Security, privacy & regulation
Australian data, held narrowly and briefly.
Livel is being built to the Australian Privacy Principles with in-country hosting. The design principle is minimisation: hold the smallest set of clinical data that makes the four weeks before surgery work, and hand it back to the record of truth.
Livel is pre-pilot. This page states the standards the product is being built to and which certifications are complete versus in progress — it does not claim accreditations we do not hold.
Role-based by default
A scheduler sees that a patient is ready. They never see why. The matrix is yours to set and yours to audit.
Region, fixed by contract
Storage, processing and backups stay in Australian regions. No offshore replication.
Breach notification
0h
to a pilot service, ahead of the statutory assessment period.
Clinical fields held
Booking plus history. Nothing else.
No imaging, no full record, no billing data.
Tested before pilot
An independent penetration test runs before the first live patient, and the report goes to the service.
01 — Controls
What is in place, and what is not yet.
In place
Australian data residency
All clinical data stored and processed in Australian regions. No offshore replication, including for backups.
In place
Encryption in transit and at rest
TLS 1.3 for all traffic; managed key encryption at rest with keys held in an Australian key service.
In place
Role-based access
Clinicians, nurses and schedulers see different fields. Schedulers see status, never clinical history.
In place
Immutable audit log
Every read and write recorded with actor, timestamp and reason, exportable for governance review.
In progress
ISO 27001 certification
Controls implemented and being documented for audit. We will not describe this as certified until it is.
In progress
Independent penetration test
Scheduled before the first pilot goes live; the report will be shared with pilot services.
02 — Data lifecycle
Where a patient's data goes, start to finish.
Collection
Minimum viable clinical set
Booking details plus the structured preoperative history. No imaging, no full record, no billing data.
Consent
Captured explicitly, in plain language
Patients are told what is collected, who sees it and why, at the point they complete their history.
Use
Perioperative coordination only
Never sold, never used for advertising, and never used to train external models.
Return
Summary handed back
A structured summary goes into the health service's record of truth, so the source of truth stays with them.
Retention
Deleted on a schedule you set
Default retention ends a defined period after the episode of care, or on request. Deletion is verifiable.
03 — Regulatory position
A coordination tool, not a diagnostic device.
Livel applies published risk instruments and shows its inputs. It does not generate a novel diagnosis, does not gate a clinical decision, and does not act autonomously. We take the view that this places it outside software-as-a-medical-device classification, and we will state clearly if a future feature changes that.
Any service considering a pilot gets our written regulatory assessment, not a marketing summary of it.
Does
Apply published, validated risk instruments consistently
Does
Show every input and threshold behind a prompt
Does
Escalate patients for specialist human review
Does not
Generate a diagnosis or a novel clinical prediction
Does not
Block, approve or override any clinical or booking decision
Immutable audit log
Exportable for governance review, with a reason recorded against every access.
04 — Questions from IT and governance
The ones we get asked first.
Where is the data hosted?
In Australian cloud regions, including all backups. We can name the provider and region in the security pack, and a pilot agreement fixes them contractually.
Do you need a full EMR integration to start?
No. A pilot can run with manual booking entry. HL7 or FHIR integration is available when a service wants it, but it is not a precondition and it is not required to evaluate the product.
Who at Livel can see patient data?
Access is limited to named engineering and clinical staff, granted per-incident with a recorded reason, and logged. Routine product work is done against synthetic data.
How do you handle a breach?
Notifiable Data Breaches scheme obligations apply. Our commitment to pilot services is notification within 24 hours of becoming aware, ahead of the statutory assessment period.
What happens to the data if we stop using Livel?
You get a full structured export, and we delete our copy on a schedule you set, with written confirmation. There is no lock-in built on holding your data.