Aperture
by Radly

Aperture Privacy Policy

Last updated: 6 October 2026

Aperture is a practice management platform for medical imaging clinics, operated by Radly Pty Ltd (ABN 93 698 488 407) ("Radly", "we"). This policy explains how information is handled inside Aperture. It is separate from the privacy policy for the Radly patient marketplace at radly.com.au. If you asked for a booking through a clinic's Radly page, the Radly Privacy Policy covers the details Radly collected and sent to the clinic, and this policy covers what the clinic then keeps in Aperture.

The short version

  • Your imaging clinic decides what health information it records about you. Aperture stores and processes that information on the clinic's behalf.
  • Aperture's database, file storage and backups are in Google Cloud's Sydney region. Text messages are sent through a provider in the United States, so their content is processed there. Emails are sent through Amazon Web Services in Sydney (see section 4).
  • Where a radiologist uses AI drafting or dictation while writing a report, the report text and dictated audio are processed by Amazon Web Services in Sydney and Melbourne, Australia. A radiologist reviews and signs every report.
  • Each clinic's records are separated from every other clinic's by access checks on every request.
  • We do not sell personal information, we do not use health information for marketing or advertising, and Aperture has no advertising or third-party analytics trackers.

1. Whose information we handle

Patients

When you book with or attend a clinic that uses Aperture, the clinic may record information it needs to provide your imaging service. This can include your name, date of birth, contact details, address, Medicare or DVA details, health fund details, emergency contact, your referral (including the referring practitioner and clinical notes), appointment history, safety screening answers, payment status, and, where the clinic uses Aperture reporting, the report of your examination and links to your images in the clinic's own imaging system.

Clinic staff

Name, role, work email, mobile number (used for SMS sign-in), and a record of actions taken in Aperture. Staff who enter Aperture from their Radly account are also signed in through Radly (see the Radly Privacy Policy for how Radly sign-in works).

Referring practitioners

Name, practice, address and, where the clinic records it, email address, as they appear on referrals and report letters.

2. Who is responsible

Your clinic is the health service provider. It decides what is collected and why, and it is responsible for telling you about its own information handling. Radly operates Aperture as the clinic's service provider and handles clinic records only to deliver the platform: storing records, computing availability, sending the appointment messages the clinic configures, producing documents the clinic requests, keeping backups, and security and fault diagnosis. For access to or correction of your health information, contact your clinic first. We will help the clinic respond.

When a booking reaches a clinic through the Radly marketplace, Radly also keeps its own record of that booking request under the Radly Privacy Policy.

3. How information is used

  • Running the clinic's appointment book, worklists and patient records.
  • Sending appointment messages the clinic has switched on (confirmations, reminders, preparation instructions and changes) by SMS and email. These can include your first name, the examination and the clinic's preparation instructions.
  • Producing report letters and receipts where the clinic uses those features.
  • Helping the radiologist write reports, where they choose to use it: turning their dictation into text, placing their notes into report sections, tidying wording and drafting an impression from their findings. Every suggestion is a draft the radiologist reviews and can change or reject; nothing is signed automatically, and AI is not used to diagnose or to read images.
  • Showing the clinic's available times on its Radly page or its own website when it offers online booking. Only availability is shown publicly, never patient information.
  • Security, audit, backup and fault diagnosis.

We do not use health information for marketing or advertising, and we do not sell personal information. We may use aggregated counts that do not identify anyone (for example, how many bookings a clinic received in a month) to operate and improve the service.

4. Where information is stored and who else handles it

  • Google Cloud (Firestore and Cloud Storage), Sydney, Australia: Aperture's database, uploaded files (such as referrals and letterhead logos) and backups.
  • Vercel: runs the Aperture application in its Sydney region. Vercel may keep operational logs (such as request addresses and error messages) on its own infrastructure, which may be outside Australia.
  • Twilio (United States): sends SMS messages, including staff sign-in codes and patient appointment messages. Twilio receives the mobile number and the message text.
  • Amazon Web Services (Amazon SES), Sydney, Australia: sends emails, including appointment and notification emails, through Amazon SES in the ap-southeast-2 region. Email archiving is not enabled and delivery requires an encrypted (TLS) connection. Once delivered, an email is held by the recipient's email system, which may be outside Australia. Before Aperture moved email to Amazon SES in October 2026, emails were sent through Resend in the United States, which keeps email content for 30 days on standard plans.
  • Amazon Web Services, Sydney and Melbourne, Australia: report drafting (Claude on Amazon Bedrock) and report dictation (Amazon Transcribe), used only when a radiologist chooses those tools. AWS receives the report text, the study type and the referral's clinical notes, and dictated audio, but not the patient's name, date of birth, address or Medicare number. Aperture does not store dictated audio; it keeps the report text and the dictation transcript with the report. Processing is limited to Australian AWS regions.
  • Radly: provides clinic staff sign-in from Radly accounts, sends booking requests made on the Radly marketplace, and stores referral documents from those bookings in its Sydney file storage. Aperture opens those documents only for signed-in staff of the clinic the booking belongs to.
  • The clinic's own systems: if the clinic connects its imaging system (PACS), Aperture reads study information from it and links to the clinic's image viewer. Those systems are the clinic's responsibility.

Because SMS content is processed in the United States, some personal and health information (for example your name, the examination and appointment details) is handled outside Australia. We use these providers under their data processing terms. Emailing finished report letters from Aperture is switched off; clinics download reports and send them through their own channels.

5. How information is protected

  • Encryption in transit (TLS) for connections, and encryption at rest by Google Cloud for stored records, files and backups.
  • Clinic separation: every request is checked against the signed-in staff member's clinic in the application. Referral documents can only be opened by signed-in staff of the clinic that holds the record.
  • Role-based access for reception, radiographers, radiologists and managers.
  • SMS-verified staff sign-in and single-use sign-in links from Radly that expire within minutes.
  • An audit log of changes, and of each time a referral document or report letter is opened. The application does not edit or delete audit entries.
  • Nightly backups in the same Sydney storage (the 30 most recent are kept), plus Google Cloud's database recovery and scheduled backups (up to 14 weeks).

No system is completely secure, but we take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.

6. Retention and deletion

Clinical records are kept for as long as the clinic requires. Health records laws generally require clinics to keep records for at least 7 years for adults, and longer for children. A clinic can delete duplicate or test patient records; records with clinical history are kept and can be merged instead.

If a clinic stops using Aperture, we provide an export of its data on request and then delete its records from Aperture's live systems on the clinic's written instruction. This is currently carried out manually by Radly, and we confirm to the clinic in writing when it is done. Copies in backups are then removed as the backups expire (up to 14 weeks). Messages already delivered by SMS or email stay with their recipients and with the provider for its retention period.

7. Your rights and complaints

You can ask for access to, or correction of, your information. For health information, contact your clinic, which holds the relationship and the record. For anything about the platform itself, contact us at support@radly.com.au. We will acknowledge complaints within 5 business days and aim to resolve them within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or, for health information, your state or territory health complaints body.

8. Data breaches

We maintain a data breach response process consistent with the Notifiable Data Breaches scheme. If we become aware of a suspected breach involving clinic records, we will tell the affected clinic promptly and work with it to assess the breach. Where a breach is likely to result in serious harm, affected individuals and the OAIC will be notified as the scheme requires.

9. Changes

We will post any changes to this policy here and notify clinics by email of material changes at least 14 days before they take effect, unless a change is needed sooner to protect information or to correct an inaccuracy.

Contact

Privacy questions: support@radly.com.au - Radly Pty Ltd, Melbourne, Australia.