Privacy Policy

1. Introduction

Lumie Dental AI ("Lumie," "we," "us," or "our") is a trading name of Explora Technologies Pty Ltd (ABN: 13 683 720 425). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when dental practices use our AI voice agent service to answer patient calls, and when people visit our website or contact us.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and applicable state and territory health records laws.

2. Information We Collect

2.1 Patient and Caller Information

When someone calls a dental practice that uses our service, we collect and process on the practice's behalf:

• The caller's phone number (caller ID)
• Name, date of birth, phone number, email address and postal address, where needed to find or create a patient record
• Details of the person an appointment is for, if the caller is booking on someone else's behalf
• Appointment details, preferences, and the reason for the appointment, which may include dental or health concerns the caller chooses to share
• Health fund or insurance details, if the caller provides them
• Audio recordings of calls
• Written transcripts of calls and AI-generated call summaries

To book appointments, the voice agent looks up and updates patient records in the practice's practice management system (PMS) using the access the practice has granted us. Those records may contain other information, such as Medicare details. We only use what is needed to identify the patient and manage the booking. Details used during a call can appear in that call's transcript and records.

2.2 Dental Practice Information

From our dental practice clients, we collect:

• Business name and contact information
• Names, email addresses and phone numbers of staff and practitioners
• Practice management system connection credentials (stored encrypted)
• Service configuration, such as opening hours and appointment types
• Billing information. Card payments are handled by our payment provider; we do not store card numbers.

2.3 Website Visitors and Prospective Customers

• Trial and waitlist forms: your name, work email, phone number, practice name, role, practice management system, and how you heard about us
• Website voice demo: if you click "Talk to Lumie", your microphone audio is sent to our voice provider so the demo agent can respond, and the conversation may be recorded and transcribed. Please don't share personal or health details in the demo.
• Usage data: pages visited, referring site, and device and browser type, collected through cookieless analytics (see section 12)

2.4 Technical Information

Our systems automatically collect:

• Call metadata (date, time, duration, how the call ended)
• System performance metrics and error logs
• Integration logs with practice management software
• Service usage statistics

3. How We Use Information

We use collected information to:

• Answer patient phone calls and transfer them to practice staff
• Book, reschedule, and cancel appointments in the practice's PMS
• Provide information about the practice to callers
• Send the practice call summaries, notifications, and messages that need follow-up
• Translate transcripts of calls held in other languages into English for practice staff
• Generate analytics and reports for practices
• Monitor service quality and fix errors, including reviewing calls when investigating a problem
• Respond to enquiries and trial requests, and tell you about Lumie
• Keep our service secure and comply with legal obligations

We do not use patient information to train AI models, and we do not sell personal information.

4. AI and Automated Decisions

Calls are answered by an AI voice agent. Using the caller's name, contact details, date of birth and appointment preferences, it can, without a person being involved:

• match the caller to an existing patient record or create a new one
• offer available times and book, reschedule, or cancel appointments according to the practice's settings
• decide whether a call should be transferred to staff or a message taken

The voice agent is instructed not to give medical advice or make clinical decisions, and to refer clinical questions to the practice. Callers can ask to speak to practice staff, and the call is transferred when the practice is open; otherwise a message is taken for the practice to follow up. Practices can review and change any booking the voice agent makes.

5. Notice and Consent

We collect health information only to provide the service to the practice the caller has contacted. Lumie's default greeting tells callers that they are speaking with an AI assistant and that the call is recorded. Practices can customise this greeting and are responsible for making sure their patients are told about the AI voice agent and call recording (see section 16).

6. Sharing and Service Providers

We share information with:

• The dental practice being called: all information from a call is available to that practice
• Service providers: the types of provider listed below, which process information on our behalf to deliver the service. Each receives only the information it needs for its role.
• Authorities: where required or authorised by law

Dental practices that use Lumie can request the names of our current service providers by emailing support@lumie.chat. We provide this list on a confidential basis.

We do not:

• Sell personal information
• Share patient information between different dental practices
• Use patient information for marketing

7. Overseas Disclosure

Most of our service providers, including our database and voice providers, store and process information in the United States. This means personal information, including patient health information from calls, is disclosed to recipients in the United States. Practice management system data stays with the practice's PMS provider in Australia, apart from the details the voice agent needs during a call.

We choose providers that commit to keeping information confidential and secure, and we limit what each provider receives to what it needs.

8. Data Security

We protect information by:

• Encrypting data in transit between our application, database, and service providers
• Using providers that encrypt stored data at rest, and additionally encrypting practice management system credentials ourselves
• Restricting each practice's account to its own data
• Limiting access to production systems to authorised personnel

Phone calls travel over the public telephone network, which is not end-to-end encrypted. If we experience an eligible data breach, we will notify affected practices, affected individuals, and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

9. Data Retention

• Call recordings, transcripts, call summaries and messages: kept while the practice's account is active so the practice can review call history. We delete them, including our voice provider's copies, when the practice asks us to, or once the 90-day period after the service agreement ends (during which the practice can request a copy) has passed, unless the law requires us to keep them.
• Technical logs: kept for up to 12 months
• Trial and waitlist enquiries: kept while we are in contact with you about Lumie. Ask us at any time to delete them.
• Practice account and billing records: kept for the duration of the service agreement plus 7 years, to meet tax and accounting obligations

10. Your Rights

Under Australian privacy law, you have the right to:

• Access personal information we hold about you
• Request correction of inaccurate information
• Ask us to delete your information (subject to legal requirements)
• Opt out of marketing communications
• Make a complaint about how we handle your information

For patients: your dental practice controls your patient records, so the quickest way to exercise these rights is to contact the practice. You can also contact us directly, and we will work with the practice to respond.

For everyone else: email us at support@lumie.chat. We aim to respond within 30 days.

11. Children's Privacy

Our service is not directed to children under 16. We do not knowingly collect personal information from children except as necessary to schedule appointments when parents or guardians call on their behalf.

12. Cookies and Analytics

The phone service does not use cookies. Our website and dashboard use cookies and browser storage that are needed for sign-in, payments, and remembering your display preferences, plus cookieless analytics that measure page visits and performance. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list.

13. Changes to This Policy

We may update this Privacy Policy from time to time, including when we change service providers. We will notify dental practices of material changes by email and update the "Last Updated" date above.

14. Complaints

If you have concerns about our privacy practices:

1. First: contact us using the details below. We aim to respond within 30 days.
2. If unresolved: lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

15. Contact Information

16. Dental Practice Responsibilities

Dental practices control their patients' information and are responsible for:

• Telling patients that calls are answered by an AI voice agent and recorded, including when they customise the default greeting
• Obtaining any patient consents they need
• Maintaining their own privacy policies
• Responding to patient requests for access to or correction of records
• Complying with their professional obligations

Acknowledgment

By using Lumie Dental AI services, dental practices acknowledge they have read and understood this Privacy Policy and will ensure their patients are appropriately informed about the use of our AI voice agent service.