Online appointment booking service HealthEngine has hit back at claims it provided customers' medical information to private injury law firms surreptitiously, saying it received express consent from users.

It has also rejected claims in an ABC story that consent to share information is hidden in its privacy policies, saying a pop-up consent form is used as part of the booking process and users can still proceed to use the app if they opt out.