Australia: privacy and data handling
Information for Australian practices considering Briefly. Our security page is the authoritative description of technical controls; this page explains the regional context.
Information last reviewed:
What Briefly is—and is not
Briefly is a productivity tool for preparing clinical correspondence. It supports clinician review and does not replace clinical judgement or an electronic health record.
Clinical correspondence remains subject to clinician approval. Using Briefly does not by itself establish that a practice has met every legal or professional obligation.
Where information is stored and processed
Clinical recordings and letters are stored in Australia. Contact the Briefly team to discuss your practice’s data-handling requirements.
Storage and processing are different. Australian storage does not mean that every processing activity takes place in Australia. Transcription and correspondence preparation use third-party processing services.
Before enabling access, discuss cross-border processing and your practice’s requirements with us. Request current subprocessor and contractual documentation through the Briefly team, and read the shared data-handling information.
Retention and deletion
Clinical recordings and letters are deleted from Briefly on a daily schedule under a 30-day retention period and can be deleted from 28 days after creation. Export approved correspondence to the electronic health record for ongoing care.
The workspace deletion period does not replace a practice’s medical-record retention obligations. See security and data handling for backup deletion and the scope of the controls.
Patient data is not used for model training.
Clinician review and patient consent
Source-linked context and review flags support inspection of a draft. They do not establish that its content is correct or complete. Review and approve correspondence before release.
Explain the use of Briefly and the handling of information to the patient, obtain informed consent before recording, and document consent in accordance with your practice policy and applicable requirements. Briefly’s consent workflow supports this process.
AHPRA’s professional guidance describes practitioner responsibilities; it is not product endorsement. See the official guidance on using technology in healthcare.
Access controls and audit history
Practice-scoped access, permissions and access logging support accountable use. The security page describes authentication, access controls and audit history. Your practice manages who is authorised to use its workspace.
Incident and breach response
Under the Notifiable Data Breaches scheme, suspected eligible breaches must be assessed reasonably and expeditiously. Entities must take all reasonable steps to complete that assessment within 30 calendar days of becoming aware of grounds to suspect an eligible breach.
Once there are reasonable grounds to believe an eligible breach has occurred, the Commissioner and affected individuals at risk of serious harm must be notified as soon as practicable. The assessment period is not a waiting period for notification.
Report a suspected security incident to security@briefly.health. Applicable notification responsibilities and communication arrangements should be addressed in the practice’s agreement with Briefly. Read the OAIC guidance on assessment and notification.
Applicable Australian guidance
- Privacy Act 1988 and Australian Privacy Principles: collection, use, disclosure, security, access and correction.
- Notifiable Data Breaches scheme: assessment and notification of eligible breaches.
- Health Records Act 2001 (Vic): Victorian health-information requirements, rather than a national framework.
- AHPRA professional guidance: accountability, informed consent, transparency and understanding a tool’s limitations.
Requirements depend on the practice, jurisdiction and circumstances. Other state and territory requirements may also apply.
Request security or contractual documentation
Contact the Briefly team for current independent assurance documentation and its scope.
We can discuss your practice’s requirements before access is enabled. Request documentation, read the security information, or review the privacy policy.