Privacy you can
see for yourself.
Your patient can see Small Mercy's privacy checks during the consult. Here’s what they check, how your record is protected and where your information goes.
Small Mercy’s default transcription and note drafting run on vetted Australian services over private links; speaker identity stays on its own infrastructure. An optional confirmed-document send reaches the connected practice-software account.
If part of Small Mercy’s processing pathway is unavailable, it pauses and says so rather than silently rerouting. A Small Mercy-managed route beyond Australia runs only after clear disclosure and explicit acceptance for that session and purpose.
Not audio, not transcripts, not notes. Your consultations are not a dataset.
Free deletes audio when the first draft arrives. Paid deletes it on confirmation by default, with bounded practice policies and a hard seven-day ceiling.
Every access is written to an append-only audit log — ordinary access can add entries, never edit them; lawful purge follows export and the required retention period.
From first word to deletion receipt.
Capture starts only in a consented session, and audio reaches Small Mercy's private Australian cloud in Sydney.
Small Mercy-held audio is AES-256-encrypted. Paid retains it for listen-back during review; Free deletes it when the first draft arrives.
Free deletes audio when its first draft arrives. Paid deletes it on confirmation by default; a practice can set a bounded retention policy. An automatic sweep enforces the 7-day hard ceiling in every mode.
A QR deletion receipt — login-free, PHI-free — flips to "Verified" only when the audio is actually gone. They can re-scan it any time.
The same lifecycle, seen from inside a confirmed note. The privacy rail names the encryption and the append-only audit log, offers to verify them, and reports that the audio has already gone — pointing back to its recorded lifecycle rather than asking you to take it on trust.
The patient watches the checks run.
During the consult, a privacy view runs live checks — encryption, residency, isolation, deletion, audit. Every line is a check against the running system, never a static claim. It's the difference between "trust our policy" and "watch it hold".
Every access to a record is written to an append-only audit log, enforced at the database level — ordinary access can add entries, never edit them; lawful purge follows export and the required retention period.
An illustration of Small Mercy-side consult checks. A confirmed-document send to connected practice software is a separate clinician action.
The app can show the Small Mercy-side evidence during a consult. Small Mercy record in Sydney · default Small Mercy processing in Australia · Small Mercy-held audio deleted by default.
Illustrative sequence. This marketing page does not run checks against a real consultation.
The patient leaves with proof, not a pamphlet.
At the end of the consult the patient can scan a QR code and keep the receipt. It's login-free and carries no patient details — just a reference that flips to "Verified" when the audio is actually deleted. They can re-scan it next week and watch it still hold.
It's a small thing with a sharp edge: a deletion promise you can hand to someone is a deletion promise you have to keep.
The unglamorous parts, done properly.
TLS 1.2/1.3 in transit; application-level encryption of transcripts, notes, PII and voiceprints at rest.
Email sign-in, optional passkeys, configured second-factor protections, refresh-token rotation and a WAF.
Small Mercy-held clinical records and default processing use Australian infrastructure. Optional sends to practice software reach the connected vendor account.
We don't yet hold formal certifications — they're on the roadmap, and we'd rather say that plainly than imply otherwise.
One profile per organisation, chosen at sign-up.
Every organisation runs on exactly one profile, chosen at sign-up and applied to everyone in it — it can't be switched in place. Your clinical record is stored in Australia on both. Change your region any time from the switch in the top bar.
On UK Sovereign, your clinical record is stored in the United Kingdom. Transcription and note drafting run on vetted services within the United Kingdom or European Union, under the consent your organisation gives — disclosed on every note — and are never used to train models. The optional Global note fallback is currently disabled; if enabled, after an in-region note-drafting failure a clinician may accept a single-use offer to send only that consult’s transcript for its note and later redrafts, never audio or other outputs. Global processing may occur outside the UK and EU; the organisation and session stay UK Sovereign, with no automatic switch. Sending a confirmed note or letter to connected practice software is a separate clinician action into the vendor account; Nookal’s European API service alone does not establish where that account stores data.
On AU Sovereign, Small Mercy stores the clinical record in Sydney and runs transcription and note drafting on vetted Australian services over private links — disclosed on every note under your organisation’s processing consent. The optional Global note fallback is currently disabled; if enabled, after an in-cell note-drafting failure a clinician may accept a single-use offer to send only that consult’s transcript for its note and later redrafts, never audio or other outputs. Global processing may occur outside Australia; the organisation and session stay AU Sovereign, with no automatic switch. Consent to record is separate for each consultation. Speaker identity is matched only on Small Mercy’s infrastructure. A Small Mercy-managed route outside Australia needs separate, explicit acceptance for that session and purpose. Sending a confirmed note or letter to connected practice software is a separate clinician action into the vendor account; Nookal’s Australian API service alone does not establish where that account stores data.
Global managed providers process audio and transcripts by default under your organisation's consent. Small Mercy stores your clinical record in Australia. No provider uses your data to train their models.
Small Mercy is a documentation aid, not a diagnostic device. It does not recommend a diagnosis or treatment. It must never invent, suggest or infer clinical facts absent from the source; required gaps are marked [not stated]. Source and critical-detail checks are advisory, and every draft requires explicit clinician confirmation before it is saved. Read the responsible-use statement.
Fair questions.
Paid listen-back is available to you while audio is retained for review; every access is logged. Free deletes audio when the first draft arrives and has no playback.
An automatic sweep deletes the audio within 7 days. It's a hard ceiling enforced by the system, not a setting someone can forget.
Never. Not audio, not transcripts, not notes. If that ever changed it would be opt-in, disclosed here first — and we have no plans to change it.
It's entirely separate from clinical data — an email address in a standard hosting store, disclosed plainly in the privacy notice for your region.
Show your patients, not just tell them.
Start free with 25 write-ups a week and no card. An uncapped 14-day individual web trial is also available. Paid Individual plans start at the founders price of A$49/month + GST, held while your subscription stays active. Practice terms are shown on the pricing page.