Your patient data, protected
A clear view of where referral data is stored, how it is encrypted and which providers support the service.
Encryption
Refera uses encrypted transport for its network connections and encryption at rest for the referral data it stores. Its authorised service processes referral content only to provide capture, display and extraction.
Source matters. Microsoft 365, Gmail and IMAP protect the connection into Refera. HealthLink provides its own secure-messaging transport. Refera keeps that source visible on the referral record.
HealthLink states that messages are encrypted, delivery is acknowledged and email is not used for clinical-document transfer. Refera preserves HealthLink as the source channel; it does not relabel that transport as email. HealthLink's description.
Refera can restrict access to one referral mailbox and encrypt the connection, processing and storage. The practice remains in control of which inbound channels it accepts.
Refera stores its platform copies in Amazon Web Services in Sydney. Where the practice's agreement and activation enable administrative extraction, recovered referral text is processed through Amazon Bedrock's Sydney runtime endpoint and Australian inference profiles (au.*) in Sydney and Melbourne. The practice's original mailbox remains subject to its own provider settings.
Refera storage: AWS Sydney. Practice-enabled Bedrock inference: Sydney and Melbourne.
Refera storage is pinned to Sydney; practice-enabled Bedrock inference uses Sydney and Melbourne.
Where a practice's agreement and activation enable administrative extraction by an AI model, Refera uses Amazon Bedrock to process recovered referral text, never images. Requests enter through the Sydney runtime endpoint and use Australian inference profiles (au.*), with inference in Sydney and Melbourne.
Rules run first, and the model is used only below the extraction confidence threshold. Haiku 4.5 is the default, with at most one Sonnet 4.6 attempt when Haiku's result is invalid or a core field (patient name, date of birth, referrer or reason) is unresolved. Extraction returns administrative fields only. A model value is kept only if it appears in the letter. The Medicare number keeps its checksum validation. The model never sets urgency or category: any urgency wording is the referrer's own, copied verbatim by fixed rules, and category comes only from a labelled field. Refera performs no clinical triage.
For that enabled path, referral text is processed over a private network path, with no internet route for the extraction function. Bedrock data retention is set to "none" in both Australian regions, invocation logging is off, and customer content is not used for training.
OCR first recovers text from scans and handwriting. Only recovered text reaches Bedrock; images and PDFs are not sent to the model.
Where enabled by the practice's agreement and activation, the text-only extraction path uses Sydney runtime entry and inference in Sydney and Melbourne.
AWS states that Bedrock prompts and responses are not used to train base models or shared with model providers. AWS remains Refera's disclosed cloud service provider.
No base-model training. No model-provider access.
The Bedrock path blocks base-model training and model-provider access.
Infrastructure policy denies Refera storage and approved AI service actions outside Australian AWS regions. This protects the platform copies Refera controls.
Offshore service actions are denied and checked again before activation.
An attempted offshore action is refused by infrastructure policy.
CloudTrail records covered AWS control activity, Refera seals product actions in the Ledger and an automated check verifies the deployed residency policy.
Infrastructure enforced. Activity logged. Product actions sealed.
The region policy, AWS activity and product actions can all be checked again.
Refera maps its controls to the Australian Privacy Principles under the Privacy Act 1988. AWS publishes ISO/IEC 27001, 27017, 27018 and 27701 certification coverage for in-scope services. Refera's own ISO 27001 certification remains on the roadmap.
Provider certifications and Refera's own certification status are shown separately.
Stored source objects use AES-256 server-side encryption. Referral records in DynamoDB use AWS Key Management Service encryption at rest. Access requires an authorised service role and is recorded for audit.
AES-256 object encryption. AWS KMS-backed records. Scoped, auditable access.
Source objects and structured records use separate encryption controls behind scoped access.
Summary
The controls that matter most to a practice.
Need the procurement detail? The Trust centre and data-residency guide cover providers, regions and control evidence.