Australian Data Residency and Access

At Zanda, we understand that data security and residency are especially important to many Australian healthcare providers-particularly when working with government agencies, insurers, or service purchasers that may require assurance around where data is stored and who has access to it.

This article provides specific information for Zanda customers based in Australia. It outlines where data is stored, how it is protected, and under what limited circumstances it may be accessed or processed from outside Australia.

Have a Canada, USA (United States), or UK account? Zanda supports Canadian, US, and UK practices on region-specific infrastructure. For where data is hosted for those accounts — including a Canadian data server / data residency answer — see the Other regions and multi-country practices FAQ near the end of this article. 

Key Points – Data Residency and Security for Australian Customers

• All data for Australian accounts is stored in Australia
  
  We use Amazon Web Services (AWS) data centres located within Australia to store and back up all customer data for Australian-based Zanda accounts. Data is encrypted both at rest and in transit.
  
  
• Australian-owned, Australian-based
  
  Zanda is an Australian company, headquartered in Victoria. We prioritise local data handling and Australian-based service delivery wherever feasible.
  
  
• Local customer support
  
  Our Australian-based support team is the default contact for Australian customers. We also conduct police and background checks on all team members with potential access to customer data.
  
  
• Consent-driven access
  
  We do not access customer data unless explicitly authorised by the account holder, and always for the purpose of providing support or resolving an issue.
  
  
• Dedicated Data Protection Officer
  
  We have an internal Data Protection Officer responsible for overseeing data privacy, security, and compliance across all operations.
  
  
• We are ISO 27001 certified
  
  Both Zanda and our infrastructure providers meet the globally recognised ISO 27001 standard for information security.
  
  
• Comprehensive, externally audited privacy program
  
  We maintain a robust privacy program that is externally audited and aligned with Australian Privacy Principles (APPs), ensuring ongoing compliance with relevant privacy regulations.
  
  
• Direct integration with Medicare
  
  We have a native, direct integration with Medicare and comply with their strict data access and processing residency requirements, ensuring sensitive health data is handled in line with Australian government standards.
  
  
• We actively choose local providers where possible
  
  Whenever practical, we work with Australian-based providers and services to help maintain high standards of privacy and data residency.
  
  

Situations Where Data May Be Accessed or Processed Overseas

While our default approach for Australian customers is to keep data stored and managed within Australia, there are limited and specific circumstances where data may be accessed or processed from outside the country:

1. After-hours or urgent support
   
   Zanda provides 24/7 customer support. While Australian customers are primarily supported by our local team, there may be situations-especially during urgent or after-hours events-where team members based in the UK or USA assist. These staff are subject to the same training, compliance obligations, and background checks.
   
   We also ensure compliance with Australian Privacy Principle (APP) 8 before granting any access, including requiring that all staff handle data in accordance with Australian privacy standards.
   
   
2. Optional third-party integrations
   
   Some integrations, such as online payments via Stripe, may involve limited data transfer (e.g., name, email, and card details) outside Australia. Stripe is PCI DSS compliant and handles this data securely.
   
   Similarly, our default email provider (SendGrid) may process email data (e.g., recipient email addresses) outside of Australia. Customers are able to configure their own email service if preferred.
   
   
3. Accessing Zanda while travelling
   
   If a customer logs into Zanda from overseas (e.g., while travelling), data is transmitted securely over the internet. This does not involve a change in data storage location, but may constitute international access under some definitions.
   
   

Summary

Zanda takes data residency and security seriously. For Australian customers, our systems, partners, and policies are built to ensure that data is stored locally by default, and that any overseas access-when it occurs-is secure, limited, and appropriately governed.

For more information, you can also refer to:

• Our Security Overview
• Our Privacy Policy

Other regions and multi-country practices

The key points above apply to Australian accounts. Zanda uses region-specific infrastructure, so data for accounts outside Australia is handled by local infrastructure in those regions. For general data residency and hosting questions across all regions, the published Security and Sub-processors pages are the primary reference, and Zanda Support can provide written, account-specific confirmation when you need it.

❓ Where is data hosted for accounts outside Australia?

Zanda stores customer data in Amazon Web Services (AWS) data centers, encrypted at rest and in transit. For accounts outside Australia, the hosting region is determined by local regulations and is located in London, Northern Virginia, or Sydney as needed. United States accounts are hosted in North American data centers. For written confirmation of the region tied to your own account, contact Zanda Support and include the reason you need it (for example, a service purchaser, insurer, oversight body, audit, or internal policy).

❓ Where is data hosted for Canadian accounts?

Zanda does not publish a Canada-specific data center city. Data for Canadian accounts is hosted in London, Northern Virginia, or Sydney based on local requirements, in line with Canadian privacy standards — the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Ontario, the Personal Health Information Protection Act (PHIPA). For account-specific confirmation, contact Zanda Support.

❓ Where is data hosted for New Zealand accounts, and does Zanda address the NZ Privacy Act 2020 and the Health Information Privacy Code (HIPC)?

Zanda supports New Zealand practices. Zanda does not operate a dedicated New Zealand data center; data for New Zealand accounts is hosted in Amazon Web Services (AWS) data centers in the Sydney region, encrypted at rest and in transit, and managed in line with New Zealand privacy standards — the Privacy Act 2020 and, for health information, the Health Information Privacy Code (HIPC) 2020. The broader Zanda privacy program is ISO 27001 certified, externally audited, and overseen by a dedicated Data Protection Officer, so the compliance framework is not limited to the Australian Privacy Principles. For a formal, account-specific response — a signed attestation, specific region wording, or a completed compliance questionnaire naming the Privacy Act 2020 or HIPC — use the Security and Sub-processors pages and contact Zanda Support with the exact wording you need.

❓ If my practice relocates to another country, does my account's data region change?

Contact Zanda Support with the region you need and the reason for the request. Moving your data to another region is a migration our team carries out for you, and it is the only thing that changes your account's data region.

Your account's data region is set when the account is created and does not change on its own. Moving your practice overseas, updating your address, changing the Country in your Business Information, or logging in from another country does not move where your data is stored.

❓ Does Zanda comply with the Health Records and Information Privacy Act 2002 (NSW)?

The Zanda privacy program—Australia-wide, including AI features such as BizzyAI—is built around the Australian Privacy Principles (APPs), is ISO 27001 certified, externally audited, and overseen by a dedicated Data Protection Officer (see Key Points above). Zanda does not publish a statement confirming compliance with any individual state or territory health-records law, including the Health Records and Information Privacy Act 2002 (NSW). For a formal, account-specific response—a signed attestation or a completed compliance questionnaire that names this Act—use the Security and Sub-processors pages and contact Zanda Support with the exact wording you need.

❓ Can one Zanda account run locations in two countries, such as New Zealand and Australia, with a different time zone for each?

Set up a separate Zanda account for each country. Each account keeps its own country, business time zone, and locations.

Tip: If you created each account on the same domain (such as my.zandahealth.com, us.zandahealth.com or uk.zandahealth.com, you can then use Linked Zanda Accounts to switch between them from a single login.

A single account has one country and one business time zone, both set in your Business Information, and every location in the account uses them. Locations do not carry a country or a time zone of their own, which is why two countries need two accounts.

If you want to see a second time zone while you work, each user can turn on Additional Time Zone in their own profile. This shows a second set of times on the calendar for that user only and does not change how appointments, availability, or reminders are stored.

⚠️ Do not change the account time zone to match a new location. Doing so shifts all existing appointments and affects every practitioner in the account. See Setting Up a User Time Zone.

❓ Can I use this article as evidence for a non-Australian account?

The detailed key points above cover Australian accounts only. For Canadian, UK, US, or other regional accounts, use the Security and Sub-processors pages together with account-specific confirmation from Zanda Support.