Privacy policy

Last updated 22 October 2026

MBS Scribe helps Australian GPs write the note for a telehealth consult and check it against the Medicare Benefits Schedule (MBS). Doing that means handling health information, so this policy sets out plainly what we collect, where it is kept, who can see it and what you can do about it.

MBS Scribe is run by James O'Brien, a sole trader in New South Wales, Australia, trading as MBS Scribe ("we", "us", "our"). We follow the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and, where they apply, the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Health Records (Privacy and Access) Act 1997 (ACT).

1. The short version

• Consult recordings, transcripts and notes are stored in Sydney and processed only in Australia.
• We never sell personal information and never use it for advertising.
• We do not use consult recordings, transcripts or notes to train AI models, and we do not let our service providers do so.
• When a GP shares a browser tab or app window to capture call audio, MBS Scribe keeps only the sound. The picture is discarded on the GP's computer and never uploaded.
• The GP must ask the patient, and everyone else on the call, before recording. MBS Scribe will not start recording until the GP confirms the patient has agreed.
• The GP decides what goes in the note and what to claim. MBS Scribe never submits anything to Medicare.

2. Whose information this covers

This policy covers:

• GPs and practice staff who use MBS Scribe or contact us;
• patients and anyone else on a consult, such as a carer, interpreter or registrar, whose information a GP records or pastes into MBS Scribe; and
• visitors to mbsscribe.com.

The GP or practice that uses MBS Scribe is responsible for its own patient records and for telling its patients how their information is handled. We hold consult information to provide MBS Scribe to that GP or practice, and we protect it as set out here.

3. What we collect

About GPs and practices

• Name, email address, practice name and practice address.
• Professional details you give us, such as your role and your practice's settings (for example, whether patients are registered in MyMedicare).
• Your plan, billing history and any tax invoice details, such as an ABN. Card details are entered on Stripe's payment pages. We never see or store full card numbers.
• Messages you send us.

About consults

When a GP records or pastes a consult, we collect what the consult contains. This is often health information, which the law treats as sensitive information:

• the audio recording: the GP's microphone and the call's sound, on separate tracks;
• the transcript, the draft note and any note the GP pastes in;
• the label the GP gives the consult (for example, a patient's initials and age), the consult type and the time;
• facts drawn from the transcript or note, the MBS check results, and the GP's decisions on each item;
• the patient's answer to the recording consent question and when it was given; and
• an audit log of what happened during the consult and sign-off.

About how MBS Scribe is used

• Technical information such as IP address, browser and device type, times of access and error reports. We use it to keep the service working and secure.

4. How we collect it

• From GPs and practice staff directly, when they create an account, choose a plan, use MBS Scribe or contact us.
• From patients and others on a consult, indirectly, through the GP's recording or pasted note. The GP must ask everyone on the call before recording.
• From Stripe, which tells us whether a payment succeeded and which plan was bought.
• Automatically, through our systems' logs, when MBS Scribe or this website is used.

5. How we use it

We use personal information to:

• transcribe consults, draft notes in the order the GP expects, and check notes against the MBS;
• show the GP the sentence behind each result and keep the audit log of their decisions;
• run accounts, plans, allowances and billing;
• answer questions and support requests;
• keep MBS Scribe secure, find and fix faults, and prevent misuse; and
• meet our legal obligations.

We may use de-identified, combined statistics, such as how many checks are run each week, to run and improve MBS Scribe. These statistics cannot identify any GP or patient.

We use health information only for the purpose the GP used MBS Scribe for, or as the law requires or allows. We do not sell personal information, use it for advertising, or send marketing to patients.

We may email GPs about MBS Scribe features and offers. Every such email has an unsubscribe link, and you can opt out at any time. Emails about your account, billing, security or changes to our terms are not marketing and will still be sent.

6. Automated processing and decisions

MBS Scribe uses computer programs, including AI models, to transcribe audio, draft the note, pick out facts from the note, and compare those facts with MBS item requirements. A versioned, dated set of rules decides which items the note supports; the AI models only draw out the facts.

• Information these programs use: the recording, transcript and note, the consult details and the practice settings described in section 3.
• Decisions made solely by these programs: none. MBS Scribe does not decide what is written in a patient's record or what is claimed from Medicare.
• Decisions these programs substantially help with: the GP's decision about what goes in the patient's note, and which MBS items to claim or not claim, which can affect the Medicare benefit paid for the patient's service. The programs draft the note and show, item by item, whether the note supports it and why. The GP decides each one and signs off. Nothing is sent to Medicare or the practice's software unless the GP copies it there.

7. Where it is stored

Consult information (recordings, transcripts, notes, check results and audit logs) is stored in Sydney and processed only in Australia. Our speech-to-text and AI model providers process it in Australian data centres.

Account and billing information is stored with the providers named in section 8. Some of them operate outside Australia; section 9 explains which.

8. Who we share it with

We share personal information only with service providers who help us run MBS Scribe, under contracts that limit what they can do with it, and only as much as each needs:

• Amazon Web Services: hosting, storage and AI model processing, in its Australian regions.
• Deepgram: speech-to-text, using its Australian processing.
• Stripe: payments, subscriptions, invoices and the billing portal.
• Cloudflare: this website, security, and forwarding email sent to our support address.
• Proton: the inbox that receives and stores messages sent to our support address.

We may also disclose information when the law requires or allows it, for example to comply with a court order, or to prevent a serious threat to someone's life, health or safety. If MBS Scribe is ever sold or merged, information would pass to the new owner only on terms that protect it at least as well as this policy, and we would tell GPs first.

We do not give consult information to Medicare, Services Australia, the Department of Health, Disability and Ageing, insurers or anyone else on our own initiative.

9. Information that leaves Australia

Consult information held in MBS Scribe does not leave Australia. Some other information may:

• Payment and billing information is stored and processed by Stripe in the United States and other countries where it operates.
• Website traffic, such as IP addresses and request details, passes through Cloudflare's network, which has data centres in many countries, including the United States.
• Emails to support@mbsscribe.com pass through Cloudflare and are stored by Proton in Switzerland and other European countries. Please do not email us patient details.

We take reasonable steps to make sure these providers handle personal information consistently with the Australian Privacy Principles.

10. How we protect it

• Information is encrypted in transit and at rest.
• Access to consult information is limited to the GP's account and practice, and to us only when needed to provide support or keep the service secure.
• Audio is held on the GP's computer only until it has been uploaded to our Australian storage.
• We keep logs of access to consult information.

If a data breach is likely to result in serious harm, we will tell affected GPs and practices promptly and, working with them, notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

11. How long we keep it

• Audio recordings: deleted within 7 days of the consult. The transcript and note stay available.
• Transcripts, notes, check results and audit logs: kept while the GP's account is open, so the GP can return to them and support their claims. A GP can delete a consult at any time.
• After an account closes: GPs can export consult information for 90 days. It is then deleted, and removed from backups within a further 35 days.
• Billing records: kept for as long as tax law requires, generally five years.

The GP's own record of the consult belongs in the practice's clinical software. MBS Scribe is not a replacement for it.

12. Access and correction

GPs and practice staff can see and update their account details in MBS Scribe, and can ask us for a copy of the personal information we hold about them, or to correct it, by emailing support@mbsscribe.com. We will reply within 30 days. If we refuse a request, we will explain why in writing and how to complain.

13. If you are a patient

Your GP decides whether to use MBS Scribe and must ask you (or, for a child or a patient who cannot consent, their parent, guardian or authorised representative), and anyone else on the call, before recording. You can say no. If you do, the GP should not record, and MBS Scribe will not record unless the GP confirms you agreed.

Because your GP holds your health record, please ask your GP or practice first if you want to see or correct information about you. You can also contact us, and we will work with your GP to help.

14. This website

mbsscribe.com does not use advertising or analytics cookies and does not load third-party trackers. Cloudflare, which serves the site, processes visitors' IP addresses and request details to deliver pages and block attacks.

MBS Scribe itself uses cookies only to keep you signed in and secure.

15. Complaints

If you are concerned about how we have handled personal information, please email support@mbsscribe.com. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Depending on where you live, you may also be able to complain to the NSW Information and Privacy Commission, the Victorian Health Complaints Commissioner or the ACT Human Rights Commission.

16. Changes to this policy

We will post any change here with a new date. If a change affects how we handle consult information, we will email GPs at least 30 days before it takes effect.

17. Contact

Email support@mbsscribe.com with any question about privacy at MBS Scribe.