Privacy Policy

1. Who we are

InstantNote is operated by DSIN Dental Pty Ltd (ACN 679 930 119) (“we”, “us”, “our”), an Australian company incorporated in Victoria. InstantNote is an AI-assisted clinical documentation tool for dental practitioners in Australia.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health information collected through this service is “sensitive information” under the Act and is handled with the highest level of care.

Contact: hello@instantnote.co

2. What we collect

• Account information: name, email address, professional details collected at sign-up via Clerk.
• Clinical transcripts: the appointment audio is uploaded briefly to secure cloud storage so it can be transcribed, then deleted. We do not keep audio recordings. The resulting text transcript is stored in your encrypted database.
• AI-generated clinical notes: structured note content generated from your transcript, stored in your account database.
• Patient identifiers: patient name, date of birth and practice software reference IDs, pulled from your practice software or entered by you, are stored so each note is attached to the right patient. If your practice software is connected, the patient details bar on a note can also show the patient’s contact details, address, Medicare number, allergies and medical history from your practice software, and these may be saved with that note if you view or edit them there. Stored patient details are never sent to AI providers.
• CPD certificates (optional): certificates you upload to your CPD log, stored in Cloudflare R2 storage in the Oceania region.
• InstantSmile images: patient photographs uploaded to the InstantSmile feature are transmitted to an overseas AI image-processing provider to generate illustrative smile previews. These images are used solely to produce the requested preview and are not used by the provider to train AI models. You are responsible for obtaining patient consent before uploading any patient photograph for this purpose. The original photo is not stored. The finished preview image is saved to your account in Cloudflare R2 storage in the Oceania region, so you can open it again later.
• AI note-taking consent: if your practice asks a patient to agree to AI note-taking in InstantNote, we store their decision, their signature if they agree, the date and the version of the wording they saw, so you can show their consent later. It is kept in your account in Australia and is never sent to AI providers.
• Usage data: page views, feature usage, and error logs to operate and improve the service. This data does not include patient content.
• Calendar events (optional): if you connect Google Calendar or subscribe to your calendar feed, your appointment times and patient names are placed in your own calendar, held by your calendar provider.

3. How we use your information

• To generate structured clinical notes from your recordings.
• To store and display those notes within your account.
• To provide customer support and respond to your enquiries.
• To send product updates and billing communications (you may unsubscribe at any time).

We never use your patient data or clinical content to train AI models, and we only use AI services whose terms do not allow them to train on it.

4. AI processing and subprocessors

InstantNote uses third-party services to deliver its features. The table below lists each subprocessor, what data they receive, and where it is processed.

What AI providers receive. We do not attach patient identifiers from your records, such as date of birth, Medicare number or address, to AI requests. The audio and transcript contain whatever is said in the appointment, which can include a patient’s name. Documents you ask us to write, such as referral letters and patient summaries, include the patient’s name so they are addressed correctly.

We only use AI services, and AI hosts, whose terms do not allow them to train on your data or keep it beyond what their terms permit for running and securing the service (for example, short-term abuse monitoring).

5. Cross-border disclosures (APP 8)

As described in section 4, several subprocessors are located in the United States. Sending personal information or health information to these providers constitutes a cross-border disclosure under Australian Privacy Principle 8 (Privacy Act 1988).

What this means for you: The United States does not have an adequacy arrangement with Australia. Overseas recipients are not directly bound by the Australian Privacy Act. However, we address this risk through the following measures:

• Provider terms: We use the business services of each overseas provider, whose terms prohibit selling your data or training AI models on it. Note generation is routed only to AI hosts that do not store or train on requests.
• Data minimisation: Government identifiers such as Medicare numbers are never sent. Only the data needed to perform the service is transmitted.
• Encryption in transit: All transmissions to overseas providers are encrypted (TLS 1.2 or higher).
• Limited retention: AI providers process your data to answer the request. Some keep requests for a short period for security and abuse monitoring, as their terms allow, and then delete them. None use it to train AI models.

By using InstantNote, clinicians acknowledge that AI transcription and note generation requires transmission of clinical audio and transcript text to overseas processors, and confirm that they have obtained or will obtain appropriate patient consent for this processing as part of their practice’s consent and privacy procedures.

If you require that no clinical data leave Australia, contact us at hello@instantnote.co to discuss local processing options.

5A. Recording consent

Practitioners must tell patients, and anyone else present, before recording an appointment and get their agreement. This is required by privacy and surveillance laws, which vary by state and territory. InstantNote’s AI consent form can be used to record that agreement. If anyone objects, stop recording.

6. Data storage and security

Core clinical data is stored in Australia. Your notes, transcripts and patient records are stored in Sydney-region infrastructure (Neon PostgreSQL, ap-southeast-2). Saved smile previews and CPD certificates are stored in Cloudflare R2 in the Oceania region. Data at rest is AES-256 encrypted. Data in transit is TLS 1.2+ encrypted. Access is scoped per clinician. You can only access notes and patients associated with your account.

We maintain audit logs of significant actions (note creation, export, approval) for security and compliance purposes. Stored files are opened through short-lived signed links that expire after a few minutes.

7. Data retention and deletion

Notes and transcripts: a daily job permanently deletes notes and their transcripts 30 days after the note was created, once the note has been approved, moved to the trash, or left as an untouched draft (not edited in 30 days). Send approved notes to your practice software, which is your record of care.

Audio: deleted after it has been transcribed.

Account data: kept while your account is active. You may export your data at any time from Settings → Export my data.

You may request account deletion by contacting us at hello@instantnote.co. We will delete all personal data and clinical content within 30 days, except where retention is required by law.

Note: as a clinician you may have independent legal obligations under state health records legislation (e.g. Health Records Act 2001 Vic, Health Records and Information Privacy Act 2002 NSW) to retain clinical records for defined periods. InstantNote is a drafting tool. You are responsible for maintaining compliant records in your practice management system.

8. Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. In the event of an eligible data breach involving your personal or health information, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by law, and as soon as practicable after becoming aware of the breach.

If a breach affects patient information held for a practice, we will tell the affected practices without undue delay, aiming for within 72 hours of becoming aware of it, with what we know at the time, so they can meet their own obligations.

9. Disclosure of information

We do not sell, rent, or share your personal or clinical data with third parties except:

• Subprocessors listed in section 4 above, under strict data processing agreements.
• Where required by Australian law or a valid court order.
• In the event of a business transfer, where your data would transfer to the acquiring entity under the same privacy protections.

10. Your rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or out-of-date information.
• Request deletion of your data.
• Opt out of direct marketing communications at any time.
• Complain about a breach of the APPs to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, contact us at hello@instantnote.co. We will respond within 30 days.

10A. Patient information and the practice

We handle patient information on behalf of the practice that uses InstantNote. Patients who want to access or correct their information should contact their practice, and we will help the practice respond within 30 days.

11. Cookies

We use cookies that are needed to sign you in (Clerk session tokens). On our public website we also use Google Analytics cookies to count visits and see which pages are useful, and a first-party cookie that records how you first found us (for example, a search engine). We do not use advertising cookies. You can block cookies in your browser; signing in requires the session cookie.

12. Changes to this policy

We may update this policy as the service changes. The current version is always on this page, with the date it was last updated. If we make a material change, we will email you at least 30 days before it takes effect.

13. Contact and complaints

Privacy enquiries: hello@instantnote.co

If you are not satisfied with our response to a privacy complaint, you may refer the matter to the Office of the Australian Information Commissioner: oaic.gov.au or 1300 363 992.