Australian readiness
Draft compliance placeholders
Named replacement fields for MediScriber's Australian privacy, security, operational, and clinical governance work.
Not evidence of compliance
Every value on this page is an illustrative placeholder unless a value explicitly says it was verified. These values are not approved policies, operating controls, certifications, service commitments, or legal claims. Replace and verify them before relying on or publishing this page as compliance information.
AU-01
Accountability and compliance scope
- Operator record
- Placeholder: see operator information
- Approved jurisdictional scope
- Placeholder: Australia-wide, pending legal approval
- Governance review date
- Placeholder: 31 December 2026
AU-02
Privacy impact and AI risk assessment
- Public assessment summary
- Placeholder: privacy and AI risk summary not yet approved
- Assessment completion date
- Placeholder: 31 December 2026
- Next assessment review
- Placeholder: 31 December 2027
AU-03
Intended use and clinical safety
- Intended use
- Placeholder: clinician-controlled drafting of consultation documentation
- Excluded uses
- Placeholder: diagnosis, treatment recommendation, risk scoring, and autonomous decisions
- TGA classification status
- Placeholder: classification assessment pending
AU-04
Processors and subprocessors
- Approved processor list
- Placeholder: provider list pending contract review
- Model-training treatment
- Placeholder: no-training terms pending provider verification
- Subprocessor change notice
- Placeholder: 30 days before a material change
AU-05
Data residency and international transfers
- Primary application hosting region
- Placeholder: Azure Australia East
- Primary database region
- Placeholder: Azure Australia East
- AI processing locations
- Placeholder: countries pending provider verification
- Overseas disclosures
- Placeholder: recipient countries pending APP 8 assessment
AU-06
Australian privacy policy
- Privacy policy version
- Placeholder: version 0.1 draft
- Privacy policy effective date
- Placeholder: not yet effective
- Privacy enquiries
- Placeholder: privacy@mediscriber.invalid
AU-07
Terms, acceptable use, and clinical safety
- Terms version
- Placeholder: version 0.1 draft
- Terms effective date
- Placeholder: not yet effective
- Governing law
- Placeholder: Australian state or territory pending legal advice
- Clinical safety guidance version
- Placeholder: version 0.1 draft
AU-08
Collection notices
- Clinician collection notice
- Placeholder: version 0.1 draft
- Patient consultation notice
- Placeholder: version 0.1 draft
- Support collection notice
- Placeholder: version 0.1 draft
AU-09
Patient consent
- Consent notice version
- Placeholder: version 0.1 draft
- Accepted consent methods
- Placeholder: recorded verbal or written consent
- Refusal treatment
- Placeholder: recording does not start and care is unaffected
- Revocation treatment
- Placeholder: recording stops immediately
AU-10
Privacy and security claims
- Claim evidence review date
- Placeholder: 31 December 2026
- Approved claims register
- Placeholder: no compliance claims approved
- Next claim review
- Placeholder: before each material site release
AU-11
Cookies and tracking
- Essential cookie categories
- Placeholder: authentication, security, and interface settings
- Non-essential tracking
- Placeholder: disabled until an approved consent mechanism exists
- Cookie notice version
- Placeholder: version 0.1 draft
AU-12
Retention and deletion
- Raw audio retention
- Placeholder: not retained after transcription
- Consultation record retention
- Placeholder: customer-configured approved period
- Security log retention
- Placeholder: 12 months
- Backup retention
- Placeholder: 35 days
AU-13
Privacy rights and account lifecycle
- Privacy request channel
- Placeholder: privacy@mediscriber.invalid
- Target response period
- Placeholder: 30 calendar days or earlier when legally required
- Export format
- Placeholder: human-readable JSON and plain text
- Account closure process
- Placeholder: verified request workflow pending
AU-14
Audit and accountability records
- Audited events
- Placeholder: consent, access, generation, export, edit, deletion, and support access
- Audit log retention
- Placeholder: 24 months
- Customer audit access
- Placeholder: organisation audit view
AU-15
Security safeguards
- Transport encryption
- Placeholder: TLS 1.2 or later
- Storage encryption
- Placeholder: provider-managed encryption at rest
- Database network access
- Placeholder: private network only
- Last penetration test
- Placeholder: not yet completed
AU-16
Organisation access control
- Customer roles
- Placeholder: clinician, practice administrator, and audit reader
- Administrative MFA
- Placeholder: required
- Support access
- Placeholder: explicitly authorised, time-limited, and audited
AU-17
Telemetry and log minimisation
- Telemetry provider
- Placeholder: Sentry configuration pending contract approval
- Telemetry content exclusions
- Placeholder: clinical content, prompts, notes, bodies, headers, and user identity
- Telemetry retention
- Placeholder: 30 days
AU-18
Incident response and data breaches
- Security reporting channel
- Placeholder: security@mediscriber.invalid
- Incident response plan version
- Placeholder: version 0.1 draft
- NDB assessment target
- Placeholder: within 30 calendar days
- Last incident exercise
- Placeholder: not yet completed
AU-19
Backups and service continuity
- Recovery time objective
- Placeholder: 8 hours
- Recovery point objective
- Placeholder: 24 hours
- Backup location
- Placeholder: approved Australian Azure region
- Last restore test
- Placeholder: not yet completed
AU-20
Secure development and vulnerability management
- Vulnerability reporting
- Placeholder: security@mediscriber.invalid
- Security scanning
- Placeholder: dependency, secret, container, and code scanning
- Software bill of materials
- Placeholder: generated for each production release
- AI red-team status
- Placeholder: not yet completed
AU-21
Clinical review and provenance
- Document lifecycle states
- Placeholder: draft, reviewed, approved, and outdated
- Clinician sign-off
- Placeholder: required before final export
- Generation provenance
- Placeholder: provider, model, template version, source revision, and timestamp
AU-22
Patient and clinician education
- Patient explainer version
- Placeholder: version 0.1 draft
- Clinician guidance version
- Placeholder: version 0.1 draft
- Accessibility review
- Placeholder: not yet completed
- Consumer review
- Placeholder: not yet completed
AU-23
Evaluation and ongoing monitoring
- Supported clinical contexts
- Placeholder: Australian general practice consultations
- Evaluation populations
- Placeholder: accents, languages, audio conditions, and cohorts pending
- Safety review cadence
- Placeholder: quarterly and after material model changes
- Last model evaluation
- Placeholder: not yet approved
AU-24
Security and compliance transparency
- Public compliance record version
- Placeholder: version 0.1 draft
- Subprocessor register updated
- Placeholder: not yet published
- Published assurance documents
- Placeholder: none
- Next transparency review
- Placeholder: 31 December 2026
AU-25
External assurance
- ISO/IEC 27001 status
- Placeholder: not certified
- ISO/IEC 42001 status
- Placeholder: not certified
- SOC 2 status
- Placeholder: no report issued
- Assurance scope
- Placeholder: not defined