Last updated: October 6, 2026 · Version: 1.5
PatientScribe helps you remember what was discussed in medical consultations. Your privacy is fundamental to how we've designed this app. Your notes are generated automatically and may contain transcription or AI errors — they are a memory aid only, not medical advice, and you should check anything important with your healthcare provider before making medical decisions.
PatientScribe is developed by DigiFrontiers, an Australian business (ABN 90 618 091 195). When this policy says "we", "us", or "our", it means DigiFrontiers.
PatientScribe has no user accounts. We do not use analytics, advertising trackers, or profiling. To create your notes, PatientScribe sends your consultation audio to our servers in Australia, where it is transcribed and turned into notes. Your audio, transcript and notes are health-related information — we use them only to produce and deliver your notes — and, if you ask for a translation, to produce and return that translation (see "Translating your notes" below) — never to profile you, sell your data, or train AI, and they are deleted from our servers shortly afterwards (see "How we process your data" below). Our servers also keep some other records and logs to operate and secure the service, including those described under "Security audit log" and "App verification records" below and the server logs described under "Translating your notes" below. We do not use them for analytics, advertising or profiling.
When you record a consultation, your audio, transcript, and notes are processed and held on our servers in Australia to generate the notes and deliver them to your device during processing (see "How the app works" below). When you save or discard a consultation, the copies on our servers are deleted. If that does not happen, automatic deletion removes server audio after about 1 day, and the transcript and notes after about 7 days. When the app uploads a recording, our servers also record the internet (IP) address your device connected from in a security audit log, kept for about 90 days (see "Security audit log" below).
Recording is optional and is not required by law. If you choose not to record, or not to consent to processing, PatientScribe cannot transcribe that consultation or generate notes for it. Under our current configuration, your consultation content is processed and stored using Amazon Web Services regions in Australia, and we are not likely to disclose it to overseas recipients; if this changes, we will update this policy first.
When you record a consultation:
This data is stored locally on your iPhone. It is protected by iOS data protection, and your notes and transcripts are excluded from iCloud backup. We do not have remote access to notes and transcripts stored on your device through the PatientScribe service, unless you choose to export or share them. If you ask for a translation, the app sends that note's text from your device to produce it — see "Translating your notes" below; the data remains subject to your device's security settings.
We operate our own servers on Amazon Web Services (AWS) in Australia. Under our current configuration, your consultation content is processed and stored in AWS regions in Australia.
Transcription: Your audio is processed by our self-hosted transcription service running on Amazon Web Services (EC2) in Sydney. Audio is encrypted in transit and at rest.
Note generation: Your transcript is processed by an AI language model (Anthropic's Claude) using Amazon Web Services Bedrock with an Australian inference profile to produce your notes. Your consultation content is not sent to Anthropic's own service — AWS runs the model on our behalf within Australia, and AWS states that Bedrock model providers do not access customer inputs or outputs. We do not use your consultation content to train AI models, and AWS states Bedrock inputs and outputs are not used to train Amazon or third-party models.
Automatic deletion: When you save or discard a consultation, the copies on our servers — including application storage, processing queues, and database records — are deleted. As a backstop, if that does not happen, server audio is automatically deleted after about 1 day, and the transcript and notes after about 7 days. Whichever way a consultation's database entry is deleted, a system record of it (which can include the transcript and notes) remains for up to about 24 hours and is then removed automatically. We do not keep separate long-term backups of your consultation audio, transcripts, or notes.
Security audit log: We keep a security audit log of access to the audio and transcript files on our servers. When the app uploads a recording, the log records the date and time, the internet (IP) address your device connected from, the app and iOS version and a random reference number for that recording, never the content. Each entry is encrypted at rest and automatically deleted after about 90 days, even if you have already saved or discarded the consultation.
App verification: Our servers can check that certain requests about a consultation come from a genuine copy of PatientScribe (the upload of the recording itself is not checked). We can switch this check on and off. For the check the app uses a verification key: a key that iOS keeps in your device's secure hardware and that Apple certifies as belonging to a genuine copy of the app (see "Third-party services" below). With each checked request the app sends our servers the key's identifier and a proof made with the key and, the first time it uses a key, Apple's certification of that key. The identifier is unique to your copy of the app on your device and lets our servers recognise that copy each time it uses that key.
App verification records: We keep an app verification record for each key that has passed its first check. It holds the key's identifier, technical details from Apple's certification of the key and from our own checks of it, and when the key was first and last used and how often. The record itself holds no consultation content, name, contact details or IP address. It is encrypted at rest, has no expiry, and nothing deletes it. When a checked request creates a consultation's database entry, a scrambled form of the identifier is stored in that entry, for checking later requests about the consultation, and is deleted with the entry (see "Automatic deletion" above). As part of the check, to limit misuse, we also keep short-lived counts of requests, held against a scrambled form of the internet (IP) address your device connected from and each removed automatically, usually within a few days.
No routine human access: Note generation is automated. DigiFrontiers personnel do not read, review, or listen to your recordings, transcripts, or notes in the normal course of providing the service, and we have no support workflow for human review of consultation content. AWS, as our infrastructure provider, processes your data on our behalf under contractual confidentiality and does not access your consultation content except as needed to operate and secure the service.
PatientScribe can translate your consultation notes into other languages. Translation is optional — nothing is translated unless you ask for it, and the first time you use it we ask for your consent in the app. If you decline, every other feature keeps working.
When you choose to translate a note, the app sends that note's text (which is health-related information) and your chosen language from your device to our servers in Australia. AWS Bedrock, our cloud provider, then processes it on our behalf by running Anthropic's Claude in Australia to produce the translation, which is returned to your device and stored alongside the English note. Your content is not sent to Anthropic's own service. We do not store the note text you send for translation or the translation on our servers. This does not change the handling of the original server copies made when your notes were first created, which are deleted as described in "Automatic deletion" above. Our server logs record when a translation was requested, the language chosen, the number of lines and whether it succeeded, never the text, and are deleted after about 30 days. As with note generation, your content is not used to train AI models, and there is no routine human access.
Translations are automatic machine translations and may contain errors. They are a reading aid: the English note is always shown alongside the translation. A translation is not a substitute for a professional interpreter or for advice from your healthcare provider.
You can withdraw translation consent at any time in Settings. This stops future translations.
We use Amazon Web Services (AWS) in Australia as our cloud infrastructure provider to host and process consultation data. This includes AWS Bedrock for AI note generation and optional note translation, which runs Anthropic's Claude model within Australia.
We do not share your consultation data with any third-party transcription, analytics, or advertising services. AWS processes data on our behalf under terms that require protections consistent with this policy, and does not use your consultation content to train AI models.
For more information, see the AWS Data Privacy FAQ.
The check described under "App verification" above uses Apple's App Attest service. When the app creates a verification key, iOS contacts an Apple server so that Apple can certify that the key belongs to a genuine copy of the app. The app passes no consultation content to iOS for this. We do not know what iOS itself sends to Apple for this certification, or where the Apple servers that handle it are. Our servers check Apple's certification without contacting Apple.
Your notes and transcripts are stored on your own device — you can view, correct, or delete them yourself at any time in the app, so you already have direct access to that information. We do not keep a central copy of your consultations: any copy on our servers is temporary and is deleted (see "Automatic deletion" above), so in general there is no consultation content for us to retrieve or hand over. If you have any other privacy request, concern, or complaint, contact us at support@patientscribe.com.au and we will respond within a reasonable time. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
PatientScribe is intended for adults. If a consultation concerns a child, or a person who may not have capacity to consent, the user must obtain consent from a parent, guardian, or other legally authorised person where required.
If we update this policy, we will post the new version here with an updated date.
Questions about this privacy policy? Contact us at support@patientscribe.com.au