How do AI agents handle patient data in a dental practice?

No. Shoutout Agents has no access to practice-management systems and does not ask for it.

The agents work in your advertising and website accounts only. The practice-management system holds things a marketing agency has no reason to see:

• The appointment book and the diary.
• Clinical notes, X-rays and patient files.
• Recall and reminders to patients.

Those stay with your own software and your own team. The agents do not book, because they cannot reach your appointment book.

No. The agents cannot reach clinical notes, X-rays or patient files.

They work with advertising and website data: keywords and search terms, bids and budgets, ad copy, landing-page behaviour and enquiry counts. All of it sits in your own ad and website accounts.

Clinical records are on the other side of the line. They live in your practice’s own systems, and Shoutout Agents has no access to those systems.

Keeping the record out of the marketing work is a design choice. The less health information there is in the ad and website accounts, the less there is to protect.

No. Shoutout Agents does not ask for My Health Record access and does not take information from it.

The My Health Records Act limits who can collect, use and disclose the information in a My Health Record. A breach can bring a civil or criminal penalty.

A marketing agency is not a patient’s treating provider, so there is no reason for our agents to see the record. We do not claim any link to My Health Record, or any special status under the Act.

Read the OAIC’s page on My Health Record for how the system works.

No. Our agents do not ask for a Medicare number, a healthcare identifier or a health-fund number.

None of them is needed for marketing work. If a person books, your front desk can ask for them later, inside the practice’s own systems.

The agents work only with advertising and website data: keywords and search terms, bids and budgets, ad copy, landing-page behaviour and enquiry counts. All of it sits in your own ad and website accounts. The agents cannot reach clinical notes, X-rays or patient files.

Healthcare identifiers carry their own law. The Healthcare Identifiers Act sets a high standard for using them, and misuse can bring a penalty.

It is personal information under the Privacy Act, even before the person becomes a patient.

Personal information is information about a person who is identified, or who can reasonably be identified. A name and a phone number are. So the details a visitor types into a website form need care from the first message.

It becomes more sensitive when health comes in. If the visitor describes a symptom or a treatment, that message can be health information, which the Privacy Act treats as sensitive information, with stricter rules.

The agents do not answer calls. Calls from the ads are recorded, with a notice at the start of each call.

Your front desk answers the phone, as it does today. The recording notice plays first, so the caller knows before the conversation starts.

Recordings are kept while your practice is a client, and deleted within 30 days of leaving.

On our own website, we publish only scripted demonstration calls, labelled as demonstrations. We never publish a recording of a real patient.

If you have a question about a recording of one of your own calls, ask your account lead.

No. The agents cannot reach patient records, so none of that data is used to train a model.

This matters to patients. In a September 2026 speech, the Australian Information Commissioner described an OAIC survey in which 93 percent of people said it is not fair for organisations to use personal information to train AI.

The OAIC also says organisations should not enter personal information, and especially health information, into public generative AI tools.

The rest of the record never gets that far. Patient records, clinical notes and the appointment book never go into an AI tool, because the agents cannot reach them.

While your practice is a client. Enquiries are deleted within 30 days of you leaving.

The same applies to call recordings from the ads.

• While you are a client: enquiries and call recordings are kept.
• When you leave: they are deleted within 30 days.

The rule behind this is APP 11. Personal information that is held has to be protected. When it is no longer needed, it has to be destroyed or de-identified.

Your practice owns the enquiry records throughout.

Your practice owns the enquiry records.

The enquiries from your website and the call recordings from the ads belong to the practice.

Your practice is a health service provider, so the Privacy Act covers it. The duties that come with an enquiry stay with the records: protecting them, keeping them only as long as they are needed, and answering a person who asks about their own information.

The accounts the agents work in, such as your Google Ads and Meta accounts, belong to your practice too.

You keep everything in your accounts, and we remove our access within 5 business days.

What you keep:

• Your Google Ads and Meta accounts.
• The campaigns and the keyword lists.
• The landing pages.
• The change log, with every change and the reason for it.

Plans are month to month, with 30 days notice. Enquiries and call recordings are deleted within 30 days of leaving.

The accounts were always yours. Shoutout Agents works inside them with the access you grant, so when you stop, nothing has to be rebuilt or handed back. We remove our own access, and the work stays where it is.

Agents apply the rules to messages about treatments or prices and log every change.

Agents publish changes inside the rules. Only these two changes wait for your OK:

• An ad spend rise over 10% a day
• A campaign you asked for

Inside hard limits, the agents move bids and budgets on their own, and they can raise ad spend by up to 10% a day when the data shows it will help; a bigger rise waits for your OK in the dashboard, and every rise shows there with its reason. Every change, approved or automatic, goes into the change log with the reason.

No. This page describes how Shoutout Agents works. It is not legal advice.

It explains what our agents can see, what they cannot, and who approves their work. For your own practice’s obligations, ask your own adviser. They can also tell you whether your own website and forms meet the rules.

For a privacy concern about Shoutout Agents:

• Use the details on contact us.
• Read our privacy policy.

You can also contact the Office of the Australian Information Commissioner, which handles privacy complaints.