Privacy Policy
Diagnify Intake · Effective date: 10 November 2026
1. Who we are
Diagnify Intake is run by Arundhati Health Services Pty Ltd (ABN 72 689 330 372), trading as Diagnify ("we", "us"). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Contact us about privacy at clinical@diagnify.ai.
2. Your practice and us: who does what
- Your practice (your clinic, GP or other health service) sends you the intake. It is the health service provider and the main holder of your health record. It decides why your information is collected and how it is used in your care.
- We run the software that asks the questions, records the answers and drafts a note for your practice. We handle patient information on behalf of your practice, to provide this service.
- We are also responsible ourselves for the account, billing and contact details of practices and their staff.
Your practice has its own privacy policy. You can ask your practice for it.
3. What we collect
About patients
- Details your practice enters: your name, date of birth, mobile number, and, if added, the reason for your visit and your appointment time.
- Your answers: what you tell the intake about your health, symptoms, medicines, allergies and history. This is health information, which the law treats as sensitive.
- Your voice: what you say on the call is sent to speech-to-text so it can be written down. We keep a written transcript of the call.
- A call recording, only if you agree when asked (see section 5).
- For a child under 14: the name of the parent or guardian and their relationship to the child.
- Technical details: to keep your link safe it works in one browser only, and our server keeps standard logs of visits (such as IP address and time).
About practices and their staff
- Name, email address, mobile, practice name, phone and address, and professional details you choose to give us.
- Sign-in details. Passwords are stored only in scrambled (hashed) form.
- Credit and payment history. Card details are handled by Stripe; we keep only Stripe's reference numbers, not the card number.
- A record of actions in the account (for example who viewed, copied, exported or deleted an intake).
4. How we collect it
We get your contact details from your practice. We get your answers from you (or your parent or guardian) when you do the intake. Your practice has asked you to do it; you choose whether to start. Taking part means you consent to us collecting your health information for your practice.
You can stop at any time. If you do not do the intake, your doctor will not have your answers before your visit.
You cannot use the intake without giving your name, because your doctor needs to know whose answers they are.
5. Call recordings
- Near the start of a voice call, the intake asks: "This call is recorded for your doctor. Is that OK?"
- If you say no, the recording is not kept and the intake carries on as normal. Only the written transcript and answers are kept.
- If you say yes, the recording is saved in encrypted form for your practice to listen to.
- Recordings are deleted after 90 days, or sooner if your practice deletes the intake.
6. Why we use it
- To send you the link by SMS and remind you.
- To run the intake and ask follow-up questions that fit your answers.
- To write a draft note and decision-support material for your practice's clinicians.
- To keep the service secure, keep an audit trail, fix faults and check it works properly.
- For practices: to run accounts, take payments and send account emails.
We do not use patient information for marketing. We do not sell personal information.
7. Use of AI
The intake uses AI software to talk with you, turn speech into text and draft a note. The note is a draft for your clinician. It is not a diagnosis and it does not give you medical advice. Your clinician reads it and makes every decision about your care. The intake is not checked straight away. In an emergency call 000.
8. Who can see it
- Your practice. The doctor the intake is for can see it. Practice admins and reception staff at the same practice can also see it, to help manage appointments. No other practice can see it.
- Our staff. A small number of authorised Diagnify technical staff can access our systems to run, secure and fix the service.
- Service providers who help us run the service (section 9).
- Others where the law requires or allows it, for example a court order, or to lessen a serious threat to someone's life, health or safety.
9. Service providers and overseas disclosure
Our main server and database are in a data centre in Sydney, Australia. To make the service work, some information is sent to service providers. Some are outside Australia. The providers we use now include:
| Provider | What it does and what it gets | Where |
|---|---|---|
| Vultr | Hosts our server, database, recordings and backups | Australia (Sydney) |
| Amazon Web Services (Bedrock) | AI that drafts the note and assessment from your answers | Australia |
| Google (Gemini) | AI that runs the conversation and helps draft the note. Gets your answers and the transcript | United States, and other countries where Google processes data |
| Lithos AI | AI that helps prepare clinical material from your answers | Outside Australia (we are confirming the country) |
| Deepgram | Turns your voice into text. Gets the call audio | United States |
| Fish Audio | Turns the intake's questions into a spoken voice | Outside Australia (we are confirming the country) |
| LiveKit | Carries the live voice call between you and the intake | United States company; servers may be in Australia or overseas |
| Exa, Voyage AI, US National Library of Medicine (PubMed) | Search tools that find medical guidelines. Get search words based on the symptoms | United States |
| Telnyx | Sends SMS. Gets your mobile number and the message (with your doctor's and practice's names and your link) | United States |
| Pydantic (Logfire) | Technical logs about speed and errors | United States |
| Resend | Sends account emails to practice staff (sign-up codes, password resets, alerts) | United States |
| Stripe | Takes card payments from practices | Australia and United States |
| Google (Places) | Looks up the practice address while staff type it | United States |
Information is encrypted while it travels to these providers. We choose providers who say they protect information, but overseas providers may not be bound by the Australian Privacy Principles, and you may not be able to seek redress under Australian law against them. By doing the intake, you consent to this overseas disclosure. If you do not want this, do not start the intake and talk to your practice instead. We will update this list when providers change.
10. How we keep it safe
- Patient details, answers, transcripts and notes are encrypted in our main database (AES-256-GCM).
- Call recordings are stored as encrypted files (AES-GCM) on the Sydney server, which only the system can read.
- Some working copies used while an intake is being processed are held on the same Sydney server behind access controls, but are not separately encrypted.
- All traffic uses encrypted connections (HTTPS).
- Every practice user signs in with a password and a second step. Each person only sees what their role allows.
- Every view, copy, export and delete of an intake is written to an audit log.
- Patient links work in one browser only and expire after a set time (usually 48 hours; your practice can choose 24 hours or 7 days).
- Nightly backups of the main database are kept on the same Sydney server for 14 days.
11. How long we keep it
- Call recordings: deleted after 90 days, or sooner if the practice deletes the intake.
- Intake details, answers, transcripts and notes: kept for the practice until the practice deletes them. Your practice should copy what it needs into its own medical record.
- When a practice deletes an intake: it disappears from the practice's screens and the patient link stops working straight away. Its recording is deleted within a day. Encrypted copies of the details, answers and note stay in our database until they are removed permanently. Right now, permanent removal is done on request: email clinical@diagnify.ai.
- Demo intakes (not real patients): deleted after 24 hours.
- Backups: each backup is deleted after 14 days.
- Practice accounts: kept while the account is open. A practice can ask us to delete its account and data.
When we no longer need information and the law does not require us to keep it, we delete it or remove anything that identifies you.
12. Seeing or correcting your information
You can ask to see the information we hold about you, or ask us to correct it. As your practice holds your health record, the quickest way is to ask your practice. You can also email us at clinical@diagnify.ai. We will check who you are, work with your practice, and reply within 30 days. We do not charge you to ask. If we say no, we will tell you why in writing and how to complain.
13. Complaints
If you are unhappy with how your information was handled, tell us first at clinical@diagnify.ai. We will reply within 30 days.
If you are not happy with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au or 1300 363 992. You can also contact the health complaints body in your state or territory.
14. Data breaches
We follow the Notifiable Data Breaches scheme in the Privacy Act 1988. If a data breach is likely to cause serious harm, we will tell the people affected, your practice and the OAIC as the law requires.
15. State and territory health records laws
Some states and territories have their own health records laws, such as the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT). Where these apply to your practice or to us, we handle health information in line with them too.
16. Cookies
We use only the cookies needed to make the service work: keeping practice staff signed in, remembering a trusted device, and keeping a patient link to one browser. We do not use advertising or tracking cookies.
17. Changes to this policy
We will update this policy when our service or providers change. The date at the top shows when it last changed.
18. Contact
Arundhati Health Services Pty Ltd, trading as Diagnify · ABN 72 689 330 372
Email: clinical@diagnify.ai
See also our Terms of Use.