Compliance & Governance
How Eirly Health handles health information.
Eirly Health delivers the laboratory’s results as reported. It does not diagnose, interpret results or give medical advice. Privacy, security, and clear clinical responsibility are part of how it is built.
The posture
Privacy, hosting, access and consent.
Privacy Act and the APPs
Eirly Health is bound by the Privacy Act 1988 and the Australian Privacy Principles.
Australian hosting
Hosted on Amazon Web Services in Australia. Results and reports from standard tests are stored and processed in Australia. Some providers operate overseas; see the Privacy Policy.
Access controls
Role-based access, audit logging, and multi-factor authentication for systems holding health information.
Encryption
TLS 1.2 or higher in transit, encrypted at rest.
Consent
Captured at the point of ordering. Withdrawn by contacting our Privacy Officer.
Client access
Clients view their results and health data through their client profile, and can download their result reports and ask for a copy of the information we hold. Deletion is processed in accordance with the Privacy Act, subject to clinical data retention requirements.
Testing and certification
What is in place, and what is not held.
We say plainly which independent checks have been done and which certifications Eirly Health does not yet hold.
| Item | Status | Note |
|---|---|---|
| Penetration testing | Live | An independent black-box penetration test was completed in August 2026, with findings tracked to resolution. |
| SOC 2 Type II and ISO 27001 | Evaluating | Not held. We are evaluating certification. |
Laboratories
How the lab partners are accredited.
Eirly Health’s lab partners are a mix of NATA-accredited laboratories (ISO 15189) and laboratories that are certified but not NATA-accredited. Accreditation sits with the labs. Eirly Health does not perform laboratory testing.
Clinical governance
Who is responsible for what.
Eirly Health delivers the laboratory’s results as reported. It does not diagnose, interpret results or give medical advice.
Critical result notified by the lab
Illustrative example
Only critical results a laboratory notifies are followed up
Critical results
If a laboratory formally notifies a critical result, a doctor engaged by Eirly Health follows it up. Eirly Health does not detect, hold or review results itself.
Optional organisation review
An organisation can choose to hold results for its own review before they reach clients. This is an organisation setting, not a clinical check by Eirly Health.
Clinical responsibility
Registered practitioners who order are responsible for the care of the people they order for. Healthtechs and practitioner networks remain responsible for their own clinical oversight.
The practitioner keeps the call
What Eirly Health does not do.
TGA
Eirly Health facilitates ordering, referral generation, and result delivery. It does not diagnose, interpret results or give medical advice. Laboratories are responsible for the tests they perform.
AHPRA
Eirly Health does not verify practitioner registration. Practitioner type is self-declared, and registered practitioners who order are responsible for practising within their scope. Medicare ordering needs a doctor's provider number (checked for format) and a signature on file.
Offshore
Where data can leave Australia.
Some service providers and specialty laboratories operate overseas. The Privacy Policy sets out the categories and the countries.
Compliance
Diagnostic infrastructure that takes compliance seriously.
Privacy, security, and Australian hosting are part of the platform. You stay responsible for your own regulatory obligations. Talk to us about how Eirly Health fits your setup.