Privacy Policy

Last updated: 26 October 2026

1. About this policy

This policy applies to MYPAL HEALTH PTY LTD (ABN 40 653 315 176), referred to as "MyPal", "we" or "us". It covers MyPal Scribe, the clinician app at scribe.mypalhealth.com.au, and this website.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We treat health information as sensitive information and give it the higher level of protection the law requires.

MyPal Scribe is an administrative documentation tool for healthcare practitioners. With the patient's consent, it transcribes a consultation and drafts a clinical note for the clinician to review, edit and approve. It includes the MyPal AI Administrative Assistant, which drafts correspondence and tasks, finds the clinician's past MyPal records, and tracks follow-up items.

2. Our role and the clinician's role

Clinicians use MyPal Scribe to help document the care they provide. The clinician, or their practice, decides when to use MyPal and is responsible for their own privacy obligations to their patients, including telling patients about MyPal and obtaining their consent.

MyPal handles patient information on the clinician's behalf, to provide the service the clinician uses. We use it only as described in this policy.

Patients who have questions about their health record should contact their clinician or practice first. We will help the clinician respond.

3. Information we collect

About clinicians

• Account details: name, email address, profession, and, if you provide them, your AHPRA number and mobile number. We also ask how you heard about MyPal.
• Profile: details you add to My Profile, such as your speciality, focus areas and a short description of your practice.
• Sign-in information: your password (stored only in hashed form), multi-factor authentication settings, and, if you choose to sign in with Google, your Google account email and identifier.
• Billing: your plan and subscription status. Stripe collects and holds your card details. MyPal does not see or store your full card number.
• Usage and security records: sign-ins, failed sign-ins, the actions you take in the service, IP address, browser type, and technical error data.
• Note-style preferences: the preferences MyPal learns from your own edits and feedback.
• Messages to us: anything you send us by email or through the website.

About patients, through clinicians

• Consultation audio: processed in memory to create a transcript. Audio is not stored.
• Transcripts: the text of the consultation.
• Notes and documents: draft and approved notes, letters, tasks and other documents created in MyPal.
• Information the clinician enters: for example a patient's name, details of the consultation, or other context the clinician adds.

This information can include health information and other sensitive information about patients.

4. How we collect it

• From clinicians directly, when they sign up, set up their profile, use MyPal Scribe or contact us.
• From the consultation, when a clinician starts a session after obtaining the patient's consent.
• From Google, if a clinician chooses to sign in with Google.
• From Stripe, which tells us whether a subscription is active and whether a payment succeeded.
• Automatically, through the security and error records our systems keep when the service is used.

5. How we use it

We use personal information to:

• transcribe consultations and draft notes and documents for the clinician;
• run the MyPal AI Administrative Assistant for the clinician;
• store each clinician's sessions and records so they can return to them;
• adapt drafts to each clinician's own note style;
• create and manage accounts, verify email addresses and send account emails;
• process subscriptions and payments;
• keep the service secure, detect misuse, and investigate and fix faults;
• respond to questions, support requests and complaints;
• meet our legal obligations.

We use health information only to provide MyPal Scribe to the clinician, or where the law requires or allows it.

We send clinicians emails about their account, such as verification, password, security and billing emails. These go out while the account is open.

We may also email clinicians about MyPal and related offers. Every such email has an Unsubscribe link, and unsubscribing takes effect straight away. You can also ask us to stop by contacting us.

6. AI and personalisation

MyPal uses AI models from Anthropic (Claude), run through Amazon Bedrock in Australia, to draft notes and run the administrative assistant. Speech-to-text runs on MyPal's own server in Sydney.

We do not use patient or clinician information to train AI models. Amazon Bedrock does not use the content we send it to train models.

Personalisation is limited to each clinician's own note-style preferences, learned from that clinician's edits and feedback. One clinician's preferences are used only for that clinician.

Every draft is reviewed, edited and approved by the clinician before it is used.

7. Who we share it with

We do not sell personal information. We share it only with the service providers below, who process it for us to run MyPal, or where the law requires it.

Services that handle health information

Services for clinician accounts

Our service providers may use personal information only to provide their services to MyPal.

We may also disclose personal information where the law requires or allows it, for example to comply with a court order, or to lessen a serious threat to someone's life, health or safety.

If MyPal's business is sold or restructured, personal information may pass to the new owner, who must handle it in line with this policy.

8. Where it is stored

Health information is stored and processed in Australia. MyPal Scribe is hosted on Amazon Web Services in Sydney. The AI that drafts notes runs on Amazon Bedrock in Australian regions, and speech-to-text runs on MyPal's own server in Sydney.

Some clinician account information is handled by Stripe, Google and Sentry, which may process it in the United States and other countries. Stripe handles billing details, and Google handles sign-in details for clinicians who choose to sign in with Google. Sentry receives technical error details only, such as the error message and the part of the service involved. Error reports carry no audio, transcripts, notes or patient details.

We take reasonable steps to make sure these providers handle the information in line with the Australian Privacy Principles.

9. How we protect it

• All connections to MyPal are encrypted (HTTPS, TLS 1.2 or higher).
• The database, backups and server storage are encrypted at rest.
• The database and the speech-to-text server sit in private networks.
• Clinicians sign in with a password and multi-factor authentication, or with Google. Passwords are stored only in hashed form. Sessions time out after a period of inactivity.
• Each clinician can access only their own sessions and records.
• Access to our systems is limited to the people who need it, and administrative access is protected by multi-factor authentication.
• We keep audit logs of sign-ins and key actions, and we monitor our systems for security threats.

Clinicians help keep information safe by protecting their password and devices and signing out on shared computers.

10. How long we keep it

• Audio is processed in memory only and is not stored.
• Transcripts, notes and documents are kept to provide the service and as the clinician's own record, until the clinician deletes them.
• Deleted sessions are removed from the service. Copies remain in our nightly backups.
• Backups are encrypted, stored in Sydney and write-protected, so they cannot be changed or deleted by mistake. We keep them long-term, currently up to 99 years, so records can be recovered if something goes wrong.
• Closed accounts: when an account is closed, sign-in is switched off straight away and the clinician can no longer see its records. We keep the account's information and records securely for audit and legal purposes. If the clinician registers again, the new account starts empty.
• Cancelled plans: cancelling a paid plan does not close the account. The clinician's records stay available in MyPal Scribe.

Clinicians are responsible for keeping their clinical records for the periods their state or territory requires. MyPal is a documentation tool: approved notes belong in the clinician's own clinical system.

11. Access and correction

You can ask us for access to the personal information we hold about you, or ask us to correct it. Clinicians can view and update most of their account and profile details in MyPal Scribe.

Patients should contact their clinician or practice first, since the clinician controls the patient's record. If you contact us directly, we will work with the clinician to respond.

We will respond within 30 days. We may need to confirm your identity first. If we refuse a request, we will tell you why in writing and how to complain.

12. Data breaches

We have a plan for responding to data breaches. If we suspect a breach, we act quickly to contain it and assess the risk of harm.

Under the Notifiable Data Breaches scheme, if a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and the people affected. We will also tell the clinicians whose patients are affected, so they can meet their own obligations.

13. Cookies and browser storage

This website uses no analytics or advertising cookies. It loads fonts from Google Fonts, which receives your IP address and browser details when it sends the fonts.

When you set up a paid plan, the payment step loads Stripe, which may set its own cookies to process the payment and prevent fraud.

MyPal Scribe stores sign-in information in your browser to keep you signed in.

14. Complaints

If you have a concern about how we have handled personal information, please contact us using the details below. We will acknowledge your complaint, look into it and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992

15. Changes to this policy

We may update this policy as MyPal changes or the law changes. We will publish the new version on this page with a new date. If a change significantly affects how we handle personal information, we will email clinicians before it takes effect.

16. Contact us

Privacy and security contact
MYPAL HEALTH PTY LTD, ABN 40 653 315 176
[email protected]