Where each AI voice and scribe vendor says it stores patient data

    Data residency is a core question for any Australian or New Zealand health buyer, and the answer often sits in a privacy policy rather than on a product page. Below is what each vendor publishes about where data is stored, quoted directly with its source link and the date we checked it.

    32 of 39 vendors publish somethingLast checked 25 Sept 2026
    This tracker records only what each vendor has published on its own public pages. It is not an assessment, audit, certification or endorsement. Vendors change their documentation — always verify directly before making a procurement decision.

    What is on the public record

    Where does AiDial store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    Privacy policy states servers are primarily hosted within Australia; the same policy states personal information may be provided to third parties located outside Australia, including server hosting providers where infrastructure 'may occasionally be located'.
    “Our AI call platform operates on our own secure servers, which are primarily hosted within Australia by trusted third-party infrastructure providers.”
    aidial.com.au

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Amazon Connect (Amazon Web Services) store patient data?Contact centre (CCaaS)
    SummaryChecked 25 Sept 2026
    Amazon Connect listed as available in Asia Pacific (Sydney), ap-southeast-2, with endpoint connect.ap-southeast-2.amazonaws.com.
    “| Asia Pacific (Sydney) | ap-southeast-2 | connect.ap-southeast-2.amazonaws.com | HTTPS |”
    docs.aws.amazon.com
    SummaryChecked 25 Sept 2026
    AWS states the customer chooses the AWS Region(s) in which content is stored, and that AWS will not move or replicate content outside the chosen Region(s) without the customer's agreement.
    “You choose the AWS Region(s) in which your content is stored.”
    aws.amazon.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Ambience Healthcare store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Privacy policy says information collected through its websites may be processed and stored in the U.S. and other jurisdictions
    “information collected through the Sites may be transferred to, processed, stored, and used in the U.S. and other jurisdictions”
    www.ambiencehealthcare.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Anthropic store patient data?Foundation model
    SummaryChecked 25 Sept 2026
    Privacy policy says personal data is transferred to servers in the US, or to other countries outside the EEA and the UK
    “your personal data is transferred to our servers in the US, or to other countries outside the European Economic Area (“EEA”) and the UK”
    www.anthropic.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does AutoMed Systems store patient data?Platform / infrastructure
    SummaryChecked 25 Sept 2026
    Privacy policy states all SMS message data is stored within Australia
    “all SMS message data is securely stored within Australia”
    automedsystems.com.au

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Cisco Webex Contact Center store patient data?Contact centre (CCaaS)
    SummaryChecked 25 Sept 2026
    Tenant created in the data center closest to the Country of Operation selected in the setup wizard. Data center locations listed: United States, Canada, United Kingdom, Germany, Singapore, Australia, Japan, India.
    “When you pick a Country of Operation in the set up wizard under the Contact Center tab, the system will create your tenant, in the data center that's closest to that country.”
    help.webex.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Cognigy (NiCE Cognigy) store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    Documentation lists SaaS clusters by region: Europe (app.cognigy.ai), US (app-us.cognigy.ai), United Kingdom (app-uk.cognigy.ai), Australia (au-02.cognigy.ai), plus NiCE CXone shared SaaS clusters including AU1 [Asia Pacific (Sydney)]. The page lists clusters and IP ranges; it does not separately state storage vs processing.
    “Australia SaaS - au-02.cognigy.ai”
    docs.cognigy.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Corti store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    EU or US hosting options, stated with no cross-border transfer
    “Data hosting options in the EU or US with no cross-border transfer”
    corti.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Coviu store patient data?Platform / infrastructure
    SummaryChecked 25 Sept 2026
    No Australia-specific storage statement found on the pages checked; privacy policy says it generally stores personal information of US-located clients in the United States
    “For clients located in the United States, we generally store personal information in the United States.”
    www.coviu.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Curious Thing store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    No single storage region stated. Privacy policy states information may be transferred, processed and stored outside the individual's country of residence, unless expressly agreed otherwise with a customer with data sovereignty requirements.
    “We collect information globally and may transfer, process and store your information outside of your country of residence, to wherever we or our third-party service providers operate”
    curiousthing.io

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Five9 store patient data?Contact centre (CCaaS)
    SummaryChecked 25 Sept 2026
    Five9 states recordings can be kept in the customer's Core Edge (a home region running the full Five9 application stack) or at the agent's local Voice Edge point of presence.
    “Keep your recordings in your Core Edge or at the agent's local Voice Edge for added control.”
    www.five9.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Genesys store patient data?Contact centre (CCaaS)
    SummaryChecked 25 Sept 2026
    Deployed in a customer-assigned AWS core region; Asia Pacific (Sydney) ap-southeast-2 is a listed core region (login.mypurecloud.com.au)
    “Asia Pacific (Sydney) ap-southeast-2 Asia Pacific (Sydney) https://login.mypurecloud.com.au”
    help.genesys.cloud

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Google (Gemini / Cloud AI) store patient data?Foundation model
    SummaryChecked 25 Sept 2026
    Customer-selected Google Cloud location for data at rest (Gemini Enterprise Agent Platform data residency)
    “When you store data on Agent Platform (such as custom model weights or metadata), it remains physically stored in the specific Google Cloud location you chose.”
    docs.cloud.google.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does HealthEngine store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    Vendor states secure servers in Australia; its policy says some service providers may store data overseas
    “We store your personal information on secure servers located in Australia in an encrypted, electronic format.”
    healthengine.com.au

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Heidi Health store patient data?Ambient scribe
    SummaryChecked 28 July 2026
    Australia — vendor states all its data is locally hosted within Australia (AU compliance page). Vendor separately states it operates local, private servers in every region it operates in, with region-specific server locations published on its Trust Centre.
    “We prioritise data sovereignty by ensuring all our data is locally hosted within Australia.”
    www.heidihealth.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does HotDoc store patient data?Platform / infrastructure
    SummaryChecked 25 Sept 2026
    Australia (hosted on AWS in Australia)
    “All personal information entrusted to HotDoc is securely stored and processed within Australia”
    practices.hotdoc.com.au

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does i-scribe by Akuru (Akuru Clinical Intelligence) store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Australia — stated as exclusive storage location for patient health information, audio, transcripts, clinical notes and metadata; cloud infrastructure stated as AWS ap-southeast-2 (Sydney) and Microsoft Azure Australia Southeast.
    “All platform data — including patient health information, audio, transcripts, clinical notes, and metadata — is stored and processed exclusively within Australia”
    www.i-scribe.com.au

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does iMedX store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Privacy policy says personal information collected through the Australian site is transferred to and maintained in the United States
    “iMedX Australia is based in the United States, so any personal information we collect through this site will be transferred to and maintained in the United States.”
    imedx.com.au

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Lyngo AI store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    No single storage region stated. The published sub-processor list names Microsoft Corporation (Azure) and Google LLC (Google Cloud Platform) as cloud service providers used to host Customer Data, each with Location: Australia & United States.
    “Lyngo AI may use the following sub-processors to host Customer Data or provide other infrastructure that helps with delivery of our Services:”
    help.lyngo.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Lyrebird Health store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Australia (all patient data)
    “All patient data is processed and stored within Australia, aligned with Australian Privacy Principles and local healthcare expectations.”
    www.lyrebirdhealth.com
    SummaryChecked 25 Sept 2026
    Australia — AWS Asia-Pacific (Sydney) region, stated for application databases, transcripts, authentication and user data, speech processing and encrypted backups.
    “remains stored in Australia (AWS Asia-Pacific Sydney region) and is not transferred overseas”
    www.lyrebirdhealth.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Medow Health AI store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Australia for Australian and New Zealand healthcare providers; Singapore and UAE hosting for providers in those regions
    “Australian and New Zealand located Healthcare provider – hosted in Australia”
    medowhealth.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Microsoft Azure AI store patient data?Platform / infrastructure
    SummaryChecked 25 Sept 2026
    Azure Speech: data is stored only in the region where the Speech resource was created. Australia East (australiaeast) is listed as a supported Azure Speech region under the Asia Pacific geography.
    “Azure Speech doesn't store or process your data outside the region of your Azure Speech resource. The data is stored or processed only in the region where the resource is created.”
    learn.microsoft.com
    SummaryChecked 25 Sept 2026
    Foundry Models sold by Azure (incl. Azure OpenAI): data at rest is stored in the customer-designated Azure geography, including for Global and DataZone deployment types.
    “any data stored at rest, such as uploaded data, and including the abuse monitoring data store created for Global and DataZone deployments, is stored in the customer-designated geography.”
    learn.microsoft.com
    SummaryChecked 25 Sept 2026
    Azure Australia geography is served from datacentres in Melbourne and Sydney (stated in Microsoft's IRAP compliance page).
    “hosted from datacenters in Melbourne and Sydney. These two datacenters give Australian customers control over where their customer data is stored”
    learn.microsoft.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Microsoft Dragon Copilot store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Data at rest by customer location: US->US; Canada->Canada; UK->UK; France/Ireland/Belgium->France, EU; Germany/Austria/Netherlands/Switzerland->Germany, EU. Australia is not listed in the published data-at-rest table
    “Microsoft Dragon Copilot stores Customer Data at rest as outlined below. … US | US · Canada | Canada · UK | UK · France, Ireland, Belgium | France, EU · Germany, Austria, Netherlands, Switzerland | Germany, EU”
    learn.microsoft.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Nabla store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    US clients: US regions on Google Cloud (GCP); all other clients: EU Google (GCP) data centres
    “U.S. based clients have data stored in U.S. regions within Google (GCP); all other clients are stored in EU Google (GCP) data centers.”
    trust.nabla.com
    SummaryChecked 25 Sept 2026
    Hosted on Google Cloud Platform; database location selected at organization creation time.
    “All our data is hosted on Google Cloud Platform databases and storage buckets. These databases are located in the region you choose when you create your organization.”
    www.nabla.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does OpenAI store patient data?Foundation model
    SummaryChecked 13 Aug 2026
    Configurable via data residency controls (eligibility-gated): customer content stored at rest in selected region; listed regions include United States, Europe (EEA + Switzerland), Australia, Canada; default region not stated
    “your customer content (as defined in your services agreement) for that project will be stored at rest in the selected region”
    developers.openai.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does PatientNotes store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    EU and US regions; Australian-region hosting via AWS Sydney available for practices that require it
    “PatientNotes hosts in EU and US regions today. Australian-region hosting via AWS Sydney is available for practices that require it”
    www.patientnotes.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does PolyAI store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    Platform documentation states a workspace lives in exactly one region, with matching Studio and API hosts. The page does not separate storage from processing.
    “A workspace lives in exactly one region — use the Studio host you log in to, and the matching API host for calls.”
    docs.poly.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Sierra store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    General privacy policy states personal information may be transferred, processed and stored anywhere in the world, including the United States. No product-level data residency region stated on the pages checked.
    “All personal information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States”
    sierra.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Suki store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    Privacy policy says personal data may be transferred to company and authorised third-party offices and servers in the US
    “such Personal Data may be transferred from your current location to the offices and servers of the Company and the authorized third parties referred to herein located in the United States.”
    www.suki.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Tortus store patient data?Ambient scribe
    SummaryChecked 25 Sept 2026
    United Kingdom / EU (London region) - Google Cloud storage of consultation audio and account identifiers
    “stored in the United Kingdom / EU (London region) and encrypted in transit and at rest”
    tortus.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does VoiceStack store patient data?Voice agent
    SummaryChecked 12 Aug 2026
    Privacy policy says information may be stored and processed in the US, where its servers may be located
    “your information may be transferred to, stored, and processed in the United States where our servers may be located.”
    voicestack.com
    SummaryChecked 28 July 2026
    Australian privacy policy states personal information may be stored on servers located in Australia, the United States, the United Kingdom, Ireland, Netherlands, Singapore and Japan.
    “Your personal information may be stored on servers … located overseas in Australia, the United States, the United Kingdom, Ireland, Netherlands, Singapore and Japan.”
    voicestack.com

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Where does Voxworks store patient data?Voice agent
    SummaryChecked 25 Sept 2026
    Amazon Web Services Sydney (ap-southeast-2) region, stated for platform storage including call recordings and other generated files.
    “Platform storage, including call recordings and other files you generate on Voxworks, is hosted in Amazon Web Services' Sydney (ap-southeast-2) region.”
    docs.voxworks.ai

    Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

    Not found on public pages

    We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere.

    Right of reply

    Something wrong or out of date?

    Are we missing something, or has this changed? Vendors and their representatives can submit a correction, and we note each change and credit the source. We review every correction request and update the entry when the source supports it.

    Submit a correction