Workplace AI Policy

Safe, ethical and privacy-conscious use of artificial intelligence

Purpose

This policy establishes how Undefeeted Podiatry may use artificial intelligence (AI) safely, transparently and responsibly. It protects patients, staff and the business while allowing approved AI tools to improve documentation, communication and administrative efficiency.

It supports compliance with professional obligations, the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs), relevant health-record requirements, and Therapeutic Goods Administration (TGA) requirements for software-based medical devices. It is an operational policy and should be reviewed alongside Undefeeted Podiatry's privacy, clinical records, cyber security, incident response and consent procedures.

Scope

This policy applies whenever any team member accesses or uses generative AI, automated decision tools, digital scribes, transcription systems, chatbots, image generators, analytics tools or AI features embedded in other software for Undefeeted Podiatry work.

• Clinical staff: podiatrists, students and other treating practitioners.
• Front-of-house and administrative staff, including remote staff and contractors.
• Owners, managers and any person with access to Undefeeted Podiatry information or systems.

Policy principles

• Human accountability: the person using AI remains responsible for the work and any resulting decision.
• Patient choice and transparency: patients are told when an AI scribe is proposed and can refuse or withdraw consent without disadvantage.
• Privacy by design: only the minimum necessary information is used, and only in an approved system for an approved purpose.
• No autonomous clinical decisions: AI does not diagnose, prescribe, determine treatment, triage urgency, discharge a patient or decide access to care.
• Accuracy and safety: AI output is treated as an unverified draft until checked by an appropriately qualified person.
• Security and governance: tools must be approved before use, access is controlled, and incidents are reported promptly.
• Fairness and professional judgment: staff consider bias, missing context and the needs of children, vulnerable people and diverse communities.

Definitions

Approved and prohibited uses

Permitted uses

Approved AI tools may be used within the purpose, data and settings authorised in the Approved AI Tool Register. Examples include:

• drafting or improving generic emails, scripts, checklists, training materials and internal process documents that contain no personal, health, employee or confidential information
• summarising public information or de-identified internal material
• brainstorming marketing ideas, provided all claims, testimonials, images and professional advertising obligations are independently checked
• using Heidi as a digital scribe under the Heidi AI scribe section
• clinical education or reasoning support using a fully de-identified case, provided the practitioner independently assesses the evidence and remains solely responsible for care

Prohibited uses

• Entering, uploading, pasting, dictating or generating identifiable or reasonably identifiable patient information in ChatGPT, Claude, Gemini or any other public/unapproved AI service.
• Entering identifiable employee, applicant, referrer, supplier or contractor information into a public/unapproved AI service.
• Uploading clinical notes, referrals, photographs, scans, imaging, pathology, audio, video, appointment lists, invoices, funding information or screenshots containing identifiers to an unapproved AI tool.
• Using AI to make or autonomously recommend a diagnosis, differential diagnosis, prognosis, prescription, treatment plan, referral, triage priority, discharge decision, funding decision or decision about access to care.
• Copying AI output into a patient record or sending it externally without appropriate human review.
• Representing AI-generated material as verified professional advice, evidence or a genuine patient statement when it has not been checked.
• Using personal AI accounts, browser extensions, plug-ins, bots or integrations for patient-related work unless formally approved.
• Using AI to impersonate a patient, colleague or clinician; fabricate evidence, references, consent, records, incidents or communications; or create misleading clinical or advertising content.
• Using AI-generated images, testimonials or case studies in a way that could mislead patients or breach advertising or intellectual-property obligations.
• Allowing AI to make employment, rostering, performance, disciplinary or recruitment decisions without meaningful human assessment.

When in doubt: Do not enter the information. Stop and ask a Director before using the tool.

Heidi AI scribe

Approved purpose

Heidi is approved only to support transcription and preparation of draft clinical documentation and related drafts within the settings and functions authorised by Undefeeted Podiatry. It must not be used to generate a diagnosis, differential diagnosis, treatment recommendation or other clinical decision that was not independently made by the treating practitioner.

Patient consent

• Written consent: new patients must complete the AI scribe consent section on the initial intake form before Heidi is used. The consent record must be retained with the patient's record.
• Verbal confirmation every consultation: before Heidi is activated, the treating practitioner must explain that an AI scribe will listen to the consultation to prepare a draft note and ask the patient whether they agree to its use for that consultation.
• Document the response: record consent or refusal in the clinical record. A suggested entry is: 'Heidi AI scribe explained; patient consented verbally for today's consultation.'
• Capacity and representatives: where consent is provided by a parent, guardian, substitute decision-maker or authorised representative, document the person's name, role and basis of authority. Involve the patient in the discussion to the extent appropriate.
• Choice: a patient may decline or withdraw consent at any time. Care must continue using an alternative documentation method, with no penalty, reduced care or pressure to agree.
• Sensitive moments: pause or stop Heidi if the patient withdraws consent, another person enters without consent, or the discussion moves to information that should not be captured.

Naming and data minimisation

Do not enter the patient's full name into Heidi. Use the minimum label required under the approved clinic convention:

• patient's first name plus surname initial; and
• the treating podiatrist's initial.

Important: This label is pseudonymised, not necessarily fully de-identified. It must still be handled as protected patient information. Do not add date of birth, address, Medicare number, phone number, email, full surname or other unnecessary identifiers.

Practitioner review and recordkeeping

• The treating practitioner must read the complete draft, compare it with the consultation and correct omissions, inaccuracies, hallucinations, wrong laterality, medications, measurements, clinical meaning and patient instructions.
• Only the reviewed and approved note is transferred to the designated clinical record system. The practitioner remains the author and is accountable for the final entry.
• The note must clearly distinguish patient-reported information, objective findings, clinical assessment and the practitioner's plan.
• Do not rely on Heidi as the sole record of the consultation. Complete and finalise the clinical record within Undefeeted Podiatry's required timeframe.
• Do not download or retain audio, transcripts or drafts outside approved systems. Delete duplicates when no longer required under the approved retention settings and vendor agreement.
• If Heidi is unavailable or behaves unexpectedly, stop using it and document manually. Clinical care must not depend on the tool.

Feature and regulatory controls

Before initial approval and after material updates, Undefeeted Podiatry will review Heidi's intended purpose, functionality, privacy settings, data locations, retention, training use, security controls and contractual terms. Any feature that analyses or interprets consultations to generate a diagnosis, differential diagnosis or treatment recommendation may bring the product within TGA medical-device regulation. Such a feature must not be enabled or used unless Undefeeted Podiatry confirms that its use is lawful, appropriately registered where required, covered by insurance and specifically approved.

External generative AI (including ChatGPT and Claude)

Public or overseas-based generative AI services may be used only for low-risk tasks that contain no identifiable or reasonably identifiable personal information and no confidential Undefeeted Podiatry material. Staff must assume that combining small details can re-identify a person.

Never include

• names, initials combined with distinctive circumstances, dates of birth, addresses or contact details
• Medicare, DVA, NDIS, private health, insurance, claim, employee or identification numbers
• appointment dates/times, exact ages, occupations, workplaces, family relationships or rare conditions when these could identify the person
• identifiable clinical notes, referrals, test results, imaging, photographs, recordings, prescriptions, billing or complaint information
• passwords, access tokens, security procedures, bank details, commercially sensitive reports, staff performance information or legal advice

Safe-use standard

• Use a generic scenario or a genuinely de-identified summary. If re-identification is reasonably possible, do not use it.
• Use only an Undefeeted Podiatry paid account and approved privacy settings. Do not assume a paid account makes patient use acceptable.
• Check facts, calculations, links, citations, tone, bias, copyright and professional requirements before use.
• Do not ask a public AI tool to diagnose a real patient, even if direct identifiers have been removed.
• Remove AI chat content when it is no longer required and do not use chat history as the official business or clinical record.

Clinical decision-making and patient safety

AI may assist a practitioner to organise information, identify questions for consideration, locate topics for further research or draft educational content. It does not replace clinical training, direct examination, professional judgment or evidence-based decision-making.

• The registered practitioner independently obtains the history, performs the examination, interprets findings, forms the diagnosis, discusses options and makes the treatment or referral decision.
• AI output must not be the sole or determinative basis for any clinical action.
• High-risk, urgent, unusual or uncertain presentations must be escalated through normal clinical pathways, not delegated to AI.
• Where AI materially assists the preparation of patient-facing clinical content, the practitioner must ensure it is accurate, appropriate, understandable and consistent with the actual consultation.

Front-of-house and administrative use

Front-of-house staff may use approved AI to improve generic wording, templates, FAQs, rosters, meeting agendas and workflow documents. They must not use AI to interpret symptoms, triage clinical risk, recommend treatment or decide whether a patient needs care.

• Patient-specific emails, recalls, complaints, invoices and booking communications may be drafted only in approved systems and must not be pasted into public AI tools.
• If a patient provides clinical information, staff follow the clinic's triage and escalation procedure and refer the matter to a podiatrist or emergency service as appropriate.
• Before sending AI-assisted communication, staff check the recipient, facts, tone, attachments, privacy, policy position and authority to send.

Approval of AI tools

No new AI tool, plug-in, feature, integration or material use case may be introduced without written approval from a Director or delegated Privacy Officer. Approval is purpose-specific and may be withdrawn.

The review must consider:

• intended purpose, clinical function and whether TGA regulation or ARTG inclusion applies
• the categories and minimum amount of data processed
• where data is stored, processed and disclosed, including overseas locations and subcontractors
• whether prompts, audio, files or outputs are used to train models and whether this can be disabled contractually
• security controls, access management, encryption, logging, breach notification and deletion
• retention periods, export capability, business continuity and vendor exit arrangements
• accuracy, foreseeable failure modes, bias, accessibility and suitability for the patient population
• contract terms, confidentiality, intellectual property, indemnities and audit rights
• professional indemnity and cyber-insurance coverage
• whether a privacy impact assessment, updated collection notice or privacy-policy change is required

Privacy, security and access

• Access is limited to authorised staff with individual accounts. Shared logins are prohibited.
• Multi-factor authentication must be enabled where available. Passwords must comply with Undefeeted Podiatry's security requirements.
• Use approved clinic devices, accounts and networks. Do not process patient information on unmanaged personal devices or accounts.
• Do not connect an AI tool to Cliniko, email, cloud storage, Square, CRM, payroll or other systems without written approval and a documented data-flow review.
• Apply the minimum-necessary principle to prompts, uploads, outputs, access and retention.
• AI-generated drafts must be stored only as long as necessary and then securely deleted in accordance with approved settings and record-retention obligations.
• All privacy, confidentiality, health-record, intellectual-property and cyber-security policies continue to apply. This policy does not create an exception to them.

Accuracy, attribution and intellectual property

• AI can confidently produce false information. All outputs must be checked against reliable sources and the original information.
• Do not cite references that have not been opened and verified. Do not invent research, patient quotes, testimonials or outcomes.
• Respect copyright, licences, trademarks and confidentiality. Do not upload third-party material unless Undefeeted Podiatry has the right and approval to do so.
• AI-assisted external content must meet professional advertising standards and must not contain misleading claims, guarantees, fabricated reviews or inappropriate before-and-after material.
• Staff must disclose material AI assistance internally when it is relevant to review, accountability or audit.

Incidents, errors and concerns

An AI incident includes accidental disclosure, use of an unapproved tool, incorrect clinical content entering a record, unintended recording, suspected unauthorised access, a vendor breach, unexpected retention or training use, or unsafe functionality.

• Stop: cease using the tool or affected function and do not delete evidence needed for assessment.
• Contain: where safe, revoke sharing, correct access, disconnect integrations or prevent further disclosure.
• Report immediately: notify a Director or the Privacy Officer using Undefeeted Podiatry's incident process. Do not wait until the end of the shift.
• Correct safely: clinical record corrections must follow the clinical record policy and preserve an appropriate audit trail.
• Assess and notify: management will assess clinical harm, privacy impact, contractual notification, insurer notification and whether the Notifiable Data Breaches scheme or another reporting obligation applies.

No blame for prompt reporting: Staff will be supported for promptly reporting a genuine mistake or concern. Concealing an incident or knowingly continuing unsafe use may result in disciplinary action.

Training, monitoring and review

• All team members must complete induction and refresher training before using approved AI tools and sign the acknowledgement in this policy.
• Clinical users must understand the relevant tool's purpose, limitations and failure modes and record applicable learning or CPD where appropriate.
• Undefeeted Podiatry may audit tool usage, consent documentation, note review, access logs and compliance with this policy, subject to applicable law and workplace requirements.
• The Approved AI Tool Register and vendor settings will be reviewed at least annually and after significant updates, incidents or regulatory change.
• The public-facing privacy policy and patient notices will be reviewed before 10 December 2026 and at least annually thereafter.

Responsibilities

Non-compliance

A breach of this policy may result in retraining, restriction or removal of AI access, corrective action, and disciplinary action up to and including termination of employment or engagement. Serious matters may also require notification to patients, insurers, regulators or other authorities. Responses will consider the circumstances, risk, intent and applicable workplace law.

Related documents

• Privacy Policy and patient collection notice
• Clinical Records Policy
• Consent Policy and new patient intake form
• Cyber Security and Acceptable Use Policy
• Data Breach / Incident Response Plan
• Social Media and Advertising Policy
• Approved AI Tool Register and vendor assessment records

Appendix A – Quick decision guide

Appendix B – Suggested patient consent wording

New patient intake form clause

Suggested wording: Undefeeted Podiatry may use an approved AI-assisted digital scribe during consultations to listen to the conversation and prepare a draft clinical note. Your podiatrist reviews and corrects the draft before it becomes part of your clinical record. The tool does not replace your podiatrist's clinical judgment. We will ask for your verbal agreement before using it at each consultation. You may say no or withdraw consent at any time without affecting your care. Information is handled in accordance with our Privacy Policy. By selecting 'I consent', you agree to this use.

Verbal script before each consultation

Suggested script: We use an AI scribe called Heidi to listen during the consultation and prepare a draft note for me. I review and correct the note, and I remain responsible for your care. You can say no or ask me to stop it at any time without affecting your care. Are you happy for me to use Heidi today?

Appendix C – Approved AI Tool Register

Appendix D – Staff acknowledgement

I acknowledge that I have read and understood the Undefeeted Podiatry Workplace AI Policy. I agree to use only approved AI tools for approved purposes, protect patient and business information, obtain required consent, verify outputs and report concerns or incidents immediately. I understand that AI does not replace my professional or workplace responsibilities.

Appendix E – Implementation checklist

• Confirm Heidi's current intended purpose, data locations, subcontractors, retention, training use and security terms in writing.
• Confirm whether any enabled Heidi feature is a regulated medical device and, if applicable, verify ARTG inclusion.
• Obtain written confirmation from professional indemnity and cyber insurers that approved AI use is covered.
• Add the consent clause to the new patient intake form and configure a clear consent record.
• Train clinicians on the before-each-consult verbal script and how to document consent/refusal.
• Update the public Privacy Policy and patient collection notice, including overseas disclosure information where applicable.
• Assess whether any computer program uses personal information in decisions that may significantly affect rights or interests; if so, publish the information required by APP 1.7-1.9 by 10 December 2026.
• Publish a plain-language patient notice about digital-scribe use and withdrawal of consent.
• Complete the Approved AI Tool Register and remove or block unapproved tools, extensions and integrations.
• Nominate a Privacy Officer, establish an AI incident route, brief all staff and retain signed acknowledgements.
• Schedule annual policy, vendor, consent and access audits.

Sources and review note

Prepared with reference to the following official Australian guidance available as at 26 August 2026:

• Australian Health Practitioner Regulation Agency (Ahpra), Meeting your professional obligations when using Artificial Intelligence in healthcare (22 August 2024).
• Office of the Australian Information Commissioner (OAIC), APP Guidelines – Chapter 1, including APP 1.7-1.9 obligations commencing 10 December 2026.
• Therapeutic Goods Administration (TGA), Digital scribes (updated 30 January 2026).
• Privacy Act 1988 (Cth) and Australian Privacy Principles.

This policy should be reviewed by Undefeeted Podiatry's privacy/legal adviser and insurers before adoption, particularly after vendor due diligence identifies Heidi's actual data flows, contract terms and enabled features.