Updated 29 October 2026 to reflect the latest rules and guidance.
Most clinic websites have a privacy policy, but many were copied from a template and never checked against what the website actually does. A policy that doesn’t match reality is worse than no policy, because it gives a false picture. It has also become a more direct risk: since 11 December 2024, the Office of the Australian Information Commissioner (OAIC) can issue infringement notices for privacy policies that don’t contain what the law requires.
This article covers what a clinic website privacy policy should explain, what has changed in the law, and how tracking pixels and automated tools fit in. From 10 December 2026, privacy policies will also need to describe certain automated decisions. It is general information, not legal advice, and your adviser or insurer should check the final version.
What has changed
Higher penalties and infringement notices
The Privacy and Other Legislation Amendment Act 2024 received assent on 10 December 2024, and most of its first schedule commenced on 11 December 2024. It created tiered penalties. At the lower tier, breaches of specified Australian Privacy Principles (APPs), including the privacy policy content requirements in APP 1.3 and 1.4 and the direct marketing rules in APP 7, are civil penalty provisions of up to 200 penalty units, and the OAIC can deal with them through infringement notices and compliance notices without going to court. A mid tier of up to 2,000 penalty units applies to any interference with privacy, and the serious-interference penalty remains above that.
That means a privacy policy is no longer just a document you’re expected to have. Its content can be the subject of a fine on its own.
OAIC guidance on tracking pixels
On 4 November 2024 the OAIC published guidance on third-party tracking pixels, such as Meta, TikTok and Google ad pixels. It says organisations should clearly disclose their use of third-party tracking pixels in their privacy policy, notify visitors (for example through a banner or pop-up), and only collect sensitive information through a pixel with a person’s express consent.
OAIC findings against health websites
On 24 June 2026 the OAIC announced two determinations, dated 11 June 2026, finding that telehealth provider Medmate and fertility provider Monash IVF interfered with people’s privacy by collecting sensitive information through third-party tracking pixels. The Commissioner found that using pixels to follow visitors to health-related websites and then target them with social media ads is a collection of sensitive information, which requires consent. In an inspection of 50 health provider websites, the OAIC found 52% used a third-party pixel, and 77% of those didn’t mention pixels in their privacy policy.
Automated decisions, from 10 December 2026
From 10 December 2026, new APPs 1.7 to 1.9 commence. If a computer program uses personal information to make, or substantially assist in making, a decision that could reasonably be expected to significantly affect someone’s rights or interests, your privacy policy must say so. APP 1.7 is in the infringement notice tier.
Who it applies to
Private health service providers are covered by the Privacy Act regardless of turnover, so the small business exemption that applies to many other small businesses generally won’t help a clinic. Health information is sensitive information, which carries stricter rules on collection, use and disclosure. The obligations sit with the practice, even when an agency, developer or software vendor set up the website.
What the policy should cover
Who you are
Say who is responsible for the website and how to contact you about privacy. Use the legal entity name and a contact that someone actually monitors.
What you collect
Be specific. Common examples:
- Contact details submitted through enquiry and booking forms.
- Information entered in forms, such as a message or a request for an appointment.
- Technical information, such as IP address and device, collected through analytics.
- Cookies, tracking pixels and similar technologies, and what they are used for.
Health information needs particular care. If your forms ask for it, say why, and avoid asking for more than you need.
Why you collect it
Explain the purposes in plain terms: to respond to enquiries, book appointments, run the practice, improve the website and, where agreed, send updates.
Tracking pixels and advertising tools
This is the section most clinic policies leave out. Following the OAIC’s guidance, say:
- that you use third-party tracking pixels or tags, and name the platforms (for example Meta, Google or TikTok)
- what they collect and what you use them for, such as measuring enquiries or showing ads
- how visitors can opt out of targeted advertising, which APP 7 requires where pixels are used to target ads
- whether the information goes overseas
Disclosure alone doesn’t make collection lawful. If a pixel would collect health information, such as which treatment pages someone visited, the OAIC’s position is that you need express consent, or you should configure the pixel so it doesn’t collect that information. The policy should describe what you actually do, not what the platform’s default settings would do.
Who you share it with
List the types of services that receive information, such as booking systems, email providers, website hosts and analytics or advertising providers. If any information goes to services outside Australia, say so and, where practicable, name the countries. Many pixel and analytics providers process data overseas, which brings in APP 8.
Marketing and consent
If you send marketing emails or messages, explain how people agree to them and how they can stop. Make sure the process in practice matches the wording. APP 7 is in the infringement notice tier, so a missing or broken opt-out is a real risk.
Automated decisions
From 10 December 2026, if you use computer programs to make or substantially assist decisions that could significantly affect patients, the policy must describe the kinds of personal information used and the kinds of decisions made solely by computer programs or with their substantial assistance. A refusal or failure to decide counts as a decision. For clinics, think about automated triage, eligibility checks, booking priority or automated approvals for payment plans. Whether everyday marketing automation reaches the “significantly affect” threshold isn’t settled, so ask your adviser if you’re unsure.
How you protect it
Describe the steps you take, in general terms, such as secure hosting, access controls and limits on who can see information. Don’t overstate it: a promise that data is “completely secure” is hard to keep.
Access, correction and complaints
Explain how people can ask to see or correct their information, and how to make a complaint. Include a contact and a realistic response time, and mention that people can complain to the OAIC if they’re not satisfied.
What it means for your website and marketing
Forms and booking
Link the policy next to every form, and add a short collection notice explaining why you’re asking for each piece of information. If a booking widget from a third party collects details, check its privacy terms and reflect them in your policy.
Cookie and consent notices
A banner only helps if it reflects what the website really does. The OAIC has suggested a first-visit banner or pop-up as a way to offer an opt-out from targeted ads, but where health information is involved, a banner that loads pixels before anyone has agreed doesn’t give you consent.
Email and SMS
Put a link to the policy in email footers, and make sure your unsubscribe process matches what the policy says.
Chatbots and AI tools
If a chatbot collects enquiries or symptoms, the policy should say so, explain where the information goes and, from 10 December 2026, cover any significant automated decisions it makes.
Common mistakes we see
- A copied template that names another business or refers to another country’s laws.
- A policy that lists services the website doesn’t use, or leaves out ones it does.
- Forms that collect more than the policy says.
- Tracking pixels that aren’t mentioned, or a vague line about “cookies” that doesn’t name the platforms.
- No explanation of how to opt out of targeted advertising.
- No mention of overseas disclosure, even though analytics and ad platforms process data offshore.
- A policy that isn’t linked from the forms where people hand over information.
- An out-of-date contact for privacy questions.
A practical review checklist
- The policy is linked from the footer, from every form and from any consent notice.
- It uses plain language and a clear date.
- It names who to contact about privacy.
- It describes the types of services that receive information, and any overseas disclosure.
- It names every tracking pixel and advertising platform on the site, and explains how to opt out of targeted ads.
- Pixels don’t collect health-related browsing or form data without express consent.
- It matches the tags and tools on your website today, checked against a real tag audit.
- It explains marketing consent and unsubscribing, and that process works.
- Before 10 December 2026, you’ve checked whether any automated tools make significant decisions about patients and updated the policy if so.
- Someone reviews it at least once a year and whenever you add a form, tool or tracking tag.
How this fits with other rules
The Privacy Act and the APPs set the legal requirements for your policy. The OAIC’s guidance explains how it reads them, and its determinations show how it applies them to health websites. Separately, the statutory tort for serious invasions of privacy commenced on 10 June 2025, letting individuals sue over serious misuse of their information. Your website’s practices also need to line up with Ahpra’s advertising rules where marketing is involved, and with the Spam Act for email and SMS.
Further reform is on the way. The Government has signalled a second tranche of Privacy Act changes, so treat your policy as a living document.
Frequently asked questions
Can we use a template?
As a starting point, yes, but it needs to be tailored to what your website really collects and shares. The OAIC’s 2026 inspection found most health websites with pixels didn’t mention them, which is a common template gap.
Do we need a cookie banner?
It depends on what you collect and share. The OAIC has suggested a banner or pop-up as one way to notify visitors and offer an opt-out from targeted ads. But a banner only helps if it reflects what the website really does, and it doesn’t replace express consent where health information is collected.
Does our privacy policy have to name Meta or Google?
The OAIC’s guidance says organisations should clearly disclose their use of third-party tracking pixels in their privacy policy. Naming the platforms is the clearest way to do that.
What is the 10 December 2026 change?
From that date, APPs 1.7 to 1.9 require privacy policies to describe decisions made or substantially assisted by computer programs using personal information, where those decisions could significantly affect someone’s rights or interests. Review any automated triage, eligibility or approval tools before then.
Can we be fined just for an inadequate policy?
Since 11 December 2024, breaches of the privacy policy requirements in APP 1.3 and 1.4 are civil penalty provisions that the OAIC can deal with through infringement notices. So yes, the content of the policy itself carries risk.
How long should it be?
As long as it needs to be, in plain language. Clear beats clever, and a layered approach, with a short summary up front and detail below, works well.
Related articles
- Tracking pixels on a health website: what practices need to know about patient privacy
- How to reply to Google reviews without breaching patient privacy
- OAIC findings on tracking pixels on health websites
- Privacy Act tranche 2 exposure draft: what it could mean for marketing
Need a hand?
We cover privacy in our compliance audit, including a check of the tags and pixels on your site against your policy, and our website builds include forms and tracking set up with privacy in mind. For legal questions, speak to a lawyer or your indemnity insurer.
This article is general guidance based on the published rules, not legal advice. Final responsibility for your privacy practices sits with your practice, and complex situations may need independent legal advice.