Controls designed to support privacy-conscious, clinician-reviewed documentation workflows.
Repnotes provides technical controls intended to help clinics manage information responsibly when using Cliniko and Nookal integrations. Each clinic remains responsible for its own legal, professional and contractual obligations.
Security of Personal Information: We rigorously validate that the caller is authorized to view or manipulate data for a specific clinic. A malicious user cannot pass another clinic's ID and access or overwrite their data. Server-side role and clinic membership checks reduce unauthorised access risk.
App Check Validation: All requests made to our backend endpoints are verified in real time using Firebase App Check and reCAPTCHA Enterprise. This safeguards your clinic’s database by blocking unauthorized API requests, automated scrapers, and potential brute-force activities.
Collection and Use of Personal Information: The NDIS places a heavy emphasis on participant consent. We now explicitly require consent before storing and transferring clinical data (like treatment notes) to an external system like Cliniko and Nookal.
Destruction of Data: NDIS guidelines mandate retaining adult clinical records for 7 years (and until age 25 for minors). Repnotes acts as an automated data conduit. Your PMS (Cliniko or Nookal) serves as the permanent Electronic Health Record (EHR). As long as data is successfully synced to your PMS, you should confirm its own retention obligations and verify successful transfer before relying on another system as the primary record.
Purpose limitation: Information is handled for the purposes described in our privacy notices, subject to service providers and disclosures required or authorised by law.
App Check & reCAPTCHA: We secure all client-to-server interactions with Firebase App Check and Google reCAPTCHA Enterprise. By verifying the integrity of the device and application environment in real-time, we block automated bots, malicious scripts, and unauthorized scrapers before they can access our APIs.
Google Secret Manager: We proudly utilize Google Cloud Secret Manager to securely encrypt your clinic's API keys at rest. This state-of-the-art, enterprise-grade encryption ensures your sensitive integration credentials remain restricted to authorised server-side processes.
No Payment Data Needed: No payment details are ever stored on Repnotes servers. All subscriptions are processed using manual billing.
Right to Erasure: If you choose to remove your clinic's account, or if it remains inactive for over a year, you may request deletion. Some information may need to be retained where law, dispute handling or security obligations require it.
Privacy Officer: We believe in absolute transparency. If you have any concerns regarding data collection, storage, or security practices, you can contact our dedicated Privacy Officer ( admin+privacy@kinetec.com.au ) for clear answers and rapid resolution.
Repnotes can help practitioners structure clinician-reviewed records using fields such as:
