Privacy Policy
Caireo · NDIS care management platform · Effective 7 September 2026
1. Who this policy is about, and who is responsible for what
Caireo is software licensed to NDIS provider organisations. Almost everything in the platform is entered by a provider about its own participants and its own workers. That distinction decides who is answerable for what, so it is worth stating before anything else.
The provider organisation is the APP entity for the personal information it holds about its participants and workers. It decides what is collected, why, who inside the organisation may see it, and when it is disclosed. It is the first point of contact for an access, correction or complaint request, and it is responsible for having its own privacy policy and collection notices.
Caireo handles that information on the provider's behalf and only on its instructions. We do not decide the purposes for which participant information is used, we do not use it for our own purposes, and we do not sell it, rent it, or disclose it to anyone except as set out in this policy or as required by law.
Caireo is the APP entity for the information we hold about our direct dealings with you — an account you sign in with, an email you send us, a billing record for a subscription.
This policy applies to the Caireo web dashboard, the Caireo mobile app for support workers, and the participant portal inside that app.
2. What we collect
| About | Information |
|---|---|
| Provider staff (coordinators, administrators) | Name, work email, phone, role, profile photo, sign-in records and an audit trail of actions taken in the platform. |
| Support workers | Name, contact details, employment and engagement details, pay classification, qualifications, immunisation records, worker screening and compliance checks, availability, leave, expense claims, device push token, and location captured at the moment of check-in and check-out. |
| Participants | Name, date of birth, NDIS number, plan type and budget, address, phone, emergency contacts, support goals, service agreements and consent records, risk assessments, medications and administration records, progress notes, incident reports, documents uploaded by the provider, and photographs attached to a note, incident or concern. |
| Nominees, guardians and family contacts | Name, relationship, contact details and the evidence of authority a coordinator has sighted. |
We also keep technical records generated by using the software: sign-in times, IP address, device and app version, and error logs. These are used to run and secure the service and to answer the question “who changed this record, and when” when a provider needs to.
Sensitive and health information
Progress notes, incident reports, medication records, risk assessments and disability-related support needs are health information and sensitive information under the Privacy Act 1988 (Cth), and are also regulated by state health records legislation — including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic). Sensitive information attracts a higher standard: it may generally only be collected with consent and where it is reasonably necessary for the provider's functions, and it may only be used for the purpose it was collected for or a directly related purpose the person would reasonably expect.
We do not collect sensitive information about participants from anyone other than the provider organisation and the participant themselves.
3. Why we collect it, and the lawful basis
Every item above exists because a provider cannot deliver or evidence NDIS supports without it. Specifically: to roster and deliver supports; to confirm that a worker attended the agreed place at the agreed time; to keep the clinical and service record the NDIS Practice Standards require; to record medication administration; to manage incidents and meet the NDIS Quality and Safeguards Commission's reportable incident obligations; to raise and answer a participant's concern; to check a worker's screening, qualifications and immunisations; to pay workers and claim correctly; and to keep the platform secure.
We do not use any of it for advertising, for profiling, for cross-app tracking, or for sale. There is no advertising identifier in the app and no advertising network receives anything.
4. Location
A worker's location is captured at two moments — check-in and check-out — and if they press the duress button. It is used to confirm attendance at the agreed location, to show a coordinator where a worker was when they asked for help, and for nothing else. The app uses the While Using the App permission and does not track location in the background, between shifts, or after a shift ends. The participant portal collects no location at all.
Permission can be withdrawn at any time in the device settings. A worker who withholds it can still check in; the record simply notes that no location was captured, and the alert still goes to the coordinator.
5. Photographs
A worker may attach a photograph to a progress note or incident, and a participant may attach one to a concern they raise. Photographs are stored with the record they belong to and are visible to the provider organisation. They are not stored in the device's public photo library by the app, and are not used for any purpose beyond the record.
6. Voice commands and automated processing
Where a provider organisation enables voice control in the dashboard, the words a coordinator speaks are converted to text and sent to a language model provider to work out which screen or action was intended. Only the text of the command is sent — never a participant record, progress note or document — although a command like “open Jane Smith” contains a name. The model returns an intent; the coordinator still performs the action.
Caireo does not use customer data to train machine learning models and does not permit our providers to do so. We use API endpoints rather than consumer products, and enable zero retention where the provider offers it. An organisation that would rather not send anything can leave voice control switched off, which is the default.
No decision that affects a person is made automatically. Rosters, incident classifications, pay, plan spending and compliance outcomes are decided by people. The platform calculates, flags, counts down and suggests; a coordinator decides. Where automated processing does become capable of significantly affecting someone's rights or interests, this section will say so and describe it, as the Privacy Act will require from 10 December 2026.
7. Who we disclose information to
Inside the platform, a provider's data is visible only to that provider. Every record carries the organisation that owns it, access is enforced in the database itself rather than only in the interface, and a worker sees only their own shifts and the participants they are rostered to support.
Outside the platform, information reaches only these parties:
| Who | Why | Where | What reaches them |
|---|---|---|---|
| Supabase | Database, authentication, file storage and server functions — the primary record system | Sydney, Australia (AWS ap-southeast-2) | All platform data, including participant records, progress notes, incident reports and uploaded documents |
| Vercel | Hosting and delivery of the web dashboard | United States, with edge delivery worldwide | Request metadata and data in transit; no separate copy of the record system is stored |
| Expo (EAS) | Mobile app distribution, over-the-air updates and push notification delivery | United States | Device push tokens and notification content (operational only — never health information) |
| Apple, Google | App distribution and push notification transport to the device | United States and global | Device push tokens and notification content |
| Groq, Google (Gemini API) | Parsing a spoken command into an action, where an organisation enables voice control | United States | The text of the spoken command only, which may include a worker or participant name |
| Brevo | Transactional email — invitations, password resets, alert digests | European Union (France) | Recipient email address and the content of that email |
| Stripe | Subscription billing and payment processing for provider organisations | United States and Australia | Billing contact and payment details of the organisation. Card numbers are handled by Stripe and never reach Caireo |
| Xero | Accounting sync, only where an organisation connects it | Australia and New Zealand | Invoice and billing totals. No participant health information, progress note or incident record is sent |
| OpenStreetMap Foundation (Nominatim) | Turning a typed address into map coordinates for shift locations | European Union | The address text being looked up. It is not linked to a named person in the request |
We will also disclose information where the law requires or authorises it — to the NDIS Quality and Safeguards Commission, to police or a child protection or adult safeguarding authority, to a court under subpoena, or where disclosure is necessary to lessen or prevent a serious threat to somebody's life, health or safety. Where we can lawfully tell the provider organisation that we have done so, we will.
If Caireo is ever sold or merged, personal information may transfer with it. The acquirer would be bound by this policy until individuals are notified of any change.
8. Where the data is held, and what that means
The record system — every participant record, progress note, incident report, medication entry and uploaded document — is stored by Supabase in Sydney, Australia (ap-southeast-2). It stays in Australia, including its backups.
Some supporting services do not. Push notification delivery, mobile app updates, the language model behind optional voice commands, transactional email, payments and address lookup run in the United States and the European Union, as the table above sets out — and what reaches each of them is narrow, never the clinical record. Those remain cross-border disclosures under Australian Privacy Principle 8, and we state them plainly rather than describing everything as “the cloud”.
Under section 16C of the Privacy Act, an act by one of those overseas recipients that would breach the APPs is treated as a breach by us. We remain accountable for them, and we contract with them on terms requiring APP-equivalent handling, purpose limitation, security, breach notification and equivalent flow-down to their own sub-processors. A provider organisation whose funding agreement or state health records obligations require participant information to remain onshore is met by the arrangement above; if your obligation extends to every supporting service, tell us before you enable voice commands.
9. Security
Data is encrypted in transit with TLS and at rest with AES-256. Access is enforced per organisation in the database itself, so a query that forgets to filter by organisation returns nothing rather than somebody else's records. Authentication credentials are hashed and never visible to us or to a provider. Access to production systems is restricted to the personnel who need it, logged, and reviewed. Clinical records such as medication administration are append-only: a correction is recorded as a correction and the original stays.
No system is perfectly secure, and we do not claim otherwise. What we commit to is the response: see the next section.
10. Data breaches
We operate a data breach response plan. If we suspect a breach we contain it, assess it within 30 days as the Notifiable Data Breaches scheme requires, and tell affected provider organisations without undue delay and in any event within 72 hours of becoming aware — with what we know, what we are doing, and what they should do. Where a breach is likely to result in serious harm, notification is made to the Office of the Australian Information Commissioner and to affected individuals as Part IIIC of the Privacy Act requires. Where the provider organisation is the APP entity for the affected information, we support its notification rather than substituting our own.
11. How long we keep it
Records evidencing NDIS supports — progress notes, shift records, incident reports, medication administration, service agreements and consent — are retained for at least 7 years, and where the participant was under 18 at the time, until they turn 25. That is the provider's obligation under the NDIS Practice Standards, and it is why deleting an account does not delete the service record. Payroll and financial records follow their own statutory periods.
Beyond those periods, information is deleted or de-identified. Push tokens, device identifiers and technical logs are kept only as long as they are useful for operating and securing the service.
12. Deleting your account
Anyone using the mobile app can delete their own account from inside it:
- Support workers: Me → Settings → Delete account.
- Participants: Me → Account & settings → Delete account.
This permanently removes sign-in credentials, the profile and push tokens, and ends access. Service records held by the provider organisation are retained for the periods above, because they are the provider's records of supports delivered and it is not lawful for us to destroy them on request. If you want those records dealt with, ask the provider organisation.
13. Access, correction and complaints
You may ask for access to the personal information held about you, and ask for it to be corrected if it is wrong, out of date, incomplete or misleading. Because the provider organisation is the APP entity for participant and worker records, ask them first — they hold the context and can act immediately. If you do not know who to ask, or the provider does not respond, contact us at careconnectsupports@gmail.com and we will help or route it.
We respond to privacy enquiries and complaints within 30 days. If you are not satisfied with the outcome you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Complaints about the quality or safety of NDIS supports go to the NDIS Quality and Safeguards Commission at ndiscommission.gov.au or 1800 035 544. In NSW and Victoria, health information complaints may also go to the state privacy or health complaints commissioner.
14. Anonymity, and children
The platform cannot be used anonymously or under a pseudonym: it exists to record who delivered which support to which person, and a service record that cannot identify either is of no use to a participant, a provider or a regulator. This is the exception APP 2 allows where identification is impracticable.
Participants may be children. Their information is entered by the provider organisation under the authority of a parent, guardian or nominee, and the portal is made available to a child or their representative only where the provider decides that is appropriate. We do not knowingly create accounts for children other than through a provider organisation.
15. Changes
We may update this policy. Where a change is material, we will notify provider organisations before it takes effect and update the effective date at the top. Continuing to use the platform after that date means the updated policy applies.
16. Contact
Privacy questions, requests and complaints: careconnectsupports@gmail.com, addressed to the Privacy Officer. For help using the platform see Support. Our contractual terms are at Terms of Service, and the security and data-handling commitments we make to provider organisations are at Data Processing.
© 2026 Caireo. This is the published privacy policy referenced by the Caireo web dashboard and by the Care Connect iOS and Android apps.