Privacy Policy

1.Who this policy covers

Medervia is a software platform used by Australian clinics and practices to prepare, send, record and retain medical administrative documents. Medervia is a business name of Medviax Pty Ltd (ABN 65 702 830 135); “we” and “us” in this policy mean Medviax Pty Ltd. This policy describes how we handle personal information and health information, including information about patients that reaches us through a clinic using the platform.

Australian privacy law does not divide organisations into controllers and processors. A clinic and a platform can both hold the same health information, and both can be accountable for it. This policy is written on the basis that Medervia is directly responsible for the information it holds, in addition to whatever obligations the clinic has to its own patients. Where a clinic's own privacy policy governs the clinical relationship, this policy governs the platform.

In this policy, “you” means whoever is reading it: a clinic user with a Medervia account, or a patient who has received a document or link from a clinic using Medervia.

2.How a clinic's records are held

Today every clinic uses Medervia standalone: we store the patient information needed to produce and retain the documents the clinic asks for. This does not require the clinic to have any other software.

Medervia is designed to also work connected to a clinic's practice management software, where that software remains the record and we would keep only the identifiers its vendor issues rather than patients' details. Connected mode is not available yet; we are in negotiation with practice management software providers. If a clinic later chooses it, this policy will describe what changes before it applies.

3.What information we collect

For clinic users, we collect the information needed to run an account: name, work email address, the clinic, role and permissions within that clinic, and a record of changes made in the platform. Depending on what the clinic uses, this also includes practitioners' professional details (such as provider and Ahpra registration numbers), the clinic's own address book of patients, practitioners and organisations, messages between members of a clinic, support tickets and any screenshots attached to them, and, for a member who turns on notifications, an address for each of their devices.

Only to the extent the clinic's chosen documents require it, we collect information about patients. For an assignment of benefit agreement this can include the patient's name, date of birth, contact details, Medicare card number and individual reference number, the service the agreement covers, and the fact and time of the patient's acceptance.

A clinic can also build its own forms, such as a medical history questionnaire, an admission form or a consent, and send them through Medervia. The answers can include health information. A form may go to a patient, who answers about themselves, or, where a clinic sends a form about a patient to another practitioner, to that practitioner, who answers about the patient. The recipient sees only the patient details the clinic chose to show. Completed answers and the resulting document are kept for the retention period the clinic chose for that form, and answers to a form that is withdrawn or never finished are deleted. A form can also carry a patient details section; details a patient or a new patient types into it may be added to the clinic's patient records once a member of the clinic reviews and accepts them, and are otherwise discarded if nobody does.

Date of birth deserves a specific mention, because it is not collected merely to identify someone. Some retention periods that apply to health information in Australia run until a patient reaches a particular age. Without a date of birth we cannot tell when we are required to keep a record, or when we are required to destroy it.

We also collect technical information: delivery records, including when a document was sent, whether it was delivered, and when it was opened, and the network information ordinarily recorded when a page is requested. On our website and throughout Medervia, including the patient portal, we use Vercel Web Analytics, which counts page views, and Vercel Speed Insights, which measures how quickly pages load. Both work without cookies and without identifying a visitor, and neither is ever loaded in a reveal room.

We do not collect government-related identifiers beyond those a document legally requires. Patients do not set a password: when a patient signs in with a code sent to their email address, we keep a sign-in record for that address and nothing else about them beyond what their clinic sent. Someone who works at a clinic and is also a patient at the same address signs in to their patient portal separately, and we record that sign-in as a patient's, so that it reaches nothing of any clinic.

Where a clinic uses Rooms, we record which of its staff, practitioners, patients and carers it has placed in which of its rooms. Patients and carers are taken out of every room every night, and the clinic's audit trail keeps the fact that they were placed. A form or agreement completed in a room records the room, who handed it out and the names of the people placed in the room at the time, and these are printed on the document. A tablet a clinic pairs to a room has no account; we record when it was paired and when it was last seen.

Where a clinic uses Handbook, we record about its staff when a person was asked to read a procedure and the reminders sent, when they acknowledged it (their name, the version they read and the time), who excused them and the reason if they are excused, and for a daily checklist which days it applied, which steps were ticked and whether each day was finished. Nothing is scored or ranked, and time spent reading is not measured. Pictures a clinic adds to a procedure are kept in private storage. A person sees their own records; the clinic's owners and admins see everyone's; other colleagues and our staff see none.

Where a clinic sends texts, we use the mobile number in the patient's record, and only when the record says the patient takes texts. For each text we keep when it was sent, which clinic sent it, the number it went to and whether it was delivered; the text itself says only what the clinic's message says, never what is waiting. A patient who opens a text's link, or asks for a sign-in code by text, can see only what the clinic that texted them sent.

A guest in a reveal room gives us a display name and, if they choose, their relationship to the person whose reveal it is. Both are shown to the other people in that room and to nobody else, and both are deleted when the room closes, at most 30 days after the reveal. A guest has no account with us, gives us no email address, and is not tracked: no analytics or third-party script runs on a reveal room page.

4.How and why we use it

We use the information to do the thing the clinic asked for and to keep the record of having done it: producing a document, sending it to the person it is for, recording their response, storing the result for its retention period, and being able to produce that record if it is later requested for compliance or audit purposes.

A guiding principle of the platform is that each recipient receives only what they need. Each patient receives their own request and sees nothing about anyone else, and where a clinic sends a form about a patient to another practitioner, that practitioner sees only the patient details the clinic chose to show.

We use aggregate, de-identified information about how the platform is used to operate and improve it. We record which apps signed-in users view and add to their cart in the marketplace, keep that for thirteen months after an app's last event, and report it only as counts. We do not use patient information to train machine learning models, and we do not sell personal information to anyone, ever.

5.Email, and what we will not send

Messages Medervia sends to patients on a clinic's behalf are transactional: the document, the link, the confirmation, the copy. They identify Medervia as the platform that sent them, because you are entitled to know that, but they do not advertise Medervia. We do not put offers, feature announcements or customer counts in a message sent to a patient.

We do not send patients marketing email. We do not send reminders or follow-ups about a scheduled reveal. Where a clinic user has an account with us, we may send them service messages about the platform, and they can opt out of anything that is not essential to the operation of their account.

6.Who we disclose information to

We disclose information to the clinic that put it into the platform, and to the person a document is addressed to. Beyond that, we use a small number of service providers to run the platform: Supabase for the database and file storage, Vercel for hosting, Resend to send email, ClickSend to send the texts a clinic chooses to send as well as an email, Stripe to process clinic subscriptions (it receives nothing about patients), Cloudflare to tell people from automated programs where someone signs in or writes to us, Anthropic to draft text when someone in a clinic uses Ask AI, and the push services of browser makers for notifications. They handle information only to provide those services to us. When a clinic starts an app's free period, we may also ask the Australian Business Register whether the clinic's ABN is active; it receives the ABN and nothing else.

We may disclose information where we are required or authorised by law to do so, including to a regulator exercising a lawful power. If we are ever compelled to disclose information about a clinic's patients, we will tell the clinic unless we are prohibited from doing so.

We do not disclose personal information to advertisers, data brokers or analytics products that would take it outside our control.

7.Where information is stored

Medervia's database and document storage, and the servers that run the app, are located in Australia, in the Sydney region. Australian law does not, in general, prohibit a private provider from storing health information overseas, but the health records legislation of New South Wales and Victoria restricts transferring health information outside those states, which is a stronger constraint than a national one and points to the same answer. Storing in Sydney is a deliberate choice, not an incident of infrastructure.

Where a service provider we rely on processes information outside Australia, we remain accountable for what that provider does with it as though we had done it ourselves, and we name the provider and the countries here. Six do so today. Email is sent by Resend, Inc.: a message leaves from Japan, and the record of having sent it, including the addresses and the delivery events, is held in the United States. A message carries what the clinic asked us to send and nothing more. Billing is processed by Stripe, Inc. in the United States: the clinic's name, its reply-to address as the billing email, its billing address, ABN and invoice history are held there; card numbers and bank account details are entered on Stripe's pages and never reach Medervia. Stripe holds nothing about patients. Where a clinic sends a patient a text as well as an email, the text is sent by ClickSend, part of the Sinch group: the message and the mobile number are held in Australia, and ClickSend's own service providers may access them outside Australia, for monitoring and debugging in North America and for support and development by Sinch companies in Sweden, the Philippines and the United States. A text carries the clinic's name, one sentence saying that something is waiting and a link to Medervia; it never names the patient, the practitioner or what the document is. ClickSend keeps a text for four months, and a record of having sent it, without its words, for up to two years. When a clinic member turns on notifications on a device, each notification is delivered through the push service of the company that makes that device's browser (Apple, Google, Microsoft or Mozilla), which may process it outside Australia, including in the United States. A push carries the clinic's name and one sentence saying what kind of thing happened, such as "A form was completed"; it never names a patient or any other person, and the detail is only shown in Medervia after the notification is opened. Where someone asks for a sign-in code, opens a reveal room's door or sends our contact form, Cloudflare, Inc. checks that a person is there with its Turnstile service, which may process the browser's network address and technical signals outside Australia, including in the United States; it receives no name, email address or message, and it is not loaded once a guest is inside a reveal room. When someone in a clinic uses Ask AI to draft part of a form, a procedure or a welcome letter, what they type and the clinic's own words around it (the clinic's name, email and locations with their phone numbers, the form's name, the titles of its other procedures) are sent to Anthropic, PBC, whose Claude models write the draft, and which may process them in the United States or elsewhere outside Australia. A patient's details are never sent: Ask AI is given no patient record, answer or document, and is asked never to write a real person's details. Anthropic keeps what it receives for a limited period to provide the service and to detect misuse, and does not use it to train its models. The draft comes back to the person who asked, who decides whether to use it; a clinic's owner or admin can turn Ask AI off in the clinic's settings. We will add any further provider to this paragraph before it handles information, not after.

A clinic may also connect its own AI tool, such as Claude, to Medervia, once an owner or admin has turned AI connectors on. The tool is the clinic's choice and its provider is the clinic's, not ours: it acts as the person who connected it, for one clinic, and can see only the clinic's forms and form templates and create draft forms, and, where the clinic uses Handbook, list, search and read its procedures and create draft ones. It cannot see patients, their answers or their documents, nor who has acknowledged a procedure or ticked a checklist, and it cannot publish or send anything. Whatever the person asks the tool, and what Medervia returns to it, goes to that tool's provider, which may be outside Australia. Any member can see who has connected a tool, and a connection can be ended at any time in the clinic's settings.

8.Our service providers, in their own words

Each provider below publishes its own privacy policy and, where it has one, the list of companies it relies on in turn. We link to them rather than summarise them, so you can read what each says about itself.

• •Supabase, the database, file storage and sign-in, in Sydney: privacy policy, sub-processors.
• •Vercel, hosting and the page counts and speed measurements, in Sydney: privacy policy, sub-processors, how its analytics treat visitors.
• •Resend, email: privacy policy, sub-processors.
• •ClickSend, texts: privacy policy, sub-processors and where each one is.
• •Stripe, clinic subscriptions: privacy policy, service providers.
• •Anthropic, Ask AI's drafts: privacy policy, commercial terms.
• •Cloudflare Turnstile, the check that a person is there: Turnstile privacy addendum, sub-processors.
• •The push services of browser makers, for notifications on a device: Apple, Google, Microsoft, Mozilla.
• •The Australian Business Register, asked whether a clinic's ABN is active: privacy statement.

9.How we protect it

Medervia is designed with Australian healthcare privacy expectations in mind. Information is encrypted in transit and at rest. Stored documents are held in private storage and opened only through links that expire after ten minutes. Access to a clinic's information is restricted to that clinic and enforced by the database as well as in application code. Every change to a clinic's records is written to the clinic's audit trail, and each request's sending, delivery, opening and outcome are recorded; ordinary reading of records inside a clinic is not logged.

Sign-in is by a code sent to the person's email address; there are no passwords. Links in emails carry their own random, expiring tokens, and knowing a record's identifier never grants access to it. Our security page describes these controls in more detail.

No system is immune from compromise, and we do not claim that ours is. Medervia is also a tool rather than a substitute for a practice's own policies, staff training or professional advice.

10.How long we keep it, and when we destroy it

Keeping information indefinitely is not a safe default. It is a breach. Australian privacy law requires personal information to be destroyed or de-identified once it is no longer needed for any purpose for which it may be used or disclosed, and no Australian law requires it to be retained.

It follows that retention is set per record type and per jurisdiction rather than as one period for everything. Records evidencing an assignment of benefit are subject to a Commonwealth record-keeping requirement measured in years from the service. Health information held about a patient in Victoria, New South Wales and the Australian Capital Territory is subject to a longer period, measured as the later of a fixed number of years after the last service and the patient reaching a particular age. Where more than one applies to the same record, the longest applicable period is used.

Medervia works out a retention date for each record and shows the clinic when records are due for review. Destroying a record is a decision an owner or administrator of the clinic makes, with a reason. Some information is deleted automatically: a reveal's result and its keepsake 30 days after the reveal, the answers to a form that is withdrawn or never finished, and patient details from a form that nobody at the clinic reviews, each after the period the clinic sets. A staff member's acknowledgements of procedures are destroyed after the number of years the clinic sets from when that person leaves, and each day of a daily checklist after the number of months it sets.

Each destruction is recorded in a register that says what was destroyed and when, without reproducing what was in it. Our database provider keeps backups for a limited number of days so the service can be restored after a failure; a destroyed record can remain in a backup until that backup expires, and it is not restored into the clinic.

11.Documents we keep as records

Where a document is retained as evidence that something was agreed, it has to stay complete, unaltered and readable for as long as it is retained. Medervia therefore stores the document that was actually presented and accepted, with a fingerprint so that any change is detectable, and never regenerates it from live data afterwards. A patient's agreement or completed form is produced as a PDF in the patient's own browser when they accept or submit it. If underlying details change, that is a new record rather than an edit to the old one.

For the same reason we retain the delivery events belonging to such a record: where it came from, where it went, when it was sent and when it was received. Those events are part of the record rather than metadata about it.

12.Automated decision-making

Medervia does not use automated decision-making to make, or to substantially assist in making, a decision that could reasonably be expected to significantly affect your rights or interests. There is no automated eligibility scoring, no risk profiling of patients, and no algorithmic assessment of a person in the platform.

The platform does apply deterministic rules: it checks that a document contains the information its type requires before it can be finalised, and it calculates dates such as when an agreement's coverage ends or when a record becomes due for destruction. These are checks and calculations, published in this policy for transparency, and a person at the clinic remains responsible for every substantive decision.

From 10 December 2026, Australian privacy law requires privacy policies to describe the kinds of personal information used in automated decisions of the significant kind described above, and the kinds of decisions made. If Medervia ever introduces such a decision, this section will describe it before that happens.

13.Accessing and correcting your information

You can ask us what personal information we hold about you and ask us to correct it. Send us a message through the contact form on our website and we will respond within a reasonable period, ordinarily 30 days.

If you are a patient, the clinic that treated you is usually the better first port of call, because it holds your clinical record and we do not. We will tell you what we hold and direct you to the clinic where that is the right place, and we will not use that as a reason to avoid answering.

We may decline a request where the law permits or requires us to, for example where correcting a retained record would defeat the purpose of retaining an unaltered copy of what was agreed. If we decline, we will tell you why and note your requested correction alongside the record rather than silently ignoring it.

14.If something goes wrong

If we suffer unauthorised access to, unauthorised disclosure of, or loss of personal information, we will assess it promptly. Where it is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the individuals at risk as soon as practicable, and we will tell the affected clinics whether or not the threshold for notification is met.

We will not delay telling a clinic about an incident affecting its patients while we work out whether we are legally obliged to tell anyone.

15.Complaints

If you think we have mishandled your personal information, please tell us through the contact form on our website. We will acknowledge your complaint, investigate it, and reply to you in writing by email.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. Depending on where you live and what the complaint concerns, a state or territory health complaints body or privacy commissioner may also be able to consider it.

16.Changes to this policy

We will update this policy as the platform changes, and the date at the top will change with it. Where a change is significant, whether a new category of information, a new service provider, or a new place information is stored, we will make that clear rather than quietly editing a sentence.

17.How to contact us

Privacy questions, access requests and complaints can all be sent through the contact form on our website, at medervia.com/contact. Clinic members can also open a ticket from Support inside Medervia.