AI, Privacy and Security

AI-assisted drafting without sending the client's identity.

For supported report and re-engagement drafts, Posture 4 Health removes direct identifiers before the request leaves the application, then substitutes the client's name back after the draft returns.

Book a Demonstration Read the privacy policy

The short version

  • Client and account data is stored in Australia (Sydney)
  • Each practice's records are kept separate
  • Two-factor sign-in, required for administrators
  • AI wording is drafted from de-identified input only
The Round Trip

What happens to the information, step by step

  1. The record staysClient and account information is stored in infrastructure hosted in Sydney, Australia.
  2. Identifiers are removedThe client name is replaced with a placeholder. Date of birth, contact details and posture photographs are not sent to the AI text service.
  3. The minimum is sentDe-identified clinical measurements required for the draft are processed by the overseas AI provider identified in the privacy policy.
  4. The draft returnsThe AI service returns wording without the client's direct identity.
  5. The record is reintegratedPosture 4 Health substitutes the name locally and places the draft back with the correct record.
  6. The practice remains responsibleThe practitioner or practice reviews the output and retains responsibility for communication and clinical decisions.

Shaded steps happen outside the application, with a third-party AI provider that processes overseas. The privacy policy names it and where it is located.

The Controls

What is in place

Where it lives

  • Client and account data stored in Australia (Sydney)
  • Daily backups, with an off-site copy
  • Traffic encrypted in transit

Who can see it

  • A practice sees only its own records, enforced at the database level
  • Role-based access, including a manager role
  • Each location's records stay scoped to it

How staff sign in

  • Two-factor sign-in with remembered devices
  • Required for administrators
  • Screens lock on an unattended device

How clients get in

  • A personal link by email or text
  • A date-of-birth check and a rolling 90-day expiry
  • A client sees only their own record

On the device

  • Scans work offline and sync when the connection returns
  • Practitioner notes and billing stay out of the portal

Accountability

  • Administrative actions recorded in an audit log
  • A published security contact
  • Providers listed in the privacy policy
Transparency and control

Clear boundaries. No broad promises.

Posture 4 Health is designed to support privacy-aware and AHPRA-conscious workflows through specific safeguards, practice-controlled settings and human review.

AI may assist with drafting and analysis, but it does not provide care, make clinical decisions or replace the judgement of the treating practitioner.

For supported AI-assisted workflows, identifying information is removed before processing and reintegrated securely when the draft returns. Some information, such as a client’s own free-text response, cannot always be de-identified in the same way. That workflow is not currently active. To file X-rays, a reduced-size copy of each image is sent to the AI service; printed names and details are removed on a best-effort basis, which cannot be guaranteed.

Some service providers involved in AI-assisted drafting, AI-assisted X-ray filing or email delivery may process limited information outside Australia. These arrangements are explained in our Privacy Policy.

View security contact information

Questions from your IT or compliance lead?

Bring them to the demonstration. We will answer them directly, including how the controls work in practice.

Book a Demonstration