Privacy notice

1. Scope and roles

Refera provides administrative process-state software to Australian practices. Refera performs no clinical triage and is not a patient-facing service. Practices decide how referral information is collected and used in their care and administration. Refera handles that information as the practice's contracted service provider and on the practice's instructions.

New accounts begin with an empty workspace. For supported direct connections, Refera uses a fixed connection email containing no patient information; assisted paths use a clearly labelled check coordinated with the practice or its IT provider. Real patient data remains technically blocked until the published connection and privacy checks are complete, including the data processing agreement and the practice collection-notice check.

Do not send patient information through public channels. The public assistant, product-overview request, enquiry form, voice service, telephone line and billing forms are for business, product and account matters only.

2. What we collect

3. How we use information

Refera uses information to:

• create, secure and support the practice account;
• provide the contracted referral-administration workflow on the practice's instructions;
• prepare and verify practice branding the practice explicitly chooses;
• operate subscription checkout, invoice requests, receipts and account administration;
• answer product questions and respond to requested business follow-up;
• send generic account, security, billing and device notifications; and
• protect, test, audit and improve the reliability of the service using fictional test data and bounded operational evidence.

Refera uses deterministic account, security, allowance, billing, connector and activation checks to allow, pause or refuse an account action. These checks do not make patient-care decisions, rank referrals or infer clinical urgency. A practice user can ask the Refera team to review an account-control outcome through the privacy or support contact below.

Refera does not sell patient information, use patient information for direct marketing, train AI models on patient information, independently contact a patient, or use referral information to rank clinical urgency, acuity, severity or diagnosis.

4. Who receives information

Refera uses service providers only for the functions described in the current sub-processor register. The main groups are:

• AWS for the current licensed service, Australian storage and platform processing;
• Amazon Bedrock for a conditional future administrative extraction path. Real referral model processing is not active unless the exact Australian route, model, logging, retention and release evidence has passed;
• Cloudflare for the public website, documentation, analytics and business-only edge relays;
• Stripe for hosted checkout, payment methods, subscriptions and invoices;
• Resend for account, agreement and sign-in email;
• Cloudflare D1 and Slack for bounded business lifecycle, invoice-request, follow-up and operational handoffs;
• Attio, now retired, may retain historical business-only CRM records until provider-confirmed export, closure and deletion evidence is complete; it receives no new events;
• OpenRouter for bounded public/support request categories and trusted documentation only;
• ElevenLabs for optional consented business voice after its provider and release checks pass;
• Twilio as the retained fallback business telephone carrier;
• Telnyx as the candidate carrier for a future customer-visible business line. Refera displays a phone number only after verifying and publishing the active line; otherwise it offers email or chat; and
• browser push providers for optional generic count-only notifications.

Only the AWS and Bedrock referral-data path is permitted to receive patient or referral material. Business, public-site, support, voice, CRM, billing-alert and push providers are prohibited from receiving it.

5. Where information is handled

The licensed portal and tenant data plane run in AWS Sydney and are protected by an AWS regional-deny policy. Any future real-referral AI processing must separately prove its exact Australian route before activation. The connected portal is served directly from AWS Sydney rather than proxied through Cloudflare.

Public website, payment, business email, CRM, support, browser push and optional voice providers operate overseas infrastructure. The countries in which recipients are currently likely to be located are the United States, United Kingdom, Ireland, Netherlands and Singapore. Those channels are restricted to the business-only or generic information described above and must not be used for patient, referral or clinical information. The live sub-processor register identifies each provider and its permitted scope. See Data residency for the testable technical boundary.

Provider certifications belong to the providers, not Refera. AWS infrastructure is independently ISO 27001 certified, and ElevenLabs states that it maintains SOC 2 certification. Refera does not claim either certification as its own.

6. Security

Refera uses encrypted transport and encrypted AWS storage, tenant-partitioned access, server-held seal keys, passkey-preferred access, email plus authenticator as the non-passkey live-access route, restricted recovery sessions, session revocation after factor changes, one-hour inactivity locking, privacy-safe logging and a sealed event history.

Authorised Refera services process referral content only to provide the features a practice has enabled. Current controls, provider responsibilities and independent assurance are published on the Trust page.

7. Retention, export and deletion

Refera keeps information for as long as needed to provide and secure the service, maintain required business and acceptance records, respond to a request, and meet any applicable legal, security and backup-retention obligations. Retention differs by record and provider; this notice does not promise one period for every category.

A practice can export its structured tenant data and available sealed history free while the account is open. Current account closure is authenticated and operator-assisted: it revokes access and preserves the records while Refera confirms the lawful export and retention position. A deletion or de-identification process is not deployed today and must be completed before live capture begins. Refera does not claim instant cryptographic erasure.

For optional web and telephone voice, ElevenLabs temporarily saves the business call so Refera can prepare the requested summary and follow-up. Refera targets deletion from ElevenLabs within four hours; provider retention is capped at one day, and deleted data may remain in provider backups for up to 30 days. Refera keeps the business summary and limited delivery records, but not a copy of the raw audio or transcript. This channel is for product and practice enquiries, not patient, referral or clinical information.

8. Access and correction

Practice users can review and correct their business profile in the authenticated workspace and can request access, correction, export or closure through Refera. Corrections to sealed referral history are recorded as new events rather than silently rewriting the prior record.

Patients should direct access or correction requests about their referral or health information to their practice. Refera assists the practice with the records it processes on the practice's instructions.

9. Contact, concerns and changes

Refera may update this notice when the service or its providers change. The effective date at the top changes with it. A change to this public notice does not silently change an accepted practice agreement; where re-acceptance is required, Refera presents the new agreement separately.