This Privacy Policy describes how MedSpec Pty Ltd (ACN 678 145 447) (“MedSpec”, “we”, “us”, “our”) collects, uses, stores and discloses personal information, including health information. when clinicians, clinics or authorised users (“you”, “your”, “Clinic”, “Clinician”, “Users”) use the MedSpec software-as-a-service platform (“Platform”).

MedSpec complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By using the Platform, you consent to the handling of personal information in accordance with this Privacy Policy.

1. Types of Information We Collect

1.1 Personal Information

Information that identifies an individual, including:

name, contact details, email address
professional details (AHPRA registration, specialty)
organisation or clinic affiliation
login credentials and authentication data
billing and payment information (if applicable)

1.2 Patient Data (Health Information)

Clinicians and Clinics may upload, generate, or store health information including:

consultation notes, dictations, letters and clinical summaries
diagnostic information, referrals, medical history
demographic information (name, DOB, contact details)
documents uploaded for processing
prescriptions or investigation requests
metadata related to clinical workflows

Clinics remain the data controller for all patient information. MedSpec acts as a data processor.

1.3 Usage and Technical Data

We automatically collect:

log data (IP address, browser, device)
session information
feature usage patterns
timestamps, error logs and performance metrics

1.4 Optional Data Provided by Clinics

Clinics may configure:

clinic branding (logo, alias, address)
staff roles and permission structures
practice workflow settings

2. How We Collect Information

We collect information through:

account registration
Clinic onboarding and subscription forms
uploads of dictations, documents or patient data
AI-assisted or automated workflows
technical logs generated through use of the Platform
customer support requests
integrations with third-party systems (e.g., EHRs, identity verification, cloud storage)

We may also collect information from publicly available registers (e.g., AHPRA) when verifying clinician identity.

3. Purpose of Collection and Use

We use personal information solely to provide, maintain, and improve the Platform, including:

3.1 Provision of Services

dictation, transcription, and document processing
clinical letter and report generation
patient document management and sharing
internal messaging and communication tools
repository storage and retrieval
workflow automation and clinical summaries

3.2 Security and Access Control

authentication and authorisation
enforcing organisational permissions
threat detection and auditing

3.3 Customer Support and Operations

troubleshooting
maintenance
responding to enquiries

3.4 Analytics, Service Improvement, and AI

MedSpec does not use identifiable Patient Data or patient voices to train, fine-tune, or improve artificial intelligence models.

MedSpec may analyse aggregated and de-identified usage data for system performance, security, and product improvement.

Separately, and only where a Clinician has explicitly opted in, MedSpec may use clinician dictation audio and de-identified generated text in accordance with Section 3.6.

3.5 Compliance and Legal Obligations

meeting regulatory requirements
responding to lawful requests
fraud and misuse prevention

3.6 Clinician Voice Personalisation (Optional)

Where a Clinician has explicitly opted in, MedSpec may process clinician dictation audio and de-identified generated text to derive audio embeddings or acoustic representations for the purpose of improving speech recognition accuracy and dictation performance within the Platform.

This processing:

applies only to clinician-initiated dictation recordings;
excludes patient voices and ambient recordings;
does not involve biometric identification or surveillance; and
does not involve sale or disclosure to third parties.

4. How Patient Data is Handled

4.1 Clinics remain the data controller of all Patient Data.
MedSpec only processes Patient Data on behalf of the Clinic.

4.2 MedSpec does not use patient data to train or improve AI models.
Only aggregated and de-identified usage patterns may be used for system improvement.

4.3 MedSpec does not sell, rent, disclose or monetise Patient Data.

4.4 Clinic Responsibilities

Clinics and clinicians are responsible for:

• providing patients with required privacy notices;
• obtaining valid consent or authorisation to collect, use, and disclose patient information via the Platform;
• responding to patient requests for access or correction of their health information;
• determining appropriate retention periods for clinical records.

MedSpec acts solely on the documented instructions of the Clinic when processing Patient Data.

4.5 Clinician Voice Data

Clinician dictation audio used for optional voice personalisation is treated as personal information of the Clinician, not Patient Data.

Clinics do not act as data controllers for clinician voice personalisation data. Participation is determined solely by the individual Clinician.

5. Lawful Basis for Processing

We process information based on:

performance of a contract (providing the Platform to a Clinic)
consent (where explicitly provided)
legitimate interest (service performance, security, support)
legal obligations (e.g., responding to subpoenas or statutory requests)

Clinics are responsible for obtaining any required patient consents.

6. Disclosure of Information

We may disclose personal information to:

6.1 Service Providers

(e.g., AWS, email providers, payment processors)
Only where necessary to provide the Platform.

6.2 Third-Party Integrations

If you enable integrations, data may flow to the third-party application under its own privacy policy.

6.3 Legal or Regulatory Authorities

Where required by law, subpoena, or regulatory obligation.

6.4 Corporate Transactions

In case of merger, acquisition, or restructuring, subject to confidentiality.

We do not disclose Patient Data to third parties except as needed to provide the Services or as required by law.

7. Data Storage and Security

7.1 Data is stored primarily in AWS Australia regions.

7.2 MedSpec maintains security controls aligned with ISO 27001 practices (noting MedSpec is not yet certified), including:

encryption in transit and at rest
role-based access control (RBAC)
multi-tenant logical separation
audit trails and monitoring
secure software development practices
penetration testing and vulnerability scanning

7.3 Access to Patient Data is limited to authorised MedSpec personnel strictly on a need-to-know basis.

7.4 No method of data transmission or storage is completely secure.
Clinics acknowledge inherent risks when using cloud-based systems.

8. Data Retention

8.1 MedSpec retains data for the duration of the service agreement with the Clinic.

8.2 Upon termination, MedSpec will:

retain or delete data according to the Clinic’s instructions and applicable law;
securely purge data where deletion is requested and legally permissible.

8.3 Backups may persist for a limited period as part of normal disaster recovery practices.

9. Cross-Border Data Transfers

MedSpec endeavours to store and process data within Australia.
If offshore processing becomes necessary (e.g., for support tooling), we will:

bind such processors under contractual obligations compliant with APP 8;
inform Clinics in advance where material changes occur.

10. Access, Correction, and Rights

Clinicians and Clinics may request:

access to personal information held about them
correction of inaccurate or outdated information
deletion of their account information (where legally permitted)

Requests must be submitted to support@medspec.com.au

Patients seeking access to or correction of their health information should contact their treating Clinic directly.

MedSpec will assist Clinics, where reasonably required, to respond to patient requests in accordance with applicable law.

Clinicians may manage participation in the Clinician Voice Personalisation Program through their account settings, including opting in or withdrawing consent at any time.

11. Cookies and Tracking

We may use:

session cookies
analytics cookies
performance measurement tools
log-based telemetry

Cookies may be required for core functionality (e.g., authentication).

12. Children’s Data

The Platform is not designed for individuals under 18.
Any patient data uploaded is handled solely under the authority of the treating Clinic or clinician.

13. Third-Party Links and Integrations

We are not responsible for the privacy practices of third-party websites, APIs, or integrated systems.
You should review the privacy policy of any integration you enable.

14. Changes to This Policy

We may update this Privacy Policy periodically.
Material changes will be posted on our website or communicated to Clinics.

Continued use of the Platform after changes take effect constitutes acceptance.

15. Contact Us

For privacy enquiries, complaints, or requests, contact:

Email: support@medspec.com.au
Entity: MedSpec Pty Ltd (ACN 678 145 447)
Address: Office 2892, Ground floor, 470 St Kilda Road, Melbourne VIC 3004