Draft for legal review

Privacy information

GeriesConsult handles health information for patient onboarding, consultations, clinical documentation and follow-up. The production privacy policy must identify the operating legal entity, contact details, purposes of collection, usual disclosures, overseas processing if any, access and correction procedures, retention, complaints and the consequences of not providing requested information.

Current patient-preparation design

• Typed onboarding and CGA answers are stored in the patient's separate GeriesConsult record and processed through ApolloMedAI and Gemini Vertex in approved Australian regions.
• Live voice requires a separate consent. Speech recognition and playback use Deepgram's Australian endpoint with model-improvement opt-out; GeriesConsult does not retain microphone audio in this pathway.
• Short-lived browser credentials are issued for Deepgram voice. Long-lived provider credentials remain server-side.
• Every generated summary remains preparation material for clinician review and is not a diagnosis.

Before public launch

• Complete and approve the Privacy Impact Assessment.
• Publish the final Australian Privacy Principles policy and collection notices.
• List every subprocessor and processing location, including Deepgram and Google Cloud.
• Provide separate consent choices for telehealth, AI transcription and sharing with carers or referring clinicians.

This placeholder must not be represented as the final legal privacy policy.