Dental enquiry follow-up with AI callbacks: privacy first

Published 6 October 2026 · OAIC pages read on 6 October 2026 · By Target Digital · 8 minute read

Dental enquiry follow-up with AI callbacks works only if you treat the call as a health privacy question first and a speed question second. A person who enquires about a toothache or a crown may well ring the next practice on the list if nobody gets back to them, so speed matters. But a dental practice handles health information, and that raises the standard for what an AI agent may ask, store and say.

This guide sets out what the Office of the Australian Information Commissioner (OAIC) says, how it applies to a callback, and a practical setup for a practice. It is general information, not legal advice. Practices should take advice from their own privacy adviser. For the calling rules that apply to every business, read our AI outbound calling compliance guide.

Is a dental practice covered by the Privacy Act?

Almost certainly. The OAIC's small business page says most small businesses, those with annual turnover of $3 million or less, are not covered by the Privacy Act, but some are, and health service providers are among those that remain covered. Its key concepts guidance says an organisation that provides a health service and holds health information is an APP entity, meaning an entity bound by the Australian Privacy Principles.

The OAIC's examples of health service providers include medical practitioners, pharmacists and allied health professionals. Whether your practice counts is for your adviser to confirm, but a practice that treats patients and keeps their records should assume it is covered.

What health information changes about an AI callback

Health information is sensitive information under the Privacy Act. Three rules matter for a callback.

• Collecting it needs consent, unless an exception applies. APP 3.3 says an entity must not collect sensitive information unless the person consents and the information is reasonably necessary for its functions, or an exception applies. One exception is a permitted health situation, such as information necessary to provide a health service, which carries conditions of its own. The OAIC's APP 3 guidance says an entity should generally seek express consent before collecting sensitive information, and cannot infer consent just because it gave notice.
• Marketing with it needs consent (APP 7). The OAIC's direct marketing guidance says you can use or disclose sensitive information, which includes health information, for direct marketing only if the person has consented. It also notes that APP 7 does not apply to marketing covered by the Do Not Call Register Act or the Spam Act, which have their own consent rules.
• Use is limited to the purpose. The OAIC's guidance on AI products says APP 6 allows personal information put into an AI system to be used only for the purpose it was collected for, unless the person consents or the secondary use is reasonably expected and related, and for sensitive information directly related.

What an AI callback should and should not ask

These are our recommendations, not rules. Agree them with your adviser.

• Ask only what booking needs: name, phone number, the type of appointment, preferred days and times.
• Do not ask for clinical detail beyond what the person volunteers, and do not store more than the booking needs.
• Give no clinical advice. The agent books and passes on. It does not diagnose or reassure.
• Hand urgent cases to a person. Decide in advance what the agent says if someone describes severe pain, swelling or an emergency, and make that route a live person or a clear instruction to contact emergency services.

Tell people it is an AI, and update your privacy policy

The same OAIC guidance says businesses should update their privacy policies and notifications with clear information about their use of AI, and make sure public-facing AI tools such as chatbots are clearly identified as such to customers. That fits the practical advice in our guide to AI caller disclosure: say it is an AI in the first sentence.

There is also a date to know. From 10 December 2026, the OAIC says APP entities must describe in their privacy policy where a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect a person's rights or interests. An agent that only books appointments may not reach that threshold, but a practice should check.

Consent for the call and the text

Health information is only one of the two consent questions. The other is consent to be contacted. Calls are covered by the telemarketing rules and texts by the Spam Act, and ACMA recommends express consent for both. Put a consent tick box on every enquiry form that collects a phone number. Our guide to consent to call from a lead form has the wording and the record-keeping, and the Spam Act guide covers texts. Calls must also stay inside permitted hours, which ACMA publishes on its telemarketing page.

Where the data goes

The OAIC tells organisations adopting AI to consider how human oversight can be built into the process, the privacy and security risks, and who will have access to the personal information put into or produced by the tool. For a practice, that means asking each provider:

• Where are recordings, transcripts and lead details stored, and for how long?
• Does anyone at the provider, or any model provider, use the data for anything else?
• Can we export and delete a patient's information on request?
• Does it connect to our practice software, and who quotes that work?

Providers differ. For example, AiDial sells a $100 a month Compliance Pack listing Australian data residency, no overseas AI model calls, seven-year call data retention and audit logs. That tells you what to ask about, and it is not an endorsement.

A practical setup for a practice

1. Add a consent tick box for calls and texts to the enquiry form.
2. Limit the agent's questions to what a booking needs.
3. Open every call with the practice name, the purpose and the fact that it is an AI, and say that the call is recorded.
4. Route urgent or clinical questions to a person.
5. Update the privacy policy to describe the AI and what it collects.
6. Book into your calendar and confirm by a text that complies with the Spam Act.
7. Review a sample of calls monthly.

Our AI Outbound Call Engine qualifies an enquiry by voice and books it into your calendar, and you can hear it call your own phone. We have not claimed any connection to specific practice management systems, so ask us on the call what your practice uses. The case for calling quickly is in our speed to lead guide.

Dental enquiry follow-up: common questions

Can AI book dental appointments?

An AI agent can ask for the details of an appointment and book it into a calendar. Whether it connects to your practice software depends on the provider, and some quote integrations separately.

Is patient data safe with AI?

That depends on the provider and your setup, not on AI as such. Use the questions above and get the answers in writing.

Do dental practices need a patient's consent to follow up an enquiry?

You need consent to contact them under the calling and Spam Act rules, and consent to collect health information unless an exception applies. A tick box and a short notice at the point of the enquiry covers both of those practical needs.

Can the agent give advice about symptoms?

We recommend it does not. It should book, pass on and escalate.

Next step

If you run a dental or health practice and want faster follow-up, a 30-minute call will go through your enquiry form, your consent wording and the questions the agent would ask. We will tell you what we would change. This is general information, not legal advice.

Book a 30-minute intro callUse the calculator