Care Scribe — Privacy Policy

1. Introduction

AI..sh AI PTY LTD (“we”, “us”, “our”) operates the Care Scribe application (“the App”), a documentation, scheduling and invoicing tool for independent NDIS support workers in Australia. This Privacy Policy explains how we collect, use, store, and protect personal information about you and the participants you support when you use the App. We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

2.1 Information You Provide About Yourself

• Account Information: Name, email address, business or sole-trader details, ABN (if invoicing).
• Worker Profile: Service categories you offer, hourly rates, qualifications you choose to record.

2.2 Information You Enter About Participants

As an NDIS support worker, you input information about the participants you support. You are the data controller for this information; we are the data processor. This may include:

• Identifying Information: Participant name, NDIS number, plan dates, contact details.
• Plan & Goal Data: Funded supports, NDIS goals, service agreements you upload.
• Session Records: Voice recordings, voice-to-text transcripts, progress notes, incident reports, shift start/end times, locations (if enabled).
• Invoicing Data: Line items, support categories, hours, totals, payment status.

2.3 Collected Automatically

• Device Information: Device type, operating system, app version, crash logs.
• Usage Data: Features accessed, session duration. Used in aggregate only.

2.4 We Do NOT Collect

• Tax File Numbers (TFN), Medicare numbers, or banking passwords.
• Government identity documents (passport, driver's licence images).
• We do not sell or rent your data, or participant data, to third parties — ever.
• We do not use your voice recordings, transcripts, or notes to train third-party AI models.

3. How We Use Your Information

• Convert your voice recordings into NDIS-formatted progress notes you can review and save.
• Track shifts, hours, breaks and travel to populate compliant invoices.
• Generate NDIS-aligned invoices with the correct line items and support categories.
• Surface NDIS reportable-event flags so you can review and report appropriately to your provider or the Commission.
• Provide secure participant management (plans, goals, agreements) accessible only to you.
• Operate, secure, and improve the App; communicate service updates.

4. Data Storage, Residency & Security

• Australian Data Residency: All data — including voice recordings, transcripts, notes, and invoices — is processed and stored on infrastructure hosted in Australia (AWS Sydney region). No participant data is sent or stored offshore.
• Encryption: Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access Control: Only authorised AI..sh AI personnel have access to production systems, audited via role-based access control.
• Device Security: Optional passcode and biometric (Face ID / Touch ID) lock on the mobile app.
• Voice Processing: Voice files are transcribed by an Australian-hosted speech-to-text service. Recordings are not used to train external AI models.

5. Third-Party Services

We choose vendors that offer Australian regions and contractual data-protection commitments. We never share participant identifying information beyond what is strictly required for the function listed above.

6. Data Retention

• Notes & Invoices: Retained for the period the NDIS Practice Standards and Australian tax law require records to be kept (typically 7 years), unless you request earlier deletion.
• Voice Recordings: Retained only until you finalise the related note. After 30 days the original audio is automatically deleted; the text note remains.
• Account Data: Retained while your account is active.
• Deleted Accounts: All personal data permanently removed within 30 days of deletion request, except where retention is required by law.

7. Your Rights & Participant Rights

• Access: View and export all your data at any time (CSV / PDF).
• Correct: Update or correct any record before saving; edit history is retained for compliance.
• Delete: Request deletion of specific records or your entire account.
• Portability: Export participant records to your provider in a standard format.

Participants you support also have rights under the Privacy Act and APPs. As the worker entering their data, you are responsible for obtaining appropriate consent and informing them of how their information is recorded. Care Scribe acts as a processor under your direction.

8. Children & Minors

Care Scribe is intended for use by NDIS support workers aged 18 and over. Participant records may relate to children where the worker is supporting them under an NDIS plan; in such cases workers must follow their provider's child-safe policies and obtain consent from parents/guardians as required.

9. Data Breach Notification

We follow the Notifiable Data Breaches (NDB) scheme under the Privacy Act. In the unlikely event of an eligible data breach we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

10. Disclaimer

Care Scribe is a documentation, scheduling and invoicing tool for support workers — it is not a registered NDIS provider and does not deliver NDIS supports. Notes, incident flags and invoices generated by the App are drafts for your review; you remain solely responsible for clinical and compliance decisions.

11. Changes to this Policy

We may update this Privacy Policy as the App evolves. Material changes will be notified in-app and via email at least 14 days before they take effect.

12. Contact