Skip to main content

Privacy and Security

The Praxi Contractor Portal is designed with security as a priority.

Authentication​

  • One-time passcodes — No passwords are stored. Each login requires a fresh 6-digit code sent to your registered email, and each code allows at most 3 attempts.
  • Session timeout — Your session ends after 60 minutes of inactivity, and never lasts more than 24 hours in total.
  • Account lockout — After 3 failed login attempts, your account is locked for 15 minutes to prevent brute-force attacks. The practice can clear a lockout early by resetting your portal access.
  • Secure sessions — Session tokens are stored in httpOnly cookies and cannot be accessed by browser scripts.

Data Protection​

  • Encryption — All data is encrypted in transit (TLS 1.2+) and at rest.
  • Isolated database — Contractor portal data is stored in a separate database from clinical records. No patient health information is accessible through the contractor portal.
  • No PHI — The contractor portal does not contain or display any patient health information.

Activity Records​

Your bookings, cancellations, and credit transactions are permanent records — you can see them in your booking history and credit history, and the practice can see them on its side. Authentication activity (including failed login attempts) is recorded in the portal's operational logs.

Data Hosting​

All data is hosted in Australia on Australian-operated infrastructure.

Questions​

If you have questions about how your data is handled, contact the practice that invited you to the portal.