A Vendor Exit Checklist for Clinics Leaving a Web or Booking Platform

Key takeaways

• A .au domain is licensed, not owned. auDA’s rules confirm a licence “confers no proprietary rights in a domain name,” and the registrant record, not the invoice, decides who controls it
• Once a domain transfer is authorised, the registry must action it within two calendar days. Getting to authorisation, when a party is unresponsive, is allowed to take up to 28 calendar days
• A lapsed domain has a 30 calendar day grace period, after which it goes to the public on a first come, first served basis with no further protection
• There are six asset layers in a clinic’s digital footprint that can each be held by a different party: domain, hosting, DNS, codebase, patient data, and platform admin access
• There is no regulator that will intervene in a vendor access dispute. This is contract and copyright territory, not a complaint mechanism
• The fix costs nothing and takes minutes when arranged before a contract starts, and can cost weeks when discovered during termination

A clinic gives notice to its web agency or booking platform, expecting a straightforward handover. Then someone asks who the domain registrant is, and nobody in the practice knows. That single unknown can turn a routine switch into a six week standoff, because auDA’s licensing rules, governing every .au domain as at 11 August 2026, put control with whoever the registrant record names, not with whoever paid for the site. Run this checklist before you send the termination email, not after, because that discovery is always worse mid dispute than in advance.

What the Rules Actually Say

Three separate legal frameworks sit underneath a vendor exit, and treating them as one question is the most common mistake.

Domain licensing. auDA administers the rules for every .au domain. The licensing rules state plainly that a domain licence “confers no proprietary rights in a domain name.” A registrant holds a time limited, renewable licence, not a purchased asset, and eligibility requires an Australian presence plus, for com.au or net.au, a match to the registrant’s name, trademark or services. Transfer to a new registrant requires both parties to meet that eligibility test, the rules allow up to 28 calendar days from an agreed transfer to reach authorisation, and the registry must then action an authorised transfer within two calendar days. An unrenewed licence has a 30 calendar day grace period, after which the name goes to the public on a first come, first served basis. (auDA .au Domain Administration Rules: Licensing, checked 11 August 2026.)

Copyright in the build. Under Australian copyright law the author of a work is generally its first owner. A contracted web developer is not your employee, so absent a written assignment clause, copyright in bespoke code can sit with the developer even though the practice paid for it. Payment typically buys a deliverable and an implied licence to use it, often enough to keep the site running and not enough to let a new developer freely rebuild on top of it. (Copyright Act 1968, ownership of copyright provisions.)

Patient data. A booking platform holding appointment and intake records does not inherit the practice’s Privacy Act obligations, and it does not remove them either. The practice stays accountable to patients under the Australian Privacy Principles for as long as it holds their information, so lawful access to that data has to survive the vendor switch even though the underlying technology does not. (OAIC, Australian Privacy Principles guidance.)

These three figures come directly from auDA’s licensing rules cited above: two calendar days for the registry to complete an authorised transfer, up to 28 calendar days allowed to reach that authorisation once a transfer agreement exists, and a 30 calendar day grace period before a lapsed domain is released to the public.

What That Means for the Build

Three fields, checked before notice goes out, decide most of how smoothly an exit runs.

1. The WHOIS registrant field. It should name the practice entity, with an email address the practice controls, not a person at the agency. Run this check today, exit planned or not, because it takes two minutes.
2. The hosting account owner. Log in directly, without asking the agency for a link. If the login belongs to the agency’s own account structure, the practice is a guest on infrastructure it does not control.
3. The DNS zone. DNS is where domain, hosting and email routing meet, and it is the layer most often left entirely in an agency’s control because it is invisible day to day. Ask specifically for DNS management access, separate from hosting access.

The build consequence of getting these three fields wrong before an exit is not abstract. A domain transfer that should take two days after authorisation can sit unauthorised for weeks if the only person who can approve it has left the agency, and DNS changes made mid dispute can take a working site offline for every visitor at once.

The figures above are a build experience estimate, not a survey finding: they reflect how long each access gap has typically taken to resolve once discovered during a live termination, against how long the same check takes when run in advance. The pattern, not the exact day count, is the reliable part.

The Six-Layer Exit Matrix

The reason to check all six rather than the one that feels most urgent is that they fail independently. A practice can hold the domain outright and still lose weeks to a hosting account it cannot log into, or export patient data cleanly and still find the site itself cannot move because nobody has repository access.

A Worked Example

Cosmetic clinic. A single site injectables clinic ran on an agency retainer that bundled hosting, the domain and social media into one invoice. Moving to an in house arrangement, WHOIS showed the agency as registrant. The agency did not object, but the registrant contact email belonged to a staff member who had left two years earlier, so the authorisation went nowhere for three weeks until the clinic escalated directly with auDA’s registrar rather than the individual account.

Dental practice. A two chair practice switched booking platforms after its provider changed pricing. The practice management software held years of recall history and online booking data. The self service export tool covered upcoming appointments only, not historical records, and a full export needed a written request with a two week turnaround under the vendor’s own process. The practice built that window into its migration date rather than discovering the gap on switchover day.

The scores above are an illustrative 1 to 3 complexity rating drawn from the two worked examples above, not a general comparison across all clinics: the cosmetic clinic’s hardest layer was the domain registrant contact, the dental practice’s was the historical recall data trapped in its booking platform.

What to Check on Your Own Site

1. Run a WHOIS lookup on your domain today. Confirm the registrant is your practice entity, not your agency.
2. Attempt to log directly into your hosting account without contacting anyone. If you cannot, ask for a full access user account in writing.
3. Ask, in writing, who can edit your DNS zone, and get read access even if you never plan to change a record yourself.
4. Locate your original web development contract and search it for the words “intellectual property,” “assign” and “licence.”
5. Ask your booking or practice management vendor, in writing, what format a full data export takes and how long it takes to produce.
6. Confirm the practice, not the agency, is listed as the primary owner on Google Business Profile, Google Analytics and any ad accounts, with the agency added only as a manager.
7. Check whether your domain auto renewal is billed to a card the practice controls, so a lapsed agency card cannot start the 30 day expiry clock without anyone noticing.

This ranking reflects how completely each missing item stops an exit from proceeding, based on build experience, not a formal audit. Losing the domain registrant blocks almost everything downstream; losing GBP ownership is serious but rarely stops the website itself from moving.

The Enforcement Anchor

There is no regulator that polices vendor exits, and no infringement notice register applies to a practice unable to get its own website back. auDA’s complaints process polices accredited registrars who breach the registrar rules, not a commercial dispute between a practice and its own agency. The au Dispute Resolution Policy covers who has a legitimate right to hold a domain name, typically a trademark or business name conflict, not a practice recovering a domain it always should have controlled. Copyright disputes over bespoke code are civil matters, resolved by negotiation or, as a last resort, in court. This is one of the few areas in this series where the honest answer is that no external referee exists, which is exactly why the checklist above matters more than it would somewhere a regulator will eventually step in.

Where This Gets Hard

The hardest case is a long standing relationship with no written contract covering IP assignment, which describes a large share of clinic websites built before roughly 2020. There is no clause to point to, both sides have a plausible account of what was agreed, and the practical question becomes whether rebuilding is cheaper than negotiating. It usually is, which is an unsatisfying answer for a practice that has already paid for the site once.

The second hard case is stock photography bought by the agency under its own account, often non transferable regardless of who paid for it originally. A migration can require re-licensing images the practice reasonably believed it already owned.

auDA’s rules say a domain licence follows the registrant record and confers no proprietary rights outside that record; the build consequence is that the practice needs to be the registrant before any exit conversation starts, not during one; whether a specific existing contract entitles a practice to compel an unwilling agency to transfer sooner is a question for your medical defence organisation or your lawyer.

Status

In force, and not regulatory. auDA’s .au Domain Administration Rules: Licensing (Policy 2019-01) and the Copyright Act 1968 both govern this area today, as at 11 August 2026, and neither is subject to a pending change that would alter the checklist above. This is not a compliance obligation with a commencement date; it is a standing contract and access position every practice can check right now.

Frequently Asked Questions

What is the single most important thing to check before leaving a web agency?

Who the registrant is on your domain. Run a WHOIS lookup. If your practice entity is not the registrant, your agency controls whether the domain moves at all, regardless of what your contract says about ownership of the website.

How long does a .au domain transfer take once it is authorised?

Once both parties have completed the transfer request, auDA’s licensing rules require the registry to action it within two calendar days. The slower part is usually getting a cooperative or unresponsive party to authorise the request in the first place, which the rules allow up to 28 calendar days for once a transfer agreement exists.

Can I get my patient data out of a booking platform if I am switching providers?

Usually yes, but the format and completeness depend entirely on the vendor’s export tools and your contract terms, not on a general legal right to bulk extraction. Request an export in a portable format such as CSV before you give notice, and confirm it in writing, because your practice keeps its own Privacy Act obligations to patients regardless of which vendor holds the records.

What happens if my domain licence lapses during a vendor dispute?

auDA’s rules give a 30 calendar day grace period after expiry to renew. After that the domain becomes available to the public on a first come, first served basis, with no further hold period. A dispute that drags past that window can mean losing the domain outright to an unrelated third party.

Is there a regulator I can complain to if a vendor will not hand over access?

Not one designed for this. auDA’s complaints process covers accredited registrars breaking the registrar rules, and the au Dispute Resolution Policy covers rights disputes over who is eligible to hold a domain name, not a commercial access dispute between a practice and its own former vendor. This sits in contract and copyright law, resolved by negotiation or, as a last resort, court.

Run the Checklist Before You Give Notice

If you are about to leave a web agency or booking platform and are not certain which of the six layers your practice actually controls, get in touch and tell us where you are in the process. We reply personally within 24 hours.

For the mechanics behind two of these layers in more depth, see who actually owns a clinic website, exporting patient data from a booking platform, and keeping control of your Google Business Profile.

Sources

1. auDA - .au Domain Administration Rules: Licensing (Policy 2019-01), no proprietary rights, eligibility, transfer and renewal timelines. Checked 11 August 2026.
2. Federal Register of Legislation - Copyright Act 1968, ownership of copyright provisions. Checked 11 August 2026.
3. OAIC - Australian Privacy Principles guidance. Checked 11 August 2026.

Last reviewed: 11 August 2026.