Responsible AI

Research with AI. Responsibility stays with people.

Ethnobot conducts qualitative research interviews and helps interpret themes. Discover returns an individual AI profile; Org Studies support commissioned research. Neither is a system for making decisions about a person’s employment or access to services.

Updated 27 October 2026 · Product statement, not a certification

Purpose and processing

Core interviews, analysis, synthesis and profiles use Claude through Amazon Bedrock with Australian inference profiles. Primary records are stored in Supabase Sydney; application compute is pinned to Sydney. Anthropic's commercial API in the United States is used only where the Australian configuration is not present, such as in development.

This does not make the entire service Australian-only. Email, logs, error monitoring and public-page analytics involve overseas services. See privacy and trust and data for details.

Client-facing findings should contain de-identified themes and quotes. Authorised Helix researchers can access transcripts for research quality. Unusual roles, incidents and small groups can still identify someone: removing names alone does not guarantee anonymity.

AI can invent, omit or misinterpret information. Profiles are not psychometric assessments. Findings need contextual review and must not be used for hiring, promotion, discipline, credit or eligibility decisions.

Six practices for responsible AI

Our working practices are mapped to the National AI Centre’s Guidance for AI adoption. This guidance evolves the earlier Voluntary AI Safety Standard’s ten guardrails. The mapping describes intent and controls; it does not assert formal conformity.

  1. 1. Decide who is accountable

    The Helix Lab Pty Ltd operates Ethnobot. Suhit Anantula is the accountable operator and privacy contact. Study sponsors and research reviewers remain responsible for how findings are used.

  2. 2. Understand impacts and plan accordingly

    Research scope, participant notice and consent come before organisational interviews. Small cohorts create identification risks; research reviewers must remove or generalise identifying detail before release. This is a review practice, not an automatic cell-size lock.

  3. 3. Measure and manage risks

    Discover and organisational research use separate data pools. Access checks, capability links and database permissions limit access. Australian processing controls cover core research; supporting services and separate tools have different processing boundaries.

  4. 4. Share essential information

    Participants are told they are speaking with AI. Our privacy and trust pages describe processors, retention and overseas operational services. Models can misinterpret language; generated profiles and themes are research interpretations.

  5. 5. Test and monitor

    Automated tests cover interview orchestration, authentication, privacy boundaries and data transformations. Error monitoring supports recovery. These checks do not establish freedom from bias or replace independent security and impact assessments.

  6. 6. Maintain human control

    Participants can stop. Authorised researchers can review transcripts for quality. Client reports require human research review before release; AI output must not determine employment, pay, credit, insurance or access to services.

Australia’s eight AI Ethics Principles

The national principles remain a reference for study design and review.

Human, social and environmental wellbeing
Use research to understand people’s experience of AI. Assess each study’s likely harms and benefits.
Human-centred values
Respect consent, participant choice and the right to stop.
Fairness
Do not use profiles for personnel decisions. Examine context and reporting bias.
Privacy protection and security
Limit collection and access; disclose processors and handle deletion requests.
Reliability and safety
Test workflows and review findings against source material.
Transparency and explainability
Disclose AI involvement, intended purpose and limitations.
Contestability
Provide a human contact to challenge a profile, quote or finding.
Accountability
Keep the operator, study sponsor and release reviewer identifiable.

Evidence and remaining gaps

We do not claim SOC 2, ISO 27001, ISO 42001, IRAP assessment or an independent penetration-test report. An Essential Eight self-assessment is an internal assessment and needs periodic owner re-attestation.

Small-group suppression is currently a human review responsibility. Formal impact assessments, an independent penetration test, a documented database restore exercise and incident tabletop evidence remain part of enterprise readiness work. A source-code backup restore does not prove database recovery.

Discover and organisational retention differ. See the privacy policy for current periods and deletion arrangements; contractual commitments require engagement-specific review.

Raise a concern

Contact [email protected] for access, correction, deletion or to challenge how your information was used. Contact [email protected] about research quality or product concerns. We aim to respond within 30 days.

If a privacy complaint remains unresolved, you can contact the Office of the Australian Information Commissioner.