Care for the information behind the care.

Core clinical data stays in Sydney

Bilby’s production database, uploaded files, encryption keys and backups are hosted on Amazon Web Services in Sydney, Australia. No cross-region backup copying is configured.

Connected services have their own processing arrangements. Some of those services process information outside Australia. The service provider register lists each provider by name, purpose and location. Sydney hosting of clinical records should not be read as a promise that every connected service processes all information exclusively in Australia.

Encryption and recovery

Clinical information is encrypted in transit and at rest. The production database uses AWS RDS PostgreSQL with Multi-AZ availability, deletion protection and automated backups.

Point-in-time recovery covers up to 35 days. Additional protected monthly snapshots are retained for 395 days, and yearly snapshots for 2,555 days. These backup copies are held separately from the live application.

Staff roles and recorded activity

Administrator, practitioner and reception roles control the functions staff can use. Activity history records changes, exports and file downloads. It does not record every chart or file view.

Notes start as drafts. Once published, a note can be amended or withdrawn, but not deleted. Every change is recorded, along with the person who made it. Publication is not a signing or locking mechanism.

Multi-factor authentication is on by default. Sign-in is provided through Clerk, with email verification and re-verification when required.

Independent assessment

We’re working with an Australian cybersecurity company to arrange independent penetration testing. We’ll update this page when the results are finalised.

Your information when you leave

Practices can export their clinical information, including documents and invoices. Practice owners can schedule practice deletion, with a 30-day grace period during which they can cancel the request. A purge follows that period.

This is a practice-wide process. Inactivating or merging an individual patient is not the same as erasing their record.

Deleting live data does not immediately erase protected backup copies. Those copies remain until their retention periods expire. Contact us to discuss your requirements before scheduling deletion.

Questions about your practice?

Contact the Bilby team for more detail about data handling, connected services or security requirements before deciding to switch.