When a dental practice starts using an AI receptionist, chat assistant or automated reminders, patient information starts flowing to new places: phone providers, cloud hosting, speech-to-text services and AI model providers. Many of these are global companies, and some process data outside Australia.
That's not automatically a problem, but it does bring obligations under the Privacy Act. This guide explains what to ask AI vendors about where patient data goes, what Australian Privacy Principle 8 (APP 8) requires, and how to document it.
This article is general information, not legal advice. Talk to a privacy adviser about your practice's arrangements.
Key takeaways
- Dental practices are covered by the Privacy Act regardless of turnover, because they provide health services.
- Patient call recordings, transcripts and messages are personal information, and often health information, which is sensitive information under the Act.
- APP 8 applies when you disclose personal information to someone overseas. You need to take reasonable steps to make sure they handle it in line with the APPs, and you can remain accountable for their mistakes.
- Ask every vendor exactly where data is stored and processed, by whom, and whether it's used to train AI models.
- Update your privacy policy to say whether you're likely to disclose information overseas and, where practicable, to which countries.
Why this matters for AI tools
A single AI phone call can involve several services:
- A telephony provider that carries and may record the call
- A speech-to-text service that transcribes what the caller says
- An AI model provider that generates replies
- A text-to-speech service that turns replies into voice
- Cloud hosting where transcripts, summaries and bookings are stored
- Your practice software or calendar, where the booking ends up
Each is a place where patient information is handled. Some may be in Australia, and others may be overseas.
What APP 8 requires
APP 8 deals with cross-border disclosure of personal information. Before you disclose personal information to an overseas recipient, you generally need to take reasonable steps to make sure the recipient doesn't breach the APPs. Usually that means having contractual protections in place.
Under section 16C of the Privacy Act, if the overseas recipient then mishandles the information, your practice can be held accountable as if it had done so itself, unless an exception applies.
Use vs disclosure
The OAIC has said that in some cases, such as giving information to a cloud provider purely for storage where the provider can't access or use it, the arrangement may be a use rather than a disclosure. AI processing, where a provider actively processes the content of calls, is less likely to fit that narrow category. Get advice on how your arrangements should be classified.
Other APPs that apply
- APP 1 (privacy policy): your policy must say whether you're likely to disclose personal information overseas and, if practicable, the countries involved. From 10 December 2026, it must also explain certain automated decisions. See the December 2026 privacy change.
- APP 5 (notification): tell patients when you collect information, including that calls are recorded and that information may go overseas.
- APP 6 (use and disclosure): use information only for the purpose it was collected for, or a related purpose the patient would reasonably expect.
- APP 11 (security): take reasonable steps to protect information, and destroy or de-identify it when no longer needed.
- Notifiable Data Breaches scheme: if an eligible data breach occurs, including at a vendor, you may need to notify affected individuals and the OAIC.
Questions to ask every AI vendor
Where is the data?
- Where is patient data stored at rest? Which countries and regions?
- Where is it processed during calls and chats, including speech-to-text and AI replies?
- Which subprocessors are involved, and where are they? Is there a published subprocessor list?
How is it protected?
- Is data encrypted in transit and at rest?
- Who at the vendor can access patient data, and how is that controlled and logged?
- What security certifications does the vendor hold? Don't assume. Ask for evidence.
How is it used?
- Is our patient data used to train AI models, by the vendor or its providers?
- How long are recordings, transcripts and logs kept, and can we set retention?
- Can we export and delete our data when we leave?
What happens if something goes wrong?
- How and when will the vendor tell us about a data breach?
- What do the contract terms say about privacy obligations and liability?
We include these and more in 15 questions to ask before buying an AI receptionist.
How IntelliDent handles data
IntelliDent's application data is hosted in Australian AWS regions. Calls and AI replies use providers such as Twilio, OpenAI and Anthropic that may process data overseas; they're listed on our Subprocessors page. We don't use your patient data to train AI models. IntelliDent doesn't currently hold HIPAA, SOC 2 or ISO 27001 certification. We'd rather tell you that up front than have you find out later.
Documenting your arrangements
Keep a simple record for each vendor:
- What patient information it handles
- Where it stores and processes data
- Its subprocessors
- The contractual privacy protections in place
- Retention and deletion settings
- Who at your practice reviewed it, and when
Then update your privacy policy and collection notices to match.
Frequently asked questions
Is it illegal to use an overseas AI provider?
No. APP 8 doesn't ban overseas disclosure. It requires reasonable steps and keeps you accountable. Many practices use overseas providers with appropriate contracts and disclosure.
Do we need patient consent for overseas processing?
Generally, the main route is reasonable steps plus clear disclosure in your privacy policy and notices. Consent-based exceptions exist but have strict conditions. Get advice before relying on them.
What if a vendor won't answer these questions?
Treat that as a red flag. A vendor handling health information should be able to explain where it goes.
Next steps
List every system that touches patient data this week, and send each vendor the questions above. For call-specific rules, read call recording laws in Australia.