What does the audit log record?

Every access to a record is written to an append-only audit log, enforced at the database level. Ordinary access can add entries, never edit them. That covers listen-back during review, and any access to a confirmed note.

Append-only, by construction

Append-only is a property of the database, not a policy someone follows. A trigger prevents ordinary changes to existing entries. Retention is a separate control: after an export and the applicable retention period, an authorised lawful purge can remove eligible records, with its own evidence trail. Deleting clinical content does not bypass audit retention.

What else is kept alongside it

Small Mercy also keeps security records: sign-in events, IP address, device and app version. They sit next to the audit log so unusual activity can be detected and every access accounted for. These are records about access, not extra copies of clinical content.

Where it fits with everything else

The audit log is one of the live checks a patient can watch during the consult, alongside encryption, residency and deletion. Each line is checked against the running system rather than quoted from a policy.

Alongside it: AES-256 encryption at rest and TLS 1.2/1.3 in transit, email sign-in with optional passkeys, and clinical data on Australian infrastructure in Sydney and handled in line with the Australian Privacy Principles on the AU Sovereign and Global profiles — on the UK Sovereign region, stored in the United Kingdom and handled in line with UK GDPR. Small Mercy doesn’t yet hold formal certifications — they’re on the roadmap, and we’d rather say that plainly than imply otherwise.

The full posture is set out on privacy by design, and what’s collected is listed in the privacy notice for your region.

Related: who can listen to a recording.