Clinical Data and Compliance Notice

Plain-language summary↑

The Dr Sophia AI platform processes three kinds of clinical data for customer organisations: structured assessments, recommendations, and audit records. That data is hosted in Australia and does not leave Australia. It is encrypted in transit and at rest, access is role-based, and every recommendation carries an exportable audit record. Retention periods and the training-data policy are set in your customer agreement.

The platform is clinician-led. Your clinicians and medical reviewers keep authority over every decision, and their reviews and overrides are logged.

On compliance, we use three words carefully. Compliant: the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and nothing else. Certified: ISO 9001, held at group level by Botaniqal and Limited Edition Labs. Registered: Rose AI Clinician, a registered SaMD (Class I). Every other framework in this notice is either designed against and not yet accredited, or aligned with. Where a claim is not yet earned, this notice says so.

If you are an insurer or self-insurer, section 6 covers workers compensation use, including tribunal-defensible decision records and claimant data residency.

This notice is informational. Your signed customer agreement governs. Questions: safety@drsophia.ai.

1. Who this notice is for↑

This notice is published by Dr Sophia AI Pty Ltd (ACN 675 911 010), the vendor of the Dr Sophia AI clinical intelligence platform (the platform). It consolidates the clinical-data and compliance facts most often requested during evaluation and procurement.

It is written for:

• healthcare organisations and GP networks, including clinical directors and clinical governance committees,
• multi-site healthcare services providers, including their commercial, clinical, and technology leads,
• insurers and self-insurers evaluating structured decision support for workers compensation, return to work, triage, and personal injury workflows, and
• the procurement, governance, risk, and audit teams, and the counsel, who advise them.

1.1 Relationship to the customer agreement

This notice is informational. It does not create contractual rights or obligations, and it does not form part of any agreement. Customer use of the platform, including the Sophia Core, Sophia Decision, Sophia Assist, and Sophia Guard modules, is governed by a separate signed customer agreement. If this notice differs from a signed customer agreement, the signed agreement governs. Use of this website is governed by the Terms of Use, and website data handling is described in the Privacy Policy.

2. Clinical data handling and residency↑

2.1 What the platform processes

The platform processes clinical data on behalf of customer organisations to deliver structured clinical decision support. Three categories apply:

• Structured clinical assessments: intake and pre-consultation information captured in structured form.
• Recommendations: structured outputs with confidence scores and evidence links, presented to a clinician or medical reviewer for review.
• Audit records: decision provenance, clinician review and override events, and access logs.

The customer organisation remains the custodian of its clinical records. The platform processes clinical data on the customer's instructions under the customer agreement. Exchange with clinical and claims systems uses HL7 FHIR integration.

2.2 Where clinical data is hosted

Customer clinical data is hosted in Australia (AWS Sovereign Cloud, AU-East). Clinical data does not leave Australia.

This statement applies to all clinical data the platform processes for Australian customers, including claimant data in workers compensation workflows (see section 6).

2.3 Encryption and access control

Clinical data is protected with AES-256 encryption in transit and at rest. Access is managed through single sign-on (SAML and OIDC) and role-based access control scoped to clinician role. Access events are logged and form part of the audit record.

2.4 Retention and deletion

Retention of clinical data is governed by the customer agreement. Default retention periods are seven (7) years for adult patients. On termination, clinical data is returned or deleted as the customer agreement directs.

2.5 No secondary use for model training

Clinical data is not used to train models without the customer's explicit written agreement. Where population-level analytics are contracted, they are de-identified at system level.

3. Regulatory framework map↑

One vocabulary rule governs this table. "Compliant" is used for one framework only: the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where a row reads "designed against, not yet accredited", the platform is engineered to the framework's requirements and no certification is claimed. Where a certificate is held, the row names who holds it.

Certificates and evidence artefacts are published on the Governance and Security page as they are verified. No certification badge appears on this site before the certificate is held.

4. Clinical safety and incident handling↑

4.1 Clinician-led operation

Dr Sophia AI operates in a clinician-led workflow.

Every recommendation the platform produces is presented to a qualified clinician or medical reviewer. The platform does not offer autonomous medical advice, does not provide diagnoses without clinician review, does not prescribe independently, does not deliver treatment, and does not establish a clinician-patient relationship. Clinical decisions remain the responsibility of qualified professionals.

4.2 Override logging

Clinician review and override are embedded by design. When a clinician accepts, amends, or overrides a recommendation, the event is recorded on the platform's audit trail, anchored on Hedera Hashgraph. Override records are available to the customer's clinical governance function.

4.3 Incident and adverse-event escalation

Suspected safety incidents and adverse events can be reported to Dr Sophia AI's clinical safety team at safety@drsophia.ai, available during business hours, or through the in-platform incident reporting function. Reports are acknowledged within one to two business days, triaged and assigned a severity classification, and managed under the platform's incident-response process, with resolution targets set by severity. Where an incident meets a regulatory reporting threshold, reporting is handled in accordance with the customer agreement and applicable law, including the sponsor's obligations under the Therapeutic Goods (Medical Devices) Regulations 2002 (Cth) to report adverse events and near adverse events to the TGA within the mandated timeframes, and the parties' respective obligations under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) where an incident involves personal or health information.

4.4 Clinical governance review

Platform outputs, override patterns, and safety signals are reviewed through a standing clinical governance process.

5. Auditability for procurement↑

Auditability is an architectural property of the platform, carried by Sophia Guard, the platform's governance and audit layer. During evaluation, or under contract, an auditor can request:

• Decision audit packs: exportable records for a given decision, showing the structured inputs, the guidelines applied, the recommendation, the confidence scores and evidence links, and the reviewing clinician.
• Provenance records: which guideline applied, which data points influenced the recommendation, and which clinician review or override occurred, anchored on Hedera Hashgraph so that records are tamper-evident.
• Access logs: who accessed which records and when, under role-based access control with single sign-on (SAML and OIDC).

The Governance and Security page carries evidence downloads prepared for procurement review, including a compliance posture brief, a frameworks matrix, a data-flow and security pack, and a sample audit artefact. The sample audit artefact shows the exact form of an exported decision record before any agreement is signed.

6. Workers compensation and insurer use↑

For insurers and self-insurers, the platform provides structured decision support across workers compensation, return to work, triage, and personal injury workflows. Three commitments matter to claims operations, medical reviewer panels, and tribunal counsel:

• Explainable, tribunal-defensible decision records. Every claims-related recommendation carries a decision record that a panel of medical reviewers, a claims team, and counsel can examine: structured inputs, applied guidelines, confidence scores and evidence links, and the reviewing medical reviewer or clinician.
• Integration with existing claims systems. The platform integrates with existing claims management systems and does not replace them. Recommendations enter the claims workflow at defined human review checkpoints, and medical reviewers retain decision authority at each one.
• Claimant data residency. Claimant data processed by the platform is covered by the same statement as all clinical data: it is hosted in Australia (AWS Sovereign Cloud, AU-East), and it does not leave Australia.

The clinician-led posture described in section 4 applies to claims workflows in full.

7. Contact for compliance questions↑

Compliance and governance questions from evaluating organisations should go to safety@drsophia.ai. Enquiries are acknowledged within one to two business days. This includes:

• Privacy questions, including data handling and residency.
• Legal questions, including this notice and the customer agreement.
• Clinical safety, incident, and adverse-event queries.

Questions requiring governance-level review are escalated to Dwayne Boyes, CEO. Postal enquiries: Dr Sophia AI Pty Ltd, Regus Suite 118, 121 King William Street, Adelaide CBD, SA 5000.