Health
Aurii
Specialists run notes, letters, orders and billing from one app.
Every clinical record, recording and generated document stays in Australia.
Health
Clinical software and its security, in production.
The clinical software we deliver runs in Australian regions, so health privacy obligations are our daily work.
Some of the health systems we build and run.
Health
Zenith Cardiology
The clinical site and the practice’s ICT now sit with one team.
Hosting, ICT management and security now run under one ongoing engagement.
Product screens shown with sample data.
Threat picture
What the sector is facing.
Notifiable data breaches, 2025
225of 1,205 notifications
Health service providers were the largest sector in 2025.
OAIC, Notifiable Data Breaches statistics for 2025, published 6 Jul 2026 
High severity
High severity
Health
What you carry, and what we do about it.
Health information is sensitive information under the Privacy Act.
Privacy Act and the APPs
Clinical records carry the strictest collection, use and disclosure rules in the Privacy Act.
We map the data you hold and where it lives, and review the gaps against the Australian Privacy Principles.
Privacy Act / APP upliftClinical software
Clinical software carries clinical obligations: access discipline, auditability, and data that never crosses tenants.
We build multi-tenant clinical software with tenant isolation enforced in the database and tamper-evident audit trails throughout.
See the Aurii buildData kept in Australia
Australian health data is expected to stay in Australian regions, and you will be asked to prove it.
Our health workloads run on Azure in Australian regions, with credentials held outside the code and every release through a reviewed pipeline.
Cloud engineering on AzureSeeing an attack underway
When something goes wrong the questions are immediate: who touched the record, when, and would you see an attack underway?
We review your logging and alerting coverage, write an incident response playbook your team can run, and pressure-test it with a tabletop exercise.
Detection and response advisory
The obligations in play.
Act
Privacy Act 1988 and the APPsCollection, use and disclosure of health information, and cross-border transfer under APP 8.Scheme
Notifiable Data Breaches schemeBreaches likely to cause serious harm must be assessed and notified to the OAIC and affected individuals.Regime
State health-records regimesNew South Wales and Victoria layer their own health-privacy statutes over the Commonwealth regime.Act
My Health Records Act 2012Further obligations apply where systems connect to My Health Record.
Services
The services that apply.
- Software engineeringWeb, mobile and platform builds, run in production.
- Cloud and AI infrastructureAzure hosting, delivery pipelines and the controls around AI systems.
- Penetration testingNetworks, web apps, cloud and AI systems, with a report and a re-test.
- Incident responseContainment, root cause and Notifiable Data Breaches support.
Questions, answered.
Do you keep health data in Australia?
Yes. Health workloads run on Azure in Australian regions.
What does the Privacy Act ask of a practice’s systems?
Health information is sensitive information under the Australian Privacy Principles, with the strictest collection, use and disclosure rules in the Act, and a breach likely to cause serious harm must be assessed and notified under the Notifiable Data Breaches scheme. We map the data you hold and where it lives, and review the gaps against the APPs.
Do you build clinical software?
Yes. We build multi-tenant clinical software with tenant isolation enforced in the database and tamper-evident audit trails throughout, and the clinical app we run for private hospital specialists is live on iOS, Android and the web.
Would we see an attack on our systems while it is underway?
We review your logging and alerting coverage, write an incident response playbook your team can run, and pressure-test it with a tabletop exercise.
Industries
Other sectors we work in.
Legal
Practice and compliance systems for law firms, with trust accounting and QLS obligations in view.
Financial services
Portals and operations for AFSL holders, built around the licence perimeter.
Property
Practice systems, deal sourcing and AML/CTF screening for valuers and buyer’s agents.
