Legal
Privacy Policy
Effective 7 July 2026, updated 25 October 2026 · Praxia Clinical Solutions
Praxia is operated by Praxia Clinical Solutions (an Australian company currently in incorporation) (“we”, “us”, “our”). We are committed to protecting your personal information, and we have designed our practices with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in mind.
This policy explains what personal information we collect, how we use and protect it, and your rights in relation to it.
1. What information we collect
We collect and hold the following categories of personal information:
From patients (collected by your clinic on our platform):
- Identity information: full name, date of birth, phone number, email address, postal address
- Health information: clinical notes, visit records, treatment plans, form responses, assessment outcomes
- Appointment information: appointment dates and times, visit type, follow-up schedule, attendance status
- Financial information: invoice amounts, payment status (payment card details are not stored by us)
From clinic staff (collected at account setup):
- Name, email address, role and professional credentials
- Roster and shift information
Automatically collected:
- System access logs: timestamps, IP addresses, and request identifiers (used for security and operational purposes only; not linked to patient records)
Health information is collected by your clinic, including through intake forms that patients can complete online, and is held by Praxia on the clinic’s behalf. It is also entered into the platform by your clinic’s authorised staff.
Contact details we collect from public sources:
We collect published business contact details for health clinics from public sources. These include clinic websites, public directories, ABN Lookup and map listings. The details are a clinic’s name, business address, business phone number, business email address and website. We use them for one purpose: to tell clinics about Praxia and Aurora, our clinic software and services. We do not collect personal mobile numbers or home addresses. If a source only shows a personal contact, we leave it out. For each record we keep the source and the date we collected it.
To opt out of contact, or to ask us to delete your details, email info@praxiaclinical.com. We will stop contacting you and delete the record, and we will not collect it again.
2. Why we collect this information
We collect and use personal information for the following purposes:
| Purpose | APP basis |
|---|---|
| Providing the clinical management platform to your clinic | Primary purpose of collection (APP 6.1(a)) |
| Sending appointment reminders and follow-up communications (where your clinic has enabled this) | Directly related to primary purpose; clinics are responsible for obtaining any consent required for this communication (APP 6.1(a), APP 7) |
| Maintaining clinical records as required by law | Legal obligation (state and territory medical record retention laws) |
| Billing and invoicing | Primary purpose of collection |
| Platform security and fraud prevention | Legitimate operational interest |
| Improving the platform (de-identified and aggregated data only) | Legitimate interest; no individual identification |
We will not use your personal information for any purpose that is incompatible with the purpose for which it was collected without your consent.
3. How we store and protect your information
Our application, clinical records database and backups are hosted in Sydney, New South Wales on infrastructure operated by Fly.io. Some services we rely on are based overseas, including our CRM and booking platform (GoHighLevel), video consults, email, website form spam checks and error monitoring. We disclose each of them in section 4.
We protect your information using:
- Encryption in transit (TLS) and at rest
- Row-level security: each clinic’s data is separated from other clinics’ data at the database level
- Role-based access controls: staff can only access information their role permits
- Staff sign-ins and patient form links expire automatically
- Daily automated, encrypted, off-host backups
4. Who we share your information with
We share personal information only where necessary to provide the platform:
| Recipient | Purpose | Location | Safeguard |
|---|---|---|---|
| Our CRM and booking provider (GoHighLevel) | CRM platform: acts as a processor for us and stores contact and appointment data on our behalf, including details submitted on our website forms such as free trial requests | AU sub-account configuration, but our CRM provider is US-based and data transits/rests on US core infrastructure | APP 8 cross-border disclosure (United States): a data processing agreement with our CRM provider is in force from account creation. We reviewed it internally in July 2026; it has not yet been legally reviewed. The relevant terms and the corresponding register entry are available to clinics on request |
| Fly.io | Cloud infrastructure and database hosting | Sydney, Australia | Standard contractual terms |
| AWS S3 (Sydney) | Encrypted off-host database backups | Sydney, Australia (ap-southeast-2) | Bucket region-locked; encryption at rest (SSE-AES-256) + S3 Object Lock |
| AWS Bedrock (Sydney) | AI assistance for drafting referral letters: clinical text is sent to Anthropic’s Claude model, designed to run in the Sydney region | Sydney, Australia (ap-southeast-2) | Designed for in-country processing; clinician reviews and approves every draft before send, see § 4.2 |
| Better Stack | Uptime monitoring + log aggregation (system health only, no patient identifiers in log fields) | United States | APP 8: technical safeguard (no PII in log fields) applied |
| Sentry | Error tracking (clinical content stripped before transmission) | United States | APP 8: technical safeguard (PII redaction) applied |
| Google Workspace + Google Meet | Telehealth video consults (video + audio of consult, meeting metadata; no recording) | US / EU routing, see § 4.1 | APP 8: disclosed, see § 4.1 |
| Google Workspace email | Email you send to us and our replies, including website enquiries | Outside Australia, including the United States | APP 8: disclosed here; Google’s terms apply |
| Cloudflare (Turnstile) | Spam check on our website forms (receives technical information from your browser, not what you type) | United States and other countries where Cloudflare operates | APP 8: disclosed here; Cloudflare’s own privacy policy applies |
The full register, including data categories, vendor data processing agreements, and Australian-residency caveats for each entry, is available to clinics on request. Any change to the register is formally reviewed and version controlled, not a silent configuration update.
We do not sell, rent, or trade personal information to third parties for marketing purposes.
4.1 Telehealth video: overseas data routing
We need to be specific about one item in the table above because the trade-off is material.
Telehealth is not complete yet and is not part of the pilot. When a clinic uses it, the video and audio of the consult are carried over Google Meet, which runs on Google Workspace. Google Workspace at our subscription tier (Business Starter) does not pin data to Australia. Video consult content may transit Google’s global infrastructure including US and EU regions. Australia is not an available data-region option at this tier.
What this means in practice:
- The consult is not recorded by Praxia. We understand that recording is not enabled for Google Meet at our subscription tier; we are confirming this. The video, audio and meeting metadata (patient name, clinician name, time) are carried over Google’s infrastructure outside Australia, as described above.
- The application and clinical records database are stored in Sydney. Some contact and appointment details sit with our CRM provider, as set out in the table in section 4. Telehealth sessions are routed overseas, as described above.
Google’s compliance posture against the Australian Privacy Principles is documented in the Google Cloud and the Australian Privacy Principles whitepaper, which we have reviewed and which informs how we disclose this under APP 8.
A patient who is not comfortable with overseas routing for their consult may request an in-person or telephone appointment instead. The choice is recorded on the visit.
We have chosen Google Meet at v1 because the marginal cost is zero and recording is expected to be off at that tier. We re-evaluate against AU-resident alternatives (e.g. Coviu, Zoom Sydney) when an upgrade trigger arrives, see the sub-processor register for current status.
4.2 AI assistance with referral letters: what we send, where it stays, who decides
After a clinical visit is signed off, our platform can generate a first-draft referral letter for the clinician’s review. We use Anthropic’s Claude model for this, designed to run on AWS Bedrock in the Sydney region.
The trade-off here is the opposite of telehealth: the clinical content is designed to stay in Australia.
What we send.
The clinical content of the visit (SOAP notes), the patient’s name and date of birth, the referring clinician’s name and AHPRA number, and your clinic’s letterhead fields. These are the inputs the model needs to draft a first-pass letter for the clinician to review and edit.
Where it stays.
Inference is designed to run in AWS Bedrock’s Sydney region (ap-southeast-2). Drafting is designed so that clinical content does not leave Australia for this purpose. The draft letter that comes back is saved into our Sydney database; the prompt is not designed to be retained outside that path.
Who decides.
Every draft is exactly that: a draft. A clinician opens it, reads it, edits it where needed, and explicitly approves it before any send. The platform does not auto-send referral letters.
Compliance basis.
Because inference is designed to run in Australia, we intend to treat this as in-country processing rather than an APP 8 cross-border disclosure. The production setting is not yet confirmed at the time of writing, and this position is subject to legal review. The decision and the alternatives we considered are documented, and our sub-processor register and data protection impact assessment cover this processing. These records are available to clinics on request.
Audit trail.
Draft generation and sending are recorded in our audit trail of key actions. If you make an access request under the Australian Privacy Act, AI-drafted artefacts about you are covered by the same response surface as the rest of your records.
AI scribe (pilot release).
The pilot release also includes an AI scribe that drafts clinical notes for the clinician to review and sign. It is not yet generally available. At the time of writing, which provider transcribes consult audio, where that audio is processed, and how long it is kept have not been settled, and this policy does not yet describe them. We expect to update this policy when they are settled.
If at any point a future version of the platform changes how AI processes clinical content, for example a different model, a different region, or a feature that removes the clinician-approval step, we will update this section before that change goes live.
5. Health information
Health information is sensitive information under the Privacy Act. We collect and hold health information only:
- With the patient’s consent (obtained by the clinic at the point of care), and
- For the purpose of providing clinical management services to the clinic
Access to health information is limited by clinic and by role. Praxia staff and the services listed in section 4 may also handle it as described in this policy.
6. Retention and deletion
We retain personal information for as long as necessary to fulfil the purpose of collection and to meet our legal obligations:
| Information type | Retention period |
|---|---|
| Clinical records (health information) | 7 years from last entry, or until patient requests deletion (subject to legal obligations) |
| Appointment and visit records | 7 years |
| Financial records | 7 years (tax and accounting obligation) |
| System access logs | 90 days |
| Staff account information | Duration of employment + 7 years |
| Free trial request details (website form) | While your request or trial is active, then deleted from our live systems 60 days after the trial ends or lapses, or sooner if you ask us to. Some records are kept for the longer periods in this table only where the law requires |
When your clinic’s subscription ends, export arrangements are agreed in writing with the clinic, and we delete the clinic’s data from our live system 60 days after the subscription ends. Some records must be kept for longer where the law requires, such as the clinical and financial records in the table above. We have not yet published a standard export process.
7. Your rights
Under the Australian Privacy Principles, you have the right to:
- Access the personal information we hold about you (APP 12)
- Correct inaccurate, out-of-date, incomplete, or misleading information (APP 13)
- Make a complaint about how we have handled your personal information (APP 1.4)
To exercise these rights, contact us using the details in section 9. We will respond within 30 days.
For patients: Your health records are held by and on behalf of your clinic. To access or correct your clinical records, please contact your clinic directly. We will assist your clinic to respond to access and correction requests.
8. Notifiable Data Breaches
We are bound by the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If we become aware of an eligible data breach that is likely to result in serious harm, we will:
- Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable (within 30 days of becoming aware)
- Notify affected individuals (or their clinic) directly
We maintain an incident response runbook to ensure timely breach assessment and notification.
9. Contact us
For privacy enquiries, access requests, corrections, or complaints:
Privacy Officer, Andrew Romano
Praxia Clinical Solutions (in incorporation)
Email: info@praxiaclinical.com
Phone: 02 4077 2942
Text: 0468 272 942
Address: 16-18 Castlereagh Street, Penrith NSW 2750
If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
10. Our website (praxiaclinical.com)
This section covers visitors to our marketing website. It does not cover the clinical platform, which is described in the rest of this policy.
What we collect. The website has no sign-in and no comments. It does have forms that you can choose to complete: a contact form, a form to request a walkthrough, an early access form, a form to download the switching checklist and a free trial request form. The forms ask for your first name and email address, your clinic type, the practice management system you use now, and an optional note. The free trial request form also asks for your last name, how many practitioners work in your clinic, and a notes box (please leave out patient information), and has a second required box confirming you understand the trial is a pre-pilot environment that is not ready for patient data. The contact, walkthrough, early access and checklist forms ask you to tick a box agreeing to be contacted about Praxia. We use that only to contact you one to one about what you asked for. The trial form has a required box that lets us contact you about your trial request, and a separate optional box, unticked by default, to receive product updates and offers. Please do not put patient information in these forms. We do not need it. If you email or phone us, we keep what you send so that we can reply.
Who holds the form information. The forms are hosted by our CRM and booking provider, GoHighLevel, and shown inside our pages. When you submit a form, your details go to GoHighLevel, not to our WordPress website. GoHighLevel acts as a processor on our behalf and stores form details, including free trial requests, on servers in the United States. We disclose this as a cross-border disclosure under Australian Privacy Principle 8, and the provider is listed in section 4.
Why we use it. We use what you send to reply to you, to arrange a walkthrough, to confirm your place in the free trial, book your onboarding and run your trial, to tell you when we can onboard more clinics, and to understand which clinics we can help. When you submit a form, we add a label (a tag) to your record that says which form you used, for example contact, walkthrough request, early access, checklist download or free trial request. We use that label to sort enquiries and to make sure you only receive messages related to what you asked for.
Consent and marketing messages. On the trial form, the required box lets us contact you about your trial request. That covers replies and trial emails only. If you tick the separate optional box, you also agree to receive occasional marketing emails from Praxia about product updates and offers. You can withdraw at any time using the unsubscribe link in any of them or by emailing info@praxiaclinical.com, and we will stop promptly. Every marketing email includes a way to unsubscribe. If you gave us your details through another form, we contact you one to one about what you asked for. We do not add you to marketing emails unless you opt in separately. We keep a record of when you ticked each box, the wording shown and the form version, so we can show your choice.
Campaign links. If you arrive from a link that carries campaign tags (they appear in the address as utm_source, utm_medium and similar), your browser keeps those tags in session storage for the length of your visit, and our pages add them to links between our own pages, so that if you send us a form we can see which link brought you. They are not used to identify you, no cookie is set for this, and your browser clears them when you close the tab.
Spam protection. Our forms may use a spam check provided by Cloudflare (Turnstile) to tell people from automated programs. Cloudflare receives technical information from your browser as part of that check, and Cloudflare’s own privacy policy applies.
How long we keep it. We keep enquiry and early access details for as long as we need them to respond and to contact you about Praxia, and delete or de-identify them when you ask us to, or when they are no longer needed. Free trial request details are kept while your request or trial is active and deleted 60 days after the trial ends or lapses, unless you ask sooner. If you opted in to marketing emails, we keep the record of your consent while you are on the list, and a minimal record after you unsubscribe so that we do not email you again.
Server logs. Our website is hosted by WPX, a hosting provider. Like most web servers, it records technical details of each request, such as IP address, date and time, pages requested and browser type. We use these logs only to keep the site secure and working, and the host keeps them for a limited period.
Cookies and tracking. We do not use analytics, advertising pixels or tracking cookies on our own pages. The embedded forms are served by our CRM provider and may set cookies or similar technology that are needed to make the form work. If we add analytics or advertising tools in future, we will update this policy and ask for your consent first.
Fonts and other third parties. The pages of this website serve their fonts and images from our own hosting. The embedded forms are served by our CRM provider and load their own fonts, including from Google Fonts, so your browser contacts those providers when a form loads. Our footer links to our Instagram profile. If you follow that link, Instagram’s own privacy policy applies from that point.
Email. We use Google Workspace for email, so messages you send to us are handled by Google under its terms.
Questions. Contact our Privacy Officer using the details in section 9.
11. Changes to this policy
We may update this policy from time to time. Clinics will be notified of material changes by email at least 30 days before they take effect. The current version is always available at this page.