AI voice agents for telehealth in Australia handle booking, call-back and reminder calls for GP practices and telehealth services under the Privacy Act. Health information is sensitive information, and live audio sent overseas raises an APP 8 question. From 10 December 2026, privacy policies must also describe significant automated decisions. Self-hosting onshore with local models keeps calls in Australia.
Key Takeaways
- Health information is sensitive information, so a practice phone agent handles it carefully.
- Live call audio sent to an overseas model is a cross-border disclosure under APP 8.
- Privacy policies must describe significant automated decisions from 10 December 2026.
Sending live call audio to a model overseas counts as a disclosure under Australian privacy law. We cover the Privacy Principles a practice phone agent touches, APP 8, the automated decision rule from 10 December 2026, and the emergency line in Dograh. For the wider picture, see our guide to voice AI in healthcare.
Telehealth in Australia after the peak
Telehealth has settled into a steady part of Australian care. The Australian Bureau of Statistics reported that 22% of people used telehealth services in 2024-25, down from a peak of 31% in 2021-22. Each of those consults still starts with a booking or a call-back.
An AI voice agent can take that administrative work, from booking appointments to taking call-back requests for a GP. It does not give clinical advice. AI voice agents for telehealth shows how these calls run for a US provider, and in Australia the calls stay the same while the privacy questions change.
The Privacy Principles a phone agent touches
The Privacy Act 1988 and its Australian Privacy Principles (APPs) generally cover private health service providers regardless of size, and health information is sensitive information under the Act. Four principles do most of the work on a practice phone line. APP 3 limits what the agent collects. APP 6 keeps each use tied to the purpose it was collected for, which generally covers reminders a patient would expect from their practice. APP 11 asks you to secure the data and destroy or de-identify it once you no longer need it, and APP 8 covers anything sent overseas. Some states, including Victoria and New South Wales, add their own health records laws.
The regulator has also written about AI products. The OAIC's guidance on commercially available AI products asks for due diligence before choosing a product, with checks continuing afterwards. It also expects a privacy impact assessment and an updated privacy policy, and says public-facing AI tools should clearly identify themselves as AI.
Where the audio goes, and APP 8
Ask any supplier where the live audio goes, not only where recordings are kept. Waboom, an Australian AI receptionist vendor, describes its own set-up openly. Transcripts and call records stay in Sydney while live audio is processed offshore during the call. That is an honest answer, and it means each call sends health information overseas, which brings APP 8 into play.
There is another way to build it. The speech and language models are a separate layer you pick, apart from the platform that runs the call. A hosted model provider receives the audio wherever it runs, so self-host in an Australian cloud region or data centre and run open-weight models in the same region. The recordings, transcripts and the live audio then stay onshore. The voice AI data residency checklist lists every copy to place.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Automated decisions from 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 adds a transparency duty that starts on 10 December 2026. A privacy policy must then describe the kinds of personal information used, and the kinds of decisions made, by computer programs where a decision could reasonably be expected to significantly affect someone's rights or interests. Those decisions stay allowed, as long as patients can read about them in the policy.
Booking a slot the patient chose is unlikely to be caught. An agent that ranks who gets the last same-day appointment, or decides which callers get a nurse call-back, could be, even with staff checking the list. Write down what your agent decides before the date and add a line to the policy where needed.
Keeping the agent administrative also keeps it clear of a separate rule. Software that diagnoses or triages patients can be regulated as a medical device by the Therapeutic Goods Administration (TGA), so the agent sticks to bookings and messages and leaves clinical judgment to clinicians.
Notice, a person, and 000
Put the practice name and a plain line such as "You're speaking with the practice's automated assistant" in the Greeting Text on the Start Call node, with a recording notice if you record. Allow Greeting Interruption is on by default, which lets a caller cut the notice short, so switch it off on that node. Recording rules differ between states, so a notice at the start of every call is the safe default.
Before the agent talks about any appointment, it checks a date of birth and one more detail against your practice system. The check itself is covered in verifying patient identity before a voice agent shares PHI. A patient who asks for a person goes through Transfer Call, which works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. Dograh calls reception first and connects the patient only when someone answers. An emergency pathway plays one fixed line: "If this is a medical emergency, please call 000 now."
APP 11 needs a deletion plan, and there is no retention setting to lean on. Recordings and transcripts stay until your own process removes them from your database and storage. The anonymous usage telemetry a self-hosted install sends by default should go too, so set ENABLE_TELEMETRY=false and remove POSTHOG_API_KEY before go-live.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Self-hosting Dograh removes the per-minute platform fee, though servers, model keys and phone minutes still cost money. Dograh Cloud charges a 1¢-a-minute platform fee. Which APPs and state laws apply depends on your practice and your suppliers, so confirm the privacy policy wording and the overseas data question with counsel before the first patient call.
Start with inbound bookings for telehealth consults. They test the notice and the onshore set-up before the agent places any outbound reminders.
Glossary
- Australian Privacy Principles (APPs)
- The 13 principles in the Privacy Act 1988 that set how organisations collect, use, disclose, secure and destroy personal information. Private health service providers are generally covered regardless of size.
- Sensitive information
- The Privacy Act's stricter class of personal information, which includes health information. A practice phone line handles it on almost every call.
- Cross-border disclosure (APP 8)
- Sending personal information to a recipient overseas. Live call audio processed by a model outside Australia is one, and the practice stays accountable for how it is handled.
- Automated decision
- A decision made by a computer program, or where a program does something substantially and directly related to it. From 10 December 2026, privacy policies describe those that significantly affect individuals.
