Trust & security
Clinical records carry real legal weight. Here is exactly how InstantNote handles security, data residency, and AHPRA / Dental Board of Australia compliance. For the full legal detail, see our Privacy Policy.
Security
Data at rest is AES-256 encrypted. Data in transit is encrypted with TLS 1.2 or higher (TLS 1.3 where your browser supports it). Stored files open through short-lived signed links that expire after a few minutes.
Core clinical data, notes, transcripts and patient records, is stored in Sydney-region infrastructure, not offshore.
Role-based access control with data isolation per clinician. You can only see notes and patients associated with your own account.
Significant actions, note creation, export, approval, are logged for security and compliance review, alongside rate limiting on sensitive endpoints.
InstantNote is regularly security tested, including attempts to reach data without signing in and to read another clinician's records. Security practices are modelled on ISO 27001:2022 and the ACSC Essential Eight.
Your clinical content is never used to train AI models. This is a contractual requirement for every AI subprocessor InstantNote uses.
Compliance
Every generated note is checked against Dental Board of Australia record-keeping guidance before you approve it.
Notes are scored against ADA Guidelines for Dental Records and the Dental Board's shared Code of Conduct. Missing fields, like consent elements, LA documentation, or follow-up plans, are flagged before approval, not after.
InstantNote is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We are subject to the Notifiable Data Breach scheme and will notify you and the OAIC of any eligible breach.
Data handling
Audio is held only long enough to transcribe it, then deleted. We do not keep audio recordings.
Stored patient records (dates of birth, contact details, Medicare numbers and other identifiers) are never sent to AI providers. Names spoken during the appointment may appear in the transcript, which is processed to write the note.
Where an overseas AI provider is used for transcription or note generation, only the data needed is sent, to services whose terms forbid training on it. Some providers keep requests briefly for security monitoring, then delete them.
Want the full detail?
Our Privacy Policy lists every subprocessor we use, what data they receive, where it is processed, and your rights under the Australian Privacy Principles.