Cliniko, Halaxy and 6 More: Where They Host Your Data

Key takeaways

• Six of the eight platforms checked state Australian data residency in plain terms: Cliniko, Halaxy, HotDoc, Power Diary (now Zanda Health), Praktika and Core Practice
• Two do not make an equivalent statement: Fresha’s privacy policy discusses international transfer safeguards without naming a default storage country, and Dental4Windows’ privacy policy commits to Australian residency only for AI-related processing
• Four of the six rely on AWS’s Australian infrastructure, with Power Diary/Zanda naming Sydney specifically: Cliniko, Halaxy, HotDoc, and Power Diary/Zanda
• Two run private Australian infrastructure with no third-party cloud provider: Praktika and Core Practice
• Power Diary rebranded to Zanda Health. powerdiary.com now redirects to zandahealth.com and the old brand name is gone from the current hosting page
• Storage location and support-access location are separate questions. Australian hosting does not by itself close out APP 8
• The underlying obligation, APP 8 and section 16C, is in force and has been since March 2014

If you run a cosmetic clinic or a cosmetic dental practice and you want to know where Cliniko, Halaxy, Power Diary or another booking platform actually keeps your patient data, the vendor’s own security page usually says so directly. We read eight of them on 11 August 2026 so you do not have to hunt through eight separate sites. Six state Australian storage in plain language. Two leave it open.

That gap matters more than a line on a comparison table. Under the Privacy Act, the platform you pick decides how much cross-border risk you are carrying before a patient ever books an appointment.

What Cross-Border Disclosure Requires

Before an APP entity discloses personal information to an overseas recipient, Australian Privacy Principle 8 requires it to take such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles in relation to that information. Section 16C then makes the entity accountable for the overseas recipient’s acts as if it had done them itself, an accountability that can apply even where reasonable steps were taken and even where a subcontractor, not the vendor, was the one that breached.

Choosing a booking or practice management platform is where that obligation starts, not where it ends. A vendor’s hosting statement is the first input into the reasonable-steps assessment APP 8 asks you to make, and you cannot make that assessment for a platform whose page never answers the question.

What That Means for Your Build

The practical build consequence is simple: read the vendor’s own security or privacy page, not a comparison blog, before you sign up or before you audit what you already run. Look for three things specifically: a named country for data at rest, a named cloud provider or region, and any statement about who can access the data and from where.

Where Eight Platforms Say They Host Your Data

We checked each platform’s own security or privacy documentation on 11 August 2026. This is what each one states in its own words, not what a third party claims about it.

Cliniko, Halaxy, HotDoc and Power Diary/Zanda make the same core claim in different words: an AWS region in Australia, disclosed by name. Praktika and Core Practice make a stronger structural claim, that no third party ever holds the data at all. Fresha and Dental4Windows are the two where the page we reviewed did not answer the question a clinic actually needs answered.

A Worked Example

Cosmetic clinic. A Perth clinic was choosing a booking platform between Cliniko and Fresha for its injectable and skin treatment bookings. Cliniko’s page named Australia and AWS directly, giving the clinic a written statement to cite in its APP 8 assessment on day one. Fresha’s policy required the clinic to email the vendor and wait for a specific answer about where Australian client bookings are actually stored, because the public policy discussed safeguards for EEA transfers without naming a default country for an Australian customer. Neither answer disqualifies a platform. The difference is how much extra work a clinic did before it could complete its own reasonable-steps assessment.

Cosmetic dental practice. A Rockingham dental practice compared Praktika against Dental4Windows for patient records and online booking. Praktika’s claim, no third-party cloud provider and no overseas servers at all, meant the practice’s vendor map for that system had one line in it. Dental4Windows’ privacy policy committed to Australian residency for AI features specifically, which left the practice needing a written answer about the base patient-records hosting before it could treat the platform the same way. The practice asked Centaur Software directly and kept the email as its reasonable-steps evidence.

Six of eight is a snapshot of what these particular pages say today, not a verdict on the other two platforms’ actual practices. A vendor can host in Australia and simply not say so on the page we found.

What to Check on Your Own Site

1. Identify every booking, records or payment platform embedded in or linked from your site.
2. Open that vendor’s own security or privacy page and look for a named country and a named cloud region, not a general “we take security seriously” statement.
3. Where the page is silent, email the vendor and ask which country data is stored in at rest, and which countries staff or subcontractors can access it from.
4. Keep the written answer. It is the evidence APP 8.1 asks for, not the marketing page itself.
5. Re-check every six to twelve months. Cliniko’s own page shows region choice varies by where an account is created, and Power Diary changed its public brand name entirely.

AWS-hosted and privately hosted are not competing claims for compliance purposes. Both are disclosed data-at-rest locations, which is the thing the two undisclosed platforms are missing.

The Enforcement Anchor

The OAIC maintains a public determinations register and cross-border disclosure sits within its remit under section 16C. At the time of writing, no published OAIC determination names a cosmetic clinic, cosmetic dental practice or booking platform specifically over an undisclosed offshore hosting arrangement. The absence of a sector-specific case is not the same as the obligation not applying, and it is more useful to say plainly that no such case exists than to imply one that does not.

Where This Gets Hard

A named AWS region answers where data sits, not who can reach it. A vendor can state Australian hosting accurately and still route support tickets through an offshore team with production access, and that access is its own disclosure under APP 8 regardless of where the database physically sits. None of the pages we reviewed for this post made a clear statement about support-access countries, only storage countries, which is a gap worth raising with any vendor directly.

There is a second layer this post cannot resolve from a public page: whether a vendor’s ultimate parent entity is incorporated in a country whose law can compel data disclosure regardless of where the servers sit. We did not attempt to verify vendor corporate ownership structures for this comparison, and a clinic that wants that answer needs to ask the vendor directly rather than infer it from a hosting page.

The regulator says you must take reasonable steps before disclosing to an overseas recipient and stay accountable for what that recipient does with the information; the build consequence is picking up the phone or the inbox for the two vendors above that did not answer the location question on their own page; whether your particular arrangement satisfies APP 8 in your circumstances is a question for your medical defence organisation or your lawyer.

Status

In force. APP 8 and section 16C have applied since the Australian Privacy Principles commenced on 12 March 2014. Nothing in this comparison depends on the proposed second tranche of Privacy Act reform, which has not passed and has no commencement date.

Get a Written Vendor Answer, Not a Guess

Get in touch with RockingWeb and we’ll check which platforms your own site actually embeds and produce the specific questions to put to each vendor in writing, the same evidence this post recommends keeping.

Related reading: what APP 8 requires and how to build a vendor map, and how to check your booking widget’s actual network requests.

Frequently Asked Questions

Which booking platforms actually store data in Australia?

Of the eight platforms we checked on 11 August 2026, Cliniko, Halaxy, HotDoc, Power Diary (now trading as Zanda Health), Praktika and Core Practice each state on their own security or privacy pages that Australian customer data is stored in Australia. Fresha and Dental4Windows do not make an equivalent blanket statement on the pages we reviewed. Vendor pages change, so treat this as a snapshot and re-check before you rely on it.

Does hosting in the AWS Sydney region mean my patient data never leaves Australia?

No. AWS Sydney keeps data at rest in Australia. It says nothing about which country a vendor’s support staff or subcontractors work from when they access that data, and support access is itself a disclosure to an overseas recipient under APP 8 if the support desk sits offshore. Ask your vendor the support-access question separately from the storage-location question.

What should I do if a vendor’s page does not state a hosting location?

Ask in writing. A written answer from the vendor is evidence you took reasonable steps under APP 8.1, which a marketing page is not. If the vendor cannot or will not answer plainly, treat that as a finding in its own right and weigh it against what an equivalent platform that does disclose would cost you to move to.

Is Power Diary the same company as Zanda Health?

Yes. As at 11 August 2026, powerdiary.com redirects to zandahealth.com and the Power Diary brand name does not appear on the current security page. If you are researching Power Diary by name, search Zanda Health instead, because that is the page a written vendor answer will now point you to.

Need a hand with your website?

If you want a second pair of eyes on how this applies to your own site, request a callback and we will talk it through.

Sources

1. Cliniko - Security page, data residency statement. Checked 11 August 2026.
2. Halaxy - Security page, data residency statement. Checked 11 August 2026.
3. HotDoc - Security, Privacy and Compliance page. Checked 11 August 2026.
4. Zanda Health (formerly Power Diary) - Safety and Security page. Checked 11 August 2026.
5. Fresha - Privacy Policy. Checked 11 August 2026.
6. Centaur Software (Dental4Windows) - Privacy Policy. Checked 11 August 2026.
7. Praktika - FAQ page, data hosting statement. Checked 11 August 2026.
8. Core Practice - Security page. Checked 11 August 2026.
9. OAIC - APP Guidelines Chapter 8, cross-border disclosure of personal information. Checked 11 August 2026.

Last reviewed: 11 August 2026.