A practice manager in Newcastle asked us this in the first ten minutes of a meeting, before anything about price or features. She'd been quoted for an AI scribe, liked the demo, and had one question the salesperson couldn't answer without checking: when the microphone in the consult room picks up a patient describing their symptoms, where does that audio physically go?
It's the right question, and it has a specific answer for every product. Here's how to get it.
What actually happens with a cloud scribe
Most AI scribes and meeting tools work the same way. The audio is captured on a phone, laptop or room device, then uploaded to the vendor's servers. There it is turned into text by a speech model, and the text is passed to a large language model that writes the note. The note comes back to your screen. The round trip takes a few seconds.
Two of those steps involve computers you don't own. Sometimes those computers are in Sydney. Very often they are in the United States, or in whichever region the vendor's AI provider happens to serve from. A vendor may be an Australian company, incorporated here, staffed here, and still process your audio in a data centre in Oregon — because the model they resell lives there.
That isn't necessarily wrong. It is, however, a fact about your practice that you should know rather than assume.
The four questions that get you a real answer
Ask these in writing. A good vendor answers them in a paragraph each; a vendor who deflects has told you something too.
- In which country is the audio processed, and in which country is it stored? These can be different. "Hosted in Australia" sometimes means the app is, while the AI processing is not.
- Which sub-processors touch the data? Ask for the list. Nearly every scribe is built on someone else's speech and language models; the sub-processor list is where the real geography lives.
- Is any of our content used to train or improve models? Ask whether that's the default, and get the answer in the contract rather than the FAQ.
- How long is the audio kept, and can we make that zero? Retention of the original recording is the risk that lingers longest after the note is written.
What the law asks of you
Health service providers in Australia are covered by the Privacy Act 1988 regardless of turnover — the small-business exemption that applies to many companies does not apply to a clinic. In NSW, health information carries a second layer under the Health Records and Information Privacy Act 2002.
The relevant point for this question is that when you disclose personal information to an overseas recipient, you must take reasonable steps to ensure that recipient handles it consistently with the Australian Privacy Principles — and you generally remain accountable for what happens to it. Sending data offshore is permitted. Sending it offshore without knowing you did, or without having taken those steps, is where practices come unstuck.
There's also the consent question, which is separate and applies wherever the processing happens: in NSW, recording a private conversation without the consent of the people in it is an offence under the Surveillance Devices Act 2007. Whatever tool you use, the patient has to be told and has to agree. Every clinic we've worked with handles this with a line at the start of the consult and a note in the file.
This is general information, not legal advice. Get your own advice on your own circumstances — and if you'd like, we'll happily talk to your lawyer directly about how our systems handle data.
The architectural answer
There's a way to make the question disappear rather than manage it: don't send the audio anywhere.
The speech models and language models that clinics use are, in 2026, small enough to run on a computer that fits on a shelf. A machine on your own network can take the recording, transcribe it, write the note in your template, and delete the audio — with no part of that touching the internet. The cross-border disclosure question then has a one-word answer, because there is no disclosure. Your obligations under APP 11 (security) still apply, and they become an ordinary IT question: who can reach the machine, how it's backed up, what happens when a laptop is lost.
We're obviously not neutral here — that's the system we install. But the architecture is the point, not the vendor. If a cloud scribe is the right fit for your practice, the four questions above will tell you which one to trust.
What we tell clinics to do this week
If you're already using something: find the vendor's data-processing terms, look for the sub-processor list, and check the retention setting on the audio. That's twenty minutes and it usually answers everything.
If you're choosing: put the four questions in your shortlist email. The replies will sort the field faster than any feature comparison.
Book a 20-minute chat if you'd like us to look at what you've been quoted.