Where the records live, what leaves the country, and who can get in.
Psychiatric records are stored in Sydney, encrypted at rest. Consultation audio is transcribed in Australia and never kept. The only thing that reaches an AI model is de-identified text, transiently, under terms that forbid training. Access needs a second factor and is logged. Letters travel by single-use encrypted link. You can export everything or erase it. The rest of this page is the detail behind each of those sentences.
By PsychDispatch · Last reviewed 3 September 2026
One consultation, from the first word to the filed record.
Where each thing is at each step, and what happens to it. This is the same account the Privacy Policy gives, in the order it happens.
One exception, stated plainly.
When you upload a document file, for example a PDF of prior records, the file is sent to our AI provider for text extraction as uploaded, before de-identification can be applied to its contents. Word and text files are extracted on our own servers and never leave them; only PDFs do. De-identification runs on the extracted text before anything is stored or used. Upload only what is needed.
Ten mechanisms. Each one implemented, not planned.
The same list a practice manager or an IT reviewer would ask for, in the order they usually ask.
Australian data residency
Clinical records at rest are stored in Sydney, encrypted with AES-256. Application hosting, transcription, PDF conversion and email delivery run on Australian infrastructure.
Audio never retained
Consultation audio goes browser to transcription provider, in Australia, and is not kept by anyone once the transcript exists. It never touches our servers.
De-identification before AI
A multi-layer pipeline removes identifiers from every piece of consultation content before it reaches a model. The patient's own identifiers do not leave the country.
No training, by contract
Every AI and transcription provider processes data under terms that prohibit its use for model training or any purpose other than producing the output you asked for.
Multi-factor authentication
TOTP multi-factor authentication with server-side enforcement: a session that has not completed its second factor cannot reach the app or its data, whatever token it carries.
Session assurance
An automatic sign-out after thirty minutes of inactivity, designed so that it never fires in the middle of a recording, and a full re-authentication every twenty-four hours.
Row-level security
Access to every record is enforced in the database itself, row by row, so a practitioner can only ever read or write their own patients' data, whichever path the request takes.
A tamper-evident audit log
Record views, exports, questions asked of the record, caseload views and custody actions are logged and visible to you in the app. Every version of a patient's intelligence record is kept append-only.
Hardened transport
TLS on every connection, and a strictly enforced nonce-based Content Security Policy in the browser, so that only the scripts we ship can run on the page.
Export and erase, on your terms
Export your complete records at any time as a standard archive. Erase an individual patient or the whole account: immediate and complete on our live systems, after you acknowledge your own records-retention obligations.
The law you already answer to, and how the product answers it.
None of these are new rules for AI. They are the existing ones, applied to a recorder, a drafting tool and a filing system.
The Privacy Act and the Australian Privacy Principles
Health information is sensitive information, and health service providers are covered regardless of size. PsychDispatch complies with the Act and the Principles in full and does not rely on the small business exemption. Where information lives and who processes it is set out in the Privacy Policy, with the service-provider list available on request.
OAIC: the Australian Privacy PrinciplesThe Notifiable Data Breaches scheme
PsychDispatch is bound by the scheme. In the event of an eligible data breach, affected practitioners and the Office of the Australian Information Commissioner are notified as the scheme requires.
OAIC: Notifiable Data BreachesYour records-retention obligations
Australian law generally requires health records to be kept for at least seven years after the last entry, or until age twenty-five for patients who were under eighteen, with variation by state. Erasure in PsychDispatch requires a recorded acknowledgement that you have satisfied yours, so a click cannot put you in breach.
Ahpra's guidance, and consent
The practitioner remains accountable for the record, patients are told when AI is used, and recording needs consent before it starts. The consent workflow and the printable form are covered in the consent guide.
The AI scribe consent guideSix things PsychDispatch does not do.
A security page is as much about the absences as the mechanisms.
- Sell, share or use patient information for marketing, advertising or profiling.
- Use patient information to train AI models, ours or anyone else's.
- Store identifiable clinical records outside Australia.
- Let consultation audio touch our servers, or let anyone keep it.
- Send anything identifiable to an AI provider, with the one stated exception below.
- Make a clinical decision. Every draft is a draft until you sign it off.
Questions practices ask about security.
Where are my patients' records stored?
In Sydney, encrypted at rest with AES-256, on secure cloud infrastructure located in Australia. Clinical records at rest do not leave the country.
Does any patient data leave Australia?
Audio does not: it is transcribed in Australia and never retained. Clinical records at rest do not. What does leave is the de-identified text of a consultation, sent transiently to our AI provider for drafting under terms that prohibit training or any other use, plus the one exception stated plainly on this page: a PDF you upload is sent for text extraction as uploaded, before de-identification can be applied to its contents.
Is patient data used to train AI?
No. Every AI and transcription provider is bound by contractual no-training terms, identifiers are removed before any AI processing, and every transcription request opts out of the provider's data-retention and model-improvement programmes.
Who can see a patient's record?
The treating practitioner, from a session that has completed multi-factor authentication. Row-level security in the database enforces that boundary on every request, and every view, export and query is written to an access log the practitioner can inspect.
How does the GP open a letter safely?
They receive an email with a single-use encrypted link, confirm their email address with a one-time code, and the document opens. Downloads are capped, delivery is tracked per recipient, and no account or portal is needed.
Can I take my data out, or delete it?
Both. Export your complete records at any time as a standard archive (spreadsheet files plus a machine-readable copy). Erase a patient or the entire account, immediately and completely on our live systems, after acknowledging your own records-retention obligations.
Are you ISO 27001 certified?
Not at this stage. What we offer instead is specificity: every control on this page is a mechanism in the product, not a policy statement, and the full security posture document is available to practices on request.
Specific enough to put in front of your practice manager.
The full security posture document, the Privacy Policy and the service-provider list are available to any practice considering PsychDispatch.