Privacy Act 1988 and its Australian Privacy Principles (APPs), overseen by the OAIC.
• NSW: the Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs), overseen by the Information and Privacy Commission NSW.

If your AI and privacy thinking only covers the APPs, it covers about half of what applies to a NSW practice.

What the HRIP Act is

The HRIP Act is NSW legislation governing how health information is collected, held, used and disclosed by organisations that provide health services in NSW — which includes dental practices. It sets out a set of Health Privacy Principles (HPPs), and NSW has its own privacy regulator and complaint pathway, separate from the federal system.

The practical point: a patient who feels their health information was mishandled has more than one avenue, and your practice has obligations under more than one law.

"We're too small for privacy law" — not for health information

Some small businesses are exempt from parts of the Commonwealth Privacy Act on the basis of turnover. A dental practice should not assume that exemption applies to it, for two reasons that are worth confirming with an adviser:

• The way the Privacy Act treats organisations that handle health information tends to bring health-service providers in regardless of size.
• The NSW HRIP Act applies in addition, on its own terms, to health information held in NSW.

In short: handling patient health records is exactly the activity these laws are built around. Practise on the assumption that both apply.

The HPPs cover familiar themes — and map onto the AI risks

The HPPs cover similar ground to the APPs — collection, use and disclosure, data quality, security, openness, access and correction, identifiers, anonymity, transborder (overseas) disclosure, and linkage. They are a separate set of obligations, not a copy of the APPs.

For AI, the useful thing is that every risk in the other guides is also an HRIP question, not just an APP one:

(The exact HPP numbering and wording should be confirmed against the current Act — this guide gives the shape, not the citation.)

What to actually do

You do not need to become an expert in two statutes. You need to:

1. Assume both laws apply to every patient-data decision in the practice.
2. Apply the same core rule as the rest of this library: keep patient information inside the protected system; the moment a workflow needs to take it out is the moment to stop and check. That rule serves both the APPs and the HPPs.
3. When you get advice, make sure it covers both the Commonwealth Privacy Act and the NSW HRIP Act — not just one.

See the foundational guide, Where Patient Data Is Protected — and Where It Escapes, for the underlying principle.

This guide is educational material only. It is not legal advice. The HRIP Act's scope, the HPPs, and how they interact with the Commonwealth Privacy Act should be confirmed with a qualified adviser. Seek qualified advice for your specific circumstances.

Owner Reporting AI Readiness

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Reporting is a management workflow. It still needs a privacy boundary.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Owner-dentists and practice managers often want AI to summarise production, chair utilisation, treatment acceptance, bookings, marketing and follow-up performance. This guide helps separate useful reporting work from unsafe data movement.

Good use cases

AI can help with:

• Turning exported totals into a management summary
• Drafting a weekly meeting agenda
• Explaining trends in plain English
• Creating action lists from non-identifiable metrics
• Comparing planned vs completed workflow tasks
• Summarising public marketing activity
• Drafting questions for the practice manager or treatment coordinator

High-review use cases

Review before using AI with:

• Patient lists
• Treatment acceptance exports with patient names
• Recall or reactivation lists
• Unscheduled treatment reports
• Appointment notes
• Complaints
• Staff performance data
• Provider-level clinical notes
• Any PMS export that includes names, dates of birth, contact details or treatment specifics

Red / amber / green reporting rule

Use this table as a starting classification. Items in amber or red are possible data-movement exposure requiring review — not a declared breach.

Overseas processing and APP 8 — a consideration to assess

Before feeding practice or patient data into an AI reporting tool, owners should check where that tool processes and stores data.

If the tool processes data on overseas servers — or uses overseas AI subprocessors — the workflow may involve cross-border disclosure of personal information. Under the Australian Privacy Act, APP 8 requires an entity to take reasonable steps before disclosing personal information to an overseas recipient, and the Australian entity can remain accountable for how the overseas recipient handles that information (s 16C). This applies even when the tool is from a reputable vendor.

This is a consideration to assess, not a declared breach. Many AI reporting tools are cloud-hosted in the US or elsewhere. That alone is not automatically a problem, but it does mean the practice should review:

• Where the tool processes and stores data
• Whether the data includes any patient-identifiable fields (names, dates of birth, contact details, treatment details)
• What contracts, data-processing agreements or terms of service exist
• Whether patients were told their information might be handled by overseas systems
• Whether aggregated, non-identifiable data can be used instead

If the reporting workflow uses only aggregated, non-identifiable totals — as recommended in the minimum reporting dataset below — the overseas-processing risk is substantially lower. The higher concern arises when patient-level PMS exports, recall lists, treatment notes or complaint data are fed directly into an overseas-hosted AI tool.

Possible cross-border review trigger: if your AI reporting tool processes patient-identifiable data on overseas infrastructure, APP 8 considerations apply. This should be reviewed before the workflow is used at scale.

Safer reporting prompt

Summarise these aggregated practice metrics for an owner-dentist.
Do not infer patient details, clinical advice or individual staff performance.
Provide operational observations and questions for management review.

Minimum reporting dataset

Prefer aggregated fields:

Avoid exporting patient-level rows unless the workflow is approved for that data.

Owner dashboard questions

Use AI to help ask better questions:

• What changed this week?
• Which funnel step is weakest?
• Which follow-up queue is growing?
• Which guide or scanner drove interest?
• Which booking source needs review?
• Which workflow needs a staff checklist?
• What should be discussed at the next owner/manager meeting?

Human review rule

AI reporting should not be treated as truth by default.

Before acting on a recommendation:

1. Check the source data.
2. Check whether the metric is aggregated or patient-level.
3. If the tool is overseas-hosted, confirm no patient-identifiable data was included in the input.
4. Ask whether the suggested action is operational, clinical or financial.
5. Escalate clinical or patient-specific decisions to the dentist.
6. Record the final human decision.

Staff policy insert

AI may be used to summarise aggregated practice metrics and draft management notes.
Patient-identifiable PMS exports, treatment lists, recall lists, complaints,
clinical notes and contact details must not be entered into public AI tools.
AI reporting outputs are drafts for owner or manager review, not automatic decisions.

This guide is educational material only. It does not provide clinical, financial, legal or compliance advice, and does not determine whether a practice is compliant or non-compliant with any law or regulation. Any data-movement patterns identified here are possible areas for review, not declarations of a breach.

Where Your Patient Files Go When You Press Save

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

A patient file on the desktop doesn't sit still. It gets backed up to the cloud — often overseas — copied and kept for years, whether you meant it to or not.

This is general educational material for dental practice owners and staff, not legal advice.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Why this matters

In the foundational guide we describe how extracted patient data multiplies once it leaves the system. The backup is the quiet end of that cycle.

A staff member exports a report, saves an X-ray, or drops a treatment-plan PDF onto the Desktop or into Downloads "just for a minute". On a modern computer or phone, that folder is often automatically synced to a cloud backup — iCloud, OneDrive, Google Drive, Dropbox, or the device's built-in backup. No one chose to send patient files to the cloud; it happened by default.

What gets backed up without anyone noticing

• PMS exports and reports saved locally
• X-ray and clinical images opened or downloaded from the PMS
• Treatment-plan PDFs and quotes
• Screenshots of patient records
• Email attachments opened and saved to a synced folder

Why a backup is different — and harder to undo

A backup is not just one more copy. It is a copy that:

• Sits outside the system, without the PMS's access controls or audit trail.
• Is often stored overseas. Many consumer cloud backups process or store data outside Australia — which can raise APP 8 cross-border-disclosure considerations (and the equivalent NSW HPP).
• Persists. Backups keep versions for a long time, so a file you "deleted" may still exist in the backup.
• May be tied to a personal account. If a work folder syncs to a staff member's personal iCloud or Google account, patient data is now in an account the practice does not control — a security concern under APP 11.

Keep the record, not the sprawl

This is not about deleting records. The authoritative clinical record must be kept inside the system for its mandatory retention period. The problem is the opposite: loose duplicates sprawling into personal and overseas backups you didn't choose and can't see. Keep one controlled copy in the system; stop the uncontrolled copies escaping into backups.

Backup exposure check

Walk through these for each practice device:

1. Is automatic device or folder backup turned on? Where does it sync to?
2. Is that backup stored in Australia, or overseas?
3. Are any personal cloud accounts (iCloud, Google, Dropbox) syncing folders that contain work files?
4. Do staff save PMS exports, images or PDFs into a synced folder (Desktop, Documents, Downloads)?
5. Who can access the backup, and could the practice delete a file from it if needed?

If any answer is unclear, that is a review item before more patient files accumulate there.

What good looks like

• Keep patient files in the system. Don't save them to the Desktop, Downloads or a synced personal folder "temporarily".
• Use a practice-controlled backup with a known location and known access — not whatever a staff member's personal device happens to sync to.
• Separate work from personal cloud accounts on practice machines.
• Know where your backups live. If a vendor or device backs up overseas, treat that as an APP 8 / HPP review item.

This guide is educational material only. It is not legal advice. Identifying a risky workflow indicates possible exposure, not a declared breach. Seek qualified advice for your specific circumstances.

You've Got Your Blueprint. Now What?

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

Your Blueprint just gave your practice a red, amber or green read across three lenses — booking, visibility, and website wording. Keep the PDF, save the private link, and give this guide fifteen minutes before you act. The order you fix things in matters more than how fast you start.

What the colours actually mean

Green means "we looked and found nothing worth flagging" — not a certification, just a clean pass on publicly visible signals. Amber means "worth a look this month": a pattern that costs patients or invites questions, but isn't urgent. Red means "this is actively costing you or worth reviewing now" — an invisible practice, a booking dead-end, wording in the riskiest category. None of it is a legal finding or a compliance verdict; every flag is a review trigger — a place to look, with your context, before deciding.

Fix in the order that pays, not the order that scares

Counter-intuitively, the wording findings — the AHPRA-sounding ones — usually go second, not first.

1. Booking dead-ends first. A missing after-hours path or absent online booking loses real patients tonight, and the fix is usually configuration, not construction: one paragraph of after-hours guidance, one visible booking link. Days, not months.
2. Wording second. Testimonial-style quotes, superlatives, outcome promises — these are editorial fixes: rewrite or remove. They matter, but a regulator complaint is a possible future cost; a 9pm patient bouncing to the practice up the road is a certain present one.
3. Visibility third. Schema markup, named-dentist bylines, answer-shaped pages — the compounding work. It pays for years, but nothing breaks while you schedule it properly.

What to ignore (for now)

A Blueprint full of ambers can feel like a to-do avalanche. It isn't. Pick the single red with the clearest fix and do only that this week. A practice that fixes one real thing a week is ahead of nearly everyone — and far ahead of a practice that bought a new AI tool instead of reading its own report.

When to get help — and when not to

Most fixes here are free and internal: our library has the templates and walkthroughs, and your web person can implement the rest from the report's specifics. Get help when the findings cross into judgement — wording you're unsure about after reading the guidance, or when you want the whole picture sequenced properly (that's the Readiness Review). And if the report's revenue questions are the ones that stung, the read-only pilot exists precisely for what a public scan can't see.

Practice-workflow education, not legal or compliance advice. Blueprint findings are review triggers built from publicly visible information — interpret them with your own context, and seek qualified advice where it matters.

You Don't Need More New Patients — You Need to See the Revenue You're Already Losing

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

This is general educational material for dental practice owners and managers, not financial, clinical or legal advice. The privacy points are review triggers to confirm for your situation, not determinations.

Ask most practices how they'll grow and the answer is "more new patients" — more marketing, more ads, more spend at the top of the funnel. Meanwhile, revenue is quietly leaking out the side of the practice from patients who are already yours. Plugging those leaks is almost always cheaper, faster and safer than buying new patients — and the information you need is already sitting in your practice management system.

Here are the four places it leaks, and the safe way to see them.

Leak 1 — Lapsed recalls

Patients who are overdue for their checkup and simply… drifted. Life got busy, the reminder bounced, no one followed up. Each lapsed recall is a relationship you've already earned, going cold. Across a whole patient base, the overdue list is often a surprisingly large number — and every name is a patient who would probably still come back if asked.

Leak 2 — Accepted treatment that was never booked

The dentist recommends treatment, the patient says "yes, let's do it" — and then it never gets scheduled. The patient leaves to "check the calendar", the front desk gets busy, and an accepted, clinically-needed treatment plan quietly sits unbooked. This is revenue the patient has already agreed to, sitting in limbo.

Leak 3 — Empty chairs and short-notice gaps

A cancellation at 2pm leaves a chair empty for the afternoon. A gap opens in tomorrow's book. Without a system to fill them, those hours are simply lost — you can't sell yesterday's empty chair back. The highest-value version of this is the after-hours urgent patient who couldn't find a way to book you and went elsewhere.

And they almost always go elsewhere: in our June 2026 audit of 969 Sydney dental practice websites scored for booking readiness, 87% scored below "adequate" on their after-hours path — a patient in pain at 11pm hits a dead end nearly everywhere — and 38% scored below adequate on online booking at all. The leak isn't rare; being the practice that doesn't leak is the edge.

Leak 4 — Follow-ups that fell through

The post-op check that never got booked. The referral that wasn't chased. The "we'll call you next week" that nobody did. Each dropped follow-up is both a clinical loose end and a quiet revenue and goodwill loss.

Why these stay invisible

None of these is a secret — the data is all there, in the practice system. They stay invisible because nobody is looking at the patterns. The front desk is rightly focused on today: the patient at the counter, the phone ringing, tomorrow's confirmations. The leaks live in the patterns across the data — the overdue list, the accepted-but-unbooked report, the recurring gaps — which no busy human reviews end-to-end, every week, by hand.

The wrong way to chase this (the trap)

The instinct, once you see the problem, is to export a patient list — pull the overdue recalls into a spreadsheet, or paste them into an AI tool to "draft the follow-ups". Don't. The moment patient information leaves your protected dental system — into a spreadsheet, an email, a personal device, or a public AI tool — it loses the protection the system gave it, and you've created exactly the privacy exposure these practices are trying to avoid. See Where Patient Data Is Protected — and Where It Escapes and Treatment Plans: How a Plan Becomes a Privacy Spill.

The safe way to see it

You don't have to choose between finding the money and protecting the data. The safe way is a read-only report that reads your own system and surfaces the patterns — and shows them to the owner, where:

• It only reads — it doesn't message patients, book appointments, or act on its own.
• The patient data stays inside the protected system — nothing is exported, pasted, or sent overseas.
• A human decides what to do with each finding. The report says "these 40 recalls are overdue"; your team, working inside the system, does the outreach.

That is the safest first AI project for most practices: a private, read-only owner report that finds the leakage — long before anything patient-facing. See Is Your Practice Ready for an AI Owner Report? for what "ready" looks like.

Where to start

• Put a number on it. Our free leakage estimator turns five aggregate figures you already know (recalls due, plans presented, gaps, average values) into a monthly and annual estimate range — no patient data, and your numbers prefill your Blueprint request.
• See your outside-in picture first. Request your free practice Blueprint — it shows booking friction, advertising-risk, privacy edge and discoverability using public information only (no patient data).
• Then the inside view. When you want a private, read-only owner report that surfaces the recalls, unbooked treatment and gaps from inside your own system — owner-approved, fully auditable, nothing acting on its own — that's the kind of system worth building rather than risking with exports and pasted lists.

This guide is educational material only. It is not financial, clinical or legal advice. Confirm any handling of patient information against the Privacy Act / Australian Privacy Principles and state laws (e.g. the NSW HRIP Act) for your circumstances.

The 20-minute website job two-thirds of Sydney practices haven't done

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

General educational material for practice owners and managers — not technical, legal or marketing advice. Schema markup makes your practice easier for machines to verify; nobody can guarantee a ranking or an AI recommendation from any single change.

Your website says who you are to humans. Schema markup says it to machines — a small block of structured data (usually JSON-LD) embedded in the page that tells Google Search, Google Maps and AI assistants, unambiguously: this is a dental practice, called X, at this address, with this phone number, open these hours.

Patients never see it. Machines rely on it. And machines are doing more of the choosing every year — Maps results, "dentist near me", AI Overviews, and assistants like ChatGPT and Perplexity deciding which practices they can confidently cite.

The numbers: this is an open gap, not table stakes

In our June 2026 audit of 1,156 live Sydney dental practice websites:

• only about a third exposed any machine-readable practice identity (Dentist or LocalBusiness markup) on any page we crawled;
• roughly one in seven had FAQ markup anywhere.

That's unusual. Most discoverability advice ("write great content", "earn reviews") is a long campaign against neighbours doing the same thing. Schema is different: it's a one-off technical job, and in most Sydney suburbs most of your competitors haven't done it. On our suburb snapshots, the "Machine-readable ID" figure is often the weakest number on the card.

What "good" looks like for a dental practice

Three layers, in priority order:

1. Practice identity — the must-have. A Dentist block (the specific type beats generic LocalBusiness) on your home page carrying: practice name exactly as it appears on your Google Business Profile, street address with suburb/state/postcode, phone, opening hours, geo coordinates, and sameAs links to your Google Business Profile and any directories you control. A skeleton looks like this:

{
  "@context": "https://schema.org",
  "@type": "Dentist",
  "name": "Example Dental Practice",
  "telephone": "+61 2 9000 0000",
  "address": {
    "@type": "PostalAddress",
    "streetAddress": "1 Example St",
    "addressLocality": "Parramatta",
    "addressRegion": "NSW",
    "postalCode": "2150",
    "addressCountry": "AU"
  },
  "openingHoursSpecification": [],
  "geo": {"@type": "GeoCoordinates", "latitude": 0, "longitude": 0},
  "sameAs": ["https://g.page/your-business-profile"]
}

2. FAQ markup — where you genuinely answer questions. If a page has real question-and-answer content ("How much does a check-up cost?", "Do you see emergencies?"), FAQPage markup makes those answers liftable by search and assistants. Two honesty rules: the marked-up questions must actually appear on the page with their answers, and don't manufacture FAQ blocks for pages that aren't answering anything — markup that misrepresents the page is a spam signal, not a boost.

3. Consistency — the part that's about discipline, not code. The name, address and phone in your schema must match your Google Business Profile and your page footer exactly. Mismatches make machines less confident, not more. One warning from our audit: don't add review-rating markup (aggregateRating) unless the reviews are visibly on the page — invisible-rating markup reads as manipulation. (And for health practices, republishing clinical-outcome reviews on your own site raises a separate advertising question — see our advertising guide.)

The brief to hand your web person

Copy-paste this:

Please add JSON-LD structured data to our website: a Dentist schema block on the home page with our exact practice name, full address, phone, opening hours, geo coordinates, and sameAs links to our Google Business Profile; FAQPage markup on any page with genuine Q&A content (and only those). Name/address/phone must match our Google Business Profile exactly. Don't add aggregateRating. Then validate every changed page with Google's Rich Results Test and send me the passing results.

That last sentence matters: Google's free Rich Results Test shows whether the markup parses, in plain pass/fail. It's your acceptance test — no technical knowledge needed to read it.

If your site is on a common platform (WordPress, Squarespace, Wix), this is typically under an hour of work with a plugin or built-in settings; a custom site is a small task for whoever built it.

How to check where you stand right now

Our free discoverability check reads your public pages the way an AI assistant would — including whether a machine-readable identity and FAQ markup are present — and benchmarks each score against the Sydney practices we've audited. Your suburb's snapshot shows the local picture: how many of the practices around you have done this job.

Twenty minutes of someone else's time, a pass/fail test you can read yourself, and a gap most of your suburb hasn't closed. There aren't many of those left on a website.

Start Here: Where Patient Data Is Protected — and Where It Escapes

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

You have a dental system for a reason. The biggest AI risk is not the AI — it is taking patient information out of that system.

This guide is the foundation for everything else in the library. It is general educational material for dental practice owners and staff, not legal or clinical advice.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

The one idea

Your practice-management system (PMS) is not just where the data lives. It is what protects it. It enforces who can see what, records every access in an audit trail, applies retention rules, secures the data, and keeps it inside a boundary you control.

The moment patient information is taken out of that system — copied into an email, pasted into ChatGPT, saved to the desktop as a PDF, opened in Word or Canva, synced to a personal cloud drive, dropped into a chat widget, or handed to a marketing tool — none of that protection comes with it. The information is now a loose copy, sitting outside the boundary that was built to keep it safe.

That is the core risk. Almost every specific danger in the other guides — overseas processing, the spread of treatment plans, a staff member pasting a name into public AI, an after-hours chatbot storing symptoms — is a consequence of patient information leaving the protected system in the first place.

Why it gets worse: extraction starts a cycle

Extraction is not a single event. It is the start of a cycle, because a loose copy tends to make more copies:

• It gets re-worked, then fed back to AI. Pulled out, edited in Word to "make it better", pasted into an AI tool to polish, pasted back in. Each round trip is another copy.
• An AI quietly reads the whole folder. An "AI assistant" or desktop tool that "reviews your Documents folder" reads every extracted file sitting in Downloads or on the Desktop — including ones you forgot were there.
• A backup sweeps it up. That loose file gets caught in an automatic cloud backup — copied again, kept for years, and often stored overseas.

So one extraction becomes many copies, in many places you no longer control, persisting long after the original task is done. That is the engine behind every other risk in this library.

Where it bites: two privacy laws, and the overseas problem

Patient information is health information — the most protected kind. Once it leaves the system, the practice still carries its obligations under both the Commonwealth APPs and the NSW HRIP Act, but now without the system's controls helping it meet them. And because so many AI and cloud tools process data outside Australia, a loose copy can quietly become a cross-border disclosure — which raises APP 8 considerations (reasonable steps, and the practice generally remaining accountable for what the overseas recipient does). Overseas exposure is, again, a downstream consequence of the data having left the system at all.

The simple rule

You do not need to memorise the law to get this right. The rule is:

Keep patient information inside the protected system. The moment a workflow needs to take it out is the moment to stop and check.

Most "AI projects" that go wrong in a dental practice fail this one test — they quietly move patient data out of the system to make something faster or nicer.

What good looks like

• One controlled copy. Keep the authoritative record inside the PMS or an approved system, with its access controls and audit trail intact.
• Destroy the duplicates, never the record. Clean up the loose copies that escaped (email attachments, desktop PDFs, Word drafts, personal-drive syncs) — but never delete the authoritative clinical record, which must be kept for a mandatory minimum retention period.
• Check before anything leaves. Before patient information is sent to, or processed by, an AI tool, a cloud service, a marketing partner or anyone overseas, treat that as a decision to review — not a default.
• Public data only in free tools. Never put patient names, treatment details, images, invoices or identifiable contact details into public AI tools.

Where data escapes — and which guide covers it

Use this guide as your map. Each escape point has its own guide:

• Staff pasting into public AI — Can I Paste This Into AI?
• AI scribes recording consultations — AI Scribe Consent Checklist
• Treatment plans leaving the system — Treatment Plans: Stop The Spread
• The systems around the PMS — Dental Privacy Edge Map
• After-hours booking and chat tools — Emergency Booking and the AI Boundary
• AI-assisted owner reporting — Owner Reporting AI Readiness
• Website and advertising copy — Website Advertising AI Review

The honest summary

The dental system was built to protect patient information. AI is not the enemy — but most AI mistakes in a practice come from taking data out of that protection to use a tool. Keep it in, check before it leaves, and you have removed the cause of most of the risk before it starts.

This guide is educational material only. It is not legal, privacy or clinical advice. Identifying a risky workflow indicates possible exposure, not a declared breach. Seek qualified advice for your specific circumstances.

Treatment Plans Are Where Revenue Meets Risk

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

A treatment plan does not stop being patient health information because the practice calls it sales.

This is general educational material for dental practice owners and staff, not legal advice. This guide covers the sales/revenue angle; the Treatment Plans: Stop The Spread guide covers the privacy/spread side of the same documents.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Why this matters

The treatment plan is one of the highest-value documents in the practice. It is also a sales document — it is how a practice presents recommended care, fees and finance, and a big lever on production and case acceptance.

That sales pressure is exactly what drives the risk. When the goal becomes "lift acceptance", staff reach for tools to help:

• Pasting the plan into ChatGPT to "make this warmer / more persuasive".
• Dropping it into Canva or a design tool to make it look better.
• Using Word/email AI to rewrite the wording.
• Sending it through marketing tools for follow-up campaigns.

Every one of those is the extraction cycle: a document full of patient name, clinical context and finances leaves the protected system to be "improved" for conversion.

The line that matters

A treatment plan does not stop being health information because the practice calls it sales.

The patient's name, their diagnosis, the proposed treatment and the costs are health and personal information whether the document is sitting in the clinical record or being polished for acceptance. The privacy obligations (APPs and the NSW HPPs) travel with the content, not with what the practice intends to use it for.

Lift acceptance without extracting patient data

You can improve treatment-plan conversion without sending patient plans out of the system:

• Improve the template, not the patient's plan. Build strong, clear, compliant wording blocks and layouts generically — then apply them inside the PMS. The AI work happens on the template, never on an identifiable plan.
• Personalise inside the system. Use the PMS's own tools to tailor and present the plan.
• Follow up from the system. Track unscheduled and unaccepted treatment and follow up through the PMS / approved channels — not by exporting patient lists into a marketing tool.
• Train the conversation, not the rewrite. Most acceptance gains come from how the plan is explained chairside, not from an AI rewording the document.

Quick self-check

• Are staff pasting patient plans into public AI to make them "sound better"? (Red — extraction.)
• Are plans going into Canva, marketing tools or personal email for follow-up?
• Is treatment-plan follow-up done inside the PMS, or by exporting patient lists?
• Could acceptance work be done on generic templates instead of identifiable plans?

This guide is educational material only. It is not legal advice. Identifying a risky workflow indicates possible exposure, not a declared breach. Seek qualified advice for your specific circumstances.

Treatment Plans: Stop The Spread

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

A treatment plan is patient health information, not just a quote.

Two privacy laws apply in NSW. As well as the Commonwealth Privacy Act 1988 and its Australian Privacy Principles (APPs), dental practices in NSW are also bound by the NSW Health Records and Information Privacy Act 2002 (HRIP Act) and its Health Privacy Principles (HPPs). Read the considerations here against both. General information, not legal advice.

Why this matters

A treatment plan can contain:

• Patient name and contact details
• Tooth numbers and symptoms
• Clinical context and diagnosis notes
• Proposed procedures
• X-rays or photos
• Costs and payment options
• Risks and alternatives
• Dentist recommendation
• Consent language

That makes it a patient-identifiable clinical and financial document — not ordinary sales copy.

The core risk: once it leaves the system, it's no longer protected

Your dental or practice-management system (PMS) was built to protect patient information. It enforces who can see what, records every access, applies retention rules, and limits how data moves. Those protections exist for a reason.

The moment a treatment plan is taken out of that system — copied into an email, pasted into ChatGPT, saved to the desktop as a PDF, opened in Word or Canva, synced to a personal cloud drive, or forwarded to a marketing tool — none of that protection travels with it. The file is now outside the boundary that was designed to keep it safe.

This is the core risk. Not the spread itself, not the overseas server, not the breach finding — those are all downstream consequences of the data leaving the protected system in the first place. The spread path in the next section shows exactly how it unfolds once extraction happens. The overseas-processing and APP 8 consideration later in this guide arises because external tools often sit on infrastructure the practice has no visibility over — and that is only possible if patient information has already left the system.

The principle in plain terms:

"You have a dental system for a reason — don't hijack information out of it. Keep patient information inside the protected system; the moment a workflow needs to take it out is the moment to stop and check."

Once it's out, it doesn't sit still — it multiplies

Extraction is not the end of the story. It is the start of a cycle. A treatment plan that leaves the system becomes a second copy with no controls on it — and that loose copy tends to breed more copies:

• It gets re-worked, then fed back to AI. The plan is pulled out, opened in Word to "make it warmer" or "more persuasive", then pasted into an AI tool to polish it — and the result is pasted back in again. Each round trip is another copy and another disclosure.
• An AI quietly reads the whole folder. An "AI assistant" or desktop tool that "reviews your Documents folder" or summarises your files will read every extracted plan sitting in Downloads or on the Desktop — including ones you forgot were there.
• A backup sweeps it up. That loose PDF on the desktop or in a personal cloud drive gets caught in an automatic backup — copied again, kept for years, and often stored overseas.

So one extraction becomes many copies, in many places you no longer control, persisting long after the original task is done. That is the engine behind every downstream risk in this guide. It is also why keeping the information inside the protected system matters: that is the one place where there is a single copy, with controls, that the practice can actually account for.

How treatment plans spread

Treatment plans often leave the PMS because staff need to make the plan look nicer, rewrite wording, add payment options, email the patient, or follow up acceptance. Each step can create another copy.

Common spread path:

PMS / clinical notes
        ↓
Treatment plan generated
        ↓
Exported to Word or PDF
        ↓
Saved to Desktop or Downloads
        ↓
Edited and reworded
        ↓
Copied into public AI for friendlier wording
        ↓
Attached to email
        ↓
Synced to OneDrive / iCloud / Google Drive
        ↓
Forwarded to patient / lab / finance provider
        ↓
Old versions remain everywhere

The red / amber / green rule

Do not

• Save plans to Desktop or Downloads
• Use patient names in filenames
• Paste patient plans into ChatGPT or public AI
• Email old versions around
• Store plans in personal cloud drives
• Send plans to marketing tools
• Reuse real plans for staff training without de-identifying and getting approval
• Keep duplicate copies forever

Do

• Use approved templates
• Store plans in the approved location
• Send approved versions only
• Remove old versions
• Ask before using AI
• Keep patient-specific details inside approved systems
• Get dentist approval before sending

File naming rules

Avoid patient names in filenames:

[Patient name] implant plan final.docx   ← avoid
[Patient name] crown quote v2.pdf        ← avoid

Use a reference number instead:

TP-2026-000142.pdf
Plan-InternalID-000142.pdf

AI wording rule

Do not ask public AI:

Rewrite this patient treatment plan for [patient name]...

Do ask approved AI or generic public AI:

Write generic patient education wording about what a crown is.
Do not include patient-specific details, guarantees, testimonials
or risk-free or pain-free claims.

Overseas-processing and APP 8 consideration

If an AI tool drafting, summarising or rewording a treatment plan processes data on overseas servers — including many widely-used public AI services — that may constitute a disclosure to an overseas recipient under the Privacy Act (Cth). APP 8 requires an APP entity to take reasonable steps before disclosing personal information to an overseas recipient, and may hold the practice accountable for what that overseas recipient does with the information (s 16C). This is a consideration to assess with qualified legal or privacy advice, not a definitive conclusion. It applies whenever the plan contains patient-identifiable information — name, health details, costs or clinical context — and the AI tool's processing location is unclear or offshore.

The same consideration may apply to:

• cloud storage services (OneDrive, iCloud, Google Drive) if patient-identifiable plans sync to overseas-processed storage
• email providers that process attachments on overseas infrastructure
• finance or third-party providers who receive plans and use offshore systems

Sending generic wording requests with no patient-identifiable information to public AI does not raise the same concern.

Treatment coordinator checklist

Before sending a plan:

• Plan is in the approved location
• Correct patient, correct version
• Dentist has approved
• No old template leftovers
• No patient data entered into public AI
• No patient name in an uncontrolled filename
• No duplicate local copies left behind
• Sent by approved method
• Follow-up task created
• If any AI tool was used to draft or reword the plan, confirm whether it processes data overseas (if overseas and the plan contained patient-identifiable information, flag for manager review — this may require an APP 8 assessment)

Manager checklist

Review monthly:

• Are treatment plans stored outside the PMS or approved vault?
• Are staff using Word templates?
• Are files saved to Desktop or Downloads?
• Are plans emailed as attachments?
• Are loose old copies (not the PMS record) cleaned up?
• Are plans synced to personal cloud drives?
• Are staff using public AI for wording?
• Are plans sent to finance or third parties?
• Is there an audit trail?
• Do any AI tools, cloud storage services or third-party recipients used in the treatment-plan workflow process patient data overseas? If so, has an APP 8 assessment been done or referred to qualified legal or privacy advice?

Safer workflow

A seven-step model for safer treatment plan handling:

1. Create the plan inside the PMS or approved vault.
2. Use approved templates and wording blocks.
3. Do not save patient-identifiable plans to Desktop or Downloads.
4. Do not paste patient plans into public AI. If an AI tool is used for any part of drafting or summarising, confirm whether it processes data overseas — if it does and the plan contains patient-identifiable information, an APP 8 assessment may be required before use.
5. Send secure links where possible, not attachments. Consider whether the recipient's systems (finance providers, third-party labs) process received data overseas, as this may also require an APP 8 review.
6. Keep one approved version with an audit trail.
7. Destroy the loose duplicates — never the record. Delete the copies that escaped the system (email attachments, Word drafts, desktop PDFs, personal-drive syncs). Do not delete the authoritative clinical record: dental records must be kept for a legally required minimum period (longer again for a minor). The aim is one controlled copy in the PMS, kept for the required period — not fewer records.

Destroy duplicates, keep the record of truth. "Get rid of old copies" means the proliferated duplicates a treatment plan spawns — not the patient's clinical record. Deleting the authoritative record to "tidy up" creates its own problem, because dental records carry a mandatory minimum retention period. Keep one controlled copy in the PMS for the required period; destroy the loose copies that escaped it. Confirm the exact retention periods against current NSW and Commonwealth requirements.

This guide is educational practice workflow material only. It is not legal advice. Identifying a risky workflow indicates possible exposure, not a declared breach. Seek qualified legal or privacy advice for your specific circumstances.

Website Advertising AI Review

Prepared for Example Dental Clinic, Sydney · 15 Jun 2026 · part of your private Dental AI Blueprint. Review and adapt before adopting — general guidance, not legal advice.

This guide identifies possible advertising-risk items for your own review. It is not legal advice and does not determine whether a practice is compliant or non-compliant with Ahpra advertising requirements or any other regulation. If you have specific concerns, seek independent legal or regulatory advice.

NSW practices: beyond Ahpra advertising rules, two privacy laws also apply to any patient information used in marketing — the Commonwealth Privacy Act 1988 (APPs) and the NSW Health Records and Information Privacy Act 2002 (HRIP Act, HPPs). General information, not legal advice.

The rules moved in 2025–26. New cosmetic-procedure advertising guidelines (September 2025, dental veneers included), a TGA enforcement priority covering whitening products, doubled consumer-law penalties for misleading conduct, and a December 2026 privacy-policy deadline for AI tools. See what changed and what to check.

Why dental website advertising is regulated

Dental services are regulated health services in Australia. Advertising for regulated health services is governed by the Health Practitioner Regulation National Law and by Ahpra's advertising guidelines.

The Dental Board of Australia states that advertising a regulated health service must not be misleading or deceptive, must not use testimonials, must not create unreasonable expectations of beneficial treatment, and must not encourage unnecessary or indiscriminate use of health services. Ahpra's advertising guidelines also make clear that advertisers are responsible for the content they publish and should seek independent advice if they are unsure whether their content meets the requirements.

Social media pages, review profiles, Google Business profiles, and other digital channels used to promote a dental practice are also considered advertising for the purposes of these requirements.

This responsibility extends to content created by AI writing tools, marketing agencies, or automated platforms on the practice's behalf. Where an AI tool or agency produces copy that is then published under the practice's name, the practice remains the advertiser for the purposes of these requirements. Such content should be reviewed against this checklist before publication regardless of who or what created it.

What this review checks

This checklist covers the most common possible advertising-risk areas. Use it to flag items that may benefit from a closer review — not to reach definitive legal conclusions.

1. Testimonials

2. Before-and-after content

3. Superlatives and superiority claims

4. Outcome guarantees and risk minimisation language

5. Inducements and discount offers

6. Urgency language

7. Cosmetic and aesthetic treatment claims

8. Finance and superannuation messaging

A note on AI-generated copy and privacy

This guide focuses on AHPRA advertising compliance, not privacy law. APP 8 (the Australian Privacy Principle covering cross-border disclosure) is largely out of scope here because the core advertising rules — testimonials, before-and-after content, outcome guarantees, inducements — do not depend on how the data flows, only on what was published.

However, there is one narrow angle where privacy is genuinely relevant: if real patient information (including identifiable reviews, patient stories, photos, names, or clinical details) is fed into a public AI writing tool or sent to an overseas marketing agency in order to generate the copy, that input step may create a possible purpose-use issue under APP 6 and a possible cross-border disclosure issue under APP 8, on top of the advertising-risk question. The rule from OAIC guidance is that patient information should not be entered into publicly available generative AI tools because of significant privacy risks. Before generating or reviewing copy with AI tools, check that no patient-identifiable information was used as input.

If patient information was used to produce the copy, seek separate independent privacy advice — that issue sits outside the scope of this advertising checklist.

Review workflow

Use this as a first-pass internal review — not a substitute for professional advice.

Common safer rewrites

Note: these alternatives are starting points only. Review them before use.

Red flags — high-review items

The following items should be treated as high-priority review triggers:

• Patient testimonials or quotes about clinical outcomes anywhere on the site
• Before-and-after photos or composites showing patient results
• Any absolute outcome guarantee ("will", "always", "100%")
• Urgency language tied to a health benefit claim
• Promotions that do not include clear terms and conditions
• Superannuation or finance copy that has not had separate legal review
• Any identifiable patient information in published content
• Copy produced by an AI tool or agency where patient information may have been used as input — review the source of the content, not only the output

Minimum review practice

Before publishing or updating website content, the practice owner or a nominated staff member should:

1. Check new content against this guide — including content produced by AI tools or marketing agencies on the practice's behalf.
2. Flag anything that matches the review triggers above.
3. Confirm that no patient-identifiable information was used as input to generate the copy.
4. Seek independent advice on any item that is unclear.
5. Remove or rewrite flagged items before publishing.
6. Keep a record that the check was done and when.

This does not guarantee compliance. It is a practical first step.

This guide flags possible review triggers. It is not legal advice and does not determine compliance. Seek independent legal or regulatory advice for specific situations.

Sources: Ahpra advertising guidelines · Ahpra testimonial guidance · Dental Board of Australia — advertising a regulated health service

If an agency publishes for you

Most advertising-risk wording arrives via a marketing agency, not the practice. Pin down who can publish what — and who reviews AI-written copy — with the one-page Marketing Agency & AI Governance Checklist (free, printable).