Trust & compliance

How we keep this platform safe to use.

Dr Rob Health is an Australian precision-health telehealth platform operating under Australian law and AHPRA guidance. This page sets out, plainly, what we verify, what we record and what we will not do.

Practitioners

Every doctor is credentialed before their room opens.

• AHPRA registration is verified against the public register, including any conditions, undertakings or reprimands — not taken from a CV.
• Professional indemnity cover is sighted and its expiry recorded, in line with the Medical Board's Professional Indemnity Insurance Arrangements registration standard.
• Identity, primary qualification and college fellowship are confirmed at their source.
• Medicare provider and prescriber numbers, CPD home registration, national police check and ABN status are all recorded and dated.
• Registration and indemnity are re-checked automatically every day. If either lapses, the room is taken offline until the renewal is recorded.

Patients

Your health information stays yours.

• Patient records are held per doctor. A doctor can only see the patients in their own room, enforced on the server, not merely hidden in the interface.
• Any emergency access to a record outside a doctor's own room is recorded as a break-glass event and reviewed.
• Reports are only published to a patient after the treating doctor has reviewed and approved them. Nothing generated automatically reaches a patient unreviewed.
• Consent and privacy preferences are captured explicitly and can be changed at any time from the patient portal.
• Handling of personal and health information follows the Privacy Act 1988 and the Australian Privacy Principles.

Clinical governance

Advice is doctor-led, and evidence is traceable.

• Biological Age and Longevity Stack outputs are drafts for a doctor to review, edit and approve — they are decision support, never a diagnosis.
• The peptide library distinguishes approved, investigational and unapproved-market compounds, with the evidence stage shown alongside each.
• Patient reviews and testimonials are moderated against the AHPRA advertising guidelines before they appear.
• Doctors complete a full guided simulation of the patient journey before they consult on the platform.

Payments

The platform never touches a patient's payment.

• Consultation payments settle directly from ZedMed/Tyro to the treating doctor. No patient payment is held, split or redirected by this platform.
• The platform fee is reconciled from the doctor's own reported revenue and paid separately by the doctor.
• Doctors receive a monthly statement showing reported revenue, the fee on it, room rent and anything outstanding, exportable for their accountant.

Platform security

Built to be defensible, not just functional.

• Administrator and doctor access requires a two-step login with an emailed one-time code.
• Every administrative action is written to an immutable audit log with the actor, the action and the affected record.
• Every write endpoint is rate limited and validated before it touches the database.
• Data is held in Google Cloud Firestore. Secrets are held as environment variables and are never exposed to the browser.
• System health is sampled on a schedule and retained, so an outage is visible after the fact rather than only while it is happening.

Documents

Read the detail.

If something on this platform does not match what is described here, tell us. A report about clinical safety or privacy is reviewed by Dr Rob directly.