✦ Now welcoming new patients  ·  Same-day emergency appointments where possible  ·  Afterpay, SuperCare & all major health fundsCaroline Springs · (03) 8358 2565
Privacy · Magical Smiles

Your information, handled with care.

This policy applies to Magical Smiles, operated by The Trustee for TOOTH FAIRY DENTAL GROUP UNIT TRUST (ABN 86 962 517 455), with clinics at Caroline Springs, Bacchus Marsh and Point Cook, Victoria, Australia. It describes how personal information is handled through this website.

Last updated: 6 August 2026

Read the policyContact the practice
On this page
  1. About this policy
  2. What this website collects
  3. How personal information is used
  4. Health and sensitive information
  5. Third parties that receive data
  6. Retention and security
  7. Access and correction
  8. Data breaches
  9. Complaints
  10. Contact

About this policy

This privacy policy explains how Magical Smiles handles personal information collected through this website. The Magical Smiles dental clinics at Caroline Springs, Bacchus Marsh and Point Cook, Victoria, Australia are operated by The Trustee for TOOTH FAIRY DENTAL GROUP UNIT TRUST (ABN 86 962 517 455), trading as Magical Smiles.

Magical Smiles is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because the practice provides health services, the health information it holds about patients is sensitive information under the Act and attracts higher protection. This policy is written for the Australian legal framework only.

What this website collects

The following describes what this website itself is built to collect. It is based on the services and forms actually present on the site.

Information you enter into forms

  • Online booking. When you book an appointment you use an embedded booking calendar provided by a third party. For the Caroline Springs and Bacchus Marsh clinics this is Centaur (via centaurportal.com); for the Point Cook clinic this is CareStack (via onlineappointment.carestack.au). Details you enter there — such as your name, contact details and appointment preferences — are submitted to that booking provider.
  • Contact and appointment-request forms.The site's contact and “request an appointment” forms are provided through a third-party form service (LeadConnector / GoHighLevel, via api.leadconnectorhq.com). The details you type into these forms are sent to that service and to the practice.

Information collected automatically

  • Analytics and advertising tags. This website loads Google Tag Manager, Google Analytics 4 and a Meta (Facebook) Pixel. These services collect technical and usage information such as your IP address, device and browser type, pages visited and interactions, and may set cookies or use similar technologies.
  • Chat widget. The site is configured to load a website chat widget (LeadConnector / GoHighLevel). If you use it, the information you provide in the chat is handled by that service.

The practice's clinical records — your dental and treatment history — are held in the practice's own clinical systems, not in this website. This policy covers personal information collected through the website and related online tools listed here; it does not name a specific clinical practice-management product.

How personal information is used

Information collected through this website is used to:

  • respond to your enquiry or appointment request;
  • book, confirm, remind you of and manage your appointments;
  • understand how the website is used so it can be improved (via the analytics services listed above); and
  • measure the effectiveness of the practice's advertising (via the Meta Pixel).

Health information provided as part of your care is used to provide dental treatment and to manage your ongoing care. Website enquiry and booking-contact details are used to respond to you and manage your appointment. The practice does not use those website submissions for unrelated marketing unless you have separately agreed to receive it.

Health and sensitive information

As a dental practice, Magical Smiles holds health information about its patients. Under the Privacy Act 1988 (Cth), health information is sensitive information. It is generally collected with your consent and handled with a higher level of protection than other personal information.

This website is not intended to be used to send detailed clinical or medical information. If you contact the practice through the website, please limit what you share to what is needed to respond to your enquiry. Clinical matters are handled through the practice's clinical systems and in person. Access to clinical records is limited to practice team members who need that access to provide care or administer the practice.

Third parties that receive data

The following third parties receive or process information through this website, based on the services actually built into it:

  • Centaur (Centaur Software, centaurportal.com) — online booking for the Caroline Springs and Bacchus Marsh clinics.
  • CareStack (onlineappointment.carestack.au) — online booking for the Point Cook clinic.
  • LeadConnector / GoHighLevel (api.leadconnectorhq.com) — the website contact and appointment-request forms, and the website chat widget.
  • Google (Google Tag Manager and Google Analytics 4) — website analytics.
  • Meta (Facebook) — the Meta Pixel for advertising measurement.

Each of these providers has its own privacy policy governing how it handles the information it receives. The list above reflects the tools configured on this website. If additional processors are added later, this page will be updated.

The practice confirms that patient data is stored and processed inside Australia. Website tools are configured on that basis; if that ever changes, this policy will be updated before any overseas disclosure of patient information.

Retention and security

The practice is required to take reasonable steps to protect the personal information it holds from misuse, interference, loss and unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed.

Website enquiry, booking-contact and similar contact data held because of this website is retained indefinitely unless you ask us to delete it or otherwise opt out of further contact, subject to any legal obligation to keep a record.

Clinical health recordsare retained in line with the practice's clinical policies and as required by applicable Victorian and Australian law. Where the law sets a minimum retention period, records are not destroyed earlier than that minimum.

The practice uses reasonable technical and organisational measures to protect personal information, including access controls for practice systems, secure configuration of the website and its third-party tools, and staff handling of patient information as part of ordinary clinical operations.

Access and correction

Under the Australian Privacy Principles, you may request access to the personal information the practice holds about you, and you may ask for it to be corrected if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

To request access or correction, contact the practice using the details in the “Contact” section below. The practice may need to verify your identity before providing access, particularly for health records. The practice aims to respond within 30 days. Access is generally provided free of charge; if a reasonable administrative fee would apply in a particular case, you will be told before it is charged.

Data breaches

The Privacy Act 1988 (Cth) includes a Notifiable Data Breaches scheme. If a data breach is likely to result in serious harm, the practice may be required to notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

If the practice becomes aware of a suspected data breach, it will contain the incident where possible, assess whether serious harm is likely, and — where the Notifiable Data Breaches scheme requires it — notify affected individuals and the OAIC as soon as practicable. You can also contact the practice using the details below if you believe your information may have been compromised.

Complaints

If you believe the practice has breached your privacy, raise it with the practice first using the contact details below. The practice aims to acknowledge privacy complaints promptly and to respond substantively within 30 days where practicable.

If you are not satisfied with the response, you can lodge a complaint with the external regulator, the Office of the Australian Information Commissioner (OAIC), via www.oaic.gov.au. The OAIC is the independent body that handles privacy complaints under the Privacy Act.

Contact

For privacy enquiries, access or correction requests, opt-out or deletion requests for website-held contact data, or complaints, contact the practice. The preferred privacy contact channel is email: