Australia's biggest medical appointment booking app, HealthEngine, is facing multi-million-dollar penalties after an ABC investigation exposed its practice of funnelling users' personal health information to law firms.
The Australian Competition and Consumer Commission has launched legal action against the Perth-based company in the Federal Court, accusing it of misleading and deceptive conduct.
In June last year, the ABC revealed HealthEngine was passing on users' most sensitive health information to law firms seeking clients for personal injury claims.
The details of the deal were contained in secret internal Slater and Gordon documents that revealed HealthEngine was sending the firm a daily list of prospective clients as part of a pilot program in 2017.
The ACCC has also accused the company of passing the personal health information of approximately 135,000 patients to insurance brokers in exchange for payments.
"Patients were misled into thinking their information would stay with HealthEngine but, instead, their information was sold off to insurance brokers," ACCC chairman Rod Sims said in a statement.
HealthEngine has also been accused of misleading consumers by manipulating users' reviews of medical practices.
"We allege that HealthEngine refused to publish negative reviews and altered feedback to remove negative aspects, or to embellish it, before publishing the reviews," Mr Sims said.
HealthEngine is facing a fine of $1.1 million for each breach of the law, but the ACCC has yet to determine how many breaches it will allege.
In a statement, HealthEngine chief executive Marcus Tan said the company has made significant changes to its business model.
"These changes were made before HealthEngine was formally advised of any ACCC investigation," he said.
"HealthEngine is confident that no adverse health outcomes were created and that personal information was not shared with referral partners unless the individual had expressly requested to be contacted."
The company is also facing an investigation by the Office of the Australian Information Commissioner and the Australian Digital Health Agency.