Privacy across the patient journey.

The healthcare service and Echo have distinct roles.

Visualisation Hub Pty Ltd trading as Echo Health AI provides the platform under an agreement with the healthcare organisation. The treating service is responsible for its care and record-handling decisions; Echo has its own obligations and the processing responsibilities agreed for the deployment. Website enquiries are handled separately. This statement does not assume that every activity has the same legal role or lawful basis.

Information within scope.

Depending on enabled services, the platform may handle patient and practitioner identity and contact details, appointments, referrals, clinical records, uploaded documents, consultation audio and transcripts, reviewed notes and correspondence, consent and representative details, billing information, messages and audit records. Optional patient-app functions may handle information a person chooses to share. The final notice must identify the actual enabled categories and collection sources.

Sources and purposes.

Information may come from patients, authorised representatives, healthcare professionals, practice administrators and authorised connected systems. Its agreed purposes may include preparing and documenting encounters, coordinating care, managing practice work, communications, security and required records. Collect only what the service needs. The final notice must explain any collection required by law, the consequences of not providing it and available alternatives.

Recording and meaningful choices.

A patient must be told what recording or AI assistance involves, the relevant recipients and their choices before the activity begins. Consent and withdrawal need to be recorded for the specific purpose where required. Refusing recording should trigger the health service's alternative workflow. Capacity, mature minors, guardians and other representatives need an appropriate assessment; age alone does not settle every authority question.

AI processing and model training are separate purposes.

Preparing a draft for a consultation is different from retaining information to train or fine-tune a model. The repository records the production-data training consent decision as unresolved. An older privacy policy permits some internal use of de-identified data; that wording has not been adopted as authority for Echo One. The final agreement must state the approved position and each provider's processing, retention and training settings before clinical information is supplied.

Sharing and service providers.

Access and sharing must match professional roles, patient authority and the agreed clinical workflow. External processing, support access and connected services need a current schedule naming the providers, purposes, information involved, locations and contractual safeguards. The older supplier list cannot establish the current deployment. Publication of this statement does not authorise a new disclosure.

Security and accountability.

The implementation uses practice-scoped access, controlled AI proposals and recorded decisions. The agreed deployment must also provide evidence for authentication, encryption, keys, support access, backups, vulnerability management and incident response. Technical design is not independent certification. Information in a clinical source must not become an instruction to bypass access or review controls.

Retention, record correction and exit.

Clinical records, recordings, transcripts, messages, audit events and backups may need different schedules. Applicable record obligations and legal holds must be considered. A correction may require an attributable amendment rather than rewriting history. The final schedule must explain export, deletion and backup handling. Website-enquiry retention remains separately pending; no single duration is invented here.

Access, correction, choices and complaints.

Start with the treating service for access to or correction of its clinical record. Contact security@echo-health.ai for Echo's processing or privacy concerns; the parties should coordinate requests according to their responsibilities. Identity and authority may need to be verified. Deletion and withdrawal requests require assessment against applicable law and record obligations. The final notice must state the handling process, response arrangements and escalation to the OAIC.

Before clinical use.

• Complete the deployment's collection notice and data-processing annex.
• Confirm active providers, recipient countries and support access.
• Resolve the model-training position without treating routine processing consent as training consent.
• Approve each retention category, export process and deletion procedure.
• Confirm incident handling, request handling and the accountable operational roles.