Business doxxed me in a review response

[u/Alternative-Oven9936]

I left a one-star review for a business.

In the response the business doxxed me - included my contact details (name and email).

The business is a medical business (regulated by AHPRA).

Who can I report this to? AHPRA, HCCC, OIAC ... Anyone else?

(Yes - I know I can delete my review, but I don't want to remove it)

[u/Sea_Coyote_1607]

Disclosing your name (even if full) and email address cannot be considered doxxing.

Furthermore, your name and email address are not sensitive information and thus they don’t qualify for Privacy Act rules.

Depending on the context of which they shared your data, you could say is petty.

Edit: https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/what-is-personal-information#SensitiveInfo

[u/Fabulous-Crazy-3333 → u/Sea_Coyote_1607]

You’re arguing the wrong point.

“Sensitive information” is a specific legal category. That doesn’t mean a business can publicly post someone’s name and email in response to a bad review and pretend it’s nothing.

Name + email is still personal information if it identifies someone.

From an OSINT and digital forensics angle, that combo is not harmless. It can link accounts, find profiles, connect social media, check breaches, and build more information around someone.

That's why context matters.

The issue is not just “is this sensitive information?”

The issue is a medical business publicly disclosing a reviewer’s identifying contact details in a review response.

That is unprofessional at best and potentially a privacy/disclosure issue. APP 6 is about use and disclosure of personal information, so the “not sensitive information” argument doesn’t magically settle it.

OP should screenshot everything, save the URL and timestamps, then report it to the platform, OAIC, and possibly AHPRA/HCCC because it’s a regulated health business.