Privacy Policy & Compliance Suite — DIAGNIFY.AI

Last updated: 26 October 2026 · Baseline: 9 August 2026 · Next Annual Review: 26 October 2027 (RACGP C6.3)

Seller / Platform Operator: Arundhati Health Services Pty Ltd trading as DIAGNIFY.AI · 18 Springfield Lakes Boulevard, Springfield Lakes QLD 4300, Australia · D-U-N-S® 890136315 · Privacy Officer: clinical@diagnify.ai

Introduction

This Privacy Policy explains how DIAGNIFY.AI ("DIAGNIFY," "we," "us," or "our"), operated by Arundhati Health Services Pty Ltd, collects, uses, discloses, and protects personal information and sensitive health information when you use the DIAGNIFY.AI platform, including our website (diagnify.ai), our Cloud EMR & Practice Platform (emr.diagnify.ai and clinic subdomains <practice>.diagnify.ai), our iOS application, and our Patient Check-In, Waitroom Intake, Telehealth, and Patient App services (collectively, the "Platform"). It should be read together with our Terms of Service.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the 13 Australian Privacy Principles ("APPs"), the Notifiable Data Breaches ("NDB") scheme (Part IIIC of the Privacy Act 1988), the Healthcare Identifiers Act 2010 (Cth), the My Health Records Act 2012 (Cth) (where applicable), and relevant Australian State and Territory health records legislation (including the Health Records and Information Privacy Act 2002 (NSW), Health Records Act 2001 (Vic), and Health Records (Privacy and Access) Act 1997 (ACT)). Where you use the Platform from outside Australia, we handle your information in accordance with this Policy and applicable local law.

DIAGNIFY.AI clinical decision support and EMR tools are intended for licensed healthcare professionals and authorised medical practices. Standalone clinician decision-support surfaces are not intended for autonomous use by patients or consumers; where a medical practice invites or registers a patient via Diagnify Patient, Waitroom Intake, or Telehealth, patient data is processed on behalf of the treating medical practice as set out below.

Who We Are & Our Dual Role (Seller to User vs Practice Processor)

DIAGNIFY.AI operates from Queensland, Australia (Arundhati Health Services Pty Ltd, 18 Springfield Lakes Boulevard, Springfield Lakes QLD 4300 · D-U-N-S® 890136315). For any privacy question, request, or complaint, contact our Privacy Officer at clinical@diagnify.ai.

• As a Direct Account Provider ("Seller to User / APP Entity"): When a healthcare professional, practice owner, or staff member registers a Diagnify account, subscribes to our services, or contacts us directly, we collect and manage that professional account information as an APP entity in our own right.
• As a Cloud EMR & Clinical Service Provider to Healthcare Practices ("Data Processor"): When a medical clinic, general practice, or healthcare practitioner ("Practice") uses Diagnify EMR to manage patient care, the Practice remains the primary healthcare provider and legal custodian of the clinical record. Diagnify holds and processes patient personal and health information strictly on behalf of, and under the instructions of, the treating Practice.

Information We Collect (APP 1.4(a) & APP 3)

Account and professional information. Your name, email address, phone number, role within the practice (e.g., Practice Owner, GP/Clinician, Nurse, Receptionist, Practice Manager, Billing), working site/branch location, occupation or specialty, area and country of practice, the medical board or governing body you are registered with (e.g., AHPRA), your professional registration number, Healthcare Provider Identifier – Individual (HPI-I), Healthcare Provider Identifier – Organisation (HPI-O), Medicare Provider Number, and Prescriber Number. We collect this to confirm that you are an authorised user under our Terms of Service and to operate practice workflows.

Clinical content you enter. Case descriptions, clinical questions, answers to work-up prompts, consultation notes, past medical and surgical history, family and social history, allergies and adverse reactions, current and ceased medications, prescriptions, immunisation records, vital signs, pathology and diagnostic imaging requests and results, specialist referral letters, care plans, recalls, uploaded documents or images, and any dictated or consultation audio you record. Audio recorded through the microphone is transcribed to text so it can be processed; recording only begins when you actively start it.

Session, security, and usage information. Consultation history you choose to save, technical logs, device and browser type, IP address hashes, Multi-Factor Authentication (MFA/TOTP) enrolment status, active session/device tokens, and an immutable security audit trail (emr_core.audit_events and chart_access_log) used to keep the service running, compliant, and secure.

Payment information. Where a subscription is purchased through our website, payment is processed by our PCI-DSS compliant payment provider. We do not collect or store your full card details. No purchase is made through the iOS application.

Patient Information & Government Related Identifiers (APP 3 & APP 9)

You may enter or collect clinical information relating to a patient. Because health information is classified as sensitive information under the Privacy Act 1988 (Cth), it is collected only with the patient's consent, as authorised by the treating clinician in connection with providing a health service, or as otherwise permitted under APP 3.3 and APP 3.4. Where you do so:

• You (and your Practice) remain the custodian of that information and are responsible for your own obligations under the Privacy Act 1988 (Cth), the Health Practitioner Regulation National Law, and any equivalent law in your jurisdiction.
• You must not enter information that identifies a patient unless you are legally authorised to do so and have met all applicable privacy obligations (including providing the Patient Privacy Collection Notice & AI Scribe Consent under APP 3 and APP 5).
• Wherever practicable on standalone non-EMR decision support tools, clinical inputs should be de-identified before submission.
• Government Related Identifiers (APP 9): Diagnify collects and stores Medicare numbers, Individual Reference Numbers (IRN), Department of Veterans' Affairs (DVA) file numbers, Pension/Concession card details, and Individual Healthcare Identifiers (IHI) strictly on behalf of the treating Practice as authorised by the Healthcare Identifiers Act 2010 (Cth), the Health Insurance Act 1973 (Cth), and APP 9.2. We never adopt a government identifier as our own internal system identifier (patient_id and organisation_id are independent UUIDs).

We process such information only to generate the clinical decision support output or EMR clinical record function you requested, and for the duration necessary to do so.

Diagnify Patient (the patient app)

Diagnify Patient is the app offered to patients of medical practices that use Diagnify. It lets a patient book appointments, complete a voice check-in before a visit (Diagnify Intake), see and add to their record, receive documents their doctor sends, join a video consult their doctor starts, and ask the Diagnify Assistant general health questions. The practice you attend is the custodian of your clinical record; Diagnify processes it on the practice’s behalf.

What the app collects. Your name, date of birth, sex and gender, Aboriginal and/or Torres Strait Islander origin (optional), mobile number and email (used to send one-time sign-in codes), home address, Medicare/DVA/concession/IHI details, an emergency contact (optional), privacy and AI scribe consent preferences, and the health information you provide: allergies, medications, conditions, measurements, documents or photos you upload, and what you say to Diagnify Intake or the Diagnify Assistant. Audio is transcribed to text so your doctor can read it; recording starts only when you tap to start. The app does not collect your location, your contacts, advertising identifiers or analytics, and shows no advertising.

AI services. Diagnify Intake and the Diagnify Assistant are AI services run for your clinic. They give general information and collect what you tell them for your doctor; they do not diagnose or recommend treatment. In an emergency call 000 (Australia) or 112 (India).

Service providers for the patient app. Database hosting in Sydney (Supabase); AI language and voice models (Google Gemini / AWS Bedrock Sydney) and address search (Google Places) for the text you type; video consult infrastructure (LiveKit); SMS codes (ClickSend); email codes (Resend). Each processes information only to perform that function.

Retention and deletion. Your clinical record is held by your practice for as long as health-records law requires, whether or not you use the app. You can delete your app account at any time in the app (Profile → Your app account → Delete): this removes your sign-in on every device, your emergency contact and preferences, anything you added or uploaded in the app and your copies of documents in the app inbox, straight away. It does not remove the clinical record held by the practice; ask the practice about that record. You can also request deletion by emailing clinical@diagnify.ai from the mobile number or email on the account.

Children. A parent or carer may create and manage a record for a child using their own mobile number. We do not knowingly collect information from a child without a parent or carer.

How We Use Information · Collection & Use (APP 2, APP 5 & APP 6)

We collect and use personal and health information to: provide the Platform and generate clinical decision support output; operate the Practice EMR (charts, appointments, recalls, pathology/imaging orders, results inboxes, prescriptions, and referrals); authenticate you and confirm your professional eligibility; maintain your saved consultations and clinical records; deliver patient intake, appointment reminders, and AES-256 protected PDF documents; provide support and respond to your enquiries; monitor security, enforce role-based access control, prevent misuse, and diagnose faults; improve the clinical quality, accuracy, and safety of the Platform; and meet our legal obligations.

Anonymity and Pseudonymity (APP 2): Where lawful and practicable (such as browsing public pages or making a general privacy enquiry), you may interact with us anonymously or using a pseudonym. In clinical care, accurate identification is required for patient safety, prescribing, Medicare claiming, and statutory medical record-keeping.

Strict Prohibitions on Secondary Use:

• No Sale or Marketing: We do not sell, rent, or trade personal or health information, and we never use clinical content for advertising.
• No Public AI Model Training: We never use identifiable patient health records, consultation audio, or clinical notes to train public or third-party foundation AI models.

AI Clinical Scribe, Clinical Decision Support & Automated Processing Transparency

• Clinician-in-the-Loop Governance: Diagnify uses artificial intelligence models and deterministic clinical rule engines to draft clinical notes, structure medical histories, calculate validated clinical risk scores, and flag potential prescribing or guideline considerations. Diagnify does not make autonomous clinical decisions. Every draft note, diagnosis, investigation request, prescription, and referral requires independent review, verification, and sign-off by a qualified healthcare practitioner.
• Patient Consent for Ambient Scribe: Practices using Diagnify's ambient clinical scribe obtain informed patient consent before starting audio capture. Patients have the unconditional right to decline or withdraw AI scribing at any time without affecting their clinical care.
• Transient Audio Handling: Consultation audio streamed to our transcription service is processed solely to return a text transcript for the active consultation and is not retained as a permanent audio recording in the patient's chart.
• De-Identified Guideline Retrieval: When Diagnify searches clinical guideline databases (such as Pinecone vector indexes or external medical evidence APIs), our privacy filter strips patient identifiers (names, dates of birth, Medicare numbers, addresses, and phone numbers) so that only short, de-identified clinical queries are transmitted.

Disclosure and Service Providers · Data Location and International Transfers (APP 8 & APP 11)

Application and clinical data for our primary production environment is stored in Australia (Sydney, ap-southeast-2), encrypted at rest using AES-256 and in transit using TLS 1.2/1.3, with daily automated GnuPG AES-256 encrypted backups. Practices may enable Australian-Only AI Routing (AU_ONLY_MODELS=1) so that all clinical text LLM calls run exclusively inside Australia via AWS Bedrock Sydney/Melbourne.

We disclose personal information to carefully selected service providers and sub-processors who help us operate the Platform, and only to the extent needed for them to perform that function:

• Authentication and database hosting (Australia — Sydney ap-southeast-2): Supabase PostgreSQL and AWS Sydney storage of your account, saved consultations, and clinical records.
• Cloud infrastructure (Australia — Sydney): Vultr Cloud Compute hosting of the application and security sidecar services.
• AI model providers (Australia / US): AWS Bedrock Sydney (ap-southeast-2) for Australian-only clinical reasoning and note drafting, and specialist LLM providers (Google Gemini, OpenAI, and configured gateways) when selected.
• Speech transcription & telehealth (Australia / US / Regional Edge): Deepgram, ElevenLabs, and Google Gemini for conversion of dictated/consultation audio to text, and LiveKit Cloud for encrypted WebRTC telehealth video/audio routing.
• Guideline & evidence search (US — De-identified only): Pinecone, Voyage AI, and Exa for de-identified medical guideline retrieval.
• Email, SMS & payment processing (Australia / US): ClickSend AU (SMS reminders), Resend (transactional email), Tyro Health (Australian practice billing), and Stripe (subscriptions and payments).

Where information is transferred overseas under APP 8, we take reasonable steps — including enterprise API zero-data-retention / no-training controls, encryption in transit, and contractual data protection obligations — to ensure it is handled consistently with the Australian Privacy Principles. A current sub-processor register is available on request from clinical@diagnify.ai. We may also disclose information where required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of any person.

Retention (APP 11.2)

We retain your account information for as long as your account is active. For standalone clinician accounts, saved consultations and clinical records are retained until you delete them or delete your account. For Medical Practices using Diagnify EMR, Australian State and Territory health records laws require adult patient health records to be retained for a minimum of 7 years from the date of the last entry, and health records for children (under 18) until the patient attains 25 years of age; signed clinical notes are immutable (amendable only via signed, timestamped addenda) and patient deletions within a Practice operate as an administrator-controlled soft-archive (archived_at) during the statutory retention period. Technical logs are retained for a limited period for security and fault diagnosis. We will delete or de-identify personal information when it is no longer needed for a purpose set out in this Policy, unless we are required by law to retain it.

Your Choices and Rights (APP 12 & APP 13)

Access and correction. You can view and correct your account and professional details from within the Platform, or ask us at clinical@diagnify.ai. We respond to access and correction requests within 30 days at no charge for making the request. For patients of a Practice, requests to access your medical chart, obtain a health summary, transfer your file, or record a correction should be directed to your treating Practice in the first instance (Diagnify provides built-in tools for your Practice to export AU Core FHIR JSON bundles and Full-Record PDFs within 30 days under APP 12 and record addenda under APP 13).

Deleting individual records. You can delete a saved consultation from your standalone history at any time.

Deleting your account. You can request deletion of your account and associated data from within the application (/delete-account), or by emailing clinical@diagnify.ai. Deletion removes your account and the clinical content associated with it. Where we are legally required to retain certain records, we will tell you. Patients using Diagnify Patient delete their app account in the app under Profile → Your app account → Delete (see the Diagnify Patient section above).

Complaints. If you believe we have breached the Australian Privacy Principles, contact our Privacy Officer at clinical@diagnify.ai. We will acknowledge your complaint within 5 business days, investigate the matter, and provide a written response within 30 calendar days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5218, Sydney NSW 2001.

Security (APP 11)

We use technical and organisational measures appropriate to the sensitivity of health information, including TLS 1.2/1.3 encryption in transit, AES-256 encryption at rest, Role-Based Access Control (RBAC) separating reception/administrative demographics from clinical notes (X-EMR-Clinical-Access: 0), restricted records with time-limited break-glass auditing, append-only hash-chained security audit logs (emr_core.audit_events and chart_access_log), Multi-Factor Authentication (TOTP MFA), automatic 15-minute idle screen lock, 5-attempt brute-force sign-in lockout, maximum 3 active devices per user, and AES-256 password protection on emailed clinical PDFs. No system can be guaranteed completely secure; you are responsible for keeping your login credentials confidential and for notifying us promptly of any suspected unauthorised access.

Children

Standalone clinician tools on the Platform are not directed to, and must not be used autonomously by, anyone under 18. Within a Medical Practice EMR or Diagnify Patient app, a treating clinician, parent, or authorised guardian may create and manage health records for a child in accordance with Australian medical consent laws.

Changes to This Policy

We may update this Policy from time to time. Material changes will be notified within the Platform. Continued use after a change constitutes acceptance of the updated Policy.

---

Data Breach Response Plan (OAIC Notifiable Data Breaches Scheme — Part IIIC Privacy Act 1988 & RACGP C6.4)

Diagnify maintains and tests a formal Data Breach Response Plan (ops/compliance/DATA_BREACH_RESPONSE_PLAN.md) under Part IIIC of the Privacy Act 1988 (Cth), the OAIC Data Breach Preparation and Response Guide, s 75 of the My Health Records Act 2012 (Cth), and RACGP 5th Edition Criterion C6.4:

• Step 1 — Contain & Preserve Forensic Evidence (Hours 0 to 4): We immediately isolate and contain any suspected unauthorised access, disclosure, or loss (locking compromised accounts via AUTH_LOCKOUT, revoking active sessions/devices, revoking leaked patient triage tokens via /triage_revoke, or rotating API/database credentials) without destroying forensic evidence. We snapshot the affected host and archive our append-only, hash-chained security ledger (emr_core.audit_events, public.chart_access_log, and public.patient_audit).
• Step 2 — Assess Within 30 Calendar Days (Target < 72 Hours, s 26WH & s 26WG): Our Incident Commander & Privacy Officer conducts a formal written NDB Assessment to determine: (a) what occurred and which patient/practice records were touched; (b) whether data was protected by AES-256 encryption without key exposure; (c) whether prompt remedial action under s 26WF (such as verified unread destruction by a bound healthcare recipient) has eliminated any likelihood of serious harm; and (d) whether a reasonable person would conclude that the breach is likely to result in serious harm to any individual.
• Step 3 — Mandatory Notification (s 26WJ, s 26WK & s 26WL):
  • Affected Medical Practice Notification (Within 24 Hours): We notify the Practice Owner of any affected <practice>.diagnify.ai tenant within 24 hours of discovery so the Practice can alert its Medical Defence Organisation (Avant / MIPS / MDA National / MIGA) and coordinate joint response under s 26WJ.
  • OAIC & Affected Individuals Notification: Where an Eligible Data Breach is confirmed, we lodge a formal statement via the OAIC Notifiable Data Breaches Portal (oaic.gov.au · 1300 363 992) and notify affected individuals directly with clear protective recommendations (including Medicare card replacement on 132 011 and free national identity support via IDCARE on 1800 595 160).
  • ADHA Notification (My Health Record / HI Service): If My Health Record data or NASH PKI credentials are involved, we notify the ADHA System Operator (1300 901 001) and the OAIC as soon as practicable under s 75 of the My Health Records Act 2012.
• Step 4 — Post-Mortem, Engineering Prevention & Breach Register (Within 14 Days): We ship permanent engineering guards through our automated release train, record every incident and near-miss (including s 26WF remediated incidents) in our Internal Data Breach Register, and run 6-monthly tabletop and restore drills.

---

Schedule A — Seller-to-Clinic Data Processing & Security Agreement (DPA)

This Schedule governs how Arundhati Health Services Pty Ltd trading as DIAGNIFY.AI ("Seller" / "Processor") processes data on behalf of each onboarded medical clinic or healthcare practice ("Practice"):

• 1. Roles of the Parties: The Practice is the primary health service provider and legal custodian of Patient Health Records under the Privacy Act 1988 (Cth) and applicable State/Territory health records laws. Diagnify processes Patient Health Records solely on behalf of and on the instructions of the Practice to provide the Diagnify EMR Platform.
• 2. Australian Data Residency: Diagnify hosts all primary production databases (Supabase PostgreSQL) and application servers (Vultr Cloud Compute) in Sydney, Australia (ap-southeast-2). Where the Practice enables Australian-Only AI Routing (AU_ONLY_MODELS=1), clinical text inference is restricted to Australian endpoints (AWS Bedrock Sydney).
• 3. No Secondary Use or Model Training: Diagnify will never sell Patient Health Records, use them for advertising, or permit third-party AI sub-processors to train foundation models on identifiable Practice or Patient data.
• 4. Security Measures (APP 11): Diagnify maintains encryption in transit (TLS 1.2/1.3) and at rest (AES-256), role-based access control (RBAC) separating clinical and non-clinical staff permissions, append-only hash-chained security audit logging (emr_core.audit_events and chart_access_log), multi-factor authentication (MFA), automatic idle screen lock, and brute-force sign-in lockout controls.
• 5. Notifiable Data Breach (NDB) Cooperation: Diagnify will notify the Practice Owner within 24 hours (and in any event no later than 72 hours) of confirming any actual or suspected unauthorised access, disclosure, or loss of Practice data, execute immediate containment, preserve forensic audit logs, and coordinate in good faith so that, where required, a single coordinated notification is made to the OAIC and affected individuals under s 26WJ of the Privacy Act 1988 (Cth).
• 6. Data Return, Export & Subscription Lapse (RACGP C6.4): If the Practice's subscription lapses or terminates, Diagnify will not hold Patient Health Records hostage. The Practice will retain read-only and export access (including AU Core FHIR JSON bundles and Full-Record PDFs) for at least 90 days to complete a safe clinical transition.

---

Template 1.3 — Patient Privacy Collection Notice & AI Scribe Consent Contract (Waitroom / Intake / Patient App / Registration)

This contract is presented to every patient who registers with a Practice or checks in via Waitroom Intake, Telehealth, or the Diagnify Patient App (Version 1.3-2026-10):

Contact Us

DIAGNIFY.AI — Arundhati Health Services Pty Ltd
18 Springfield Lakes Boulevard, Springfield Lakes QLD 4300, Australia · D-U-N-S® 890136315
Email: clinical@diagnify.ai · Website: https://diagnify.ai