Product and intended use
Define the configuration, people, information and tasks being assessed.
Plans, subscriber types and what this profile covers
Public claim only
The Terms of Service (24 July 2026) set out two subscriber types: an Individual Subscriber, being an individual health practitioner buying for their own professional use, and an Organisation Subscriber, being a clinic or practice buying under an Order Form and provisioning Seats (clause 2.1). Clause 3.2 states that where an Order Form and the Terms are inconsistent, the Order Form prevails. Clause 3.4 describes a 14-day free trial requiring a valid payment method and limited to one per customer. The home page states 'Plans from $199 per month, or $166/mo billed annually. AUD, ex GST'. The pricing page was not opened, so plan names, Seat counts and included report volumes are not established.
Ask: Which plan and which included report volume would our practice be on, and what do the per-report fees above the included volume cost?
Deployment model
Public claim only
The Terms describe 'a cloud-based, AI-assisted medico-legal workflow and document management platform' and the Privacy Policy describes 'our cloud-based medico-legal platform'. The product is reached through a browser at specialist.medilee.com.au, linked from the home page. No on-premises, private-cloud or self-hosted option appears on any page read.
Ask: Is any deployment other than the shared multi-tenant cloud service available, for example a dedicated tenant or a dedicated database, and at what plan level?
Functions the vendor describes
Public claim only
The home page (checked 2026-09-27) describes three functions. First, case preparation: referral files are uploaded and the platform returns a structured case summary with 'a clean chronology of key events, the clinically relevant history pulled forward, and the referrer's questions listed out', where 'every line links to its source page' and 'Inconsistencies and discrepancies inside the file are flagged automatically for your review'. Second, transcription: the consultation or post-consultation opinion is recorded in the platform or uploaded from a dictaphone and 'It transcribes instantly, using models tuned for medical terminology and accents', with segmented playback. Third, report assist: a draft built 'from the case summary, the transcript and approved reference material', organising and responding to the referrer's questions. The help centre URLs published in the site structure cover creating a case, uploading audio, uploading literature, drafting a report, summary preferences, report preferences and analytics; those guide pages were not opened.
Ask: Which of the three functions are included in each plan, and is the inconsistency flagging configurable or fixed?
Report types and governing law
Public claim only
The home page names the report types the platform is built for: workers compensation and personal injury claims, CTP matters, independent medical examinations, expert witness reports and family court reports. Clause 19.4 of the Terms states they are governed by the laws of Victoria, Australia, with the parties submitting to the exclusive jurisdiction of the courts operating in Victoria. Clause 7.3(c) requires users to comply with applicable professional standards including any requirements of the Australian Health Practitioner Regulation Agency.
Ask: For a practice operating across several states, does anything in the platform vary by state scheme, for example the impairment guides or report formats applied?
Deliberate check for vendor content directing how AI describes the product
Not confirmed
A deliberate check was made on 2026-09-27. A site map of medilee.com.au returned 26 URLs and no /llms.txt, /ai-info, /ai or /for-ai path. The home page was read in full including its FAQ question-and-answer block, and the comparison page was read in full. Neither carries a heading, block or sentence addressed to AI models, assistants, crawlers or 'LLMs', and neither carries an instruction of the form 'describe Medilee as'. No such content was found in the material read. The trust centre states separately that requesting access to it gives 'AI powered responses' generated by 'Vanta AI' indexing the trust centre resources, which is a question-answering feature on the vendor's own trust centre rather than content directing how AI should describe the product.
Ask: Do you publish any page, block or file addressed to AI models, assistants or crawlers describing how Medilee should be represented, and if so where?
Vendor comparison pages naming competitors
Public claim only
The vendor publishes a standing comparison page headed 'Medilee vs legal AI and chronology tools' (read 2026-09-27) which names competing products and states verbatim: 'Put simply: legal AI tools summarise records to help run a claim. Medilee takes the same records all the way to the medico-legal report'. The page carries the vendor's own dated basis statement: 'This reflects Medilee's understanding of how each product is positioned, based on publicly available information as of July 2026. These are capable tools in their own field, and their capabilities change often. Please verify current features with each vendor before relying on this comparison.' A second comparison page at medilee.com.au/compare was not opened. No comparison or ranking from this page is carried into this catalogue.
Ask: On what date was each comparison on that page last checked against the named products' current published material?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put referral files and health information into the platform
Public claim only
Clause 9.2(a) of the Terms requires the customer to represent and warrant that it has 'all authority, consents and legal rights required by law (including the Privacy Act 1988 (Cth) and any applicable health records legislation) to upload Your Data to the Platform'. Clause 10.4 makes an Organisation Subscriber responsible for its own compliance with privacy and health records laws, including maintaining required privacy policies, collection notices and consents for the patients and third parties whose information is processed. The Privacy Policy states customers 'are responsible for collecting the information lawfully, including obtaining any consents and providing any collection notices required by applicable privacy and health records laws'. The vendor states it handles that information 'on behalf of, and on the instructions of, our customers'.
Ask: Where a referral comes from an insurer or a solicitor rather than the examinee, what does Medilee expect us to hold as evidence of authority before the file is uploaded?
Which AI providers and models process case material
Not confirmed
The Privacy Policy states that the platform 'uses artificial intelligence and machine learning technologies, including AI technologies provided by third parties (AI Technologies), to provide assistive features such as document summarisation, transcription and report drafting support', and that the vendor 'contractually require our AI Technology providers not to train their models on data we submit'. No provider, model or model family is named there, in the Terms, on the home page or on the trust centre overview. The home page states transcription uses 'models tuned for medical terminology and accents' without naming the model or who tuned it. The four subprocessors shown on the trust centre overview are GitHub, Google Workspace, Jira and Microsoft Azure, none described as an AI provider.
Ask: Name every AI provider and model used for case summarisation, transcription and report drafting, state the country in which each runs inference, and confirm whether each appears on the trust centre subprocessor list.
Published subprocessor list
Public claim only
The trust centre publishes a subprocessor list. The overview page (checked 2026-09-27) shows four entries, each with a role and a location: GitHub (version control, Australia), Google Workspace (identity provider, Australia), Jira (collaboration, Australia) and Microsoft Azure (cloud provider, Australia East). A 'View all' link to a dedicated subprocessors page was not opened, so whether further subprocessors are listed is not established. The Privacy Policy separately names Microsoft Azure among data storage, web-hosting and server providers, Stripe as the payment processor, and Google Analytics and Meta tools for website analytics. The Terms contain no subprocessor notification or objection clause.
Ask: Is the trust centre list complete for the services that touch case data, and will you give us advance notice and a right to object before a new subprocessor is added?
Training on customer content
Public claim only
Clause 11.2 of the Terms states the vendor will not '(a) use Your Data in identifiable form to train, fine-tune or otherwise develop any artificial intelligence or machine learning model without your prior written consent; or (b) attempt to re-identify any individual from de-identified data'. Clause 11.1 permits the vendor to create and use irreversibly de-identified and aggregated data derived from customer data and platform usage for platform improvement 'including improving any AI technologies and features integrated with the Platform', quality assurance, model evaluation, security testing, developing new services, identifying trends and benchmarking, and states the vendor owns that de-identified data. The Privacy Policy repeats both commitments and adds that AI providers are contractually required not to train on data submitted to them.
Ask: Clause 11.2(a) leaves a consent pathway open — will you remove it for our agreement, and how is 'irreversibly de-identified' under clause 11.1 tested for referral files that describe rare injuries or small populations?
Use of feedback and in-product corrections
Public claim only
Clause 8.3 of the Terms states the vendor 'may use any Feedback you or your Authorised Users provide in any manner we see fit, and no benefit is owed to you as a result of our use of Feedback'. Clause 20 defines Feedback as 'any ideas, suggestions, comments, input or know-how, in any form, that you or your Authorised Users provide to us relating to the Platform or any aspect of our business', and states expressly that 'Feedback is not Confidential Information'. Nothing read states whether corrections a specialist makes to a generated summary or draft inside the platform are treated as Feedback.
Ask: Are edits and corrections a specialist makes to a generated case summary, transcript or draft report treated as Feedback under clause 20, and are they used to evaluate or tune the platform?
Retention of case data
Public claim only
Clause 18.4 of the Terms provides that for 30 days after cancellation, expiry or termination the vendor will make customer data available for export in a standard format on request, after which it will delete the data except to the extent it is required by law to retain it or it is held in routine backups, in which case it continues to be protected until deleted. The Privacy Policy states the same 30-day export window and that personal information is retained 'only for as long as reasonably necessary for the purposes for which it was collected'. No backup retention period is published, and no in-life retention setting for closed cases is described on any page read. The trust centre controls list includes 'Data retention procedures established'.
Ask: How long do routine backups hold our case data after deletion, and can retention be set per case or per plan so that closed matters are purged on a schedule we choose?
Deletion on request and on exit
Public claim only
Clause 18.4 of the Terms commits the vendor to delete customer data after the 30-day post-termination export window, subject to legal retention and routine backups. The trust centre controls list includes 'Customer data deleted upon leaving'. The site structure includes a help centre guide at medilee.com.au/guides/delete-a-case, which was not opened, so what an in-life case deletion actually removes — including the uploaded source file, the transcript and any derived summary — is not established. No deletion certificate is offered in the documents read.
Ask: When we delete a case during the subscription, what is removed and what is retained, and will you provide written confirmation of deletion including backups on request?
Vendor personnel access to case material
Not confirmed
Clause 9.1 of the Terms grants the vendor a non-exclusive licence to 'access, analyse, back up, copy, store, transmit and use Your Data' to the extent required to supply the platform, to 'diagnose problems with, maintain, protect and improve the Platform (subject to clause 11)', and to comply with law. Clause 2.5 records that access to and use of the platform may be logged, monitored and audited. The Privacy Policy states sensitive information may be disclosed to the vendor's employees, contractors and related entities and to IT service providers engaged to deliver the platform. Nothing read states whether vendor staff can open a customer's referral files or reports in readable form, what approval is required, or whether the customer is notified. The trust centre lists an Access Control Policy behind an access request.
Ask: Which Medilee personnel can open our referral files, transcripts or draft reports in readable form, under what approval, and will that access appear in a log we can see?
Authentication, roles and network controls
Public claim only
The home page security section lists role-based access control, multi-factor authentication and least-privilege access, and states that 'Enterprise controls such as SSO (SAML and OIDC) and IP allowlisting are available for practices' — a plan-dependent statement whose plan is not identified. Clause 2.4 of the Terms requires accurate registration details, states logins are personal and must not be shared, and makes the customer responsible for all activity under its accounts. Clause 2.3(c) makes an Organisation Subscriber responsible for allocating, deactivating and reallocating Seats. The trust centre controls list includes 'Unique production database authentication enforced', 'Unique account authentication enforced' and 'Encryption key access restricted'.
Ask: At which plan or Order Form level are SSO (SAML and OIDC) and IP allowlisting included, and what roles exist inside a practice account — can a practice manager be prevented from opening clinical content?
Encryption in transit and at rest
Public claim only
The home page security section states 'AES-256 encryption at rest' and 'TLS 1.3 in transit'. The Privacy Policy states the vendor puts in place measures 'including encryption in transit and at rest, role-based access controls, logging and monitoring, and regular security testing'. The trust centre controls list includes 'Data transmission encrypted' and 'Encryption key access restricted'. No customer-managed or customer-held key option is described on any page read, and the Terms contain no encryption clause.
Ask: Who holds and rotates the encryption keys, and is a customer-managed key option available for an Organisation Subscriber?
Independent certification and attestation
Public claim only
The trust centre publishes ISO 27001:2022 and SOC 2 Type I compliance badges plus an Australian Privacy Principles badge. A trust centre update published 20 August 2026 states Medilee 'achieved ISO 27001:2022 certification, independently assessed by Sensiba LLP', and an update published 14 March 2026 states it 'completed its SOC 2 Type I attestation, independently assessed by Sensiba LLP', adding that it is 'continuing to strengthen our security program as we progress toward SOC 2 Type II'. The home page and Privacy Policy both state the SOC 2 Type II examination is in progress. Certificates, reports and the underlying policy documents (including the Access Control Policy, Third-Party Management Policy, Secure Development Policy, Risk Management Policy, Incident Response Plan and Information Security Policy) are listed on the trust centre behind a request-access gate and were not read.
Ask: Will you provide the ISO 27001 certificate with its scope statement and the SOC 2 Type I report under a non-disclosure agreement, and what is the target date for the Type II report?
Contracting entity, contract structure and liability
Public claim only
The Platform Terms of Service, last updated 24 July 2026, are between Medilee Pty Ltd (ACN 685 703 913) and the customer; the same entity and ACN appear in the Privacy Policy and in the site footer. Clause 1.4 lets the vendor amend the Terms on written notice, with continued use after the earlier of the notice date or 30 days constituting agreement; an Individual Subscriber may cancel instead, and an Organisation Subscriber on a fixed-term Order Form may object so that the amendment does not take effect for the remainder of the term. Clause 16.2(c) limits the vendor's total aggregate liability to the total fees paid in the 12 months before the first event giving rise to the liability. Clause 16.3 excludes liability for any decision, action or outcome arising from use of or reliance on the platform or any AI Output, including the content of an approved report. Clause 17.1 requires the customer to indemnify the vendor for reliance on an approved AI Output, misuse of the platform, breach of professional obligations and unlawful handling of uploaded data, except to the extent caused by the vendor's breach or negligence. No separate data processing agreement is published; clause 10.1 incorporates the Privacy Policy into the Terms by reference.
Ask: For an Organisation Order Form, will you accept a liability cap above 12 months' fees for a privacy breach, and will you narrow clause 17.1 so it does not cover reliance on an AI Output that was wrong because of a platform defect?
Where data is held and whether it leaves Australia
Public claim only
Clause 10.3 of the Terms states 'We host Your Data on infrastructure located in Australia. We will not change the location of hosting of identifiable health information outside Australia without giving you at least 30 days' written notice.' The Privacy Policy states personal information 'including all health information processed through the Platform' is stored on infrastructure located in Australia, and that 'Some technical service providers (for example, support tooling or analytics) may store or access limited personal information (excluding health information) outside Australia', in which case disclosure is made in accordance with the Australian Privacy Principles using providers under contractual safeguards. The trust centre lists Microsoft Azure as cloud provider with the location 'Australia East' and the other three shown subprocessors with the location 'Australia'. Nothing read states where inference for summarisation, transcription or drafting is performed.
Ask: Does inference for case summarisation, transcription and report drafting run inside Australia, and if any AI provider processes outside Australia which country is it and does clause 10.3 cover that processing?
Security incident and breach notification
Public claim only
Clause 13.2 of the Terms requires either party becoming aware of or reasonably suspecting a security incident affecting customer data to notify the other promptly, after which the vendor will investigate within a reasonable time and remediate a confirmed incident so far as operationally, commercially and technically feasible. Clause 13.3 provides that where the vendor determines an incident is notifiable under Part IIIC of the Privacy Act 1988 (Cth) it will promptly notify the customer, give any required notice to the Office of the Australian Information Commissioner, and coordinate with the customer on notifying affected individuals, with the vendor taking the lead unless the parties agree otherwise. Clause 13.4 permits suspension of access to address an incident. The Privacy Policy repeats the Notifiable Data Breaches commitment. No fixed notification deadline in hours or days is published; an Incident Response Plan is listed on the trust centre behind a request-access gate.
Ask: Will you commit to a fixed notification window, for example 24 hours, for any incident affecting our case data, and can our practice take the lead on notifying our own examinees where the incident is confined to our cases?
Notice of changes to terms, fees and the platform
Public claim only
Clause 1.4 of the Terms sets a 30-day variation notice period for changes to the Terms. Clause 4.6 requires at least 30 days' written notice of a change to fees or plan inclusions. Clause 14.2 states the vendor may update the platform to fix issues, improve performance or change features, and that where an update materially reduces the core functionality of the customer's plan it will endeavour to give reasonable prior notice, with a right to cancel and a pro rata refund of prepaid fees for a materially adversely affected customer. A product updates page is published at medilee.com.au/updates and was not opened. Nothing read commits the vendor to notify before changing the AI provider or model behind any feature.
Ask: Will you notify us before changing the AI provider or model behind case summaries, transcription or report assist, and would such a change fall inside clause 14.2 as an update capable of materially reducing core functionality?
Getting data out at the end
Public claim only
Clause 18.4 of the Terms provides that for 30 days after the effective date of cancellation, expiry or termination the vendor will make customer data available for export in a standard format on request. Clause 8.2 gives the customer ownership of all Report Outputs, with any vendor rights in them assigned on creation; 'Report Output' is defined in clause 20 as a user-facing output, expressly excluding the platform itself and any back-end or internal outputs. Clause 9.3 states the customer is responsible for maintaining its own copies of its data and that the platform is not a system of record. Clause 16.3(b)(ii) excludes vendor liability for loss or deletion of data after the clause 18.4 retention period. The export format is not specified.
Ask: What exactly does the standard-format export contain — the source-linked case summaries, the audio and transcripts, and the source files as uploaded — and in what file formats?
Integrations and connections to other systems
Not confirmed
No customer-side integration, connector or application programming interface is named in the Terms, the Privacy Policy, the home page or the trust centre overview. The only customer-side connection described anywhere is single sign-on, stated on the home page as 'SSO (SAML and OIDC)' available for practices. The third parties named are the vendor's own suppliers rather than customer connections: Microsoft Azure for hosting, Stripe for payments, Google Workspace as the vendor's identity provider, and Google Analytics and Meta tools on the website. Referral files reach the platform by upload and audio by in-browser recording or dictaphone upload.
Ask: Is there an API or a direct connection to a practice management system, a document management system or an imaging system, or is upload the only route in?
Whether the platform retrieves material from the internet
Not confirmed
Nothing in the Terms, the Privacy Policy, the home page or the trust centre overview states whether any feature retrieves content from the internet. The home page describes report assist as built 'from the case summary, the transcript and approved reference material' and states that drafting is 'ring-fenced to validated case data and your own opinion', and clause 7.2 of the Terms states AI Outputs 'are generated from the data provided without accounting for information not disclosed through the Platform'. A help centre guide at medilee.com.au/guides/upload-literature appears in the site structure and was not opened, so how reference material reaches the platform is not established.
Ask: Does any feature retrieve material from the internet — for example to locate a guideline or verify a reference — and if so from which sources, and is each retrieval recorded against the case?
Whether the product takes actions on its own
Public claim only
Clause 7.1(b) of the Terms states the platform 'does not provide medical, legal, diagnostic, clinical or professional advice, and is not a decision-making system'. The Privacy Policy states 'The Platform does not make automated decisions that produce legal or similarly significant effects on individuals without human review'. No feature described on any page read sends, files, bills or transmits anything outside the case file without a user acting; outputs are described as drafts inside the platform. Whether a case can be shared or a report sent from inside the platform, and under what control, is not addressed in the documents read.
Ask: Can the platform send a report or case material to anyone outside our practice — a referrer, insurer or solicitor — and if so what user step is required first?
Human review of generated output
Public claim only
Clause 7.2 of the Terms states AI Outputs — 'case summaries, transcriptions, consultation summaries, draft reports and any other outputs' — 'are assistive drafts only', 'may be inaccurate, incomplete or misleading', and that the vendor does 'not approve, certify, endorse or adopt any AI Output'. Clause 7.3 requires the user to 'independently review, verify and approve all AI Outputs before any clinical, medico-legal or other professional use', to exercise independent professional judgement, to comply with professional standards including Australian Health Practitioner Regulation Agency requirements, and to maintain current professional indemnity insurance. Clause 7.4 states any final report remains the professional work product of the practitioner who approves it. The Privacy Policy adds that AI outputs 'are drafts for review by qualified practitioners' with 'human oversight of significant AI-assisted processes'. The home page states 'Medilee never forms a clinical view and never writes your conclusion' and that 'every line links to its source page'.
Ask: Is the per-line source link preserved in the exported report or in an audit trail, so that a reviewer or a court can trace a statement back to the page it came from after the report leaves the platform?
