What we hold, how it is protected, and who can see it.
StatDoctor holds registration and identity documents for doctors, and roster and contact details for healthcare facilities. This page says plainly what that means, in the detail a privacy officer needs rather than the detail a brochure allows.
An Australian company, under Australian law.
StatDoctor Australia Pty Ltd, ACN 671 408 692, ABN 63 671 408 692, is an Australian company. It is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and it is regulated by the Office of the Australian Information Commissioner.
The full detail of how information is collected, used and disclosed is in the Privacy Policy, and the terms you agree to in the Terms of Use. Where this page and those documents differ, those documents govern.
Three kinds of information, and no more.
From doctors
Name and contact details, AHPRA registration, indemnity cover, CV and work history, references, and a police check where one has been obtained through the platform.
From healthcare facilities
Your organisation and site details, the people who run your roster, the shifts and roles you post, and the doctors you have chosen to keep in your bank.
From this website
Enquiries you send us, resources you download, and anonymous analytics about how pages are used. No clinical information is collected here.
The facility a doctor applies to, and nobody else.
This is the question doctors ask first, so it is answered plainly.
A doctor decides
Documents sit on the doctor's own profile. A healthcare facility sees them when that doctor applies to its shift or joins its bank, and not before.
A facility reviews
The facility reviews what it needs to make its own credentialing, scope of practice and onboarding decisions. Those decisions stay with the facility.
Nothing is brokered
StatDoctor does not put a doctor forward to a facility they have not chosen, and does not sell or share personal information for marketing by anyone else.
No clinical records
StatDoctor is a staffing platform. It does not hold patient records, and no patient information passes through it.
Controls, not adjectives.
Encrypted in transit
Every connection to the website, the app and the platform is served over TLS. There is no unencrypted path to the data.
Encrypted at rest
The database and the file storage holding documents are encrypted on disk by the managed infrastructure they run on.
Row-level security
Access rules are enforced in the database itself, on every table, rather than only in application code. A request that should not see a row cannot see it.
Authenticated access
Accounts are protected by password authentication with multi-factor authentication available, and staff access to production is limited to the people who need it.
Managed cloud infrastructure.
StatDoctor runs on managed cloud infrastructure rather than its own servers. The database and document storage are hosted by Supabase on Amazon Web Services, and the website is delivered by Vercel.
If data residency is a requirement for your organisation, raise it with us directly and we will tell you exactly where your data would sit and what we can commit to.
Where AI processing happens.
StatDoctor uses AI to read submitted documents and check them against the details on a doctor's profile: that a registration has not expired, that the name matches, that the document is the type the slot asked for. A person still makes every decision that follows.
That processing runs on Amazon Bedrock in the AWS Sydney region, through an inference profile that routes only within Australia. Documents are not used to train any model and are not retained by it. The restriction is enforced by the access policy on the credential itself, not only by configuration, so work of this kind cannot be sent elsewhere by mistake.
AI is also used for ordinary business work, such as researching and drafting correspondence with healthcare facilities. That runs on Anthropic's API, which processes in the United States, and it never handles a doctor's documents.
Every service with access, named.
These are the providers StatDoctor uses to run the platform. Each one is bound by its own agreement, and none of them may use your information for their own purposes.
| Provider | What it does |
|---|---|
| Supabase | Database, authentication and document storage |
| Vercel | Website hosting and delivery |
| Amazon Web Services | AI processing of doctor documents, in the Sydney region |
| Anthropic | AI used for business and prospecting work only; never doctor documents |
| Resend | Transactional and notification email |
| Validex (Risk Group Pty Ltd) | Nationally Coordinated Criminal History Checks, where requested |
| Google Analytics | Website analytics |
| Meta Pixel | Page views only; no conversion or lead events are sent |
| Stripe, PayPal | Payment processing |
What you can ask us to do.
Ask what we hold
You can ask for a copy of the personal information StatDoctor holds about you, and we will provide it unless the law requires otherwise.
Correct it
If something is wrong or out of date, tell us and we will correct it. Doctors can also update most of their own profile in the app.
Close your account
You can ask us to close your account and erase your information. Some records, including financial records, must be kept for seven years.
Complain
Complaints go to admin@statdoctor.net first. If you are not satisfied with how we handle it, you can take it to the Office of the Australian Information Commissioner.
If you find a security issue.
Email admin@statdoctor.net with what you found and how to reproduce it. We will acknowledge it and tell you what we are doing about it. Please give us a reasonable chance to fix it before disclosing it publicly, and please do not access, change or keep anyone else's data while testing.
Bring us your security questionnaire.
If your organisation has a privacy impact assessment, a vendor questionnaire or an information security review, send it through. We would rather answer it properly than have you guess from a web page.