What Refera does and doesn't do with your data

General information, not legal advice. Reviewed by: pending

This page describes how Refera handles referral information today. It has not yet been reviewed by a lawyer. The executed data processing agreement, once approved, governs.

Who this page is for: practice owners, managers and their advisers who want the short, exact answer.

What Refera does

• Reads only the inboxes you connect, read-only. Refera reads new mail only from the Microsoft 365 inboxes the practice connects, one folder per mailbox, and nothing else. Each connection is approved separately. Its Microsoft permission is read-only and limited to each connected mailbox, and Refera proves its access stops there before any referral is captured. It does not import older mail.
• Stores referral records in AWS Sydney. The licensed portal, API and stored platform copies remain in AWS Sydney, encrypted in transit and at rest, with each practice’s data separated in a shared, partitioned store.
• Extracts administrative details for your team to check. Fixed rules pull out details such as the patient, referrer, reason, Medicare number and contact details. Where a practice’s agreement and activation enable AI-assisted administrative extraction, Amazon Bedrock receives recovered referral text, never images, through its Sydney runtime endpoint and Australian inference profiles, with inference in Sydney and Melbourne. Bedrock data retention is set to none and customer content is not used for training. A model value is kept only if it appears in the letter.
• Records every step. Each action your team takes is added to a tamper-evident history that nobody can quietly edit. Corrections are new entries; the earlier value stays visible.
• Lets you leave with your records. Structured data and the available sealed history export free at any time.

What Refera doesn’t do

• Never sells your data. Refera never sells patient information, uses it for marketing, enriches it from other sources or uses it for another customer.
• Never trains AI on it. No model is trained on your practice’s referral information.
• No clinical judgement. Refera performs no clinical triage. It never ranks referrals by urgency or interprets clinical content; the referrer’s words are shown as theirs.
• Never contacts patients on its own. Nothing is sent to a patient or referrer without a named person approving it, through the practice’s own channel.
• No access to your other systems. Refera does not read other mailboxes, connect to your EMR or write to your booking system.
• No patient data in logs or support. Operational logs exclude patient content, and Refera’s support channels do not accept patient information.

What Refera keeps, and for how long

Refera keeps the practice’s referral records so the team can work on them and export them. That is separate from the AI service, which does not retain inputs. Today, closing an account revokes access and preserves the records; it does not delete or de-identify them. A reviewed deletion and de-identification process, with backup-retention evidence, must be in place before live capture begins, and the data processing agreement will set the agreed periods. Refera does not claim instant deletion.

Who else is involved

A short list of named sub-processors supports hosting, email and the optional services; see Sub-processors. Public website, signup, billing, optional voice and support requests contain business information only.

Related

• Handling health information: what your practice must do
• Security, breaches and the NDB scheme
• Data residency
• Exports and leaving

Administrative process-state only - Refera performs no clinical triage.