On this page
Key points
- On iPhone and iPad, nothing is sent to an AI or transcription service until you give permission in the app.
- Note and document drafting run in Australia (AWS Sydney, ap-southeast-2) under zero-data-retention settings, and so does Miraa's server transcription batch. Consultation transcription is not always that batch. On iPhone and iPad every consult is transcribed by Apple's recogniser on the device and that text is saved as the consult's transcript, so the Australian batch is not what your note is drafted from. In the web app the same happens on Safari whenever Miraa's own in-browser model is unavailable. Apple may perform that recognition on its own servers rather than on the device: on iPhone and iPad Miraa records which of the two happened, and in the web app it can establish neither, so it records that transcript's residency as unknown. "Which providers receive it, and where" below sets this out.
- Identifiable patient health information is never used to train AI models by Miraa or by any model provider Miraa engages, and no clinic opt-in changes that. Miraa cannot make the same commitment for the browser and device recognisers described below, because it neither contracts with them nor can observe what they do with the audio.
- On iPhone and iPad you can withdraw permission at any time in Settings; AI features stop and the rest of Miraa keeps working. This control is not yet available in the web app.
What Miraa sends
When you record a consultation or dictate, whether the audio leaves your device at all depends on which engine turns it into text, and the next section names each one. Where Miraa's own model runs on your own device - in your browser in the web app, and for dictation on iPhone and iPad - the audio is transcribed there and is sent to no provider. Where a recogniser built into your device or browser produces the text instead, that audio goes to that vendor. Where a consultation runs Miraa's server transcription batch, Miraa sends the recorded audio to that service in Australia. The transcript itself, however it was produced, is sent to the AI providers named below when you ask Miraa to draft from it.
When you ask Miraa to draft a note, letter, referral, or other document, Miraa sends the transcript together with the consultation context you have chosen to include. That context may contain the patient's name, age, sex, reason for visit, history, medications, allergies, results, and previous notes held in your clinic's record, along with the template and instructions you selected.
When you use the Miraa assistant, translation, or a document draft, Miraa sends the text or audio you supply and the clinical context needed to answer it, plus your account and clinic identifiers so the request can be authorised, rate-limited, and audited.
Miraa does not send clinical content to its billing, analytics, or rate-limiting providers.
Which providers receive it, and where
Amazon Web Services, Sydney (ap-southeast-2). Amazon Bedrock runs the models that draft notes and documents. Amazon Transcribe runs Miraa's server transcription batch, with Amazon S3 holding the consultation audio for the length of that job and deleting it when the job ends. That batch is not run for every consult: where a live in-consult transcript has already been produced on your own device or browser, Miraa keeps that text as the consult's transcript and sends no audio to Amazon Transcribe for it. On Miraa's iPhone and iPad app that is what happens on every consult, so Amazon Transcribe is not what produced the words your note was drafted from there; in the web app it is what happens whenever the live transcript is usable. Telehealth consults, and any consult left without a usable live transcript, do run the batch. Miraa invokes Bedrock through Australia-only inference profiles on an account configured for zero data retention, so request and response content is not retained by AWS or passed to the model provider. Miraa operates under an AWS Business Associate Addendum.
Apple. The live in-consult transcript uses Apple's speech recognition. On devices that support on-device recognition the audio stays on the device; where the device does not support it, Apple processes that audio on its servers. On Miraa's iPhone and iPad app this is the recogniser used for every consult, and the text it produces is saved as the consult's transcript - the record your note is drafted from - rather than being replaced by the Australian batch. In the web app Apple's recogniser is reached on Safari, whenever Miraa's own in-browser model is unavailable, and its text is likewise saved as the consult's transcript; there Miraa can neither require Apple's recogniser to run locally nor observe afterwards whether it did, so it records that transcript's residency as unknown rather than assuming it stayed on the device. On iPhone and iPad, Miraa records for each transcript whether recognition stayed on the device or ran on Apple's servers.
Miraa's own on-device model. Where Miraa's own Whisper model runs - in your browser in the web app, and on the phone for dictation on iPhone and iPad - that audio is transcribed on your own device and is not sent to any provider. On iPhone and iPad this model is used for dictation only; consults there use Apple's recogniser, described above.
Your browser's own speech recognition, in the web app only. Where Miraa's on-device dictation model is unavailable, the Ask Miraa composer microphone and the note-edit dictation island fall back to the recogniser built into your browser, and on Chrome and Edge that sends the dictated audio to the browser vendor in the United States. This is dictation you compose with, not the consultation transcript, and it does not apply on Miraa's iPhone and iPad app.
The Australian transcription batch has no overseas fallback. If Amazon Transcribe cannot complete a job, the consult is not transcribed and Miraa tells you so, rather than sending the audio to a provider in another country. The providers Miraa engages are published in the Subprocessor List; that list does not name Apple as a recipient of consultation audio, or your browser's vendor as a recipient of dictated audio, because those recognisers are the ones already built into your own browser or device rather than services Miraa engages. Both paths are described here instead. Where an overseas disclosure occurs to a provider Miraa engages, Miraa takes reasonable steps under Australian Privacy Principle 8 to ensure that recipient handles the information consistently with the Australian Privacy Principles. Miraa cannot take those steps with Apple or with your browser's vendor, because it has no agreement with either and no way to observe what either does with the audio. What it can do for those two paths, and does, is name them here, record for each transcript what it is able to establish about where the recognition ran, and support a clinic that wants the path avoided.
How your permission works, and where it applies
On Miraa's iPhone and iPad app, Miraa asks for your permission before the first time it sends anything to an AI or transcription service, records which version of this notice you were shown, and holds those requests until you answer.
If you decline, Miraa does not send consultation audio, transcripts, or clinical context to any AI or transcription service. Recording, dictation, note and document drafting, the assistant, and telehealth transcription stay switched off. Your schedule, patient list, tasks, and existing notes continue to work as normal.
On iPhone and iPad you can give or withdraw permission at any time in Settings, under AI and data sharing. Withdrawing stops future processing. It does not delete work already produced, which stays in your clinic's record under the clinic's retention settings.
In the web app this permission step is not yet available. Miraa does not show the prompt there, there is no AI and data sharing screen, and AI features are therefore available without a separate AI-processing permission from you. What applies in the web app is this notice itself - what Miraa sends, which providers receive it, and where they process it - together with the patient consent step described below. On that step Miraa's servers refuse to transcribe a consultation where the patient's recorded decision is a refusal or a withdrawal, and, where your clinic requires a recorded decision before capture, where no decision has been recorded at all. Where your clinic does not require one, starting the recording is treated as the clinician's own attestation and Miraa writes that record itself, so read it as an attestation by you rather than as a decision the patient gave through Miraa. Miraa is building the web permission control; until it ships, treat this notice as a description of Miraa's processing rather than a record of a permission you have given.
Patient consent is a separate step
This notice covers your permission as the clinician using Miraa. It does not replace the patient's consent to be recorded and transcribed. You remain responsible for obtaining that consent, and Miraa records the decision against each consultation. Where a patient declines, do not record; document the consult as usual.
The wording Miraa suggests for that conversation is in the Patient Recording Notice and Consent Script.
Retention and model training
Identifiable patient health information is not used to train AI models. This applies to Miraa's own models and to every third-party model provider Miraa engages, and it is not subject to a clinic opt-in. Miraa cannot make that commitment for the two recognisers described under "Which providers receive it, and where" that are already built into your own browser or device: Apple's, which receives consultation audio, and - in the web app only - your browser vendor's, which on Chrome and Edge receives dictated audio. Miraa neither contracts with those recipients nor can observe what they do with the audio, so what happens to it there is governed by that vendor's own terms rather than by Miraa's.
Audio recordings and raw transcripts are deleted automatically after your clinic's retention window. Patient identifiers such as Medicare and IHI numbers are encrypted at rest.
Questions
Questions about this notice, or a request to access or correct information Miraa holds about you, can be sent to privacy@miraahealth.com. The Privacy Policy sets out what Miraa collects, how it is used, and the choices clinics and individuals have.