Who Owns Your Clinic Website: Domain, Code, Content and Data

Key Takeaways

• A clinic website is five separate assets: the domain licence, the hosting account, the codebase, the content, and the data. Each can sit with a different party
• A .au domain is licensed, not owned. The registrant controls it, and if that is your agency rather than your practice entity, the licence is not yours
• Paying for a website does not automatically transfer copyright in bespoke code. That needs an express written assignment
• The fastest ownership test takes ten minutes: a WHOIS lookup, a hosting login attempt, and a repository access check
• Patient data is a separate question governed by the Privacy Act, not by your development contract
• Ownership problems are almost always discovered at the worst possible moment: a dispute, a rebuild, or a practice sale

Ask a clinic owner who owns their website and the answer is usually “we do, we paid for it.” Ask who is listed as the registrant on the domain, and the answer is usually silence. Those are different questions, and only the second one determines whether you can move your website next week without anyone’s permission.

A clinic website is not a single asset. It is five, and in a surprising number of practices they are held by three or four different parties who have never spoken to each other.

The Five Layers

The reason this matters is that the layers fail independently. You can own your content outright and still be unable to move your site, because the domain licence sits with an agency that has stopped returning calls.

The values above are a build-experience severity ranking, not survey data. They reflect how completely each missing layer blocks a move: without the domain licence almost nothing can proceed, whereas missing content can usually be rewritten.

The Domain Is a Licence, Not a Purchase

This is the layer people get wrong most often, and it is the one with the least room for argument.

auDA administers the rules for .au domain names. A registrant does not buy a domain outright the way they buy a desk. They hold a licence for a term, renewable, subject to the published licensing rules including Australian presence requirements. The practical consequence is that control follows the registrant record, not the invoice.

If your agency registered the domain in their own name, they hold the licence. They may be entirely honest and entirely cooperative, and it still means your practice cannot transfer, renew or recover the domain without them. If they are not cooperative, or they cease trading, you are negotiating for an asset your patients type into their browser.

What to check: run a WHOIS lookup on your domain and read the registrant field. It should name your practice entity, not a person at your agency and not the agency itself. Your developer should appear, if at all, as a technical contact.

Copyright Does Not Follow the Invoice

Under the Copyright Act the author of a work is generally the first owner of copyright in it. There are exceptions, notably for work made by an employee in the course of employment, but a contracted web developer is not your employee.

So absent a written assignment, the developer may hold copyright in the bespoke code they wrote, even though you paid for it and it runs on your site. What you get by paying is the deliverable and, in most cases, an implied licence to use it for the purpose it was commissioned for. That implied licence is usually enough to keep operating. It is often not enough to let a new developer freely modify and redistribute the code.

This is a contract problem with a contract fix: an express assignment clause, agreed before work starts, is a paragraph. Retrofitting one after a relationship has soured is a negotiation.

What That Means for the Build

Three things belong in every clinic web engagement from the first day.

1. Register the domain yourself, in the practice entity’s name, with a practice email address as the contact. Give the developer delegated access, not the registrant record.
2. Hold the hosting account in the practice’s name, billed to the practice card. Add the developer as a user. A developer who resists this is telling you something useful.
3. Get an express written IP assignment for bespoke code and content, effective on payment. Standard, uncontroversial, and worth more than any other clause in the agreement.

This chart is illustrative of relative effort, not a price quote. The pattern it encodes is the reliable part: every one of these is trivial to arrange up front and expensive to arrange under pressure.

A Worked Example

Cosmetic clinic. A Perth clinic wanted to move from a retainer agency to an in-house arrangement. WHOIS showed the agency as registrant. The agency was cooperative, and the transfer still took eleven days because the registrant contact email pointed at a staff member who had left the agency two years earlier. Nothing was contested; the process simply had no valid recipient for the authorisation code.

Dental practice. A practice sold, and the buyer’s due diligence asked for proof of website IP ownership. There was no assignment clause in the original 2019 engagement. The original developer had ceased trading. The transaction proceeded, but the website was excluded from the asset schedule and treated as having nil value, which is a real cost extracted from a real sale price.

What to Check on Your Own Site

1. WHOIS your domain. Is the registrant your practice entity?
2. Log into your hosting provider directly, without asking anyone for access. Can you?
3. Ask your developer for repository access in writing. The response tells you the answer regardless of what it says.
4. Find your original engagement contract and search it for “intellectual property”, “assign” and “licence”.
5. Check where website form submissions are delivered and stored, and who else can read them.
6. Confirm your domain auto-renewal is billed to a card the practice controls, not an agency card.

The Enforcement Anchor

There is no regulator that enforces website ownership. This is contract and copyright territory, and it is resolved commercially or in court, not by AHPRA or the OAIC.

What that means practically is that there is no complaint mechanism to fall back on. Unlike an advertising breach, where a regulator can act, a website ownership dispute has no external referee short of litigation whose cost usually exceeds the value of the asset. The absence of an enforcement path is precisely why the up-front contract terms matter more here than in areas where a regulator will eventually intervene.

Where This Gets Hard

The genuinely difficult case is a long-running relationship with no written contract at all, which describes a large share of clinic websites built before about 2020. There is no document to point at, both parties have a plausible account of what was agreed, and the practical question becomes whether rebuilding is cheaper than negotiating. Usually it is, which is an unsatisfying answer but an honest one.

The second hard case is content. Stock photography licences are often bought by the developer under their own account, and are frequently non-transferable. A site move can therefore require re-licensing images the clinic reasonably believed it owned.

Status

In force, and not regulatory. auDA’s licensing rules govern .au domains today and the Copyright Act 1968 governs authorship today. Neither is pending reform in a way that changes the advice above. This is one of the few areas in this category where nothing is waiting to commence.

Frequently Asked Questions

Do I own my .au domain name?

No. A .au domain name is licensed, not owned. auDA administers the licensing rules and a registrant holds a licence for a fixed term, renewable. What matters practically is whether your practice entity is the registrant, because the registrant controls the licence. If your web developer or marketing agency is listed as registrant rather than as technical contact, the licence is theirs and moving the domain requires their cooperation.

Does paying for a website mean I own the code?

Not automatically. Under Australian copyright law the author of a work is generally the first owner of copyright, so absent a written assignment the developer may retain copyright in bespoke code even though you paid for it. Payment buys a deliverable and, usually, an implied licence to use it. Owning the copyright requires an express written assignment.

What happens to my clinic website if my web developer stops trading?

It depends entirely on which layers you control. If the domain registrant is your practice entity and you hold direct logins to hosting and the DNS, you can appoint someone new in a day. If the developer holds the domain licence, the hosting account and the repository, you may have no lawful route to any of it, and rebuilding is often faster than recovering.

Is patient data held in my website forms covered by the same ownership questions?

No, and conflating them is a common mistake. Ownership of code and content is a contract and copyright question. Personal and health information collected through your site is governed by the Privacy Act, and your obligations to patients under the Australian Privacy Principles do not transfer to a vendor just because the vendor holds the database.

Get a Written Ownership Position

If you are not certain which of the five layers your practice actually controls, get in touch and we will run the checks and give you a written summary of what you hold and what you do not.

Sources

1. auDA - .au domain administration rules and licensing policies. Checked 10 August 2026.
2. Federal Register of Legislation - Copyright Act 1968, ownership of copyright. Checked 10 August 2026.
3. OAIC - Australian Privacy Principles. Checked 10 August 2026.

Last reviewed: 10 August 2026.