1. Overview and Our Commitment

Bright Technology Pty Ltd trading as DentalStock Pro ABN: 32 697 297 886 ("we", "us", "our") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy describes how we collect, use, hold, and disclose personal information in connection with the DentalStock Pro platform and website, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

As a platform used by dental practices, we understand that the information you share with us may be sensitive. We will never sell your personal information to third parties. We collect only what is necessary to provide the Service. We use your information only for the purposes described in this policy. We will tell you about any material changes to our practices before they take effect.

If you have any questions about this policy or wish to exercise your privacy rights, please contact our Privacy Officer at info@dentalstockpro.com.au or write to Bright Technology Pty Ltd, [Your Address], Queensland, Australia.

2. What Personal Information We Collect

We collect personal information that you provide directly to us when you register for an account, including your name, email address, phone number, and password; practice information including practice name, address, and ABN or ACN where applicable; billing information including payment details processed securely through Stripe, noting that we do not store your full card number or CVV; content and data that you input into the platform including inventory records, supplier contact information, and purchase history; and any communications you send to us including support requests, feedback, and enquiries.

We also collect information automatically when you use the Service, including usage data such as which features you access, actions you take within the platform, and how frequently you use the Service; technical and device data including your browser type, operating system, IP address, device type, and screen resolution; server logs including error reports, access timestamps, and session information; and information collected via cookies and similar technologies as described in our Cookies Policy.

3. How We Use Your Personal Information

We use the personal information we collect to create, manage, and maintain your account and provide you with access to the Service; to operate, maintain, and improve the DentalStock Pro platform and develop new features; to process your subscription payments and send you billing communications and invoices; to provide technical support and respond to your enquiries and requests; to send you service-related notifications including security alerts, maintenance notices, and important updates about the Service; to detect, investigate, and prevent fraud, security incidents, misuse of the Service, and other illegal activities; to comply with our legal and regulatory obligations under Australian law; and to produce aggregated and de-identified analytics to understand how the platform is used and to improve it.

We will not use your personal information for any purpose materially different from those described in this policy without first notifying you and, where required by law, obtaining your consent.

4. Disclosure of Personal Information to Third Parties

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. We may disclose your personal information to the following categories of third-party service providers who assist us in operating the Service: Stripe, which processes payment transactions on our behalf and is bound by its own privacy policy and PCI-DSS compliance obligations; cloud hosting and infrastructure providers who store and process data on our behalf in Australia or in jurisdictions with adequate data protection standards; email service providers who send transactional and service-related communications on our behalf; and analytics providers who produce aggregated, de-identified usage reports to help us improve the platform.

All third-party service providers are carefully vetted and contractually required to handle your personal information only for the specific purposes we authorise, to maintain appropriate technical and organisational security measures, and to comply with applicable Australian privacy law. We do not permit our service providers to use your personal information for their own purposes.

We may also disclose personal information where we are required or authorised to do so by law, including in response to a court order, subpoena, or request from a regulatory authority; where disclosure is necessary to protect the rights, property, or safety of DentalStock Pro, our users, or others; or in connection with a merger, acquisition, or sale of all or substantially all of our business assets, in which case we will provide reasonable prior notice and ensure ongoing confidentiality obligations.

5. Lawful Bases for Processing

We process your personal information only where we have a lawful basis to do so. Our primary lawful bases under the Privacy Act 1988 (Cth) and the Australian Privacy Principles are as follows. We process personal information where it is necessary to perform our obligations under the Terms of Use and Subscription Agreement, including account management, billing, and service delivery. We process personal information where you have given us clear and informed consent for a specific purpose, such as receiving promotional communications, and you may withdraw that consent at any time. We process personal information where it is necessary for our legitimate business interests, provided those interests are not overridden by your privacy rights and interests, including fraud detection, security monitoring, and improving the platform. We also process personal information where we are required to do so to comply with a legal obligation under Australian law.

We apply the principle of data minimisation, meaning we collect and retain only the personal information that is necessary and proportionate to the purposes described in this policy.

6. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to request access to the personal information we hold about you and to receive a copy of that information in a readable format; to request correction of any personal information that is inaccurate, incomplete, or out of date; to request deletion of your personal information, subject to our legal obligations to retain certain records; to request that we restrict or cease certain processing of your personal information; to object to our processing of your personal information for specific purposes; to request that we provide your personal information to you or a nominated third party in a portable, machine-readable format where technically feasible; and to withdraw your consent to any processing that is based on your consent, at any time and without detriment.

To exercise any of these rights, please contact us at info@dentalstockpro.com.au. We will acknowledge your request promptly and respond substantively within 30 days. We may need to verify your identity before processing your request. There is no charge for making a reasonable request.

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. We encourage you to contact us first to give us an opportunity to resolve your concern directly.

7. Data Storage and Security

We implement appropriate technical and organisational security measures designed to protect your personal information against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security measures include encryption of all data in transit using TLS/HTTPS and encryption of data at rest; role-based access controls that strictly limit which of our personnel can access your data and for what purposes; regular security assessments, vulnerability testing, and code reviews; secure, audited cloud infrastructure with automated backups and disaster recovery procedures; and multi-factor authentication for all administrative access to our systems and databases.

Your personal information is stored in Australia or in countries with data protection standards that are equivalent to or exceeding those in Australia. We do not transfer personal information to countries with inadequate privacy protections without first implementing appropriate contractual safeguards.

In the event of a data breach that is likely to result in serious harm to any individual, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), as soon as practicable after we become aware of the breach.

While we take all reasonable steps to protect your personal information, no internet-based system or electronic storage is completely secure. We cannot guarantee that your information will never be subject to unauthorised access, and we encourage you to take steps to protect your own account, including using a strong, unique password and logging out when using shared devices.

8. Retention of Personal Information

We retain personal information for as long as is necessary to fulfil the purposes for which it was collected, to provide you with the Service, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Account information is retained for the duration of your subscription and for a period of 7 years following closure of your account to comply with our tax and accounting obligations under Australian law. Subscriber Data entered into the platform is retained for 30 days following termination of your subscription, after which it is permanently deleted from our systems. Billing and payment records are retained for 7 years as required by Australian tax law. You may request early deletion of your personal information at any time, subject to our legal retention obligations.

9. Third-Party Links

Our website and platform may contain links to third-party websites, supplier portals, or external resources for your convenience. We are not responsible for the privacy practices, security, or content of any third-party website. We have no control over and accept no liability for the privacy policies or practices of those websites. We strongly recommend that you review the privacy policy of any third-party website you visit, particularly supplier portals, government health databases, or any other external platforms you access via links within DentalStock Pro.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we make material changes, we will update the date at the top of this policy, notify you via email to your registered address or via a prominent in-platform notification, and provide at least 14 days' prior notice before material changes take effect. For changes that significantly affect how we process your personal information, we will seek your renewed consent where required by law. Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised policy, you must stop using the Service and close your account. Prior versions of this Privacy Policy are available on request.