Privacy Policy
Carers Portal (carersportal.me) is operated by The Gippy Geek (“we”, “us”). We provide a portal that helps people receiving care, their families, and their support workers record and coordinate day-to-day care. This policy explains what personal information we collect, why, how we protect it, and the choices you have. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we treat health information as sensitive information under that Act.
1. Who this policy covers
- Participants — people receiving care, including NDIS participants and aged-care recipients.
- Nominees and family — people a participant authorises to act on their behalf or view their care records.
- Support workers and coordinators — people who deliver or organise care and record it in the portal.
- Visitors — anyone who browses the public website or uses the demo.
2. What we collect
Account information: your name, email address, role (for example participant, support worker, administrator) and the organisation or “circle” you belong to. If you sign in with Google, we receive your name, email address and profile picture from Google.
Care records (health information): information entered into the portal to support a participant’s care, which may include shift notes, therapy session notes, meal and fluid intake, continence and bowel-health records, medication observations, mail and correspondence logs, and roster or calendar entries. This is sensitive information and we only collect it with the consent of the participant or their authorised nominee.
Technical information: IP address, browser type, device type, pages visited, error reports and performance measurements (for example page-load timing). We use this to keep the service secure and working.
Payment information (when enabled): if you pay for a plan, payments are processed by Stripe. We receive a payment reference, the amount and the last four digits of the card. We never receive or store full card numbers.
We do not collect government identifiers such as Medicare or NDIS numbers unless a participant or nominee chooses to enter them into a care record. We do not use the portal to make automated decisions about anyone’s care or eligibility.
3. Why we collect it
- To provide the portal — letting the right people see and record a participant’s care.
- To keep accounts secure — verifying identity at sign-in, detecting misuse and preventing unauthorised access.
- To support participants and organisations that ask us for help.
- To meet legal obligations, including record-keeping expected under the NDIS Practice Standards.
- To improve the service, using aggregated, de-identified usage information.
We do not sell personal information, and we do not use care records for advertising.
4. Who we share it with
Care records are visible only to people inside the participant’s circle who have been given a role that allows it. Administrators of an organisation control who those people are.
We use a small number of service providers to run the portal. Each is contractually limited to acting on our instructions:
- Google Cloud — hosting, databases and backups, in the Sydney (australia-southeast1) region.
- Auth0 (Okta) — sign-in and account security, hosted in Auth0’s Australian region.
- Google — if you choose “Sign in with Google”.
- Stripe — payment processing, when paid plans are enabled.
We may also disclose information where the law requires it, for example to a court, regulator or the NDIS Quality and Safeguards Commission, or where necessary to prevent a serious threat to someone’s life, health or safety.
5. Overseas disclosure
Your personal and health information is stored in Australia. Our hosting and sign-in providers operate Australian regions for this service. If we ever need to use a provider that stores data outside Australia, we will update this policy first and take reasonable steps to ensure the recipient handles the information in line with the APPs.
6. How we protect it
- Data is encrypted in transit (TLS) and at rest.
- Each organisation’s data is kept in its own isolated database schema.
- Access is role-based and every sign-in is verified by our identity provider; sessions can be revoked.
- Health information is redacted from application logs.
- Backups are taken automatically and stored in Australia.
- We restrict staff access to production data and log administrative actions.
If we become aware of a data breach that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
7. How long we keep it
We keep account information while your account is active. Care records are kept for as long as the participant or their organisation needs them and for at least seven years after the last entry, consistent with NDIS record-keeping expectations, unless a longer period is required by law. When an organisation closes its account we delete or de-identify its data after a 90-day grace period, except where we must keep it by law.
8. Your choices and rights
- Access and correction: you can view and update your own account details in the portal. To access or correct other information we hold about you, contact us using the details below. We will respond within 30 days.
- Deletion: you can ask us to delete your account. Care records that belong to a participant’s file may be retained under section 7 even if the author’s account is deleted.
- Sign-in choice: you can sign in with an email and password or with Google; you can switch at any time.
- Anonymity: you may browse the public website and the demo without identifying yourself. You cannot use the care portal anonymously, because records must be attributable to the person who made them.
- Cookies: we use only cookies and browser storage that are strictly necessary to keep you signed in. We do not use advertising or cross-site tracking cookies.
9. Children and people with impaired capacity
Participants may be children or adults who rely on a nominee. In those cases we act on the instructions of the parent, guardian or authorised nominee, and we expect organisations using the portal to confirm that authority before granting access.
10. Contact and complaints
Email our privacy contact at privacy@carersportal.me for questions, access requests or complaints. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
11. Changes to this policy
We may update this policy as the service changes. We will post the new version at this address and update the date at the top. For material changes we will notify account holders by email or in the portal before they take effect.