Privacy Policy

CareCert is built not to hold participant identities. We do not ask for participant names, NDIS numbers, dates of birth, health records or care notes. Participants are referred to only by codes your organisation assigns. Typed text is screened for things that look like personal details, such as names, phone numbers, emails and addresses, and those are removed before the text is stored or sent to an AI model. Screening is automatic and can miss things, so please don’t type them in.

• Your users: name, work email and sign-in details, including an authenticator app if you turn on two-step sign-in. Passwords are handled by our authentication provider; we never see them.
• Your organisation: business name, ABN, the states you operate in, the supports you deliver, and the compliance records you enter or upload, such as registers, policies, evidence and correspondence drafts.
• Incident records: the type of incident, when it happened, what happened, the actions taken, whether anyone was harmed, attachments and voice-note transcripts, linked to participant and worker codes. An incident description can include details of an injury or of someone’s health. Because your organisation can link a code to a person, we treat these records as personal and potentially health information and protect them accordingly.
• Your workers: staff names, staff codes, role titles, credentials (for example NDIS worker screening, police checks, Working with Children Checks, qualifications and training) and their dates. Police check and screening outcomes can be sensitive information. You collect this from your workers and enter it; you are responsible for telling them and, where needed, getting their consent. If you upload a scan of a certificate so we can read its dates, the scan file is deleted once it has been read. We keep the text read from it, after screening, and the dates you confirm.
• Questions you ask the AI: the question after screening, and the answer with its sources, are kept in an audit log so answers can be checked later.
• Billing: handled by Stripe. We do not store card numbers.
• Usage and diagnostics: what is needed to run and secure the service, and a record of changes made in your account.

To provide the service you signed up for (compliance tracking, registers, incident reporting drafts, worker credential tracking, billing checks, scorecards and audit packs), to keep accounts secure, to send service messages such as deadline alerts and rule-change notices, and to meet our own legal and accounting obligations. We do not sell personal information, and we do not use your data to train AI models.

Where CareCert uses an AI model, it only drafts wording around facts that come from our rules data or your records. Regulatory values such as deadlines and reportability come from approved rules, not from the AI. Typed text is screened before it reaches the model.

Voice notes are different: if you upload a recording, the audio goes to our transcription provider before anything can be removed, and the transcript is screened afterwards. Don’t say participant names in recordings.

The worker credential tracker uses a computer program to work out, from approved rules, whether a worker’s recorded credentials meet the requirements for their role. It uses the worker’s code, role, credential types, credential status and expiry dates, and shows “eligible” or “not eligible” with the reasons. Your organisation decides what happens to the worker; CareCert does not. A worker who disagrees with the result should ask your organisation to check and correct their records.

We use these service providers. Some are outside Australia:

• Supabase: database, sign-in and file storage, in Sydney, Australia.
• [Application hosting: Google Cloud Run, Sydney, Australia, or Render, Singapore: confirm which is live].
• Qdrant: stores search indexes of guidance and of documents you register, in [São Paulo, Brazil; moving to Sydney, Australia before launch].
• NVIDIA: AI model provider, in the United States. Receives screened text only.
• [OpenAI, United States: voice-note transcription, only if enabled. Receives the audio itself.]
• Stripe: payments, in the United States and Australia.
• Plausible Analytics: cookie-free usage statistics, in the European Union.
• [Email provider and location]: sends alerts and service emails.
• [Sentry, United States: error reports, if enabled].

Before sending information overseas we take reasonable steps to make sure the provider handles it consistently with the APPs, and we remain responsible for how it is handled.

Information is encrypted in transit and at rest. Each organisation’s data is kept separate by database-level access rules, and staff access is limited to what is needed. Two-step sign-in is available for every user. Changes, reads of incident records and AI answers are written to logs that cannot be edited.

We keep your records while your organisation’s account exists. If your trial ends or a plan lapses, the account becomes read-only and nothing is deleted.

An owner can delete the organisation at any time under Your data in the app. Deletion is immediate and permanent. Change and audit logs are kept with the link to your organisation removed, for [period to be confirmed]. As an NDIS provider you must keep incident and complaint records for 7 years, so download your data before you delete: deleting CareCert’s copy does not end that obligation.

We use Plausible Analytics, which uses no cookies and collects only aggregate, non-identifying statistics such as pages viewed, referrers and device type. We use strictly necessary cookies to keep you signed in. Stripe may set its own cookies on its checkout pages.

We only send service messages unless you opt in to updates. Every marketing email has an unsubscribe link.

You can ask to access or correct personal information we hold. Organisation owners and admins can also download a full export under Your data in the app. We confirm identity before acting on a request about another person’s information. Workers asking about their own records should usually start with the organisation that entered them; we will help that organisation respond. Using CareCert anonymously is not practicable because the service is tied to your organisation’s account.

If a data breach is likely to result in serious harm, we will notify affected organisations and individuals and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme.

Send privacy questions or complaints to [privacy@carecert.com.au]. We will respond within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au.