Privacy policy

[Legal entity name] (ABN [ABN]) (“PatientsHeard”, “we”, “us”) makes software that, with the consent of everyone present, records a conversation between a health professional and a patient, transcribes it and drafts clinical documentation that the health professional reviews, edits and signs.

We handle health information, which is “sensitive information” under the Privacy Act 1988 (Cth). We follow the Australian Privacy Principles (APPs) and, where they apply, [state health privacy laws].

1. Who this policy is for and what our role is

• Patients and other people in a consultation. When a clinic or health professional (“your clinic”) uses PatientsHeard, we handle your information on behalf of your clinic, as its service provider. Your clinic decides to use our software, asks for your consent and keeps your medical record. Please read your clinic's privacy policy too.
• Health professionals and clinic staff who use our software (“users”). We collect your account information for our own purposes.
• Website visitors, prospective customers and people who contact us.

2. What information we collect

Patients can't use the scribe anonymously, because the note is part of their medical record. They can always decline the scribe and the clinic will take notes another way.

3. How we collect it and how consent works

• Recording can't start until the health professional confirms in the app that the patient (or their decision maker) and every other person present who may speak has agreed. Recording can be paused or stopped at any time.
• Anyone can say no, or change their mind, without any effect on their care. The clinic will take notes another way.
• If consent is not confirmed or is withdrawn: [what happens to audio already captured].

4. Why we use it

• To transcribe the consultation and draft notes and letters for the health professional to review.
• To show the health professional where each sentence came from, so they can check it.
• To keep evidence that consent was obtained.
• To keep the service safe, investigate incidents and keep an audit trail.
• To run accounts, support and billing.
• To improve our software, using usage data only, never patient information.
• To send users product news, only if they opted in, with an unsubscribe link.

We never use patient information to train or fine-tune AI models, sell or on-sell it, use it for marketing, or send marketing to patients.

5. Automated decision-making and AI

Our software uses computer programs, including speech-to-text and large language models, to:

• turn the audio of a consultation into a transcript; and
• draft clinical notes and letters from that transcript.

Personal information these programs use: consultation audio and transcripts, which contain health information about the patient and what other people said.

Decisions made solely by a computer program: none. Our software does not make decisions about anyone's care, eligibility, access to services or anything else.

Decisions where a program does something substantially and directly related to a decision: [to be confirmed after legal review]. The draft note is a starting point only. The health professional must read, correct and sign every note before it leaves the app, and they make every clinical decision.

6. Who we share it with and where it is stored

• Your clinic and the health professional who ran the session.
• Our service providers (sub-processors), who store and process patient information only in Australia and may not use it to train AI. See the sub-processor list.
• Others where the law requires or allows it, for example a court order.

We do not disclose patient information outside Australia. [Countries for any website or account data held overseas].

7. How long we keep it

• Consultation audio: deleted when the note is signed, and within 24 hours at most if it is never signed.
• Transcript and draft: [period set by your clinic].
• Signed note: your clinic keeps it in its own records; we keep our copy for [period].
• Consent records and audit logs: [period].
• Website enquiries: [period].

8. How we protect it

Encryption in transit and at rest; Australian hosting; multi-factor authentication; role-based access with clinic-level separation; an audit log of access to patient information; no patient information in our logs, analytics or support tools; staff confidentiality undertakings and training.

9. Accessing and correcting your information

• Patients: your clinic holds your medical record, so please ask your clinic first. If you contact us, we will pass your request to your clinic and help them respond.
• Users and others: contact our Privacy Officer. We respond within [30 days].

10. Data breaches

If a data breach is likely to cause serious harm, we will work with your clinic to notify you and the Office of the Australian Information Commissioner (OAIC) as the Privacy Act requires.

11. Contact us — Privacy Officer

Privacy Officer · privacy@patientsheard.com · [postal address]

12. Complaints

1. Contact our Privacy Officer. We acknowledge complaints within [2 business days].
2. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.
3. Depending on where you live, you may also contact [state health privacy bodies].
4. Complaints about a health professional's care go to your clinic, your state health complaints body or Ahpra.

13. Cookies and website analytics

This website sets no cookies and uses no analytics or advertising trackers. See the cookie notice. No patient information is ever collected through the website.

14. Changes to this policy

We will update this policy when our practices change and post the new version here with its date. If we change a sub-processor, where information is stored, how long we keep it, or the AI models we use in a way that matters to patients, we will tell clinics in advance.