Trust & compliance
Who holds your patients' information, where it is, how it is protected and which law applies — written so a practice manager can check it, not just read it. Current as at 16 October 2026.
Westergaard Pty Ltd, ABN 22 663 084 900, Paddington, Queensland. The same company runs a registered telehealth practice whose doctors use MedCall every day.
We handle personal information under the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles. The Notifiable Data Breaches scheme applies to what we hold.
Database, file storage and the servers that run a consult are in Sydney (AWS ap-southeast-2 and Vercel's Sydney region). Consult records, chat messages and files are stored there and nowhere else.
Video and audio travel directly between the two browsers, encrypted with DTLS-SRTP. A relay, when a network needs one, passes packets it cannot read.
There is no recording feature and no code path that stores video or audio. A call exists only while it is happening.
Patients join by tapping a link. They never create an account, so there are no patient passwords to phish and no patient credentials to leak. Clinicians sign in with a confirmed email address.
MedCall is operated by an Australian company and handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles: we collect only what the consult needs, use it only for that, take reasonable steps to secure it, and give people access to what we hold about them. Our privacy policy is written to the Principles.
The Notifiable Data Breaches scheme applies to the information we hold. We keep a written breach-response plan and, if a breach were likely to cause serious harm, we would notify affected people and the Office of the Australian Information Commissioner, as the scheme requires. Affected practices hear from us first, whether or not a breach reaches that threshold.
Where a provider outside Australia is involved — SMS, email and billing — we disclose it below and send only what that function needs. Consult content is not sent to them.
The clinical record stays with your practice. MedCall is the call, not the record: we handle patient information on your behalf, only to run the consult, and you remain the party with the clinical relationship and the obligations that come with it.
Everything MedCall keeps about a consult, and why. If it isn't in this table, we don't have it.
| What | Why | Kept |
|---|---|---|
| Patient's name (if entered), mobile number or email | To send the invitation and show you who is waiting | With the consult record, seven years |
| Chat messages, photos and PDFs shared in the call | So both sides can see them during and after the consult | With the consult record, seven years |
| Call events — opened, joined, left, duration, connection quality | The printable call record, and fault-finding | Seven years |
| Browser, device and operating system used to join | Fault-finding and support | With the consult record |
| Optional 1–5 rating of call quality | Measuring call quality | With the consult record |
| Video and audio | — | Never stored |
| Medicare numbers, dates of birth, clinical notes, diagnoses | — | Never collected |
Seven years matches the usual retention period for an adult patient's record. Consult links themselves expire 24 hours after they are created. A practice can ask us to delete its account and records at any time.
The companies that touch a consult, what each one does for us, where, and the certifications they hold. Theirs, not ours — MedCall does not hold ISO 27001 or SOC 2 in its own right.
| Provider | What they do for MedCall | Where | Their attestations |
|---|---|---|---|
| Supabase | Database and file storage | Sydney (AWS ap-southeast-2) | SOC 2 Type 2, ISO 27001 |
| Vercel | Application hosting; functions run in Sydney | Sydney (syd1); public assets on a global CDN | SOC 2 Type 2, ISO 27001 |
| Amazon Web Services | Infrastructure under the two above | Sydney | ISO 27001, SOC 2 |
| Twilio | SMS invitations; relay servers for calls that cannot connect directly (encrypted packets only) | United States and global network | ISO 27001, SOC 2 Type II |
| SendGrid (Twilio) | Email invitations and account emails | United States | ISO 27001, SOC 2 Type II |
| Stripe | Practice billing. Sees practice and billing details, never patient data | United States | PCI DSS Level 1 |
| Ahrefs Web Analytics | Cookieless page-view counts on the public website only. Never loaded on consult, dashboard or record pages | Outside Australia (Singapore company) | — |
Who can see what: each clinician sees their own consults. A practice manager sees how many consults each doctor ran — never patient names, numbers or chat. Our own team accesses consult data only to run and support the service — fault-finding, an automated twice-daily health check of call quality, and support you ask for — and never chat content unless you ask us to look. The browser never talks to the database: every read and write goes through our application servers, which hold the only credentials.
The Medical Board's telehealth guidelines and the RACGP's telehealth guide put these on the practitioner. MedCall is built so you can meet them without extra work.
Sources: Medical Board of Australia — Telehealth consultations with patients, RACGP — Telehealth, OAIC — Privacy for health service providers.
Our breach-response plan follows the OAIC's four steps: contain it, assess it within 30 days, notify the practices affected and — where the Notifiable Data Breaches scheme requires — the people affected and the OAIC, then review what let it happen.
Found a security issue? Email hello@medcall.au. Good-faith reports are welcome and answered by a person. The technical detail of how a consult is protected is on our security page.
A free trial takes two minutes. Send yourself a link and watch what the patient sees.
Start free trial