Allied health and pharmacy website privacy guide
See what your allied health or pharmacy website needs to cover, from booking forms to tracking pixels, and which fixes to make first.
By the Savira teamPublished Last reviewed 6 min read
If you run a physio clinic, allied health practice, NDIS service or pharmacy, the Privacy Act 1988 (Cth) almost certainly applies to you, whatever your turnover. That makes allied health website privacy a real obligation: your booking forms, privacy policy and any tracking tools on your site all need to stand up to a closer look.
Your website now does a lot of what the front desk used to. People book appointments, fill in intake forms, upload scripts and send referrals online. Every one of those steps collects information about someone’s health, and the regulator has been paying close attention to health websites this year.
Does the Privacy Act cover allied health and pharmacy businesses?
In most cases, yes. The Office of the Australian Information Commissioner (OAIC) says an organisation that provides a health service and holds health information is covered by the Privacy Act, even if it is a small business.
The OAIC’s examples include pharmacists and allied health professionals such as physiotherapists, podiatrists, psychologists, occupational therapists and speech pathologists. Disability service providers are also on the list where they handle health information, which is why many NDIS providers are covered too.
If you are not sure where your business sits, our guide to whether the Privacy Act covers health service providers walks through it. Some states, including New South Wales, Victoria and the ACT, also have their own health records laws that can apply alongside the federal Act.
Why is health information on your website treated differently?
Health information is “sensitive information” under the Privacy Act, which means it gets extra protection and you generally need a person’s consent to collect it.
On a website, health information is not just what someone types into an intake form. It can be the appointment type they pick (“pelvic floor assessment”), the condition page they read before booking, or the prescription they upload for collection. If a tool on your site records those actions, it may be collecting health information too.
What did the OAIC find about tracking pixels on health websites?
In June 2026 the Privacy Commissioner found that two health service providers, Medmate and Monash IVF, interfered with people’s privacy by collecting sensitive information through third-party tracking pixels without consent.
A tracking pixel is a small piece of code from a platform like Meta, Google or TikTok that reports what visitors do on your site, often so you can show them ads later. The Commissioner’s decision establishes that tracking visitors on health-related websites and then targeting them with ads on social media counts as collecting sensitive information, so the website owner needs consent.
Alongside the decisions, the OAIC reported on its inspection of 50 health service provider websites. More than half used a third-party tracking pixel, and 77% of those did not mention it in their privacy policy (Your life, pixelated: how tracking pixels watch your every click, OAIC, 24 June 2026).
Your patients notice this kind of thing. In the OAIC Australian Community Attitudes to Privacy Survey 2026, 91% of people said targeted advertising based on sensitive information is unfair.
For a physio clinic, the risk is usually simple: a Meta pixel added by a marketing agency that fires on every page, including “book a sports injury assessment”. Our article on tracking pixels on health websites goes deeper on the decisions.
What should a clinic or pharmacy privacy policy cover?
Everything any Australian privacy policy has to cover, plus the detail that is specific to health. Start with the core list in our guide to privacy policy requirements in Australia, then make sure yours also says:
What health information you collect. Medical history, treatment notes, Medicare or health fund details, NDIS plan information, prescriptions.
Which systems hold it. Your online booking and practice management software, and whether any of it is stored or accessed overseas.
Who you share it with. Referring GPs, other treating practitioners, health funds, the NDIS, pathology or delivery partners.
What runs on your website. Analytics and advertising tools, named, and what they collect.
How people get their records. How to ask for access or a correction, and who to contact.
Pharmacies have a reason to move first. Chemists and pharmacists are one of six sectors in the OAIC’s first privacy policy compliance sweep, which began in January 2026. If you offer script uploads, vaccination bookings, home delivery or a loyalty program, each one should be reflected in your policy.
How to check your website privacy in an afternoon
You do not need a compliance team for this. You need a list, a scan and an honest hour with your privacy policy.
1. List every form on your site
Booking, contact, intake, script upload, NDIS referral, newsletter sign-up. For each one, check you only ask for what you need, and add a short note beside it explaining why you are collecting the information.
2. Find every tracking tool
Run your site through the free website privacy scanner and ask your web agency for a list of everything they have installed. Note which pages each tool fires on.
3. Deal with tracking on sensitive pages
Remove pixels from booking, condition and treatment pages, or make sure nothing loads until a visitor has agreed. A cookie consent banner that holds tracking back until someone clicks accept is the usual way to do that.
4. Make your privacy policy match reality
Update it with every system and tool you found in steps 1 and 2. A policy that leaves out your booking software or your Meta pixel is exactly the gap the OAIC flagged.
5. Check your software settings
Find out where your booking and practice management systems store data, and who outside your business can log in, including agencies and contractors.
6. Put a date on it
Record when you last reviewed your site and set a reminder for twelve months, or sooner whenever you add a new tool.
Want to know where your clinic stands first? The allied health privacy risk scorecard and the pharmacy privacy risk scorecard give you a plain-English starting point. For a wider view of health sector obligations, see our healthcare privacy compliance page.
Sources: What is a health service provider?, OAIC, last updated 27 October 2023, and Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation, OAIC, 24 June 2026.
This is general information, not legal advice. Every business handles information a bit differently, so if you’re not sure how this applies to yours, it’s worth checking with a lawyer or privacy adviser.
Do physio clinics need a privacy policy in Australia?
Can I use the Meta pixel on my physiotherapy website?
Can I use the Meta pixel on my physiotherapy website?
Only with real care. In June 2026 the Privacy Commissioner found that using tracking pixels on health websites to target visitors with ads is a collection of sensitive information that needs consent. If you use the Meta pixel, keep it off booking and condition pages or make sure it only loads after a visitor agrees, and name it in your privacy policy.
Do NDIS providers have to follow the Privacy Act?
Most do. The OAIC lists disability service providers that handle health information as health service providers, and NDIS supports usually involve health information, so the small business exemption rarely helps. NDIS providers can also have privacy expectations under NDIS rules, so it is worth checking both sets of obligations rather than assuming you are exempt.
What does a pharmacy privacy policy need to include?
The same core points as any Australian privacy policy, plus pharmacy detail. That means the kinds of health information you hold, how you collect it (including script uploads and vaccination bookings), who you share it with, any overseas storage, the tools running on your website, and how customers can access their records or make a complaint.
Is my clinic covered if our turnover is under $3 million?
Probably, yes. The $3 million turnover threshold exempts most small businesses, but not those that provide a health service and hold health information. A small allied health clinic or independent pharmacy usually falls into that group, so it is safest to work on the basis that the Australian Privacy Principles apply to you.