SCHEDULE A · PRIVACY ACT 1988 (CTH) · APP 8, APP 9 & APP 11 · RACGP 5TH ED. C6.4
Schedule A — Seller-to-Clinic Data Processing & Security Agreement (DPA)
Effective Date: 26 October 2026 · Baseline: 9 August 2026 · Next Annual Review: 26 October 2027
Seller / Processor: Arundhati Health Services Pty Ltd trading as DIAGNIFY.AI · 18 Springfield Lakes Boulevard, Springfield Lakes QLD 4300, Australia · D-U-N-S® 890136315 · Privacy Officer: clinical@diagnify.ai
Schedule A — Core Binding Commitments (Seller to Medical Practice)
Where you register or operate a healthcare practice or medical clinic ("Practice") on the Diagnify EMR Platform (emr.diagnify.ai or <practice>.diagnify.ai), this Schedule A forms part of the Terms of Service and Privacy Policy between Arundhati Health Services Pty Ltd trading as DIAGNIFY.AI ("Seller" / "Processor") and the Practice:
- 1. Roles of the Parties: The Practice is the primary health service provider and legal custodian of Patient Health Records under the Privacy Act 1988 (Cth) and applicable State/Territory health records laws. Diagnify processes Patient Health Records solely on behalf of and on the instructions of the Practice to provide the Diagnify EMR Platform.
- 2. Australian Data Residency: Diagnify hosts all primary production databases (Supabase PostgreSQL) and application servers (Vultr Cloud Compute) in Sydney, Australia (
ap-southeast-2). Where the Practice enables Australian-Only AI Routing (AU_ONLY_MODELS=1), clinical text inference is restricted to Australian endpoints (AWS Bedrock Sydney). - 3. No Secondary Use or Public AI Model Training: Diagnify will never sell Patient Health Records, use them for advertising, or permit third-party AI sub-processors to train foundation models on identifiable Practice or Patient data.
- 4. Security Measures (APP 11): Diagnify maintains encryption in transit (TLS 1.2/1.3) and encryption at rest (AES-256) for database and daily GPG backup archives; Role-Based Access Control (RBAC) separating clinical and non-clinical staff permissions; append-only, hash-chained security audit logging (
emr_core.audit_events) and chart-access logging (chart_access_log); and Multi-Factor Authentication (MFA), automatic idle screen lock, and brute-force sign-in lockout controls. - 5. Notifiable Data Breach (NDB) Cooperation (Part IIIC Privacy Act 1988): If Diagnify becomes aware of any actual or suspected unauthorised access, disclosure, or loss of Practice data, Diagnify will notify the Practice Owner within 24 hours (and no later than 72 hours) of confirmation, execute immediate containment steps, preserve forensic audit logs, and coordinate in good faith so that, where required, a single coordinated notification is made to the OAIC and affected individuals under s 26WJ of the Privacy Act 1988 (Cth).
- 6. Data Return, Export & Subscription Lapse (RACGP C6.4): If the Practice's subscription lapses or terminates, Diagnify will not hold Patient Health Records hostage. The Practice will retain read-only and export access (including AU Core FHIR JSON bundles and Full-Record PDFs) for at least 90 days to complete a safe clinical transition.
Clause 1 — Custodianship, Scope of Processing & Government Identifiers (APP 3 & APP 9)
- Practice as Record Custodian: The Practice determines which patients are registered, which clinicians and reception/administrative staff are granted access, and how clinical care is delivered.
- Government Related Identifiers (APP 9): Diagnify collects and stores Medicare numbers, Individual Reference Numbers (IRN), Department of Veterans' Affairs (DVA) file numbers, Pension/Concession card details, Healthcare Provider Identifiers (HPI-I and HPI-O), and Individual Healthcare Identifiers (IHI) strictly on behalf of the Practice as authorised by the Healthcare Identifiers Act 2010 (Cth), the Health Insurance Act 1973 (Cth), and APP 9.2. Internal system records use independent UUIDs (
patient_id,organisation_id). - Clinician-in-the-Loop Governance: All AI-generated clinical notes, differential diagnoses, risk scores, investigation requests, prescriptions, and referral letters are drafts requiring independent review, verification, and sign-off by an AHPRA-registered healthcare practitioner.
Clause 2 — Australian Infrastructure & Approved Sub-Processor Register (APP 8 & APP 11)
| Function | Sub-Processor | Primary Region | Safeguards & Data Scope |
|---|---|---|---|
| Primary EMR Database & Auth | Supabase PostgreSQL (AWS) | Sydney, Australia (ap-southeast-2) |
AES-256 at rest, TLS 1.2/1.3 in transit, daily GnuPG AES-256 encrypted backups. |
| EMR Application & Security Sidecars | Vultr Cloud Compute | Sydney, Australia | Isolated tenant routing, immutable hash-chained security audit ledger. |
| Australian-Only Clinical AI | AWS Bedrock | Sydney, Australia (ap-southeast-2) |
Zero data retention, zero model training; forced when AU_ONLY_MODELS=1 is set. |
| Specialist LLM & Speech-to-Text | Google Gemini / OpenAI / Deepgram / ElevenLabs | Australia / US (Enterprise API) | Zero training on API payloads; consultation audio transcribed transiently and not kept as permanent chart audio. |
| Medical Guideline Vector Search | Pinecone / Voyage AI / Exa | US (De-identified queries only) | Privacy filter strips names, DOB, Medicare/IHI, addresses, and phone numbers prior to query. |
| Telehealth, SMS, Email & Billing | LiveKit / ClickSend AU / Resend / Tyro Health / Stripe | Australia / Regional Edge | Encrypted WebRTC media, transactional reminders,AES-256 password-protected clinical PDFs. |
Clause 3 — Mandatory Technical & Organisational Security Controls (APP 11)
- Role-Based Access Control (RBAC): Non-clinical reception/billing roles operate with
X-EMR-Clinical-Access: 0, separating administrative scheduling/demographics from confidential clinical consultation notes. - Confidential Items & Break-Glass Auditing: Sensitive records are protected behind time-limited break-glass access that writes an immediate, immutable audit event.
- Append-Only Hash-Chained Audit Trail: Every chart open, read, write, print, and export is logged in
emr_core.audit_eventsandpublic.chart_access_log. - Session & Endpoint Protection: TOTP Multi-Factor Authentication (MFA), automatic 15-minute idle screen lock, 5-attempt brute-force sign-in lockout, and a 3-device active session ceiling per user.
Clause 4 — Statutory Retention, Data Portability & 90-Day Transition Guarantee
In accordance with Australian State and Territory health records legislation (including the Health Records and Information Privacy Act 2002 (NSW), Health Records Act 2001 (Vic), and Health Records (Privacy and Access) Act 1997 (ACT)):
- Adult medical records are retained for a minimum of 7 years from the last clinical entry, and pediatric medical records until the patient attains 25 years of age.
- Signed clinical consultation notes are immutable and may only be amended via signed, timestamped clinical addenda (APP 13).
- Upon request at any time — and for at least 90 calendar days following any subscription expiry or termination — the Practice may export complete patient records in AU Core FHIR JSON bundle and Full-Record PDF formats at no hostage fee.
Contact & Execution
This Schedule A takes effect automatically upon Practice onboarding to Diagnify OS / Cloud EMR. Signed countersignature copies for Practice Accreditation (RACGP 5th Edition) are available on request from clinical@diagnify.ai.
DIAGNIFY.AI — Arundhati Health Services Pty Ltd
18 Springfield Lakes Boulevard, Springfield Lakes QLD 4300, Australia · D-U-N-S® 890136315 · clinical@diagnify.ai