RapidWrite Privacy Policy
Effective date: 14/09/2026
This is the privacy policy for the RapidWrite mobile application and web platform, published by AtlasOne Products Pty Ltd. AtlasOne Products Pty Ltd is the developer of RapidWrite on Google Play and Apple App Store.
We are an APP entity bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our internal handling of personal information is governed by an information security management system aligned to ISO 27001.
Who this policy covers
RapidWrite is a professional tool used by occupational rehabilitation consultants, allied health professionals, medical practitioners and injury management providers to capture assessment information and produce draft reports.
This policy covers two groups of people:
Users. The consultants and administrators who hold a RapidWrite account and use the app.
Individuals described in the content. People whose personal information a user enters, records or uploads into RapidWrite. This is typically an injured worker, and may also include employers, supervisors, treating practitioners, case managers, patient and other parties involved in a claim.
If you are an individual described in the content and you want to access or correct your information, section 13 explains how.
Our role
Where a user's employer (for example a rehabilitation provider or insurer) engages AtlasOne under a services agreement, we handle personal information on that organisation's behalf and in accordance with our contract with them. Unlike the EU GDPR, the Privacy Act does not distinguish between a controller and a processor: the same APP obligations apply to us either way, and we accept them.
The organisation that engaged us remains responsible for the clinical content, for the lawful basis of the underlying assessment, and for how the finished report is used and distributed.
What we collect
| Category | What it includes | Source |
|---|---|---|
| Account information | Your name, work email address, employer or practice, professional role, user ID, and authentication credentials (passwords are stored only as salted hashes) | You, at registration, or your organisation's administrator |
| Voice and sound recordings | Audio recorded through your device microphone during an assessment, consultation or dictation session, and audio files you upload from elsewhere | Captured in-app or uploaded by you |
| Transcripts and text | Machine-generated transcripts of that audio, plus any notes, survey answers and free text you enter | Generated in-app or entered by you |
| Files and documents | Documents you upload, such as certificates of capacity, medical certificates, referrals, medical reports and workplace documents | Uploaded by you |
| Health information | Injury details, diagnoses, treatment, capacity for work, restrictions and related clinical information contained in the above | Contained in what you record, enter or upload |
| Other personal information about third parties | Names, contact details, employer details, claim numbers and dates of birth appearing in your content | Contained in what you record, enter or upload |
| App activity | Features used, assessments started and completed, reports generated, timestamps and audit trail entries | Collected automatically as you use the app |
| Device and technical data | Device model, operating system version, app version, language, IP address, and a device or installation identifier | Collected automatically |
| Diagnostics and crash logs | Error reports, stack traces and performance diagnostics | Collected automatically when a fault occurs |
| Support communications | Messages you send us and our replies | You |
Health information and other sensitive information. Under the Privacy Act, health information is sensitive information and attracts higher protection. RapidWrite is designed to handle it, and we collect it only where it is reasonably necessary to produce the report you are creating.
What we do not collect. RapidWrite does not collect your precise or approximate location, your contacts, your SMS messages, your calendar, your photos outside files you deliberately upload, your browsing history, or an advertising identifier. We do not collect payment card numbers in the app.
Device permissions
| Permission | Why RapidWrite asks for it |
|---|---|
| Microphone | To record an assessment or dictation when you start a recording. Recording only occurs while you have explicitly started it, and the app shows a clear recording indicator. RapidWrite does not record in the background. |
| Files and media | To let you attach documents and audio files to an assessment, and to save a generated report to your device. |
| Notifications | To tell you when a draft report is ready or an assessment needs attention. |
| Network access | To sync your work to our servers. |
You can review or revoke any of these in your Android/iOS settings. Some features will not work without the relevant permission.
How we use personal information
We use personal information to:
provide the app and your account, and authenticate you;
transcribe audio you record or upload;
generate a draft report from your structured answers, transcripts and uploaded documents, for you to review and edit;
store your assessments and reports and make them available to you and to your organisation;
keep the service secure, prevent misuse and meet our security obligations;
meet legal, regulatory and insurance obligations, including any record keeping obligations that apply to your organisation; and
improve the reliability and accuracy of the product using aggregated or de-identified information.
We do not use your content, or the personal information in it, for advertising or marketing to the individuals described in it.
How AI is used
RapidWrite uses automated speech recognition and large language models to turn what you record and enter into a draft report.
Processing location: AI processing is performed in an Australian data centre region operated by our cloud provider. Your content is not routinely sent overseas. See section 10.
No model training: Your content, and the personal and health information in it, is not used to train, fine-tune or improve any AI model, ours or a third party's. Our agreements with our AI processing providers prohibit it.
Human review: Everything RapidWrite produces is a draft. It is presented to you for review, correction and approval before it is used. You remain the author of the report and are responsible for its accuracy.
No automated decisions about individuals: RapidWrite does not make, and is not designed to make, any decision about a person's entitlements, capacity, treatment or employment. It does not rely solely on automated processing to produce a decision with a legal or similarly significant effect.
Conservative behaviour by design: The system is built to leave a field blank rather than guess. It is instructed not to invent clinical or factual content that is not present in the source material.
Who we disclose personal information to
We disclose personal information only to the following types of recipients:
Your organisation. Your employer or practice and your insurer, where your account is provided by them. They can see the assessments and reports created under their account.
Recipients you send a report to. When you export, email or transmit a report from RapidWrite, it goes where you direct it, for example to an insurer, employer or referrer. That disclosure is made by you, in the course of your professional work.
Our service providers, who handle information on our behalf, under contract, and only for the purposes we specify: cloud hosting and storage (Australian region); AI and speech-to-text processing (Australian region); error monitoring and crash reporting; email and notification delivery; customer support tooling.
Others where required or permitted by law, including to regulators, a court, or the Office of the Australian Information Commissioner, or where necessary to prevent a serious threat to life, health or safety.
We do not sell personal information. We do not exchange personal or sensitive information with third parties for monetary or other valuable consideration. We do not disclose it to data brokers, advertising networks or analytics providers for their own purposes.
How we protect information
All information is transmitted between the app and our servers using modern cryptography over HTTPS/TLS.
Information is encrypted at rest in our Australian hosting environment.
Access is role based and restricted to personnel who need it, with multi-factor authentication and logging.
We operate an information security management system aligned to ISO/IEC 27001, including access control, cryptographic control, backup, information transfer, asset management, and incident management processes.
Our personnel receive privacy and security training and are bound by confidentiality obligations.
We assess privacy and security risk as part of our product lifecycle, including privacy impact assessments where appropriate.
How long we keep information
| Information | Retention |
|---|---|
| Account information | While your account is active |
| Audio recordings | Deleted immediately on request. |
| Transcripts, assessments and reports | For the period set in our agreement with your organisation, to meet their record keeping obligations for workers compensation matters |
| Uploaded documents | Same as the assessment they belong to |
| Diagnostics and crash logs | 90 days |
| Audit and security logs | 90 days |
| Backups | Overwritten on a rolling cycle and purged within 90 days |
Retention periods for clinical and claim records are often set by the regulator or insurer your organisation works with, and may be longer than the periods above. Where that is the case, your organisation's instruction governs.
Overseas disclosure
Personal information collected through RapidWrite is stored and processed in Australia.
Deleting your account and your data
When you request deletion we delete your account record, your credentials, your app activity, your device identifiers, and the recordings, transcripts, documents, assessments and reports created under your account.
We may retain a limited amount of information where we are required or permitted to, specifically:
records your organisation is legally obliged to keep for a workers compensation claim, which are returned to or retained by that organisation rather than kept for our own purposes;
security, fraud prevention and audit logs; and
information we must keep to comply with a law, regulation or lawful request.
We will tell you what, if anything, is retained and why. Deletion is completed within 30 days of a verified request, and backups containing the information are purged within 90 days.
If your account was provided by your employer or practice, your organisation's administrator may also need to act, and we will work with them to complete your request.
If you are an individual described in a report
If a consultant has used RapidWrite to record or prepare a report about you, we hold that information on behalf of the organisation that engaged us.
The quickest route is to contact that organisation directly, because they hold the claim file and the context. You can also contact our Privacy Officer at info@atlasone.co and we will help you identify the right organisation and pass your request on.
Your rights
Under the Privacy Act and the APPs you can:
Be informed about how we handle your personal information. This policy, and any notice given to you at the point of collection, is how we do that.
Access the personal information we hold about you (APP 12). You can ask verbally or in writing. We respond within a reasonable period and do not charge for making a request. Any charge for giving access will not be excessive.
Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13). If we refuse, we will give you written reasons, and on request we will attach a statement noting that you consider the information inaccurate.
Ask us to restrict handling in certain circumstances. This is not an absolute right. Where handling is restricted we may store the information but will not otherwise use it.
Opt out of direct marketing at any time (APP 7). Every marketing message we send includes a simple way to opt out.
Ask for a copy of the information you gave us in a usable form, where that is practicable. We offer this as a matter of good practice.
Complain. See section 15.
Data breaches
If we become aware of, or suspect, unauthorised access to, unauthorised disclosure of, or loss of personal information we hold, we invoke our incident management process immediately and assess the incident under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). We take all reasonable steps to complete that assessment within 30 calendar days.
Where we have reasonable grounds to believe an eligible data breach has occurred, we notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable, and we tell affected organisations. Notifications describe the breach, the information involved, and the steps we recommend individuals take. Our assessment and our decision on whether to notify are documented and retained in every case.
Complaints
If you think we have mishandled your personal information, contact our Privacy Officer at info@atlasone.co. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
Children
RapidWrite is a professional tool. It is not directed to children, and accounts are only issued to adults acting in a professional capacity. We do not knowingly allow anyone under 18 to create an account.
An individual described in a report may in some cases be under 18, for example a young worker with a claim. Information about them is handled as sensitive information on the same basis as all other information in this policy.
Changes to this policy
We review this policy as part of our continual improvement process and whenever the app's handling of personal information changes. Where a change is material, we will notify users in the app or by email before it takes effect.
Contact us
AtlasOne Products Pty Ltd
Email: info@atlasone.co
