Privacy Policy

Zenith Care Global Pte. Ltd. (UEN 202613836W), trading as Zenith Dental
190 Clemenceau Avenue, #06-08, Singapore Shopping Centre, Singapore 239924
Data Protection Officer: William Holmes
Email: info@zenithdentalgroup.com
Phone: +61 485 825 719

Zenith Dental is the controller of your personal information for the purposes of the Singapore Personal Data Protection Act 2012 (PDPA), the Australian Privacy Act 1988 and Australian Privacy Principles (APPs), and the New Zealand Privacy Act 2020 and Information Privacy Principles (IPPs).

Each partnered dental clinic is a separate, independent controller for the personal information it collects, uses, and stores for clinical treatment purposes. We share information with the clinic so they can treat you; how the clinic handles that information after it reaches them is governed by the clinic's own privacy practices and by the laws of the country in which the clinic operates.

We collect the following categories of personal information:

• Identification and contact details — full legal name, date of birth, residential address, phone number, email address, nationality, passport details (if needed for travel coordination), emergency contact details.
• Health and medical information (sensitive information) — dental history, current dental conditions, relevant medical history, medications, allergies, diagnostic photos and imaging (X-rays, panoramic radiographs, CBCT scans), treatment plans prepared by the clinic.
• Financial information — payment method, transaction records for deposits and treatment payments, bank details for any refunds. We do not store full card numbers; card payments are handled by our payment processor.
• Travel information — flight numbers, accommodation, passport details if required, trip dates, visa status.
• Communications — emails, WhatsApp and messaging app conversations, call recordings (where we have your consent), notes from consultations.
• Next of kin / emergency contact details — name, relationship, phone number, email.
• Device data, cookies, and tracking — we use cookies, pixels, and local storage identifiers to enhance user experience and measure marketing performance. You can block or delete cookies through your browser, though certain features may not function properly.
• Signing audit trail — IP address, device fingerprint, timestamped signing record, email delivery receipt, and your name, collected for audit integrity and fraud prevention when you sign agreements electronically.

We collect most of this information directly from you. Some information (specifically clinical information after you arrive for treatment) is generated by the clinic and shared back with us for coordination purposes. We collect only data reasonably necessary for the purposes stated in this policy.

• Coordinating your treatment journey — scheduling appointments, liaising with the clinic on your behalf, arranging in-country support, communicating trip logistics.
• Providing pre-travel information — sharing the clinic's pre-travel health questionnaire with you, relaying the clinic's treatment plan and warranty terms.
• Case management — ongoing support throughout your engagement, including the post-treatment coordination window.
• Legal and regulatory compliance — responding to regulators, complying with our contractual obligations, defending any claims, meeting our retention obligations.
• Quality review (internal) — reviewing how our coordination service performs, to improve it. This is performed on an anonymised basis where practicable. Where anonymisation is not technically practicable, we will seek your separate consent before using identifiable information.
• Marketing (opt-in only) — contacting you with updates about our services, case studies, or promotions. This requires your separate, explicit opt-in consent and you can withdraw it at any time.

We will not use your information for any purpose beyond those listed unless we ask for your separate consent first, or unless a new purpose is directly related to and compatible with the original purpose and you would reasonably expect it.

Your health information is sensitive information under Australian law and is subject to a higher standard of consent under the PDPA, NZ Privacy Act, and the laws of the country in which the clinic operates.

• We collect your health information only with your explicit, informed consent.
• Your health-information consent is separate from your general personal-information consent.
• Your marketing consent is separate from both and is strictly opt-in. You can withdraw marketing consent at any time without affecting the service we provide you.

You can withdraw any consent at any time (subject to certain exceptions where the law requires us to retain information). Withdrawing your health-information consent will usually mean we can no longer coordinate your treatment, because sharing your health information with the clinic is essential to treatment.

• Our partnered dental clinic — for treatment planning, clinical delivery, post-treatment care, and payment reconciliation. The clinic is an independent controller of the information we share.
• Our in-country operations team — bilingual support staff, logistics assistants, and consultants who handle your non-clinical support during your trip.
• Local service providers — who support our in-country operations, including logistics. Information shared is limited to what is necessary for operational support.
• Case-management and administrative service providers — document storage providers, e-signing platforms, accounting services, legal advisers. Each is contractually bound to handle your information consistently with this policy.
• Analytics and advertising partners — such as Meta, Google, Microsoft, Cloudflare, and RudderStack for hosting, analytics, and advertising.
• Regulators and authorities — where we are legally required to disclose (for example, under a valid court order, regulatory investigation, or tax authority request). We will notify you of any such disclosure unless the law prohibits us from doing so.
• Your next of kin / emergency contact — in a medical emergency. By providing us with your next-of-kin details, you explicitly consent to us contacting them and sharing relevant health and treatment information in a medical emergency.

We do not sell your personal information. We do not share your personal information with data brokers.

Because our business coordinates treatment overseas for clients in Australia and New Zealand, your personal information crosses international borders during the course of your engagement.

Australia/New Zealand to Singapore. When you submit your information to us, it moves to Singapore, where our contracting entity is based. Under APP 8.1 we remain accountable to you under the Australian Privacy Principles for how your information is handled by any overseas recipient, as if we had handled it ourselves in Australia. New Zealand transfers are made on an equivalent basis under IPP 12 of the NZ Privacy Act.

Singapore to the clinic's country. When we share your information with a partnered clinic, our in-country staff, or local service providers, it moves from Singapore to the country in which the clinic operates. This transfer is made under s 26 of the Singapore PDPA (the Transfer Limitation Obligation). We satisfy s 26 through written data processing agreements that bind recipients to provide a standard of protection comparable to the PDPA.

Processing within the clinic's country. Once your personal information is in the clinic's country, it is subject to local data protection laws. Compliance obligations for in-country processing rest on the clinic and local service providers as local data handlers. Our data processing agreements require them to maintain any filings or assessments required by local law.

Return transfers. When we send you information from the clinic's country or Singapore (for example, your treatment plan or post-treatment follow-up information), we ensure the return transfer complies with APP 8 (for Australian clients) and NZ IPP 12 (for New Zealand clients).

We retain your personal information only for as long as it is needed for the purposes in this policy, plus any additional period required by law.

Depending on where you are resident, you have some or all of the following rights:

• Access — you can ask us for a copy of the personal information we hold about you.
• Correction — you can ask us to correct information that is inaccurate, out of date, incomplete, or misleading.
• Withdrawal of consent — you can withdraw any consent you have given us at any time. Withdrawal may prevent us from providing the service.
• Deletion — you can ask us to delete your information, subject to any legal retention obligations.
• Data portability — if you ask us to provide a copy of your information in a structured, commonly used format, we will do so where technically practicable.
• Objection — you can object to our processing of your information for marketing purposes.

To exercise any of these rights, contact our Data Protection Officer at info@zenithdentalgroup.com. We will respond within 30 days of receiving your request.

If we discover a personal data breach that poses a risk of significant harm to you, we will notify you as soon as practicable following our assessment of the breach.

• For notifiable breaches under the Singapore PDPA, we will notify the Personal Data Protection Commission (PDPC) within three (3) calendar days of completing our assessment.
• For breaches affecting Australian clients, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.
• For breaches affecting New Zealand clients, we will comply with the notifiable privacy breach requirements under Part 6 of the NZ Privacy Act 2020.

We use reasonable technical and organisational security measures appropriate to the sensitivity of the information, including:

• Encrypted storage for health information and identification documents
• TLS-encrypted data transmission
• Access controls so that only authorised staff can access your information on a need-to-know basis
• Firewalls, WAF/DDoS protection, and network isolation
• Contractual obligations on all service providers to protect your information consistently with this policy
• Staff training on privacy and data protection
• An incident response plan for handling suspected breaches

• We may contact you by email, SMS, WhatsApp, Facebook Messenger, or phone following your submission of a contact or booking form.
• All messages include clear opt-out instructions.
• You may withdraw consent for marketing at any time; processing will cease within a reasonable timeframe.
• Outbound calls are made only to individuals who have expressed interest in our services.

Our services are not intended for individuals under 18 years old. We do not knowingly collect data from minors and will delete such information upon discovery.

If you think we have mishandled your personal information, please contact our Data Protection Officer at info@zenithdentalgroup.com and we will respond within 30 days.

If you are not satisfied with our response, you can escalate to the relevant regulator:

• Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• New Zealand: Office of the Privacy Commissioner — privacy.org.nz

We may update this policy from time to time to reflect changes in law, our business practices, or our services. If we make material changes we will notify you at least 30 days before the change takes effect and give you a chance to withdraw your consent if you do not agree. The latest version is always available on this page.