Skip to main content

Privacy and Security

Your information is protected by Australian privacy laws and industry-standard security measures.

How your data is protected​

  • Encryption: All data is encrypted in transit and at rest using AES-256 encryption
  • Access controls: Only authorised practitioners and staff can view your records
  • Audit trails: All access to your records is logged and retained for 7 years
  • Australian hosting: Your data is stored in Australian data centres
  • Secure login: Your session uses secure, httpOnly cookies — your credentials are never stored in your browser

Account security​

You can strengthen your account security from the Security page in the portal:

  • Passkeys: Sign in with Face ID, Touch ID, Windows Hello or your device PIN. A passkey only works on Praxi, so it can't be phished, and it counts as your second verification step
  • Multi-factor authentication (MFA): Add a second verification step using a passkey (recommended) or an authenticator app
  • Backup codes: One-time codes in case you can't use your passkey or authenticator
  • Security emails: Praxi emails you when a passkey is added or removed, and when a backup code is used
  • Account lockout protection: Your account is temporarily locked after multiple failed login attempts to prevent unauthorised access

Your rights​

Under the Privacy Act 1988, you have the right to:

  • Access your personal information
  • Request corrections to your information
  • Know how your information is being used
  • Withdraw consent for information sharing
  • Export your personal data
  • Request erasure of your personal data

Exporting your data​

You can download all the personal information held about you at any time:

  1. Go to the data export option in the portal
  2. Preview what will be included in the export
  3. Choose your preferred format (JSON or CSV)
  4. Download the file

The export includes your profile, consents, appointments, invoices, tasks, documents, and assessments. Clinical notes authored by your practitioner are not included in the self-service export — contact your practitioner to request these.

Requesting data deletion​

You can submit a request to have your personal data erased:

  1. Submit an erasure request through the portal
  2. Review the impact report showing what data can and cannot be deleted
  3. Your practice will review the request and process it

Some records must be retained by law (for example, health records for 7 years). The portal will clearly show you what will be deleted and what must be kept.

Data retention​

Health records are retained for a minimum period as required by Australian law (typically 7 years for adults, or until a child turns 25). After this period, you can request deletion.

Questions about privacy​

Contact your practice or review their privacy policy for more information about how your data is handled.