Last updated: 24 June 2026
DRAFT — UNDER LEGAL REVIEW. This document is a working draft prepared for legal review before launch and is not yet in force.
Write My Consult is an AI veterinary consult-note scribe operated by the team at writemyconsult.com ("Write My Consult", "we", "us", "our"). We provide our service to Australian veterinary clinics on a per-clinic basis. Our software records a veterinary consultation, transcribes it, and drafts a structured clinical note that the treating veterinarian reviews, edits and signs.
This Privacy Policy and Collection Notice explains, in plain language, what personal information we handle, why, where it goes, how we protect it, how long we keep it, and the rights you have. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), in particular APP 1 (open and transparent management of personal information), APP 5 (notice of the collection of personal information) and APP 8 (cross-border disclosure of personal information).
Two parties are involved in handling information. The veterinary clinic is the treating provider and the entity with the direct relationship to the animal's owner; the clinic decides what is recorded, obtains consent, and is responsible for the clinical record. Write My Consult processes information on the clinic's behalf and under its instructions. The "How the clinic and Write My Consult roles work" section below sets this out in detail.
Contact for any privacy question, request or complaint: support@writemyconsult.com.
Write My Consult is built and operated by a practising Australian veterinarian and is sold to Australian veterinary clinics. This policy covers personal information we handle as part of providing the service: information about the veterinarians and clinic staff who hold accounts, and the clinical information captured during consultations (which can include information about an animal's owner where it is spoken aloud during the consult).
The primary subjects of our service are the people who use it (vets and clinic staff) and, indirectly, animal owners whose details may be mentioned in a consultation. Animals themselves are not 'individuals' under the Privacy Act, but owner-identifying details that appear in a recording or note are personal information and are treated as such.
Governing law for this policy and our service is the law of Victoria, Australia, and the Commonwealth Privacy Act applies.
We collect only what we need to run the service. There are two categories.
This is the single most important thing to understand about how the service works.
When a consultation is recorded, the audio is streamed to our transcription sub-processor, AssemblyAI (United States), to be converted into text. We do not save the audio recording on our servers. The audio is held only transiently in memory for the purpose of transcription and is then discarded — it is never written to our database or persisted in our storage. There is no stored audio file to retrieve, export or breach.
What we do keep is the resulting text transcript and the clinical note drafted from it. These are stored (see 'Where your information is stored and how we protect it' and 'How long we keep information').
Because audio carries an animal owner's voice and anything said in the room, keeping it transient by design is a deliberate privacy choice.
After transcription, the transcript is sent to our note-generation sub-processor, Anthropic (Claude), in the United States, which drafts a structured clinical note. A separate Anthropic (Claude) pass then performs a safety and accuracy review of that draft, producing advisory flags for the vet's attention; this review never silently rewrites the note.
The note is a draft. It is generated by an AI model and must be reviewed, corrected and signed by the treating veterinarian before it becomes part of the clinical record. See 'Automated processing and AI-drafted notes' for what this means for you and for accountability.
We use a small number of carefully chosen third parties ('sub-processors') to deliver the service. Each receives only the information it needs for its specific function. We do not sell personal information, and we do not use it for advertising.
Some of our sub-processors are located in the United States, which means that to provide the service, personal information is disclosed to and processed by overseas recipients in the United States. Specifically:
- Consult audio is sent to AssemblyAI in the United States for transcription (then discarded). - The consultation transcript and draft note are sent to Anthropic (Claude) in the United States for note generation and safety review. - Email addresses for essential service emails are handled by Resend in the United States.
We disclose only what each function requires. We are putting data-processing agreements in place with each US sub-processor to bind them to appropriate protections, including zero-retention and no-training-on-your-data commitments (see the next section). Where information is disclosed overseas, the protections available in that jurisdiction may differ from those under Australian law; the contractual arrangements we are establishing are intended to require each recipient to handle the information consistently with the APPs. By using the service, the clinic and its users understand that this cross-border processing is necessary for the service to function.
We are in the process of putting signed data-processing agreements in place with each US sub-processor (AssemblyAI, Anthropic and Resend). These agreements are intended to require, among other things, that the sub-processor: processes the information only on our instructions for the specific function described above; does not retain consult content beyond what is needed to perform that function (zero-retention); and does not use your data to train its models.
We describe this honestly as in progress rather than complete: these agreements are being finalised and are not all signed at the date of this draft. This document will be updated to reflect the final position before launch.
We store the data we retain — account details, transcripts, clinical notes, and the audit log — in a PostgreSQL database, with short-lived session data in Redis.
Hosting location, stated honestly: our servers are currently hosted on a virtual private server located in Malaysia. A migration to an Australian (Sydney) region is in progress and is not yet complete at the date of this draft. We will update this notice when the Australian hosting is live.
The security measures we have in place today are:
We believe an accurate picture matters more than a reassuring one. At the date of this draft:
- Clinical notes and transcripts are stored as plaintext in the database. We do not yet apply application-layer ('at-rest' / per-field) encryption to that content. Our current at-rest protection relies on the database being reachable only from the local host on a hardened server and on encrypted backups, not on column-level encryption. Per-field encryption is planned for a later stage. - The Malaysia-to-Sydney hosting migration described above is in progress and not yet complete. - The data-processing agreements with our US sub-processors are being put in place and are not all signed yet.
We hold no formal security certifications (we do not claim ISO 27001, SOC 2, HIPAA or similar). We will update this notice as each of these items changes.
Retention is configurable per clinic. Each clinic chooses a retention window for its consult records.
- Audio is never retained at all (it is discarded after transcription, as described above). - Transcripts and clinical notes are kept for the clinic's chosen retention window, then permanently and automatically deleted ('auto-purge'). The purge is a hard delete — the transcript, note and version history are removed, not merely hidden — and the deletion is recorded in the audit log (the audit record itself carries no clinical content). - Account information is kept while the account and clinic relationship is active. A departing staff member's account can be removed while their authored consults remain attributable within the clinic.
A clinic can also request earlier deletion of specific records or its data as described under 'Your rights'.
Understanding who is responsible for what is central to how privacy works here.
We want to be clear about the role of automation, because the note is produced with AI.
The clinical note is AI-drafted: an AI model produces an initial structured draft from the transcript, and a separate AI pass flags potential safety or accuracy concerns for the vet's attention. No clinical decision is made by the software alone. The draft has no clinical or legal effect until the treating veterinarian reviews it, makes any corrections, and signs it. The vet and the clinic remain clinically and legally responsible for the content of the record.
In other words, the AI assists the vet; it does not replace the vet's judgement, and there is always a qualified human in the loop before a note becomes part of the clinical record. Because the output is reviewed and adopted by a person, this is not automated decision-making that produces legal or similarly significant effects on an individual without human involvement. If you have a concern about how an AI-drafted note was produced, contact us at support@writemyconsult.com.
Subject to the roles described above (the clinic generally controls its records), you have the following rights in respect of your personal information:
For any privacy request (access, correction or deletion), question, or complaint, contact us at support@writemyconsult.com. Please include enough detail for us to identify the relevant information and, where the request concerns a clinic's records, expect that we may need to involve the clinic that controls those records.
We will acknowledge your request promptly and aim to respond within a reasonable time, and in any case within the timeframes required by the Privacy Act. If your request relates to records held on behalf of a veterinary clinic, the clinic — as the treating provider — may be the appropriate party to action it, and we will coordinate with them.
If you are not satisfied with how we have handled your complaint, you can contact the Office of the Australian Information Commissioner (OAIC): - Website: oaic.gov.au - Phone: 1300 363 992 - Post: GPO Box 5288, Sydney NSW 2001
We will update this policy as our practices change — in particular when the Australian (Sydney) hosting migration completes, when our sub-processor data-processing agreements are finalised, and if we add or change a sub-processor or introduce at-rest encryption of stored content. The 'last updated' date at the top reflects the current version. Material changes will be communicated to clinics.
This is a draft under legal review and will be finalised before the service launches.