Trust Centre

1. Australian Data Residency

Meet your obligations under Australian privacy and health records law without managing offshore data risk.

• All patient health information is hosted and stored in Australian data centres.
• Production databases, patient documents and backups containing patient health information remain in Australia.
• Our platform runs on enterprise-grade cloud infrastructure with physical security, redundancy and continuous monitoring.
• A list of our sub-processors is available on request.

2. Privacy and Regulatory Compliance

One platform that satisfies Australian requirements and maps to the international standards your governance team already knows.

Consentic is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Many of our customers and partners also assess vendors against the US Health Insurance Portability and Accountability Act (HIPAA). Our safeguards are designed to meet both frameworks:

Consentic also supports state health records legislation, such as the NSW Health Records and Information Privacy Act 2002 and the Victorian Health Records Act 2001, and Services Australia requirements for digital Medicare Assignment of Benefits.

3. Certification and Independent Assurance

Evidence you can hand to your board, hospital partners or procurement team — not just promises.

• ISO/IEC 27001: we are actively working towards certification of our information security management system.
• HIPAA: our administrative, physical and technical safeguards are aligned with the HIPAA Security Rule, and maintained as an ongoing part of our compliance program.
• 21 CFR Part 11: Consentic supports FDA 21 CFR Part 11 requirements for electronic records and electronic signatures, including secure, time-stamped audit trails, for use in clinical trials.
• Continuous compliance monitoring: our security controls are monitored on an ongoing basis through an automated compliance platform.
• Penetration testing: independent third-party penetration testing is completed annually as part of our compliance program.
• Security reviews: we routinely complete security questionnaires for hospitals, day surgeries and integration partners.

4. Encryption

Patient data is protected whether it is being stored or sent.

• All patient health information in our database is encrypted at rest.
• All data travelling between patients, practices, integrated systems and Consentic is encrypted in transit using TLS.
• Every request to our platform must carry a time-limited authentication token.

5. Access Control

Your practice decides who sees what.

• Multi-factor authentication (MFA) is available to all users and can be made mandatory by the practice.
• Role-based permissions let practices control which staff can view, send and manage consents.
• Patient-facing forms are delivered through secure, time-limited links, with one-time passcode verification for self-registration kiosks.
• Consentic staff access to customer accounts is limited to authorised personnel, used only to resolve support requests, and fully logged. Access logs are available on request.

Recommended settings for your practice

Security is shared between Consentic and your practice. We recommend that every practice:

• Enforces MFA for all users.
• Gives each staff member their own login and never shares accounts.
• Assigns each user the lowest-privilege role that fits their job.
• Removes departing staff promptly, and reviews the user list at least quarterly.
• Reports any suspicious activity or suspected account compromise to Consentic straight away.

6. Audit Trail and Accountability

A defensible medico-legal record of every consent.

• Every consent records who sent, viewed, completed and signed it, and when.
• Changes to consent requests are captured in a full audit history.
• Completed consents and their audit records are available to the practice to support medico-legal, accreditation and governance requirements.

7. Data Retention and Ownership

Records are kept as long as you may need them, at no extra storage cost to your practice.

• Your practice owns its data. Consentic processes it on your behalf.
• Australian health records retention requirements vary significantly with the patient’s age and jurisdiction — for example, records for patients treated as children may need to be kept for many years beyond adulthood.
• To support these requirements, Consentic retains consent records and patient health information by default, and absorbs the associated storage costs.
• Data export and deletion on contract end are available on request.

8. Infrastructure and Operational Security

A platform built to stay available and recover quickly.

• Hosted on enterprise-grade cloud infrastructure in Australia.
• Continuous monitoring and alerting across our production environment, including resource and availability alerts.
• Separate production and development environments, with ongoing patching and vulnerability management.

9. Business Continuity and Disaster Recovery

Your consent records are protected against loss, and the service is built to be restored quickly.

• A documented Business Continuity and Disaster Recovery policy and plan, with defined recovery time and recovery point objectives.
• Frequent automated backups of all practice and patient data, stored in encrypted storage that is independent of our primary hosting, and kept within Australia.
• Server, code and configuration backups are maintained separately, so the full platform can be rebuilt if required, including on alternate infrastructure.
• Automated alerts notify our technical team immediately if a backup fails.
• Backup restoration and recovery procedures are tested regularly, and the plan is reviewed after each test.
• If a major disruption occurs, affected customers are notified promptly and kept updated until service is restored.

10. Incident Response

If something goes wrong, you won’t face it alone.

• A documented Incident Response Plan covers security incidents, outages and suspected data breaches, from detection through to post-incident review.
• Every incident is triaged by severity. Critical and security incidents are escalated immediately to our senior technical leadership.
• Our response follows a structured process: investigate, contain, eradicate, recover, then harden and improve.
• Impacted customers receive regular updates throughout a critical incident, followed by a written incident report covering scope, root cause and remediation.
• If an incident may affect your patients’ information, we notify you without undue delay, help identify the affected records, and work with you to meet your obligations under the Notifiable Data Breaches scheme.
• Evidence is preserved during every investigation, and relevant logs are shared securely with affected customers when a security risk is identified.
• Incident and problem records are retained long-term to support review and continuous improvement.

11. Secure Integrations

Connect Consentic to your existing clinical systems without widening your risk.

• Integrations with practice management and clinical systems use authenticated, encrypted connections.
• Only the information needed for the consent and registration workflow is exchanged.
• Failed transmissions are retried automatically and monitored, so documents are not silently lost.

12. Documentation Available on Request

To support your due diligence, we can provide the following to prospective and existing customers:

• Sub-processor list
• Architecture and data flow diagrams
• Incident Response Plan (summary)
• Business Continuity and Disaster Recovery Policy
• Completed security questionnaires
• Penetration testing confirmation
• ISO/IEC 27001 certification status and supporting policies