Halaxy vs Zanda: The Best Halaxy Alternative for Allied Health Practitioners

There are concerning differences regarding how Halaxy can use your clients’ health data.

We’re highlighting the Halaxy Privacy Policy because it contains clauses we think most practitioners and patients wouldn’t expect to find. In fact, we haven’t found clauses like these in any other commonly used competitors in the marketplace.

So what’s actually in the Halaxy Privacy Policy?

The Halaxy Privacy Policy starts out with a fairly standard introduction, and reinforces the notion that by providing personal information, you consent to Halaxy using it in the manner described in that policy. This is all pretty standard.

Data collected

It then goes on to list the type of personal information Halaxy may collect. Again, this list is fairly standard for a practice management system. However, it’s important to note that the personal information collected may include health information entered into Halaxy by a patient or practitioner, including:

• “..the treatment you have received…;
• …service type, description of the service…;
• …which practitioner treated you…;
• …test results…;
• …current and past medical history”.

Permitted purposes of use

Halaxy’s Privacy Policy then outlines the full range of permitted purposes under which it can use and/or disclose the Personal Information entered into its system. Among the standard uses that might be expected, a number of purposes are included that we think neither practitioners nor patients would reasonably expect or knowingly consent to. This includes:

• “…conduct research or compile or analyse statistics relevant to health or safety;
• “to prepare aggregate reports for current or future advertisers, sponsors or other partners”;
• “to send you marketing and promotional messages…sent by…our business partners…”.

You can see a more details in this screenshot of the policy:

In other words, the Halaxy Privacy Policy appears to give it permission to access, use and disclose individually identifiable medical information that has been entered into its system for purposes that include medical research, marketing, advertising or other commercial activities. Furthermore, there does not appear to be any requirement for Halaxy to notify practitioners or patients when data is used for these purposes, who patient data has been provided to, or any mechanisms for practitioners or patients to prevent the further use of their data once it has been provided to third parties.

What about patient consent? Who is responsible?

To understand this we need to look at Halaxy’s overall Privacy Policy.

The answer to the consent question appears to be contained in the section ‘Information of another individual’:

“…you must take reasonable steps to ensure the individual concerned is aware of and/or consents to the various matters detailed in this Privacy Policy…”

Put simply, this appears to indicate that if you’re a practitioner using Halaxy, you agree that you have made your patients aware of how Halaxy can use patient health data, and you have obtained patient’s consent for this.

This appears to be further emphasised in Halaxy’s Privacy Policy, where it states that if you are using Halaxy and providing information to it about someone else, i.e. entering patient treatment information, “you must ensure that you are authorised to disclose that information to us and that without us taking any further steps… we may collect, use and disclose such information for the purposes described in this Privacy Policy.”

While there are also circumstances where patients can provide consent to Halaxy’s Privacy Policy directly, i.e if they were to register directly on the system, it would appear that failing this, it is the practitioner who enters patient data into Halaxy that is attesting to the fact that they have obtained their patients’ consent for Halaxy’s subsequent use of their data.

We believe this is an unreasonable expectation and unfair to put that onus of responsibility onto practitioners or practice managers.

Is Halaxy different from other PMS providers?

In short, yes.

In our review of practice management systems, we found that nearly all of them, including Zanda, operate something like this:

Fees

There is almost always a base subscription fee, plus additional fees for extras such as SMS use, payment processing etc.

Data use

Patient health data entered is considered to be the exclusive property of the practice. It is only used by the PMS in a manner you’d reasonably expect as part of operating a practice management system. The Privacy Policies don’t allow accessing or using patient data for other commercial or research purposes. Halaxy’s Terms and Conditions, Privacy Policy, and its pricing model indicate a very different approach:

Free plus fees for extras

Halaxy promotes its software as “free”, with costs only applying to additional features like SMS, payment processing, and other extras. However as the saying goes:

“If you’re not paying for the product, then you are the product.” -Tristan Harris

Offering free software in exchange for people’s personal data is not new, and not necessarily a bad thing – but it’s essential for users to make informed decisions. Most people use free services like Google, Facebook, Instagram, and understand their data is used for advertising and other purposes. But in these cases, people are making the decision themselves – with Halaxy, the responsibility lies with the practice to inform each client and give people the option of whether to go ahead with their service or not.

Halaxy advises users they “are building the largest, most unique health longitudinal datasets in the world” and that by using Halaxy, they’re “contributing” in exchange for “access” to the system.

In our view, this doesn’t make it anywhere near clear enough that Halaxy can use and disclose patient data for a much wider range of purposes. Furthermore, the onus of gaining consent for that data use primarily lies with the practitioner – which is unreasonable and impractical.

Concerned? What should you do?

Start by reading the full Halaxy Privacy Policy and decide for yourself whether it meets your expectations, and the expectations of your patients. If you’re not sure about any element, seek the opinion of a legal professional who specialises in healthcare, and follow their advice.