Data handling
Written for the information governance form someone is going to ask you to fill in, and for the patient who asks the same question in plainer words. Specific, and specific about the parts that are not reassuring.
This page is a summary. The Privacy Policy is the binding statement. If the two ever disagree, the Privacy Policy governs and this page is the one that is wrong. Written on 25 September 2026 against the Privacy Policy dated 14 July 2026. Tell us at privacy@aidietitians.com.au if you find a gap between them.
By plan
This is the whole reason there are two plans. The difference is not a discount, it is a data boundary.
$14.99 per month
There are no AI features on this plan, so nothing is sent to an AI provider. That is a property of the software, not a setting: an Essentials account has no path to an overseas service. If your information governance team needs a tool that keeps patient data onshore, this is the plan to put in front of them.
See what is on Essentials$79 per month
AI features are processed by services in the United States. Dictation audio and the text sent for AI processing leave Australia. Free-text is redacted on our Australian server before any AI call, but the redacted content still crosses the border. Everything else, your records, your calculations and your files, stays in Sydney.
Compare the two plansUnder Australian Privacy Principle 8, sending that content to a provider overseas is an overseas disclosure, and we describe it as one in the Privacy Policy rather than leaving it implied.
The detail that usually gets glossed over
Free text that is bound for an AI provider passes through a redaction step on our Australian server before the request is sent. It removes direct identifier tokens: medical record and case numbers, dates of birth, phone numbers and email addresses. The clinical signal survives, so the model still sees age, sex, ward, conditions, allergies, medications and results.
A lint rule in our codebase flags a prompt-building file that reaches an AI provider without going through that step, so the rule is enforced in review rather than remembered.
It is pattern matching, not a classifier. It will not catch every way a name can end up in free text, for example a referring doctor named in a sentence. It reduces exposure. It is not anonymisation, and you should not treat it as though the content stopped being health information.
Dictation works the other way round. The audio is sent to the transcription provider as recorded. It is not scrubbed before it is sent, because you cannot scrub audio without transcribing it first. Identifiers are removed from the transcript afterwards, before it is stored or reused. If a patient name is spoken aloud, the provider's transcription service receives it.
That second point is worth reading twice. It is the honest answer, and it is the one that should decide whether you dictate patient names or use initials.
Storage and access
Service providers
The list our Privacy Policy names, with the purpose it names for each.
| Provider | What it is used for |
|---|---|
| OpenAI, Google (Gemini), Perplexity | AI drafting and clinical search |
| Self-hosted Supabase | Hosting and database, hosted in Australia |
| SendGrid | |
| Twilio | SMS |
| Stripe | Payments |
| Tag manager, analytics and translation | |
| Microsoft Clarity | Analytics |
| Cloudflare Turnstile | Bot protection |
| Cliniko, Halaxy, Splose | Practice-management sync, only where you connect one, and on your instruction |
Some of these providers, including our AI, email, SMS and payment providers, are located or process data overseas, including in the United States. That is the Privacy Policy's own statement, and it is the one that governs.
The law, and your rights
AUSCLIN PTY LTD handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Information is kept while your account is active and deleted on request, or a reasonable period after closure, subject to legal retention.
To request access to, correction of, or deletion of your information, write to privacy@aidietitians.com.au. If you are not satisfied with how we handle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Website analytics runs on this marketing site by default and you can switch it off at any time. Do Not Track and Global Privacy Control signals are honoured automatically, and there are no advertising or profiling cookies. See the Cookie Policy.
"All data is handled in Australia." We published that. It was not true on Pro, where AI processing happens in the United States, and it was corrected. We will not round it off again.
"Dictation is scrubbed before processing." We published that too. It was not true: the audio reaches the transcription provider as recorded, and redaction happens to the transcript afterwards. Also corrected.
Both corrections are left visible on purpose. A vendor who has never had to correct anything has either never been checked or is not telling you when they were.
The full documents: Privacy Policy, Terms of Use, Disclaimer, Cookie Policy and Attributions and Data Sources.
Governance-ready
Start on Essentials. It has no AI features at all, so there is nothing to disclose under APP 8, and you can move to Pro later without losing your work.