Breach Notification Commitment

Praxi alerts affected customers as soon as we suspect a breach affecting their data, and confirms the outcome as soon as practicable after we conclude an assessment under section 26WE of the Privacy Act 1988.

In practice, our internal target is to give you that confirmation within 24 hours of completing the assessment. If it is an eligible data breach, we also give the statutory statement to the OAIC as soon as practicable; telling you never delays it. Section 26WH requires us to take all reasonable steps to complete the assessment within 30 days; for most incident types it takes days rather than weeks.

This is a commitment, not a contractual service-level agreement, and nothing in it limits your rights under the Privacy Act.

Our breach-notification posture is shaped by the following Australian regulatory frameworks:

• Privacy Act 1988 (Cth): Notifiable Data Breaches scheme (sections 26WA–26WT)
• Privacy and Other Legislation Amendment Act 2024: statutory tort of serious privacy invasion and expanded OAIC powers (as applicable)
• State health-records legislation where applicable (HRIP Act 2002 (NSW); Health Records Act 2001 (Vic); Health Records (Privacy and Access) Act 1997 (ACT)). These regulate how health information is handled but do not add a separate breach-notification duty for private providers.

Detect → Contain (early alert to affected customers) → Assess (s 26WE) → Notify OAIC (s 26WK) and confirm to customers → Notify affected individuals (s 26WL) → Remediate → Final review.

We do not commit to a fixed hour-clock from detection to statutory notification because Australian law does not impose one and an arbitrary commitment may force premature notification before the section 26WE eligibility threshold is met. The 30-day period in section 26WH applies to the assessment only, and a notification that is already due is never held back for it.

For every eligible data breach affecting your data, we will provide:

• The nature of the breach
• The categories of data affected (account / billing / clinical)
• The approximate number of records and individuals affected (where known)
• The likely consequences and recommended actions
• The status of regulator notifications (including the OAIC, where required)
• Contact details for follow-up questions

You remain the APP entity for personal information about your clients held in your Praxi tenant. If a breach affects your clients' personal information, your practice may have notification duties under sections 26WK and 26WL. Praxi also assesses and fulfils its own applicable Privacy Act duties; responsibilities must be coordinated rather than assumed to rest with only one party.

Where both Praxi and your practice hold the affected information, one assessment and one notification can satisfy both of us (sections 26WJ and 26WM). We agree with you who notifies: usually your practice tells its clients, using the facts and template notice we supply, and Praxi notifies them directly if that is not possible.

Praxi will provide forensic logs, breach scope evidence, and template notification copy within 24 hours of your request (or as soon as practicable for complex multi-tenant incidents), to support you meeting your obligation. Praxi will also fulfil its own applicable notification obligations.

We welcome coordinated security disclosure.

• Email: hey@praxi.au (the same address published in our security.txt)
• We acknowledge receipt within 24 hours
• We will not pursue legal action against good-faith researchers who comply with coordinated-disclosure expectations (no data exfiltration, no service disruption, reasonable disclosure timelines)

See also our Security Controls page.

You may also contact:

• Office of the Australian Information Commissioner (OAIC): 1300 363 992 / oaic.gov.au
• Australian Digital Health Agency (ADHA): 1300 901 001 / digitalhealth.gov.au
• Australian Cyber Security Centre (ACSC): 1300 292 371 / cyber.gov.au

Last reviewed: 7 November 2026.
We run a breach-response tabletop exercise at least once a year. The first has not run yet; it is due by 30 November 2026, before any practice goes live.