Your health information, handled with the same care as a clinic visit.

Yes. As an Australian telehealth provider, Doccy operates under the Privacy Act 1988 and the Australian Privacy Principles (APPs).

For you, that means:

• Your information is encrypted when sent and when stored
• Only authorised clinicians and support staff involved in your care can access your records — not other patients, and not advertisers
• We collect only what we need to provide safe care
• We do not sell your health data to third parties

Your information should feel as confidential here as it would at a traditional clinic.

Card payments are processed by Stripe, which meets PCI DSS Level 1 — the highest standard for payment security.

Your full card number goes directly to Stripe and is never seen or stored by Doccy.

Your medical records are tied to your account — another patient cannot view your information.

Access is limited to the doctors and authorised staff delivering your care, and we maintain records of who accesses patient information.

We are actively pursuing SOC 2 Type II and aligning our information security practices to ISO 27001, supported by continuous compliance monitoring.

Today we already operate under Australian healthcare regulation — the Privacy Act 1988 and AHPRA clinical governance — and follow SOC 2-aligned controls across our stack.

Please contact our team by email with clear steps to reproduce and the potential impact.

Please don't access, modify, or delete other users' data while researching, and give us reasonable time to remediate before any public disclosure. We acknowledge reports promptly and keep you updated throughout.

No. We do not sell your health data, and we do not share it with advertisers.

We use a small number of trusted service providers to run Doccy — for example, payment processing and email — only for what's needed to deliver the service, and under strict privacy terms.