General information only. This guide is not legal, clinical or privacy advice. Laws and professional duties depend on the organisation, location, patient, purpose and service. Get advice from a qualified Australian professional for your facts.
Trace the whole path
A cloud transcription service usually captures audio on a phone or computer, sends it to a speech service, passes text to another model, stores some combination of audio, transcript and note, then returns the result.
Those steps may use different companies and countries. An Australian business can use overseas infrastructure. “Hosted in Australia” may describe storage while processing or support happens elsewhere. It may also be accurate for the whole path. The contract and sub-processor list are where the answer lives.
Four questions for the vendor
- Where is each data type processed and stored? Ask separately about audio, transcript, generated note, backups and logs.
- Which other providers can access it? Ask for speech, language-model, hosting, support, analytics and security sub-processors.
- Can any content be used to train or improve a model? Check defaults, opt-outs and the binding terms, not only the marketing page.
- How long is each copy kept? Ask about the live system, backups, support copies and deletion after the account ends.
Ask in writing. Keep the response with the product assessment and review it when the vendor or workflow changes.
What Australian privacy law may ask
Private health service providers are among the small businesses that can be covered by the Privacy Act 1988 regardless of the usual turnover threshold. Coverage and exemptions still need to be checked for the actual entity and activity. In NSW, the Health Records and Information Privacy Act 2002 can add another, fact-specific layer.
Where APP 8 applies to a disclosure to an overseas recipient, the organisation generally needs to take reasonable steps before disclosure and can remain accountable for the recipient's handling under section 16C. Exceptions exist, and technical routing through another country is not always the same thing as disclosure. Get advice on the real arrangement rather than treating geography as the only test.
APP 5 may also require a clear collection notice, including likely overseas disclosures where applicable. APP 11 keeps security and deletion in view.
Recording consent is separate
Keeping audio in Australia does not remove recording law or professional consent duties. Rules differ across states and territories and can involve Commonwealth telecommunications law as well.
LocallyAI's conservative operating default is express consent from every principal participant before recording starts. Explain who is recording, the purpose, outputs, access, retention and any outside service. Offer a non-recording option and record the consent lawfully. Ahpra's AI guidance for health practitioners also stresses informed consent and recording the patient's response.
What local processing changes
A local transcription path can keep the audio, transcript and model inference on the practice's appliance. For that specific path, there may be no overseas recipient receiving the material. Other obligations remain: authority, notice, consent, access, accuracy, retention, security, backup and incident response.
Local does not mean no connection in every mode. Web research, updates, an external integration, remote support and off-site fine-tuning are separate exceptions. Each enabled path needs its own data-flow record.
This is a plain description of where the work happens of where the work happens. What your own configuration does, and any exception you have chosen, is named in your quote and setup record — see the full feature list.
A short review list
- Purpose
- Why is recording or transcription needed, and is AI suitable for that job?
- Consent
- Who was told, what did they agree to, and where is that recorded?
- Countries
- Processing, storage, support and backup locations confirmed separately.
- Providers
- Vendor and sub-processor list kept with the assessment.
- Training
- Contract position on model training and service improvement checked.
- Retention
- Audio, transcript, note, logs and backups each have an approved period.
- Review
- Important transcript passages and generated notes checked by a qualified person.
LocallyAI can explain its technical data flow. A privacy lawyer, health-law adviser, insurer or professional body should answer how the rules apply to a particular practice.