---
title: "MedExtract (MedExtract (trading name; no corporate entity, ACN or ABN published))"
url: "https://ailawframework.com/software/medextract"
type: "software_profile"
site: "AI Law Framework"
id: "medextract"
vendor: "MedExtract (trading name; no corporate entity, ACN or ABN published)"
category: "Legal-specific"
segment: "Medico-legal"
confidence: "low"
last_reviewed: "2026-09-27"
---

# MedExtract (MedExtract (trading name; no corporate entity, ACN or ABN published))

> Australian service that turns large medical record bundles into a date-ordered chronology, a narrative summary, a de-identified version and an audit report, for personal injury, workers compensation, TPD and public…

Canonical page: https://ailawframework.com/software/medextract  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: MedExtract as published on medextract.com.au and sold as fixed-scope paid pilots: Medical Chronology, Medical Summary, De-Identification and Audit & Provenance outputs. No terms, DPA or sub-processor list is published.

Australian service that turns large medical record bundles into a date-ordered chronology, a narrative summary, a de-identified version and an audit report, for personal injury, workers compensation, TPD and public liability files.

## Capabilities

- Chronology building
- Document summarisation
- Data extraction
- Redaction

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | Managed service |
| Hosting regions | Unknown |
| Australian region | On request |
| Training on customer content | No |
| Retention | The compliance page states 'Records are retained only for the period required to deliver outputs and fulfil contractual obligations. Secure deletion on request or at the end of the retention period, in accordance with APP 11.2', checked 2026-09-27. No retention period is published. The same page says a 'Data Processing Agreement' covering 'data handling, security standards, retention periods, deletion procedures, breach notification obligations, and permitted uses' is 'Available before the pilot begins', so the retention period is set in a document that is not published. |
| Legal content coverage | No legislation or case-law library is published. The vendor states the pipeline 'Understands AMA 4/5 impairment ratings, state-specific WorkCover schemes, Medicare and PBS references, and Australian clinical terminology out of the box', which is a claim about medical and scheme terminology rather than a published legal content set. |
| Pricing | No figure is published. The pilot page states the pilot is 'a paid engagement with defined deliverables' covering '3-5 cases, full production outputs', 'Priced per case based on complexity and volume', and that 'If the pilot converts to an annual contract, the pilot fee is credited in full toward your first invoice', checked 2026-09-27. The home page states 'We offer fixed-scope paid pilots with clear success metrics.' No rate card, per-page rate, subscription price or annual contract price is published anywhere on the pages read. |
| Australian presence | Yes. Contracting entity and ACN or ABN: none is published. The footer of every page read carries a copyright line naming an individual rather than a company, followed by 'ABN on request', and a location line reading 'Melbourne, Australia', checked 2026-09-27. No company, trust or partnership name appears anywhere on the three pages read, so the party a firm would contract with is unidentified, and the ABN is withheld until asked for. Australian data residency: the compliance page and the pilot page both state 'Live customer pilots are scoped around Australian-hosted processing and storage, with model-provider, retention, access, and deletion requirements confirmed before any live records are processed', and the APP 8 row of the compliance table repeats that wording. The home page headline states the product is built 'with audit trails and Australian data sovereignty by design' and a statistic tile reads 'AU Data sovereignty by design'. The detailed sentence makes residency something scoped for each pilot rather than a published property of the service, and no cloud provider, region or data-centre location is named on any page read. Whether inference runs in Australia is not published; the compliance page says only that the 'model-provider path' is confirmed in writing before live records are processed. State and territory law is addressed by name: the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT), with the vendor stating its practices 'are designed to comply with the most stringent requirements across all jurisdictions'. |
| Website | https://medextract.com.au |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and deliverables covered | Public claim only | The vendor publishes four named deliverables: Medical Chronology ('Structured, date-ordered timeline of all medical events, diagnoses, treatments, medications, and providers. Every entry hyperlinked to its source page in the original records'), Medical Summary ('tailored to case type: workers' compensation, personal injury, TPD, or public liability'), De-Identification ('Automated removal and redaction of identifying information') and Audit & Provenance ('Confidence scores per extraction, source page citations, model provenance logs, and flagged items requiring human review'). Outputs are delivered 'in Word, Excel, and PDF'. The pilot page adds a fifth item, a 'Pilot Evaluation Report'. All of this is on the vendor's own marketing pages; no specification document is published. | Which of the four deliverables are included in the price we are quoted per case, and is the de-identification output an extra? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) |
| Release stage of the product | Public claim only | The vendor describes the offering in pilot terms on every page read, checked 2026-09-27: '100+ Page bundles supported in pilots', 'Pilot Turnaround scoped per file and urgency', 'Pilot outputs can include reviewer checks where your workflow requires them', 'We offer fixed-scope paid pilots with clear success metrics' and 'Live customer pilots are scoped around Australian-hosted processing and storage'. The pilot page states 'Every pilot delivery is identical to what you'd receive as a customer.' No generally available product with published specifications, service levels or turnaround commitments is published. | Is there a generally available service behind the pilot, with published turnaround and volume commitments, or is every engagement scoped individually? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot); [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| How the service is delivered | Public claim only | The published model is a delivered service rather than software the firm operates: records are sent through 'our secure, encrypted transfer', 'Our AI pipeline reads every page', and outputs are returned as Word, Excel and PDF files. No tenancy, login, browser application, mobile client, API or on-premises option is published. No cloud provider or region is named. The deployment value recorded here is the closest available in the controlled list and should be read with this finding. | Do we get a tenancy and logins of our own, or do we send records and receive files, and where does the processing physically run? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) |
| How the extraction pipeline is described | Public claim only | The home page states 'Not a single-model black box. Different document types route to specialised models - vision models for scanned layouts, language models for clinical extraction, purpose-built OCR for handwritten notes', and that the pipeline 'handles scanned PDFs, digital records, handwritten clinical notes, and mixed-format documents' at 'Up to thousands of pages per case'. Audit output is said to carry 'Confidence scores per extraction, source page citations, model provenance logs'. No model, provider, version, confidence-scoring method or provenance format is published, checked 2026-09-27. | How is the confidence score calculated, what does a model provenance log contain, and can we see a worked example on one of our own bundles? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Australian law addressed | Public claim only | The compliance page maps the service against named Australian Privacy Principles - APP 1, 6, 8, 11, 12 and 13 - and against the Health Records Act 2001 (Vic), the Health Records and Information Privacy Act 2002 (NSW) and the Health Records (Privacy and Access) Act 1997 (ACT), stating that handling practices 'are designed to comply with the most stringent requirements across all jurisdictions'. De-identification is said to follow 'the OAIC's De-identification Decision-Making Framework', including a 'motivated intruder' test. The page carries no version, no effective date and no governing-law or jurisdiction clause, and no contract is published. | Which entity gives these compliance undertakings, under which State's law would our agreement be governed, and are the compliance page statements warranted in the agreement? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Authority to send client health information | Not confirmed | Nothing published addresses the customer's authority, consents or notices. The compliance page says records are processed 'consistent with APP 6 primary purpose limitations' and that the vendor provides a 'Data Processing Agreement' before the pilot begins, but that agreement is not published, so who warrants what about consent and authority is unverified as at 2026-09-27. There is no controller and processor characterisation, and no customer warranty, on any page read. | In the data processing agreement, who is the APP entity responsible for the collection, and what does MedExtract require us to warrant about consent before we send a claimant's records? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Which models and providers process the records | Public claim only | No model, model family or model provider is named on any page read. The compliance page and the pilot page state that the 'model-provider path' is 'confirmed in writing' before live records are processed, and the APP 8 row states the same. The home page describes 'vision models for scanned layouts, language models for clinical extraction, purpose-built OCR for handwritten notes' without naming any of them. The model provider is therefore something settled per engagement rather than published. | Which models and providers will process our records, in which country does each of them run inference, and will that be named in the pilot scope document? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Sub-processors and onward disclosure | Not confirmed | No sub-processor list is published and no sub-processor, cloud provider, OCR provider or reviewer supplier is named anywhere on the pages read. The compliance page states that reviewer checks can be added 'where your workflow requires clinical QA, procurement assurance, or sign-off', which implies people other than the extraction pipeline may see records, but who they are and whether they are employees or contractors is not published. No change-notification right over sub-processors is published. | Please list every sub-processor and reviewer, employee or contractor, who could access our clients' records, with the country each one operates in, and how we are notified of a change. | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Whether records are used to train models | Public claim only | The compliance page states 'Client medical records are never used to train, fine-tune, or improve AI models. Records are processed solely for producing requested outputs, consistent with APP 6 primary purpose limitations', checked 2026-09-27. The APP 6 row repeats 'No secondary use. No model training on client data.' This is a statement on the vendor's own compliance page; no contract, data processing agreement or model-provider term is published to support it, and no model provider is named whose terms could be checked. | Will the data processing agreement carry the no-training undertaking, and does it bind the model providers as well as MedExtract? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Use of corrections and reviewer feedback | Not confirmed | Nothing published addresses what happens to feedback. The pilot page says 'We walk through the outputs together and gather your feedback' and the compliance page says 'corrections handled promptly post-delivery' under APP 13, but neither states whether corrections, reviewer annotations or evaluation results are retained, reused or excluded from the no-training undertaking. | Are the corrections we make to a delivered chronology retained, and are they excluded from the no-training undertaking in the same terms as the source records? | [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot); [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| How long records are kept | Public claim only | The compliance page states 'Records are retained only for the period required to deliver outputs and fulfil contractual obligations. Secure deletion on request or at the end of the retention period, in accordance with APP 11.2', checked 2026-09-27. No period is given. The same page says retention periods are covered in the Data Processing Agreement, which is 'Available before the pilot begins' and is not published. | What is the default retention period in days for records, outputs, backups and audit logs, and can we require deletion within a shorter period? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Deletion on request | Public claim only | The compliance page states 'Secure deletion on request or at the end of the retention period, in accordance with APP 11.2' and lists 'Secure deletion at end of retention period' under APP 11, checked 2026-09-27. No deletion timeframe, no certificate of destruction, no treatment of backups and no treatment of de-identified derivatives is published. Deletion procedures are said to be in the unpublished data processing agreement. | Within how many days of a deletion request are records, outputs, backups and any de-identified derivatives destroyed, and will MedExtract certify it? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Which people can read the records | Public claim only | The compliance page states 'Access controls enforce least-privilege principles. Audit logs track every access event' and lists 'Least-privilege access controls. Audit logging on all access events' under APP 11. Separately it states that 'A qualified reviewer checks all de-identified outputs before delivery' in the de-identification workflow, and that reviewer checks can be added for clinical quality assurance or sign-off. The number of people involved, whether they are employees or contractors, which country they work in and whether the firm can obtain the access log are not published. | Who are the reviewers who read our clients' records, are they employees, in which country do they work, and can we obtain the access log for a given case? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Authentication and account controls | Not confirmed | No login, tenancy, single sign-on, multi-factor authentication, role model or session control is published, because the published delivery model is a transfer of records and a return of files rather than an application the firm logs into. The pilot page refers only to 'Secure encrypted record upload' and 'our secure, encrypted transfer'. What that transfer is - a portal, a secure link or email - is not stated. | What is the secure transfer mechanism, who at our firm can authorise an upload or a download, and is multi-factor authentication available on it? | [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Encryption at rest and in transit | Public claim only | The compliance page states 'All data is encrypted using AES-256 at rest and TLS 1.3 in transit' and repeats 'AES-256 encryption at rest, TLS 1.3 in transit' in the APP 11 row, checked 2026-09-27. Key management, key custody and backup encryption are not addressed, and no security page or technical documentation is published; the compliance page says security documentation is 'Available on request for your IT and compliance review'. | Who holds the encryption keys, where are they held, and can we see the security documentation before the pilot rather than after? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Independent assurance | Not confirmed | No certification, attestation, audit report or independent test is claimed anywhere on the three pages read - there is no ISO 27001, SOC 2, IRAP or HIPAA claim, no penetration test statement and no trust centre. The compliance page offers 'Security Documentation' described as 'Technical documentation covering encryption standards, access controls, infrastructure architecture, and incident response procedures', 'Available on request'. The absence of any published assurance document is itself the finding, checked 2026-09-27. | Has any part of the service been independently audited or penetration tested, and if so by whom, when, and can we see the report? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| What we would be contracting to, and with whom | Not confirmed | No terms of service, master agreement or data processing agreement is published. The compliance page states a 'Data Processing Agreement' covering 'data handling, security standards, retention periods, deletion procedures, breach notification obligations, and permitted uses' is 'Available before the pilot begins'. The counterparty is not identified: the footer of every page read names an individual and states 'ABN on request', with no company, trust or partnership name, checked 2026-09-27. The pilot converts to an annual contract with the pilot fee credited to the first invoice. | Which legal entity contracts with us, what is its ACN or ABN, and can we see the data processing agreement and the annual contract before the scoping call? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Cross-border disclosure | Public claim only | The compliance page addresses APP 8 in conditional terms: 'Live customer pilots are scoped around Australian-hosted processing and storage, with cross-border disclosure requirements and model-provider path confirmed before live records are processed.' The home page headline and a statistic tile state 'Australian data sovereignty by design' and 'AU Data sovereignty by design'. No provider, region or data-centre location is named, and there is no statement that no data leaves Australia. The vendor also states of others that 'Offshore BPO and US-based AI tools process sensitive health information outside Australian jurisdiction' - a comparative claim about unnamed products that is not carried into this profile. | Will MedExtract warrant in writing that no record, prompt, output or log leaves Australia, and if any component sits offshore which one is it and under what APP 8 mechanism? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Data breach notification | Not confirmed | No breach notification commitment is published. The compliance page lists 'breach notification obligations' among the matters covered in the Data Processing Agreement, which is not published, and lists 'incident response procedures' among the contents of the security documentation available on request. There is no reference on any page read to the Notifiable Data Breaches scheme or to notifying the Office of the Australian Information Commissioner, notwithstanding that the pages otherwise engage closely with the Privacy Act 1988. | What notification period and content will the data processing agreement commit to for an eligible data breach involving our clients' health information, and who notifies the OAIC? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| How changes are notified | Not confirmed | No version number, effective date, change log or change-notification commitment appears on any page read, including the compliance page that carries the privacy and security statements, checked 2026-09-27. Because the pipeline is described as routing document types to different models, a model change would alter how records are processed, and no notice right over that is published. | Will we be told before the models, the reviewer arrangements or the hosting location change, and will the compliance statements be versioned so we can see what we relied on? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Ending the engagement and getting data out | Not confirmed | Nothing published addresses termination, transition or export. Outputs are delivered as Word, Excel and PDF files, which the firm keeps, but there is no statement about access to audit and provenance records after delivery, no post-termination deletion timetable and no run-off or transition assistance. The pilot page states there is 'No obligation beyond the pilot'. | After a pilot or an annual contract ends, what happens to the records, the audit and provenance logs and any de-identified derivatives, and over what period? | [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Integration with firm systems | Not confirmed | No integration, API, connector or practice management or document management link is published. Intake is described as 'Securely upload your medical records - any format, any volume' through 'our secure, encrypted transfer', and delivery as files 'in Word, Excel, and PDF'. Whether records can be pulled from, or outputs written back to, a matter file is not addressed on any page read. | Is there any way to send records from our document management system and return the chronology to the matter file, or is manual transfer the only path? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) |
| Whether the pipeline reaches outside the supplied records | Not confirmed | Nothing published states whether the models consult anything beyond the records supplied for the case. The vendor states that every entry is 'hyperlinked to its source page in the original records' and that 'Every extraction traces to a source page', which describes provenance of the output rather than a restriction on what the models may read. No statement excludes external retrieval or web access. | During extraction, does any model retrieve clinical reference material or other content from outside the bundle we supplied? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Whether the service takes actions of its own | Not confirmed | The published workflow is four steps - Upload, Extract, Review, Deliver - and describes no action beyond producing and delivering documents. No agent, workflow automation, outbound messaging or write-back to another system is published, and no statement sets a boundary on what the service may do without instruction. | Does any part of the service act outside producing the requested documents, for example contacting providers, requesting further records, or writing to another system? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) |
| Whether a human checks the output before delivery | Not confirmed | The vendor's statements differ across the same site, checked 2026-09-27. Optional: 'Reviewer checks can be included where your workflow requires added clinical QA, risk review, or sign-off. AI performs extraction; humans can be added where the use case calls for it' (compliance page); 'AI does the heavy lifting. Reviewer checks can be included where accuracy, risk, or client requirements call for human sign-off' (home page); 'AI extraction + scoped review ... Reviewer checks can be included where your workflow requires them' (pilot page). Mandatory: 'Human verification. A qualified reviewer checks all de-identified outputs before delivery. Automated de-identification is effective but not infallible - the human layer catches edge cases' (compliance page, de-identification framework) and, in the APP 13 row, 'Human review layer ensures errors are caught before delivery'. The audit deliverable also lists 'reviewer sign-off' and 'flagged items requiring human review' as though review is part of every delivery. | Is a human reviewer included in the price for chronologies and summaries, or only for de-identification, and who signs off the audit report if we do not buy reviewer checks? | [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) |
| Published evidence for the defensibility claims | Public claim only | The vendor publishes 'Defensible in court proceedings', 'Court-Defensible Outputs' and 'Outputs are designed to withstand cross-examination', and states 'Australian Clinical Fluency ... out of the box', checked 2026-09-27. No proceeding, ruling, expert evaluation, accuracy measurement, benchmark or methodology is cited on any page read, and no sample output is published. The site also quotes third-party statistics (Safe Work Australia, Key WHS Statistics 2025) about the claims market rather than about the product. | Has any output been tested against a manually prepared chronology, or been the subject of evidence in a proceeding, and can we see the accuracy method and results? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) |
| Fit for Australian scheme work | Public claim only | The vendor states the product 'Understands AMA 4/5 impairment ratings, state-specific WorkCover schemes, Medicare and PBS references, and Australian clinical terminology out of the box' and names the buyer groups it is built for: personal injury firms 'Plaintiff and defence', 'Insurers & TPAs' for 'Workers' comp, CTP, TPD, and public liability claims at volume', medico-legal firms for 'Assessment coordination, IME preparation, and desktop reviews', and medical specialists. Summaries are said to be 'tailored to case type: workers' compensation, personal injury, TPD, or public liability'. Nothing published shows which schemes or jurisdictions have actually been run, and no customer is named. | Which State schemes and claim types have been run on real files to date, and can you show a de-identified worked example for the scheme we practise in? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) |
| Check for vendor content directing how AI describes the product | Not confirmed | A deliberate check for content telling AI models, assistants or crawlers how to describe the product found none on this vendor's site as at 2026-09-27. Checked: a site map run that returned nine URLs, none of which is /llms.txt, /ai-info, /ai or /for-ai; the link sets and footers of the three pages read (home, compliance and pilot), which contain no such path; and the text of those pages, which contains no block addressed to AI models, assistants or LLMs. No file at /llms.txt was fetched directly, so this is an absence in what was indexed and read rather than a proven absence. The site does carry comparative marketing about unnamed other products - 'Many tools in this space are built for US or Canadian workflows' - which is not carried into this profile. | Does MedExtract publish any file or page addressed to AI models or crawlers, such as /llms.txt, describing how the product should be presented? | [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au); [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act); [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) |

## Notes

Four firecrawl operations were spent on this product: one site map and one home-page scrape in the research stage, then the compliance page and the pilot page. Everything recorded here comes from the vendor's own marketing pages; no binding document exists to read, because none is published. The site publishes no terms of service, no data processing agreement, no sub-processor list, no security page and no trust centre, and the footer link labelled 'Privacy' points to the compliance page rather than to a privacy policy. That absence is the central finding, and it means most of the critical controls are either a claim on a marketing page or unverified. The party a firm would contract with is unidentified: the footer names an individual, states 'ABN on request', and no company, trust or partnership name appears anywhere on the pages read. Australian residency is published conditionally, not absolutely - pilots are 'scoped around Australian-hosted processing and storage' with the model-provider path confirmed before live records are processed - while the home page headline says 'Australian data sovereignty by design'; no cloud provider, region or data-centre location is named and whether inference runs in Australia is not published, so australianRegion is recorded as on_request rather than yes. No model or model provider is named. There is a live conflict on human review: the compliance page states 'A qualified reviewer checks all de-identified outputs before delivery' and that the human review layer 'ensures errors are caught before delivery', while the same page and the home and pilot pages describe reviewer checks as something added where the buyer's workflow requires them. Ownership, founding year and any assurance remain unverified. The delivery model is a service rather than software the firm operates, and the deployment value recorded is the closest available in the controlled list. Deployment re-mapped to managed_service on 2026-09-27 when that value was added to the controlled DEPLOYMENT list (previously recorded ['saas'] because the list had no escape and forced a value). The firm sends records and receives files, with no tenancy, login, application or API published, so 'saas' misdescribed the delivery model. Segment re-mapped to medico-legal on 2026-09-27 when that value was added to the controlled SEGMENT list (previously ediscovery-litigation, used because no closer value existed).

## Sources

- [MedExtract - home page (deliverables, pipeline, buyers)](https://medextract.com.au) (checked 2026-09-27)
- [MedExtract - Privacy-aware AI medical record processing (Privacy Act, APPs, de-identification, client documents)](https://medextract.com.au/compliance/privacy-act) (checked 2026-09-27)
- [MedExtract - Pilot page (process, deliverables, pilot pricing and commitments)](https://medextract.com.au/pilot) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.