Where your recordings go, in plain language.

Audio, transcripts and clinical content are processed and stored in Australia — AWS’s Sydney region, ap-southeast-2. Note drafting runs on an Australia-only inference profile, chosen over the wider Asia-Pacific one specifically so that clinical content is not routed offshore.

We say “audio, transcripts and clinical content” rather than “all data” because the second one would not be true. Operational things — error reporting, the calendar service you book a demo through — are not all Australian, and a claim that quietly includes them is the kind of claim you should distrust.

You do. Clinical records remain the property of your practice. Anyhealth is not the system of record and is not designed to become one — signed notes are written back into your practice management software, and from that point the copy there is the authoritative one.

The practical test: if you closed your Anyhealth account tomorrow, nothing would be lost that is not already in your own practice management software. That is a design constraint we hold ourselves to, not a policy we could quietly drop.

We never use your recordings, transcripts or notes to train models. We do not sell them, and we do not hand them to anyone to train on.

The model that drafts your notes runs on Amazon Bedrock, where your content is not stored, is not shared with the model provider, and is not used to train the underlying models. That is AWS’s contractual position rather than a checkbox we could get wrong.

Speech-to-text runs on Amazon Transcribe, and we have opted out of AWS using your audio to develop or improve its services. That opt-out is set at the account level and applies to every AWS AI service we use, now and in future.

We do look at de-identified, aggregate usage — how long processing takes, how often a step fails, which note sections get edited most — to improve the product. You can opt out of that and the product works identically.

A patient has to agree before Anyhealth records them, and the product enforces it rather than trusting you to remember: without a recorded consent decision for that patient, recording will not start.

Consent is a standing decision per patient, not a form at every visit — you ask once, it is recorded with the date it was given and how it was given, and a patient can decline or change their mind at any point. A declined decision is kept as a record of the refusal.

Source audio is deleted automatically after 30 days. That window exists so a note can be regenerated if something went wrong with the first pass — not so we can keep a library of consultations.

Practices that would rather not have it at all can turn on zero retention, and the audio is destroyed as soon as the transcript exists.

Every record belongs to one practice, and access is scoped to that practice at the query layer rather than by convention — a practitioner sees their practice’s data and no one else’s. Roles are minimal by default.

Our own access is limited to what is needed to run and support the service, and is logged.

Health information is sensitive information under the Privacy Act, and the obligations sit with your practice as the entity that holds the clinical relationship. Anyhealth is built to make meeting them straightforward rather than to take them off you.

In practice that means: collection is limited to what the note needs; the patient is told and agrees before recording; content stays in Australia; access is restricted; audio is destroyed on a defined schedule; and the records stay in your own system so that access and correction requests are answered where you already answer them.

If you need something specific for a practice policy or an insurer, email aaron@anyhealth.com.au and ask. We would rather answer a hard question than have you guess.