AHPRA, the APP, and where your patient data actually lives

Two acronyms come up in almost every clinic owner conversation we have: AHPRA and the APP. They cover different things, and conflating them is where a lot of confusion starts. One is about clinical conduct. The other is about data. A clinic needs to satisfy both, and most software vendors only ever talk about one.

What each one actually governs

AHPRA sets the standards physiotherapists are held to as registered health practitioners, including what a clinical record needs to contain and how long it needs to be kept. It’s about the clinician’s professional obligations, not the software.

The Australian Privacy Principles, part of the Privacy Act, govern how personal information, including health information, is collected, stored, used and disclosed. This is where software vendors are directly in scope, because if patient data passes through a tool, that tool’s handling of it is now part of the clinic’s privacy obligations.

A tool can be AHPRA-aware in how it structures a note and still fall short on the APP in how it stores the data behind that note. Both need checking separately.

Where “hosted in Australia” actually matters

Data residency gets mentioned a lot, sometimes without much behind it. The relevant question isn’t just which country the servers sit in. It’s whether the data is isolated per clinic, who inside the vendor’s team can access it, whether it’s encrypted in transit and at rest, and whether there’s a full audit trail of every access event.

A vendor hosting servers in Brisbane but pooling every clinic’s data in one shared database, with broad internal access, hasn’t really solved the problem. The location is one part of a larger picture.

How Physiflow handles this

We built the data model around minimal retention and clinic-level isolation from day one.

• Hosted in Australia, with data encrypted in transit and at rest.

• Each clinic’s data is fully isolated from every other clinic on the platform.

• Every access to patient data is logged, giving you a complete, reviewable audit trail.

• Role-based access and multi-factor authentication mean people see only what their role requires.

• We keep the minimum patient data needed to do the job. Your PMS stays the source of truth.

What to ask your current vendor

If you’re already using clinical software of any kind, it’s worth putting these same questions to that vendor directly. Data residency, isolation and audit trails aren’t features to take on trust. They’re things a vendor should be able to explain clearly, in plain language, without a lawyer translating for you.

Want the full compliance summary for your own review? Book a demo and we’ll walk you through it.