Privacy Policy

Introduction

CareIQ Pty Ltd ("CareIQ", "we", "us", "our") is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all personal information collected through our website (careiq.com.au), the CareIQ Platform, our IT managed services, and any other interactions you have with us.

Information We Collect

We may collect the following types of personal information:

• Identity information: name, job title, organisation name
• Contact information: email address, phone number, postal address
• Account information: username, password (encrypted), account preferences
• Service information: details about the IT services or software you use with us
• Technical information: IP address, browser type, device information, pages visited
• Communication records: emails, support tickets, phone call records
• Payment information: billing details (processed securely through third-party payment providers)

For CareIQ Platform users, we may also collect information related to participants, staff, and operational data as part of providing our care management software. This data is collected and processed on behalf of the organisation that subscribes to the platform.

How We Use Your Information

We use your personal information for the following purposes:

• Providing and managing our IT services and software
• Responding to your enquiries and support requests
• Processing payments and managing billing
• Sending service-related communications and updates
• Improving our products, services, and website
• Complying with legal and regulatory obligations
• Marketing communications (only with your consent, and you may opt out at any time)

How We Store and Protect Your Information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:

• Encryption of data in transit (HTTPS) on every connection
• Access controls and authentication for all systems, with multi-factor authentication available
• Staff training on data handling and privacy obligations
• Secure data centres located in Australia

Your records are stored in Australia, in Amazon Web Services' Sydney region. CareIQ does not hold and does not claim any security certification (such as SOC 2 or ISO 27001).

Overseas Recipients

Australian Privacy Principle 1.4 requires this policy to state “whether the entity is likely to disclose personal information to overseas recipients” and, where practicable, “the countries in which such recipients are likely to be located” (Privacy Act 1988 (Cth), Schedule 1, APP 1.4(f) and (g)).

Yes. We do disclose personal information to recipients outside Australia. The recipients, what they receive and where they are located are:

• OpenAI (United States) — receives the specific content analysed by the optional CareIQ Assist features. Depending on which features your organisation has switched on, that content can include progress notes, clinical and health records being summarised, uploaded medication charts, uploaded receipts and onboarding documents, descriptions or documents used to draft a form, and behaviour incident records. Each of these features is optional and can be switched off for your organisation.
• Twilio (United States) — SMS alerts, where your organisation uses them.
• Meta (United States) — WhatsApp family updates, where your organisation uses them.

Before disclosing personal information to an overseas recipient, Australian Privacy Principle 8.1 requires an entity to take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to the information. We contract with these providers on their data processing terms and do not permit your data to be used to train external models.

Third-Party Services

We use trusted third-party services to operate our business. These may include:

• Amazon Web Services (AWS): cloud hosting, Sydney region
• Microsoft 365: email and productivity tools
• Analytics providers: to understand website usage and improve our services
• Payment processors: for secure handling of billing and payments
• Communication tools: for email marketing and support communications

We only share personal information with third parties where necessary to provide our services, and we require all third parties to handle your information in accordance with this Privacy Policy and applicable Australian privacy law.

Disclosure of Information

We may disclose your personal information in the following circumstances:

• To our employees, contractors, and service providers who need the information to perform their duties
• To comply with a legal obligation, court order, or regulatory requirement
• To protect the rights, property, or safety of CareIQ, our clients, or the public
• With your consent

We do not sell, rent, or trade personal information to third parties for marketing purposes.

CareIQ Mobile App

The CareIQ mobile applications (available on Google Play and the Apple App Store) collect and process the following data to deliver care management features. This data is processed on behalf of the care organisation that subscribes to CareIQ, and is governed by the same Australian Privacy Principles set out in this policy.

• Location (GPS): When a support worker clocks in or out of a shift, the app captures their device's GPS coordinates to verify attendance at the agreed location (geofence verification). Location is only collected at the moment of clock-in/clock-out - the app does not track location in the background or when not in use.
• Camera / photos: The app may capture a photo at clock-in (optional, organisation-configurable) and allows workers to attach photos to clinical notes, incidents, and shift records. Camera access is only used when the worker actively takes or attaches a photo.
• Health information: The app handles sensitive health information about care participants (clinical notes, medications, vital signs, incidents) so that support workers can deliver and document care. This information is entered by authorised staff and stored securely; it is never used for advertising and never sold.
• Account & device data: email address and authentication tokens to keep the worker signed in, and a push-notification token (if enabled) to deliver shift and care alerts.

We do not use any mobile app data for advertising, and we do not sell or share it with third parties for marketing. All data is transmitted over encrypted connections (HTTPS/TLS) and hosted on secure servers located in Australia. Workers can request access to or deletion of their personal data through their organisation's administrator, subject to the organisation's record-keeping obligations under the NDIS and applicable law.

App permissions (location, camera, notifications) are requested only when needed for the relevant feature, and can be declined or revoked in your device settings - though some features (such as GPS-verified clock-in) will not work without them.

Cookies and Website Tracking

Our website may use cookies and similar technologies to improve your browsing experience and analyse website usage. You can control cookie settings through your browser preferences. Disabling cookies may affect the functionality of some parts of our website.

Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or outdated information
• Request deletion of your personal information (subject to legal obligations)
• Opt out of marketing communications at any time
• Lodge a complaint about how we handle your information

To exercise any of these rights, please contact us using the details below.

Data Retention

We retain personal information only for as long as it is needed to fulfil the purposes for which it was collected, or as required by law. When personal information is no longer needed, we securely destroy or de-identify it.

For managed IT service clients, support records and service data are retained for the duration of the service agreement and for a reasonable period afterwards for legal and compliance purposes.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most current version will always be available on our website. We encourage you to review this page periodically.

Contact Us

If you have questions about this Privacy Policy, wish to access or correct your personal information, or want to make a complaint, please contact us:

CareIQ Pty Ltd
Banyo, Queensland 4014
Phone: 07 4898 1042
WhatsApp: 0467 328 172
Email: [email protected]

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.