Privacy Policy

Last updated: 2 November 2026

Oromax NSW is a specialist oral and maxillofacial surgery practice with rooms in Sydney City, Miranda and Hurstville. We look after some of the most personal information people share: their health, their images and their contact details. This policy explains what we collect, why, who we share it with, and the choices you have.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and by the Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles. In this policy, “we” and “us” means Thomas Cameron Jaunay trading as Oromax NSW (ABN 87 744 725 400).

Contents

What we collect

We only collect what we need to assess and treat you, run the practice and meet our legal obligations. This usually includes:

  • your name, date of birth, address, phone number and email address
  • your Medicare number, private health fund details and DVA or other funding details
  • your medical and dental history, medications and allergies
  • referral letters, x-rays, CT and CBCT scans, clinical photographs, test results and treatment records
  • consent forms, quotes, invoices and payment records
  • the name of your referring dentist or doctor, and your next of kin or emergency contact
  • notes of phone calls, emails and messages about your care

Health information is “sensitive information” under privacy law. We collect it with your consent, which you give when you complete our patient registration and privacy consent, or where the law otherwise allows it.

How we collect it

Most information comes directly from you: when you fill in forms, talk to us, attend an appointment or contact us online. We also receive information from:

  • your referring dentist, doctor or orthodontist, including through our online referral portal
  • other practitioners involved in your care, such as radiology and pathology providers and hospitals
  • a parent, guardian or other person authorised to act for you
  • Medicare and health funds, when we process claims

We also hold contact details for referring dentists and doctors. We use them to correspond about patients and to send our clinical newsletter, and every newsletter includes an unsubscribe link.

If we receive information about you that we didn’t ask for and don’t need, we destroy it or de-identify it.

Why we use it

We use your information to:

  • assess you, plan and provide treatment, and look after you afterwards
  • communicate with your referring practitioner and others involved in your care
  • arrange your surgery with the hospital or day surgery and the anaesthetist
  • send appointment confirmations, reminders and follow-up messages
  • prepare quotes, process payments and lodge Medicare and health fund claims
  • meet our legal, professional and insurance obligations
  • improve the quality and safety of our care through clinical audit

We may use information that has been de-identified, so you can’t be identified, for audit, quality improvement, teaching and research. Research that uses identifiable information only happens with your consent, or where the law permits it with approval from a human research ethics committee.

Clinical photographs form part of your record. We will only use an identifiable photograph or video of you in teaching, publications or promotional material with your specific written consent.

We do not use automated systems to make decisions about you. Decisions about your care are made by your surgeon and our team.

Who we share it with

We share only what is needed, with people who need it for your care or to run the practice:

  • your referring practitioner and other health professionals involved in your care
  • hospitals and day surgeries where your procedure takes place, and your anaesthetist
  • radiology, pathology and dental laboratories
  • Medicare, your health fund and, if you choose to use one, a payment plan provider
  • service providers who support the practice, such as our practice management software, IT, email, SMS and document storage providers. They may only use your information to provide services to us.
  • our professional indemnity insurer and lawyers, if needed to handle a complaint or claim

We may also disclose information when the law requires or allows it. Examples include a subpoena or court order, a mandatory report, or a serious threat to someone’s life, health or safety.

We never sell your information.

Our website and online referrals

Analytics. We use Google Analytics to understand how people use our website: which pages are visited, the type of device, the approximate location and how visitors found us. Google Analytics uses cookies. We don’t use it to identify you. You can block or delete cookies in your browser settings, and the website will still work.

Enquiry and appointment forms. When you send us a form, it is emailed securely to our practice email system. The website keeps a copy for no more than seven days, then deletes it.

Online referral portal. Referrals and scans uploaded by your dentist or doctor go directly into the practice’s secure document storage. The website keeps a copy for no more than seven days, then deletes it.

Our website may link to other sites, such as payment providers. Their privacy policies apply when you use them.

Technology, AI and overseas providers

Your patient record is held in our practice management system. Our email and documents are held in Microsoft 365. Both store your information in Australia.

We use an artificial intelligence (AI) service to help our team draft replies to website enquiries. Names and contact details are removed before any text is sent to the AI service, and they are added back on our own systems. Every reply is checked and approved by a member of our team before it is sent.

Some of our service providers are based overseas or store some data outside Australia. These are Google (website analytics, United States), our AI drafting service (United States, de-identified text only) and MailerLite (newsletters to referring practitioners, European Union). MailerLite holds practitioner contact details only, never patient information. Before we use an overseas provider, we take reasonable steps to make sure it protects information to the standard required by Australian privacy law.

How we store and protect it

We keep records electronically on secure, access-controlled systems. Protections include multi-factor authentication, encryption and staff training. Paper records are kept secure in our rooms. Every staff member and contractor signs a confidentiality agreement.

NSW law requires us to keep your health records for at least seven years after your last visit. If you were under 18 when the information was collected, we keep it until you turn 25. We may keep records longer where there is a good reason, such as ongoing care or monitoring of implants. When we no longer need records, we destroy them securely.

How we contact you

We contact you by phone, SMS, email or post about your appointments, treatment and accounts. Please tell us if you would prefer we use, or avoid, a particular method. We only email clinical information to you with your agreement.

We don’t send you marketing. If we ever send general practice information, it will include a simple way to opt out, and we will respect that choice.

Staying anonymous

You can ask general questions without giving your name. To provide surgical treatment, however, we need to identify you. That is required for safe care, for continuity with your other practitioners, for Medicare and health fund claims, and for hospital admission.

Seeing and correcting your information

You can ask to see or get a copy of the information we hold about you. Please ask in writing to our Privacy Officer (details below). We may need to confirm your identity.

We aim to respond within 30 days and will always respond within 45 days. We may charge a reasonable fee to cover the cost of copying or preparing records, and we will tell you the amount first. There is no charge to make a request.

The law allows us to refuse access in limited cases, for example where access would pose a serious threat to someone’s health or safety. If we refuse, we will tell you why in writing and how to complain.

If you think something we hold is wrong or out of date, tell us and we will correct it, at no cost. If we disagree, you can ask us to attach a note of your view to your record.

If you would like your records transferred to another practitioner, we can arrange that.

If something goes wrong

If a data breach involving your information is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner. We will explain what happened and what you can do. We investigate and record every suspected breach, whether or not it needs to be reported.

Questions and complaints

If you have a question about this policy or a concern about how we have handled your information, please contact our Privacy Officer first. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

Privacy Officer, Oromax NSW
Phone: (02) 8513 9810
Email: admin@oromaxnsw.com.au
Post: Level 5, Suite 2, 86 Kiora Road, Miranda NSW 2228

If you are not satisfied with our response, you can complain to either regulator:

  • Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992
  • Information and Privacy Commission NSW: ipc.nsw.gov.au, 1800 472 679

Changes to this policy

We review this policy at least once a year and whenever privacy laws or our practices change. The current version is always on this page. You can ask us for a free printed copy at any of our rooms.

Share this file