What we commit to, in writing.
Health had more notifiable data breaches than any other Australian sector in 2025: 225 of 1,205. Your website is part of that risk. Here's how we build around the rules, and where your own obligations sit.
We build to the rules. You keep the obligations.
We design and build to these requirements. Your legal obligations under them stay with your organisation, and we recommend your own legal adviser confirms your privacy policy. For infrastructure beyond the website, we work alongside healthcare IT specialists.
Privacy Act 1988 and the APPs
Health providers are covered whatever their turnover. Forms need collection notices, data must be stored securely, offshore tools need care.
A data map of everything the site collects and where it goes. Australian hosting where the tools allow. A privacy policy draft for your lawyer to approve.
Notifiable Data Breaches scheme
Eligible breaches must be assessed and reported to the OAIC and the people affected.
Monitoring, logging and an incident plan in every web care plan, so you can assess quickly.
2024 privacy reforms
People can sue for serious invasions of privacy from June 2025. Privacy policies must disclose automated decisions from 10 December 2026.
We audit chatbots, AI tools and tracking, and update policy wording before the deadline.
AHPRA advertising rules
No clinical testimonials, no misleading claims, clear terms on offers, care with titles like specialist.
Content checked against the guidelines. Review tools set up so clinical testimonials aren't republished.
Tracking and analytics
Ad pixels on booking or condition pages can leak health information to ad platforms.
No ad pixels on sensitive pages. Consent management. Server side analytics where it's needed.
PCI DSS
Any payment flow that touches card data.
Hosted payment pages or tokenised gateways, so card data never touches your site.
Essential Eight
The Australian Cyber Security Centre's baseline controls.
Site and admin set up with MFA, patching, backups and least privilege access.
WCAG 2.2 AA
Accessibility, and exposure under the Disability Discrimination Act.
Designed, built and tested to AA.
The things people ask before the first call.
Where is our data stored?
In Australia wherever the tools allow. Before launch, you get a list of every tool the site uses and where its data lives.
What happens if something goes wrong?
Clients on a web care plan get monitoring and an incident plan, so you can assess and notify within the scheme's timeframes.
Can you sign our security questionnaire or vendor agreement?
Yes. We're happy to complete your vendor due diligence and work under your data handling terms.
Want this checked on your current site?
Our brand analysis includes a security, privacy and AHPRA check of your existing site, with a prioritised list of fixes.