DictaMed legal
Privacy Policy
Effective 31 October 2026 ยท Australia
1. Scope and our role
This Privacy Policy explains how DictaMed handles personal information when registered health practitioners use our website and clinical documentation service. DictaMed provides temporary transcription and drafting tools to practitioners. The treating practitioner and their healthcare organisation remain responsible for the patient relationship, collection notices, consent, the official clinical record and lawful use of patient information.
2. Information we collect
We collect practitioner account details such as name, professional email, country, language, AHPRA registration number, plan and account-security records. When a practitioner uses the service, we process audio, dictated or pasted text, images or PDFs, generated drafts and corrections. Transcripts and drafts may contain patient names, dates of birth, addresses and other health information exactly as dictated or supplied by the practitioner. We also collect technical, usage, security, billing and support information needed to operate the service. DictaMed does not maintain a permanent patient demographic directory.
3. How we collect information
Information is provided directly by practitioners, generated through their use of DictaMed, or received from service providers such as authentication, hosting and payment providers. Practitioners must only submit patient information where they are authorised to do so and must provide any notice or obtain any consent required by law, professional standards or workplace policy.
4. Purposes of processing
We use information to verify and secure accounts; transcribe speech; organise clinical content into practitioner-selected note templates; extract text from documents; generate clinical notes; synchronise temporary drafts across approved devices; administer subscriptions; measure service usage and cost; prevent fraud or misuse; troubleshoot; respond to support requests; and comply with law. On the public homepage only, visitors may choose whether to allow Google Analytics to measure page visits. DictaMed does not load this analytics tag in the signed-in doctor workspace and does not send clinical content to Google Analytics. The homepage choice can be changed in the footer. We do not use patient health information for advertising.
5. Audio, transcripts, drafts and automatic deletion
Audio is transmitted to a speech provider for transcription. DictaMed does not write audio to its database and discards its in-process copy after transcription. A provider may retain submitted content in security or abuse-monitoring logs for the period stated in its published terms. Full transcripts and clinical drafts, including any identifiers dictated by the practitioner, are encrypted and scheduled for automatic deletion no later than 24 hours after creation. A practitioner may delete them sooner. DictaMed is not the official medical record or a backup service: practitioners must review and copy the final content into their authorised clinical system before it expires. Operational backups and security logs may have limited technical retention where required for security and service integrity.
6. Disclosure and service providers
We disclose information only as needed to operate DictaMed, to the practitioner or organisation controlling the account, with consent, or where required or authorised by law. Providers may include cloud hosting and databases, artificial-intelligence and speech-processing services, email delivery, payments, monitoring and professional advisers. If a public homepage visitor allows analytics, Google Analytics receives a page-view event and may use browser identifiers or cookies for measurement; optional advertising signals and enhanced measurement are disabled. Providers receive information required to perform their function and handle it under their service terms, privacy commitments and security controls. We do not sell patient information. Payment-card details are collected and handled by Stripe and are not stored by DictaMed.
7. Overseas processing
DictaMed is currently hosted outside Australia and some technology providers process or support information outside Australia, including in the United States and other locations in which they operate. Users should assume that cross-border processing occurs unless DictaMed expressly identifies an Australian-region configuration for a specific service. DictaMed applies technical safeguards and reviews provider security and privacy information. Practitioners and healthcare organisations must determine whether their workplace or jurisdiction imposes additional data-location requirements before using the service.
8. Security
DictaMed uses encrypted network transport, encryption for temporary clinical drafts at rest, access controls, hashed passcodes, session expiry, attempt limits, restricted administrative access and audit-oriented usage metadata. No online service can guarantee absolute security. Practitioners must secure their devices and email accounts, avoid shared accounts and immediately report suspected unauthorised access.
9. Access, correction and account choices
Practitioners can review or update available profile settings, delete temporary drafts and end connected sessions. Requests to access or correct other account information may be sent to joedmiso@pharmacia.com.au. Patient requests relating to the official health record should ordinarily be directed to the treating practitioner or healthcare organisation. We may need to verify identity before acting on a request.
10. Retention of non-clinical information
Account, subscription, security, consent and transaction records are retained for as long as reasonably required to provide the service, meet legal and accounting obligations, resolve disputes and protect the service. We delete or de-identify information when it is no longer reasonably needed, subject to lawful retention requirements.
11. Data incidents and complaints
Suspected privacy or security incidents should be reported promptly to joedmiso@pharmacia.com.au. We will assess and respond to incidents, including notification to affected individuals and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it. Privacy complaints will be acknowledged, investigated and answered within a reasonable period. If unresolved, a person may contact the OAIC at oaic.gov.au.
12. Children, changes and contact
DictaMed accounts are for authorised health practitioners and are not offered directly to children. We may update this policy when the service, providers or legal requirements change. Material changes will be communicated through the service or by email. Privacy enquiries, access or correction requests and complaints: joedmiso@pharmacia.com.au.