Your data
Where your data lives and who owns it
Your data is yours, and a full export of it goes with you if you leave. In any system we build, identifiable patient data never goes to an overseas AI model.
13 October 2026
The more of your week’s work you hand to AI, the more of it touches your customers’ details. So it matters which country those details sit in, and whether they come with you if you change suppliers.
The Privacy Act and your suppliers
National AI Centre, AI Adoption Tracker, “Last 3 months” view, read 1 October 2026 · OAIC, small business and APP 8, read 11 October 2026
On the National AI Centre’s tracker, 26.9% of Australian small and medium businesses felt well prepared for the cyber and privacy side of AI. That’s about 1 in 4.
Most businesses turning over $3 million or less sit outside the Privacy Act, but a health service provider is covered whatever its turnover. A business the Act covers that discloses someone’s personal information to a recipient overseas is generally accountable if that recipient mishandles it. So where a supplier keeps your customers’ details can become your problem.
Sorting your data first
Before we build anything, we sort what the system will hold into four kinds: public, business, personal, and health or legal. The most sensitive record in it sets the rules for the whole system. A booking calendar that holds one patient’s notes gets built as a health system, even if nearly everything else in it is appointment times.
Which country your data sits in
Ostley privacy policy v0.4.1, clause 10 · OAIC, APP guidelines, chapter 1, paragraph 1.30 · both read 11 October 2026
When we set up the database behind the system you and your staff sign in to, we put it in Sydney. For a trades business, that’s where your customers and jobs live. When Ostley OS holds health or legal records, the system itself runs from Sydney as well.
The services around the system can sit overseas, often in the United States. The common ones are the form on your website, the service that sends the system’s emails, card payments and any AI model the system calls. Some form services keep a copy of every enquiry sent through them.
Stripe, for one, processes payment information in the United States, and our own privacy policy says so.
If the Privacy Act covers your business, your privacy policy has to say whether you’re likely to disclose personal information to anyone overseas and, where it’s practical, in which countries. Ask every supplier, us included, for a list of the services your system uses and the country each one is in. You’ll need it to write that part of your policy.
Patient data and AI
Ostley privacy policy v0.4.1, clauses 7 and 15 · Law Council of Australia, Australian Solicitors’ Conduct Rules, rule 9 · both read 11 October 2026
Patient data counts as identifiable if it could tell someone who the patient is: a name, a date of birth, a Medicare number, or a few details that together point to one person. None of that goes to an overseas AI model in a system we build, and our privacy policy commits to the same in clause 7.
With the identifying details taken out, AI still does real work: a model can read a referral letter and draft the summary a doctor checks. Where a job can’t work without those details, the processing stays on-shore.
“As a matter of best practice, the OAIC recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, due to the significant and complex privacy risks involved.”
Office of the Australian Information Commissioner, guidance on privacy and the use of commercially available AI products, published 21 October 2024, updated 17 January 2025, read 11 October 2026.
That covers a receptionist pasting a patient’s email into a free chat app to tidy up the reply. If it happens in your office today, stopping it costs nothing, and the help with the wording can come back in a tool that keeps the patient’s details out.
When Ostley OS holds health records, signing in takes a password and a code from an authenticator app, so a stolen password on its own opens nothing.
A law firm carries a duty of its own. Under rule 9 of the Australian Solicitors’ Conduct Rules, a solicitor generally must not disclose a client’s confidential information. That duty is one reason Ostley OS runs in Sydney, database included, when it holds legal records.
If you leave
Ostley terms v0.6, clauses 13, 14 and 17, read 11 October 2026 · Ostley OS terms v0.1, clause 15, a draft still under review
Our recurring services run month to month after any minimum term in your proposal, which sets out the terms in plain words before you sign. When you end the service, a full export of your data goes with you: your customers, their enquiries, the messages and the records the system kept. It comes as CSV or similar files, the kind Excel, Google Sheets and the next system can open.
Ask any supplier what format their export comes in before you sign. If only their own software can open it, the export won’t get you far.
Your domain is registered in your business’s name, and our terms let you move it to your own account at no charge.
We keep the code we write. Under our terms you use it for your business, under licence, while your fees are paid. Your data and your domain stay yours either way.
Questions for any supplier
| You ask | We answer |
|---|---|
| Which country is my customers’ data in? | We put the database behind the system you sign in to in Sydney. Services around it, like email and card payments, are often in the United States. |
| Does the system itself run in Sydney? | When Ostley OS holds health or legal records, yes. |
| Can an overseas AI model see my patients’ details? | Only with everything that identifies them taken out. |
| Does the AI train on my data? | No. We don’t let the AI providers inside our systems train their models on it. |
| Does my system use AI at all? | We tell you before we build. Some systems are built with AI and run without it. Others call an AI model as they work. |
| What does signing in take? | When Ostley OS holds health or legal records, a password and a code from an authenticator app. |
| Whose name is on the domain? | Your business’s. |
| What do I take if I leave? | A full export of your data, in CSV or similar files. |
| Who owns the code? | We do. You use it under licence while your fees are paid. |
Bring the list to the discovery call and we’ll answer each one for your business. The call is free and takes 20 minutes, on Google Meet or in person.