Security and compliance
Trilbii helps practice teams with the work around the practice: marketing, operations, patient communications and AHPRA advertising checks. Practice data is hosted in Australia, and Trilbii Comms keeps patient information in Australia too.
This page sets out what information Trilbii holds, where it is stored, who can reach it, and how it is protected. If you need more detail than this for a vendor assessment or an accreditation cycle, ask and you will get it in writing.
The short version
The marketing, operations and AHPRA tools work on practice information: your website content, treatment descriptions, brand voice, manuals and SOPs, and your public Google reviews. They do not read, store or process patient records or clinical notes. Trilbii Comms handles patient names and contact details, never clinical notes. That is set out further down this page.
Nothing is installed in Dental4Windows, Dental4Web or any other practice management system. The marketing, operations and AHPRA tools make no connection to it at all. Trilbii Comms reads the appointment and recall information needed to trigger a message, for practices that switch it on, and never writes back.
Trilbii runs in Amazon Web Services in Sydney. Your practice information, your account and your uploaded files are all held in Australia, encrypted in transit and at rest.
Each practice has its own tenancy. Your content, your knowledge base and your settings are visible only to the users you invite.
What goes in
The clearest way to understand Trilbii’s privacy position is to look at what actually goes into it.
If a practice uploads a document to the Operations Manuals tool, it is the practice’s responsibility to make sure that document does not contain patient identifiable information. Operations manuals and SOPs are operational documents, not clinical records, and Trilbii is built on that assumption.
Data residency
Trilbii runs in Amazon Web Services in the Asia Pacific (Sydney) region. The application, your practice information, your account and your uploaded files are all held in Australia, on infrastructure certified to ISO 27001, SOC 2 and IRAP.
Patient information handled by Trilbii Comms stays in Australia end to end. Data is encrypted in transit and at rest, and each practice’s information is separated from every other practice’s.
Some content generation for public marketing material, such as website copy, social posts and blog drafts, may be processed by a model provider outside Australia. Patient information is not. If you need the detail behind that for a vendor assessment, get in touch and you will have it in writing.
Service providers
Trilbii uses a small number of service providers to deliver the platform. Each receives only what it needs to do its job.
The current list, naming each provider and the country it operates in, is available on request. Practices are told before a new provider that handles practice or patient information is added.
Privacy Act 1988 (Cth)
The Privacy Act 1988 (Cth) sets out thirteen Australian Privacy Principles. This is how each applies to Trilbii.
| APP | Principle | How Trilbii applies it |
|---|---|---|
| 1 | Open and transparent management | Trilbii publishes a Privacy Policy, this page, and Terms and Conditions. Practices can ask questions about data handling at any time and receive a written answer. |
| 2 | Anonymity and pseudonymity | Trilbii is an account based tool for practice teams, so users are identified. Practices may use role based mailboxes rather than individual names where they prefer. |
| 3 | Collection of solicited personal information | Trilbii collects only what is needed to produce the practice’s content and run its account. Where patient contact details are handled for practice communications, only the fields needed to send that communication are collected. |
| 4 | Unsolicited personal information | If personal information is received that Trilbii did not ask for and does not need, it is destroyed or de-identified. |
| 5 | Notification of collection | Practices are told at sign up and at onboarding what is collected and why, and the Privacy Policy sets it out in writing. |
| 6 | Use or disclosure | Information is used to deliver the service to the practice that supplied it. It is not sold, and it is not shared with other practices. |
| 7 | Direct marketing | Trilbii markets to practices, not to patients. Practice communications sent through Trilbii are the practice’s own communications to its own patients, with consent and opt out controlled by the practice. Those messages are subject to the Spam Act 2003 (Cth), the practice is the sender, and Trilbii enforces the unsubscribe mechanism technically on every message. Every Trilbii marketing message carries an opt out and the opt out is honoured. |
| 8 | Cross border disclosure | Practice and patient information is held in Australia. The only service providers that process information outside Australia are the model providers used for public marketing content. They are named in the service provider list above and set out in the Privacy Policy. |
| 9 | Government related identifiers | Trilbii does not use Medicare numbers, tax file numbers or other government identifiers. AHPRA registration numbers are handled as public professional information for advertising compliance purposes only. |
| 10 | Quality of personal information | Practices can review and correct their practice details, practitioner details and knowledge base at any time from within the application. |
| 11 | Security of personal information | Encryption in transit and at rest, role based access, multi factor authentication available on every account and required for privileged roles, separation between practices, monitoring and alerting on the platform and its database, and controlled release of changes to the platform. Information is destroyed or de-identified when it is no longer needed, on the schedule set out below. |
| 12 | Access | Practices can access the information Trilbii holds about them, and can request a copy in writing. |
| 13 | Correction | Practices can correct their information themselves in the application, or request a correction in writing. |
Automated decision making
The Privacy and Other Legislation Amendment Act 2024 (Cth) introduces obligations to disclose where automated decisions are made using personal information. Trilbii’s position is straightforward.
Trilbii does not make automated decisions about individuals. It does not score patients, rank them, or make any decision that affects a person’s rights or access to care.
What Trilbii does is generate drafts and flag issues for a person to review. An AHPRA advertising check produces a report with findings and reasoning. It does not approve or reject anything. A social post is a draft. A review response is a draft. Every output is reviewed and published by a person at the practice, and the practice remains the publisher and the advertiser for AHPRA purposes.
Where patient communications are sent on a practice’s behalf, the practice sets the rules for who is contacted and when, and controls consent and opt out. Choosing who is due for a recall applies a rule the practice sets. It is not a decision Trilbii makes about a person. Trilbii carries out the practice’s instructions rather than deciding anything about a patient.
How Trilbii is run
People at your practice sign in to their own account with a role that sets what they can do. Access to Trilbii’s own systems is limited to the staff who need it to run and support the service.
Information is encrypted in transit and encrypted at rest, so it is protected both while it moves and while it is stored.
Each practice’s content, knowledge base and settings sit in their own tenancy. A user at one practice cannot reach another practice’s information.
Changes to the platform are tested before release, and production releases require an approval step. Every change is recorded.
Notifiable data breaches
Trilbii operates under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).
If Trilbii becomes aware of unauthorised access to, or disclosure or loss of, information belonging to your practice, your nominated contact is told without undue delay. You are told what happened, what information was involved, what Trilbii has done, and what the practice may need to do.
Where the incident is likely to result in serious harm, Trilbii notifies the Office of the Australian Information Commissioner and supports the practice in meeting its own obligation to do the same. A named person at Trilbii owns each incident from first report to closure, and the practice receives a written account afterwards.
Retention
APP 11.2 requires personal information to be destroyed or de-identified once it is no longer needed. Trilbii’s retention is:
A practice can ask for a copy of its information, or for it to be deleted, at any time.
Certification
Trilbii is developed to SOC 2 and ISO 27001 control standards, operates in line with the Australian Privacy Principles, and is hosted on infrastructure certified to ISO 27001, SOC 2 and IRAP. Trilbii does not yet hold a certification of its own, and will not claim one until it does.
Trilbii is also subject to state health records legislation where a practice operates, including the Health Records and Information Privacy Act 2002 (NSW), the Health Records Act 2001 (Vic) and the Health Records (Privacy and Access) Act 1997 (ACT). Patient information is held in Australia, which is what those Acts require of a transfer.
Formal certification is on the roadmap, driven by what practices and partners need for their own accreditation and vendor assessments. If your practice needs specific evidence for an accreditation cycle or a vendor review, get in touch and you will have a direct answer about what can and cannot be provided today.
Trilbii Comms
Trilbii Comms sends recalls, reactivation messages and treatment follow ups on your practice’s behalf, triggered by what is already in your practice management system. That means it handles information the marketing and operations tools do not, so it is set out here rather than buried.
Patient information stays in Australia end to end, is held for the practice that supplied it and separated from every other practice, and is never used to train AI models. Your practice remains the owner of the patient relationship and controls who is contacted, when, and how they opt out.
Questions practices ask
Nothing is installed in your practice software. The marketing, operations and AHPRA tools run independently of your practice management system and make no connection to it.
Trilbii Comms is different, and only for practices that switch it on. It connects to Dental4Windows or Dental4Web and reads the appointment and recall information needed to trigger a communication. It does not write to your practice software, and it does not read clinical notes.
Not with the marketing, operations and AHPRA tools. Those work with practice information: your website content, treatment descriptions, manuals, brand voice and public reviews.
Trilbii Comms handles patient contact details and the treatment events that trigger a message, so recalls, reactivation and treatment follow ups can be sent on your practice’s behalf. It does not hold clinical notes, treatment plans or images, and patient information stays in Australia.
In Amazon Web Services in Sydney. Your practice information, your account, your uploaded files and any patient information handled by Trilbii Comms are all held in Australia.
No. Trilbii does not train models on your content. Trilbii uses paid API services rather than consumer tools, and patient information is never sent to a model at all.
Only the small number of staff who need access to run and support the service, and that access is for support and maintenance rather than for reading practice content.
Not yet. Trilbii is built to those control standards and hosted on infrastructure certified to them, but does not yet hold a certification of its own. Formal certification is on the roadmap, and Trilbii will not claim one until it has it.
No. Each practice’s content, knowledge base and patient information is separated by tenancy and is used only to serve that practice.
The practice is. Trilbii’s AHPRA tools flag likely issues against the advertising guidelines and explain the reasoning, so the team can make an informed decision. They produce a report for a person to act on. They do not approve content, and they do not replace professional judgement.
Your practice does. Trilbii Comms sends your practice’s own communications to your practice’s own patients, under the rules you set. Consent, opt out and the record of both stay with the practice.
Yes. Get in touch through the contact page and Trilbii will provide a copy of the information held about your practice, or delete it, in line with the Privacy Policy and any obligations to retain records.
Get in touch with what your assessor is asking for. You will have a written answer about what evidence is available today and what is not.
If your practice, your partner or your assessor needs more detail than this page provides, ask. Trilbii would rather answer a hard question in writing than have a practice guess.
For security matters specifically, including reporting a suspected vulnerability, use the contact form and mark it for the security team. Reports are acknowledged within one business day. Trilbii does not pursue legal action against researchers who report a genuine issue in good faith and give a reasonable window to fix it.
This page describes Trilbii’s security and privacy practices and is provided for information. It does not form part of any contract. The Privacy Policy and the Terms and Conditions govern the relationship between Trilbii AI Pty Ltd and its customers. Third party product names belong to their respective owners. Last reviewed September 2026. This page is reviewed quarterly; next review December 2026.