All patient and clinical data stored by Qliva is hosted within Australia. Processing is a separate question: several of the providers in the table below operate outside Australia. That table matches the list in our Privacy Policy, which is the canonical source.
Australia-first hosting
Qliva runs on AWS ap-southeast-2 (Sydney), with application compute in Vercel's Sydney region. This means all patient records, clinical notes, pathology results, prescriptions, invoices, forms, consents, and communications are stored in Australia. Where those records are processed by a third-party provider — AI drafting, transcription, telehealth video, email, SMS, payments, accounting, error and uptime monitoring — the provider's region is listed below, and several sit outside Australia.
This applies to:
- Patient demographics and health records
- Clinical notes and consult summaries
- Pathology results and clinical mail
- Signed prescriptions and eRx tokens
- Invoices and payment records
- Form responses and consent documents
- Communications (SMS and email logs)
- Wearable data synced from connected devices (coming soon)
Encryption
| Layer | Standard |
|---|---|
| Data at rest | AES-256 |
| Data in transit | TLS 1.2+ |
All data is encrypted both when stored on disk and when transmitted between services.
Tenant isolation and row-level security
Every table in Qliva's database has Row Level Security (RLS) enabled, and the core clinical tables carry policies that restrict rows to the signed-in user's own clinic (tenant_id). That is the database-level control on cross-clinic access. A small number of shared reference tables, such as pricing catalogues, hold no clinic or patient data.
RLS does not cover every path. Many server-side operations use a privileged service connection that bypasses RLS by design, and on those paths tenant isolation depends on the application code scoping each query to the correct clinic — so a mistake in that code could expose another clinic's data, and RLS would not catch it. Within a clinic, RLS does not restrict access by role; see our Privacy Policy.
Third-party services
Qliva uses third-party services for specific functions. Here's each one, what it touches and where it operates:
| Service | What data it touches | Region |
|---|---|---|
| Supabase | Database, auth, file storage | AWS ap-southeast-2 (Sydney) |
| Vercel | Application hosting and compute | Sydney (syd1) |
| Amazon Web Services | Server hosting the pathology receiver | ap-southeast-2 (Sydney) |
| Medical Objects | Inbound pathology and clinical correspondence | Australia |
| Parchment | Electronic prescribing (eRx tokens) | Australia |
| Tyro Health | Medicare and health fund claiming | Australia |
| i-Screen | External pathology ordering | Australia |
| Bloody Good Tests | External pathology ordering | Australia |
| Deepgram | Speech-to-text for the AI scribe | Australian regional endpoint |
| ClickSend | SMS delivery (phone number, message body) | Australian company; the region in which message data is held is not publicly specified and we have not obtained written confirmation of it |
| Anthropic (Claude) | Clinical text, de-identified first — used for AI note drafting, AI scribe note generation, pathology result extraction, treatment plan generation, communications drafting and Blueprint patient wording | Processed outside Australia |
| Sentry | Error monitoring — error reports and stack traces | Processed in the United States |
| Resend | Email delivery (content, recipient address) | Processed outside Australia |
| Daily.co | Live video/audio for telehealth consultations | Processed outside Australia |
| Google Calendar | Calendar sync, only where a practitioner connects their own calendar — appointment date, time and duration, appointment type name, the patient's full name in the event title, the telehealth link, and any appointment notes | Processed outside Australia |
| Microsoft Graph (Outlook Calendar) | Calendar sync, only where a practitioner connects their own calendar — the same event details as Google Calendar | Processed outside Australia |
| Apple iCloud (CalDAV) | Calendar sync, only where a practitioner connects their own calendar — the same event details as Google Calendar | Processed outside Australia |
| Stripe | Payment processing (card data never touches Qliva servers) | Processed outside Australia |
| Xero | Invoice and payment data (if connected) | Processed outside Australia |
| UptimeRobot | Uptime monitoring and public status page | Processed outside Australia |
Every AI feature that sends clinical text to Anthropic runs a PHI de-identification pass first (lib/phi/deidentify.ts). The pass is not a guarantee: if the model call fails for a reason other than a timeout, or returns an empty response, it falls back to pattern-matching alone. That still removes structured identifiers such as Medicare and phone numbers, but it can leave a name spoken conversationally in the text, and nothing signals when the fallback has happened.
AI Scribe and audio data
The AI Scribe feature transcribes in-consultation audio in real time via Deepgram. Qliva stores no consultation audio today — the platform holds zero audio files, and only the text transcript is retained, attached to the clinical note.
Be aware that this describes the current state rather than a hard guarantee. A private audio storage bucket and a direct browser upload path exist in the platform for handling large recordings, and it is empty at present. If that path is switched on for your clinic, audio would be stored in Australia alongside your other records. What Deepgram itself retains is governed by Deepgram's own terms, which we have not independently verified.
Wearable data and patient consent (coming soon)
Wearable and device integration is a planned feature and is not yet available on the platform. When launched, patients will explicitly connect their wearable devices through the patient portal, and no data will be collected without consent.
Backup and data retention
- Database backups: daily automated backups of the database, plus point-in-time recovery with a seven-day window
- File storage is not covered by either: documents held in file storage — pathology PDFs, signed consents, message attachments, clinic photos and pharmacy PDFs — are not included in database backups or point-in-time recovery. Restoring the database does not restore a file deleted from storage
- Retention: clinical data is retained for at least the period required by applicable health records legislation — generally seven years from the date of last service, and longer for records relating to children. We do not delete information that constitutes a health record until your clinic confirms in writing that it holds a complete copy, or instructs us in writing to delete it
- Soft deletion: records that are deleted within the app are soft-deleted — they are preserved in the database for regulatory compliance and can be recovered if needed
Qliva is designed for Australian healthcare providers and is built to comply with the Privacy Act 1988 and the Australian Privacy Principles (APPs).
If your clinic is subject to specific regulatory requirements — for example, government contracts requiring IRAP-assessed infrastructure, or jurisdictional data localisation requirements beyond standard APPs — contact Qliva support before going live. We can discuss your compliance needs and whether additional configuration is required.