Privacy, and how this site works

Demo Dental Co is a fictional practice built by Cirrus Digital to demonstrate how a clinic website can work. The practitioners, address, phone number and fees on this site are made up. It isn't a real health service, and nothing on it is medical advice.

The appointment request, enquiry, new patient and careers forms all work.

The opening hours are made up too. The phone number is from a range set aside in Australia for use in fiction, so it won’t reach anyone, and the team photos are AI-generated.

You won’t find patient testimonials, before-and-after photos or promises about treatment results here. Advertising rules for registered health professions restrict all three, so a clinic site built by Cirrus Digital leaves them out.

Sorry if you were hoping to find a dentist. If you run a clinic and would like a site like this, Cirrus Digital can help (opens in a new tab). You can also email Tim at tim@cirrusdigital.com.au.

This site collects what you type into a form or the AI Chatbot, and it runs two analytics tools. Vercel Web Analytics counts page views: which page was viewed, the page before it, the type of device and browser, and roughly where in the world the visit came from. It sets no cookies and does not store your IP address. It tells one visit from the next with a code made from your request, which it discards after 24 hours. Google Analytics records that a page was viewed, roughly where in the world from, and which page came before it, and when the booking, phone or email links or the AI Chatbot's handover are used. It sets cookies to tell one visit from the next, does not store your IP address, and is set to drop anything in a page's web address except where the visit came from. Neither is linked to anything you type into a form. There is no advertising or remarketing tag on this site. The one third-party embed is the Cal.com calendar on the booking page, covered below.

There are four forms: the enquiry form, the appointment request, the new patient form and the careers form. Because Demo Dental Co is not a real practice, a submitted form is emailed to Cirrus Digital, the agency that built this site. The email is delivered by Resend, an email service based in the United States. Resend sends it from servers in Tokyo and stores a copy on servers in the United States. Resend receives what you typed into the enquiry form, the appointment request or the careers form, and your name, email, phone, last dentist visit and emergency contact from the new patient form.

The new patient form’s health details are not emailed: your date of birth, Medicare number, health fund, medical conditions, medications, allergies and anything you would like to talk about. They are checked for errors and then discarded. On a real clinic build, the whole form would go over an encrypted connection to the practice’s clinical records system.

The careers form is for practitioners who’d like a confidential chat about working at the practice. It asks for your name, email, mobile, profession, Ahpra registration number if you have one, and good times to call, and optionally a fellowship and a message. It’s emailed to Cirrus Digital, the agency that built this site in the same way as the other forms, and isn’t stored on this website. The Ahpra number is used to check the public register of practitioners before anyone calls, and for nothing else. On a real clinic’s site, the practice may phone or email you about roles. Here there’s no practice to call you back. Your details aren’t used for marketing, and your current practice isn’t told. The careers page has no advertising or tracking tag.

One check runs outside this site. When you submit a form, your IP address, the technical details your browser sends with every request (such as its name and version) and the email address you entered go to Arcjet, a security service. It checks that the submission comes from a person and not a script, that the same address is not sending dozens of forms, and that the email address can receive mail. The rest of the form, including anything about your health, is not sent to Arcjet. Arcjet handles this on the site’s behalf, may process it outside Australia, and keeps a record of each check.

The booking page also carries a calendar from Cal.com. It books a call with Cirrus Digital, the agency that built this site, and what you enter into it goes to Cal.com and to Cirrus Digital under Cal.com’s privacy policy. It loads only on that page.

To see how well this site works, it counts a few things: a tap on a Book button, the phone number or an email address, and where on the page it was; opening the AI Chatbot, and asking it for reception to get back to you; a form sent, and which form; and a booking made through the booking calendar, where the booking system tells the site. None of these counts includes anything you typed. The taps and bookings are counted by Vercel Web Analytics, described above.

It also measures how quickly each page loaded and responded on your device. Each measurement holds the page, whether it was a phone or a computer, and five timings. Nothing identifies you, and your IP address is not kept with it.

It also counts how many form submissions and AI Chatbot messages Arcjet blocked. The count is a number for each day and nothing else: not your IP address and nothing you typed.

The form counts, the blocked counts and the speed measurements go to Cirrus Digital, the agency that built this site, as daily totals in its database, which Neon hosts in Amazon Web Services’ Sydney region. They are kept for 400 days and then deleted.

The chat button in the corner of each page opens an AI Chatbot. It answers general questions about the practice, such as opening hours, parking, booking and what to expect at a first visit. It can’t give dental or health advice, so please don’t type health information, names or contact details into it.

Each message goes from this website’s server, which runs on Vercel in Sydney, to Google’s Vertex AI service in its Sydney region (australia-southeast1), which writes the reply. Google handles these messages under its own terms, which say what it keeps, for how long and what it uses it for, and which Google can change. After each reply, a second, shorter request to the same service labels the question with a topic (such as “opening hours”) and whether the AI Chatbot could answer it.

Arcjet checks each message the same way it checks a form. It receives your IP address and the technical details your browser sends, and limits how many messages one address can send in a short time. The text of your message is not sent to Arcjet.

Conversations are kept for up to 90 days, then deleted. They’re kept so Cirrus Digital can write a monthly report of what visitors ask, as it would for a real practice, and the report has no names or contact details. The chat window says conversations are kept.

Each message and its reply are kept with the time, the topic label and a random number that groups one visit’s messages together, in Cirrus Digital’s database, which Neon hosts in Amazon Web Services’ Sydney region. Phone numbers, email addresses and Medicare numbers are removed before a message is stored. Names and anything else you type are not removed, which is why we ask you not to share them. Your IP address and browser details are not kept with the conversation.

On a real clinic’s site, the practice has no access to stored conversations. On this demonstration site they’re held by Cirrus Digital. If you ask for yours within the 90 days, Cirrus Digital will export it for you.

Whether or not conversations are kept, a monthly count of topics, and a short neutral summary of questions the AI Chatbot couldn’t answer, are kept. They contain no messages.

You can ask the AI Chatbot to have someone at the practice contact you. A short form then asks for your name, a phone number or email address, and a good time to reach you. When you send it, those details and the conversation so far are emailed to the practice through Resend, the same way the forms on this site are. On this demonstration site that email goes to Cirrus Digital. The details you type into that form are not sent to Google and are not saved with the conversation. Cirrus Digital’s database records only that a message was passed on, when, and whether the practice was open at the time. It keeps no copy of your details or of the email. Arcjet checks the form as it checks the others, including the email address if you give one.

If a page, form or the AI Chatbot fails, a report of the fault goes to Sentry, an error-monitoring service based in the United States, so Cirrus Digital can fix it. The report says which page failed, what went wrong in the site’s code, and the type of browser and device. It doesn’t include anything you typed into a form or the AI Chatbot, your cookies, your IP address or location, or anything added to the end of the page’s web address. Sentry keeps reports on servers in the United States for up to 90 days.

This website doesn’t keep your forms. A submitted form is checked, emailed as described above, and then dropped. No copy is written to disk, and the site keeps no record of who submitted what. Two records exist elsewhere: the email in Cirrus Digital’s inbox, which Resend also keeps a copy of for 30 days, and Arcjet’s log of the security check described above, which holds your IP address, browser details and email address and never the rest of the form.

Conversations with the AI Chatbot are kept for up to 90 days in Cirrus Digital’s database. Google keeps messages under its own terms and Arcjet logs each check, as described under the AI Chatbot. If you ask for someone to contact you, that request is an email in the practice’s inbox, which Resend also keeps a copy of for 30 days.

On a real clinic build, the submission would then be entered into the practice’s clinical records system, governed by the Privacy Act 1988 and, in Victoria, the Health Records Act 2001, with the retention periods those set. This demonstration site has no such system.

Health information is a special category under Australian privacy law, and it is handled differently to a name and a phone number.

Please don’t send any through this site. Demo Dental Co is not a real practice, and the new patient form offers example answers to fill it with instead. Its health questions are never emailed or stored, whatever you type into them.

This site is run by Cirrus Digital. A form you sent exists only as the email Cirrus Digital received and Resend’s 30-day copy of it. A kept chat conversation is stored with no email address or IP address, and is deleted after 90 days. To get a copy of yours before then, tell us roughly when you chatted and what about. To have an email deleted, or for questions about how the site works, get in touch through Cirrus Digital (opens in a new tab).