Skip to main content

Privacy and Security

The Praxi Referrer Portal is designed with privacy and security as a priority, in compliance with the Australian Privacy Act 1988.

Authentication​

  • One-time passcodes — No passwords are stored. Each login requires a fresh 6-digit code sent to your registered email.
  • Session timeout — Your session expires 15 minutes after login.
  • Account lockout — After 3 failed attempts, your account is locked for 15 minutes to prevent brute-force attacks.

Data Protection​

  • Encryption — All data is encrypted in transit (TLS 1.2+) and at rest.
  • Minimal access — You can only see clients linked to you through a referral relationship. Full clinical records are never exposed.
  • No PHI in emails — Notification emails never contain clinical information or client details.
  • Secure document links — Download links expire after one hour.

Audit Trail​

All actions in the referrer portal are logged, including:

  • Login attempts (successful and failed)
  • Client records viewed
  • Documents accessed and uploaded
  • Messages sent and read

Audit records are retained for 7 years as required by Australian healthcare regulations.

Data Hosting​

All data is hosted in Australia on Australian-operated infrastructure, in compliance with data sovereignty requirements.

Questions​

If you have questions about how your data is handled, contact the practice that invited you to the portal.