How we handle your patients’ data

Who’s responsible

Your clinic is the agency responsible for your patients’ health information under the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). DearDoctor — a Rebellion Digital product — is the tool and service provider you use to run consults and prepare clinical letters.

Under section 11 of the Privacy Act, information a service provider holds only on your behalf is treated as held by your clinic, so your clinic stays in charge of it.

At a glance

• Audio only. DearDoctor records audio only (never video), purely to draft your clinical letter.
• Stored in Auckland. Recordings, transcripts and draft letters are stored on Amazon Web Services in Auckland, New Zealand, encrypted at rest and only reachable over encrypted connections.
• Transcription happens in the United States. Transcription is done by a specialist provider in the US. We say so plainly because you’ll need to tell your patients.
• Letters are drafted in the Australia/New Zealand region. The AI model that drafts letters runs on Amazon Web Services in the Australia/New Zealand region.
• You approve every letter. You review and approve every AI-drafted letter before it’s filed. Nothing is sent automatically.

Where it’s stored and processed

What	Who handles it	Where
Consult recordings (audio only)	Amazon Web Services	Auckland, New Zealand
Transcripts and draft letters	Amazon Web Services	Auckland, New Zealand
Transcription	A specialist medical transcription provider	United States
Drafting the letter	An AI model on Amazon Web Services	Australia/New Zealand region
Approved letters	Filed by you to the patient’s record in your practice management system	Your clinic’s system

Keeping it secure

• Encrypted at rest. Recordings, transcripts and draft letters are encrypted with AES-256 (AWS KMS).
• Private storage. The storage is private, with public access blocked, and only reachable over encrypted connections.
• Encrypted video calls. Video calls are encrypted in transit.
• Signed-in staff only. Your staff sign in through an access-controlled portal, and each doctor can only open their own consult room.
• A record of recording downloads and deletions. When a manager downloads or deletes a recording, it’s logged.

What you can tell patients

If a patient asks how the scribe works, these statements are accurate today:

• “We record audio only, not video, and only to prepare your clinical letter.”
• “Recordings, transcripts and draft letters are stored in Amazon Web Services in Auckland, New Zealand, encrypted at rest and only reachable over encrypted connections.”
• “Transcription is done by a specialist provider in the United States.”
• “Letters are drafted by an AI model on Amazon Web Services in the Australia/New Zealand region.”
• “Your doctor reviews every AI-drafted letter and files it themselves; nothing is sent automatically.”
• “Video calls are encrypted in transit.”

Consent

Consent is part of your clinic’s process. Your clinic asks for the patient’s consent before using the scribe, explains that transcription happens in the United States, and respects a patient who would rather it wasn’t used. How you ask and record that consent is up to your clinic — we’re happy to talk it through.

You approve every letter

The AI produces drafts. You review and approve every AI-drafted letter before it’s filed — nothing is sent automatically, and you’re responsible for what you approve. DearDoctor doesn’t diagnose or give medical advice.

Your record-keeping obligations

Under the Health (Retention of Health Information) Regulations 1996, your clinic must keep health records for at least 10 years from the day after the last service to the patient. The lasting record is the letter you file in your own practice management system, so that obligation stays with your clinic and your system. Ask us about retention for recordings, transcripts and drafts held in DearDoctor.

How this relates to NZ rules

DearDoctor is designed to support clinics with the rules below. It doesn’t hold any certification or accreditation, we don’t claim compliance on your behalf, and it isn’t a substitute for your clinic’s own privacy assessment and advice.

Rule	What it covers	How DearDoctor relates
HIPC rule 5 — security	Reasonable safeguards against loss, misuse and unauthorised access	Storage in Auckland, encrypted at rest and in transit, private storage, signed-in staff, doctors limited to their own consult rooms.
HIPC rule 9 — retention	Not keeping health information longer than needed	The lasting record is the letter you file in your own system. Ask us about retention for recordings, transcripts and drafts.
HIPC rule 11 — disclosure	Limits on disclosing health information	Information is processed by the services listed above, to transcribe the consult and draft the letter.
HIPC rule 12 — overseas	Rules for disclosing health information outside New Zealand	Transcription happens in the United States, and letters are drafted in the Australia/New Zealand region. Consider this in your own assessment and tell patients.
Health (Retention of Health Information) Regulations 1996	Health records kept for at least 10 years from the day after the last service	Your clinic, as record holder, keeps the patient record — including filed letters — in its own system.
HISO 10029 Health Information Security Framework	Security expectations for the health sector	We don’t claim HISO 10029 compliance. If you’re assessing us against it, ask for details.
Consent to the AI scribe	Patients agreeing to the scribe being used	Your clinic asks for consent before using the scribe, as part of its own process.
Clinician review of AI output	A clinician checks AI-generated notes and letters	You review and approve every AI-drafted letter before it’s filed.
Health NZ and AI scribes	Health NZ’s National AI and Algorithm Expert Advisory Group reviews AI tools for the public health system	DearDoctor isn’t on Health NZ’s endorsed list. Public-sector clinicians should follow their organisation’s process before using any new AI tool.

Questions about any of this, or want it for your privacy assessment? Email [email protected] — we’d rather you asked.