Where briefs and chronologies are kept
All storage and processing of the documents you supply happens in Australia, on computers Trenthos controls. That covers the application, the database, the store that holds each document, and the AI models that read the pages. The chronologies made from your documents are kept in the same place.
Your browser connects to ime.trenthos.com directly, with no outside host or CDN in between.
Backups also stay in Australia, on equipment Trenthos controls, and are encrypted.
AI models run on our own computers
Text is taken from each page’s own text layer, or read by text recognition software (Tesseract) when there is none. The AI models that find entries in that text, and on a free trial find the details to hide, run on Trenthos’s own computers. No page, image, text or chronology is sent to an outside AI service.
Your documents are never used to train an AI model.
Each AI call is recorded with the model it used, and the disclosure annexure for a matter is built from those records, so you can say how Trenthos IME was used. Trenthos IME does not write opinions or reports. The examiner forms every opinion and writes the report.
What leaves Australia, and why
Briefs and chronologies stay in Australia. Three service providers hold some account information outside Australia, and Trenthos sends none of them records or chronology content.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Resend | Sends account and service emails, such as email verification, password resets, invitations, billing notices and “your chronology is ready” | Your name, email address and the content of those emails, which never contain records or chronology content and never name a claimant | A United States company, sending from its Japan (Tokyo) region |
| Mailgun | Receives emails you send to support@trenthos.com | Whatever you write or attach | United States |
| Stripe | Takes payment for plans and briefs | Your name, email address, billing details and card details. You enter your card on Stripe’s page, and Trenthos never sees or stores your full card number | Outside Australia, including the United States and India |
Because support email passes through Mailgun, please do not attach records or chronologies when you email us.
We do not otherwise disclose personal information overseas. This public website is separate from Trenthos IME: it sends its subscription emails through Resend and loads its typefaces from Google Fonts, as the website Privacy Policy explains.
Deletion and retention, by matter type
“Delivery” is when a trial chronology is first made available to you.
Free trial matters
| What | When it is deleted | Source |
|---|---|---|
| The identified original of the brief | Within 7 days of delivery | Trial undertaking v2.2, section 2 (Deletion); Privacy Policy section 7 |
| Everything else: the redacted copy, the chronology and any processing records | 30 days after delivery, or 30 days after your last upload if a chronology is never delivered | Trial undertaking v2.2, section 2 (Deletion); Privacy Policy section 7 |
| Backup copies | Within 21 days after the live deletion above | Trial undertaking v2.2, section 2 (Deletion); Privacy Policy section 7 |
| Any of the above, sooner | On request: email support@trenthos.com | Trial undertaking v2.2, section 2 (Deletion) |
| Files sent for a trial that the registration check declines | Deleted from the service at once; nothing is prepared from them | Trial undertaking v2.2, section 2 (Registration check); Privacy Policy section 7 |
| The record that you accepted the undertaking (your name, the date and time, the network address and browser, and the document accepted) | Kept for 7 years after the trial is deleted, as evidence of your acceptance, then deleted | Trial undertaking v2.2, section 4; Privacy Policy section 7 |
| A one-way keyed code made from your email address and Ahpra number (not the address or number itself) | Kept after your account is deleted, and used only to prevent a repeat free trial | Trial undertaking v2.2, section 2 (One trial per examiner); Privacy Policy section 7 |
| A coded form of the network address a trial was started from | 30 days | Privacy Policy section 2 |
A trial brief sent under an earlier version of the undertaking is deleted as that version says.
Paid matters
Paid matters are processed as the brief was received, because the examiner needs the names: the documents are not redacted; quotes are kept exactly as printed, names included, and entries refer to the claimant as “the worker”.
| What | When it is deleted | Source |
|---|---|---|
| A matter’s documents and chronology | Kept while your account is open | Privacy Policy section 7 |
| A matter you delete, or every matter when an administrator deletes the account | Its content is deleted from the service after the undo period shown when you ask, except where the law requires us to keep it | Terms of Service section 7; Privacy Policy section 7 |
| Backup copies of a deleted matter | May persist for a limited time after that deletion, in Australia, and are not used for anything else | Terms of Service section 7; Privacy Policy section 7 |
| The record that a deletion happened | Kept, with no content | Terms of Service section 7; Privacy Policy section 7 |
| Matters when a subscription ends | We warn your account administrators, and the matters are destroyed 90 days after the end of service unless you renew or delete them sooner | Terms of Service section 7 and Privacy Policy section 7 (the warning); Trenthos IME service setting (the 90 days) |
Account records
| What | How long it is kept | Source |
|---|---|---|
| Account details, including your specialty and Ahpra registration number | While your account is open | Privacy Policy section 7 |
| Records of sign-ins and actions in the app | Kept with the history they protect | Privacy Policy section 7 |
| Sign-in records keep the network address and browser they came from. | Expired sign-in records are deleted 90 days after they expire or are cancelled. | Privacy Policy sections 2 and 7; Trenthos IME service setting (the 90 days) |
Security and access
Encryption. Records are encrypted in transit and at rest.
Two-factor sign-in. Two-factor sign-in (TOTP) is required before any matter, page or chronology can be opened. A new examiner may send the free trial brief first. An idle session locks after 15 minutes and needs your PIN to resume.
Passwords. Your password is stored only in a form that cannot be read back.
Practices kept apart. Each practice’s records are kept separate in the database itself: row-level security is turned on and forced on every table that holds clinical records, so an application bug alone cannot read another practice’s records from the database.
Audit log. Each time health information is opened, it is recorded in an audit log. The application can only add to that log. It cannot change or delete entries, except to remove a deleted matter’s details when the Privacy Policy requires it.
Access within Trenthos. Within Trenthos, access to records is limited to Dr Liu, and only to provide or support the service, for example when you ask for help. On a free trial, the identified original is held in a restricted holding area that is not copied to any backup, and no person needs to open it for redaction.
Sources
- Trenthos IME Terms of Service, 27 October 2026.
- Trenthos IME Privacy Policy, 29 October 2026.
- Confidentiality Undertaking: Free Trial Chronology, version 2.2, 28 October 2026. It is shown in your Trenthos IME account before you send a free trial brief.
- Trenthos website Privacy Policy, for this website only.
Questions about any of this: support@trenthos.com.