How do AI agents handle patient data in a dental practice?

No. Shoutout Digital has no access to practice-management systems and does not ask for it.

The agents work in your advertising and website accounts only. The practice-management system holds things a marketing agency has no reason to see:

• The appointment book and the diary.
• Clinical notes, X-rays and patient files.
• Recall and reminders to patients.

Those stay with your own software and your own team. The website chat does not book, because it cannot reach your appointment book. It hands each enquiry to your front desk instead.

No. The agents cannot reach clinical notes, X-rays or patient files.

They work with advertising and website data: keywords and search terms, bids and budgets, ad copy, landing-page behaviour and enquiry counts. All of it sits in your own ad and website accounts.

Clinical records are on the other side of the line. They live in your practice’s own systems, and Shoutout Digital has no access to those systems.

Keeping the record out of the marketing work is a design choice. The less health information there is in the ad and website accounts, the less there is to protect.

No. Shoutout Digital does not ask for My Health Record access and does not take information from it.

The My Health Records Act limits who can collect, use and disclose the information in a My Health Record. A breach can bring a civil or criminal penalty.

A marketing agency is not a patient’s treating provider, so there is no reason for our agents to see the record. We do not claim any link to My Health Record, or any special status under the Act.

Read the OAIC’s page on My Health Record for how the system works.

No. The chat and the automations do not ask for a Medicare number, a healthcare identifier or a health-fund number.

None of them is needed to answer an enquiry. If the person books, your front desk can ask for them later, inside the practice’s own systems.

Healthcare identifiers carry their own law. The Healthcare Identifiers Act sets a high standard for using them, and misuse can bring a penalty.

A visitor might still type one into the chat without being asked. The chat asks people not to share these numbers, and it removes one if it is typed.

A name, a phone number, an email address and the reason for the enquiry, which it hands to your front desk.

The chat can also ask whether the person is a new or existing patient. That question is optional.

It never asks for:

• A Medicare number or a health-fund number.
• A healthcare identifier.
• A date of birth.

A privacy notice shows before the chat starts. The enquiry reaches your front desk by email and SMS, and the chat does not book or give clinical advice. Enquiries are kept while your practice is a client and deleted within 30 days of leaving.

It is personal information under the Privacy Act, even before the person becomes a patient.

Personal information is information about a person who is identified, or who can reasonably be identified. A name and a phone number are. So the details a visitor types into the chat need care from the first message.

It becomes more sensitive when health comes in. If the visitor describes a symptom or a treatment, that message can be health information, which the Privacy Act treats as sensitive information, with stricter rules.

That is one reason the chat does not discuss symptoms, and hands the enquiry straight to your front desk.

That message can be health information, and the chat does not give clinical advice about it.

Instead, the chat does two things:

• It asks the visitor to call the practice, so the team can help.
• It offers to pass the visitor’s name and phone number to the front desk.

A chat that suggests a diagnosis or a treatment does a different job. The TGA can treat software that does that job as a medical device, and Ahpra’s advertising rules apply to what it says. This chat is not built to do that job.

The chat does not handle emergencies. It points the visitor to the practice phone.

The agents do not answer calls. Calls from the ads are recorded, with a notice at the start of each call.

Your front desk answers the phone, as it does today. The recording notice plays first, so the caller knows before the conversation starts.

Recordings are kept while your practice is a client, and deleted within 30 days of leaving.

On our own website, we publish only scripted demonstration calls, labelled as demonstrations. We never publish a recording of a real patient.

If you have a question about a recording of one of your own calls, ask your account lead.

No. The provider behind the website chat does not train its models on the enquiry text.

This matters to patients. In a September 2026 speech, the Australian Information Commissioner described an OAIC survey in which 93 percent of people said it is not fair for organisations to use personal information to train AI.

The OAIC also says organisations should not enter personal information, and especially health information, into public generative AI tools.

The rest of the record never gets that far. Patient records, clinical notes and the appointment book never go into an AI tool, because the agents cannot reach them.

While your practice is a client. Enquiries are deleted within 30 days of you leaving.

The same applies to call recordings from the ads.

• While you are a client: enquiries and call recordings are kept, so your front desk can follow them up.
• When you leave: they are deleted within 30 days.

The rule behind this is APP 11. Personal information that is held has to be protected. When it is no longer needed, it has to be destroyed or de-identified.

Your practice owns the enquiry records throughout.

Your practice owns the enquiry records.

Shoutout Digital runs the website chat for your practice. The enquiries it takes, and the call recordings from the ads, belong to the practice.

Your practice is a health service provider, so the Privacy Act covers it. The duties that come with an enquiry stay with the records: protecting them, keeping them only as long as they are needed, and answering a person who asks about their own information.

The accounts the agents work in, such as your Google Ads and Meta accounts, belong to your practice too.

You keep everything in your accounts, and we remove our access within 5 business days.

What you keep:

• Your Google Ads and Meta accounts.
• The campaigns and the keyword lists.
• The landing pages.
• The change log, with every change and the reason for it.

Plans are month to month, with 30 days notice. Enquiries and call recordings are deleted within 30 days of leaving.

The accounts were always yours. Shoutout Digital works inside them with the access you grant, so when you stop, nothing has to be rebuilt or handed back. We remove our own access, and the work stays where it is.

A person at your practice. The message waits for your OK before it goes live.

The agents can draft. They cannot publish anything new to patients on their own. These four things always wait for your practice:

• New ad copy and offers, including any price.
• Clinical wording, such as what a treatment does.
• A change to the agreed budget.
• A new campaign or channel.

Inside the agreed budget, the agents move bids and budgets on their own, and they never spend past it. Every change, approved or automatic, goes into the change log with the reason.

No. This page describes how Shoutout Digital works. It is not legal advice.

It explains what our agents can see, what they cannot, and who approves their work. For your own practice’s obligations, ask your own adviser. They can also tell you whether your own website, forms and chat meet the rules.

For a privacy concern about Shoutout Digital:

• Use the details on contact us.
• Read our privacy policy.

You can also contact the Office of the Australian Information Commissioner, which handles privacy complaints.