Privacy Policy
Version 2.2 · effective 18 October 2026
Also read:Terms of ServiceData Processing AddendumAI and Acceptable Use Terms
Contents
1. About this policy
1.1 This policy explains how Data Nebula Pty Ltd (ABN 63 684 548 598) ("we", "us") collects, uses, stores and discloses personal information in connection with CareHelm, our website, our free registration checker and our demo workspace (together, the "Service").
1.2 We're an Australian company. Contact details are in section 14.
1.3 We have chosen to handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), including the notifiable data breaches scheme.
1.4 Our approach in short:
- We collect as little personal information as we need.
- Your business data and files are stored in Google Cloud's Sydney region.
- We use service providers to run the Service, including AI services. Some of them process data outside Australia (section 5).
- AI only writes drafts. A person checks and confirms every draft (sections 6 and 7).
- We send marketing emails only to people who have agreed to receive them, and every one has an unsubscribe link.
- We don't sell personal information, and we don't use your data to train AI models.
2. Two roles we play
2.1 Information about you as our customer or visitor. For example, your name, email and business details. We decide how this is used, and this policy applies directly.
2.2 Information you put into CareHelm about other people. For example, your staff's names, qualifications, certificate expiry dates and policy sign-off records, and your incident records. We hold and process this on your behalf to provide the Service, under our Data Processing Addendum. You (the provider) are responsible for telling those people how their information is handled and for having any consents needed. We use it only to provide the Service to you, and as this policy describes.
3. What we collect
| Category | Examples | From whom |
|---|---|---|
| Checker answers | The services you provide, team size, number of sites, how participants' plans are managed, registration status. The answers stay in your browser. We receive them only if you ask for the report by email or start a trial from the result (see below) | You, when you use the checker |
| Checker email address | Only if you ask for the report by email. We use it to send the report. If you also tick the box asking for tips, we use it to send you a short series of emails about getting registered (section 4) | You |
| Email preferences | Whether you agreed to marketing emails or unsubscribed, when, where, and the wording you agreed to. We keep this record with a one-way code of your email address in place of the address | You |
| Account information | Name and email address, your password (stored by Firebase Authentication as a one-way hash), role, sign-in records, two-step verification settings, when you last used the app, your notification settings | You and your Users |
| Legal acceptance records | Which version of our Terms and Privacy Policy you accepted, when, and how (for example "at sign-up") | You, when you accept |
| Business information | Business name, legal name, ABN, address, phone, services, number of sites, registration groups, registration dates | You |
| Referral records | If you sign up through another customer's referral link: the referral code, your organisation's name and whether you signed up | The link you used |
| Staff information (on your behalf) | Staff names, work email, mobile number, role, qualifications, training and certificates, NDIS Worker Screening Check number and expiry date, records of checking the clearance, risk-assessed role, orientation, induction and supervision records, policy sign-off records (including how the staff member confirmed their identity), and answers to policy questions | You or your staff |
| Participant file checklist (on your behalf) | A participant code you choose (for example "P-07") and which file items are in place | You |
| Incident and complaint records (on your behalf) | What happened, when and where, whether someone was hurt or needed medical treatment, whether a restrictive practice was used, and who reported it. A description may identify a participant and include health information. For complaints: what the complaint is about and, if the person chooses to give them, their name, email and phone number | You or your staff, or the person making a complaint through your complaints form |
| Content and files | Your answers to the business and policy interviews (typed or recorded), policies you create or edit, evidence files you upload, comments, data exports and audit packs you create | You and your Users |
| Billing information (from when paid plans open) | Billing contact, business name, billing address, ABN, subscription and payment history. Card details are collected and held by Stripe | You, Stripe |
| Communications | Emails and support messages you send us; research-call notes and recordings, only with your permission | You |
| Technical and usage information | IP address, device and browser type, pages and features used, error logs | Automatically, when you use the Service |
Checker answers we receive. If you ask for the report by email, we use your answers to build the email and don't keep them. If you start a trial from the result, we keep the answers for up to 7 days so your new account starts with them.
Demo workspace. Anyone can open our demo workspace to try CareHelm. Other visitors use the same workspace and can see what you enter, and we reset it every day. Enter made-up information only.
Participant information. Use participant codes where CareHelm asks about a participant. Leave out names, NDIS numbers, diagnoses and case notes unless a feature asks for them. Incident records are the exception: the NDIS rules ask you to record incidents, and a record may need to identify a participant. We treat incident records as sensitive information and protect them like all your data.
Sensitive information. Incident records, screening check details and some staff records can be sensitive information. We collect them only because you choose to use the Service to keep them.
Anonymity. You can read our website, use the checker and open the demo workspace without telling us who you are. To receive the checker report by email or to use CareHelm, we need your email address.
4. Why we use it
| Purpose | Information used |
|---|---|
| Show your checker result, and email it to you if you ask | Checker answers, email |
| Send tips about getting registered, only if you ticked the box | Email, the type of audit your checker result showed |
| Start your account with your checker answers | Checker answers |
| Create and run your account, including sign-in and security | Account and technical information |
| Record which Terms and Privacy Policy versions you accepted | Legal acceptance records |
| Provide CareHelm features, including drafting with AI (section 6) | Business, staff, incident, content and files |
| Send service emails: invitations, staff sign links and codes, incident deadline alerts, reminders, data export notices | Email address, names, the item and its date |
| Send account emails: your next setup steps after you sign up, a summary of what is due when you haven't signed in for 3 weeks, and mid-term audit dates | Email address, name, your organisation's progress and dates |
| Record referrals, so the referring customer can see who signed up and both can get any referral reward | Referral records |
| Bill you and issue tax invoices, from when paid plans open | Billing information |
| Provide support and respond to you | Communications, account information |
| Invite you to research calls, only if you've agreed | Name, email |
| Keep the Service secure, prevent misuse, fix problems | Technical and account information |
| Improve the Service using de-identified, aggregated data and usage statistics (section 12) | Usage information, de-identified |
| Meet legal obligations (for example tax records) | Billing information |
Marketing emails. We send them only to people who agreed: by ticking the box under the checker, by turning on "Product news and offers" in CareHelm's notification settings, or on our email preferences page. The checker tips are three emails over about two weeks. We send at most two marketing emails a week. Every marketing email has an unsubscribe link that works straight away.
We don't use personal information for other purposes unless you'd reasonably expect it and it's related to the purposes above, you've agreed, or the law requires or allows it.
5. Where it's stored and who we share it with
5.1 Main storage in Sydney. Your account data, business data, staff information, incident records, content and files are stored in Google Cloud's Sydney region (australia-southeast1), using Cloud Firestore, Cloud Storage for Firebase and Cloud Functions.
5.2 Backups. We don't keep separate backups today. Download your data regularly (Settings, "Download all your data"). If we start keeping backups, we'll update this policy to say where they are stored and how long they are kept.
5.3 Service providers ("sub-processors"). Third-party service providers process data on our behalf to run the Service. Each receives only what it needs.
| Provider | What it does for us | Information involved | Where it processes data |
|---|---|---|---|
| Google Cloud / Firebase (Firestore, Cloud Storage, Cloud Functions) | Database, file storage, application servers | All account, business, staff, incident, content and file data | Australia (Sydney) |
| Google Firebase Authentication | Sign-in (password, email link, Google), two-step verification | Email address, name (Google sign-in), password hash, IP address, device information, sign-in times | United States |
| Resend | Sending emails | Recipient email address and the email content (for example a reminder naming a certificate and its expiry date) | Japan (Tokyo) |
| Firebase Hosting (Google) | Hosting our website, checker and app | IP address, pages visited | Global network |
| Google Analytics (Google LLC) | Usage statistics for the website and app (section 12) | Pages and features used, device and browser type, approximate location, a random browser ID. Organisations appear only as a one-way code | Outside Australia, including the United States |
| AI services | Writing drafts and suggestions, reading uploaded documents and turning recordings into text, when you use a feature that does this (section 6) | The content the task needs, in full | Outside Australia |
| Stripe | Payments and tax invoices. From when paid plans open | Billing contact, business name, billing address, ABN, payment card details (held by Stripe), IP address | United States and other countries where Stripe operates |
| Twilio | SMS codes and reminders. Not used today | Mobile number, message content | United States and other countries where Twilio operates |
5.4 Overseas disclosure (APP 8). As shown above, some information goes overseas: sign-in data to the United States (Firebase Authentication), email addresses and email content to Japan (Resend), usage statistics to the United States and other countries (Google Analytics), and the content of AI tasks to AI services outside Australia. When paid plans open, billing information goes to Stripe in the United States. Before we use an overseas provider, we take reasonable steps to make sure it protects personal information consistently with the APPs, including by using providers with contractual data protection terms and security certifications.
5.5 Other disclosures. We may also disclose personal information:
- to people you choose to share it with, for example an auditor you give a read-only auditor link;
- if you signed up through another customer's referral link, to that customer: your organisation's name and whether you signed up;
- if you signed up through a referral partner (such as your bookkeeper or accountant), to that partner: only your business name, plan and subscription status, so we can pay their referral fee;
- to professional advisers (such as our accountant) where needed;
- to a buyer of our business, under confidentiality, if we sell the business or the Service (we'll tell you first);
- where required or authorised by law, such as a court order; or
- with your consent.
5.6 We don't sell personal information and we don't share it with advertisers.
6. How we use AI
6.1 What AI does. Some CareHelm features use AI services to write drafts and suggestions from the information you give. The free checker uses no AI: it suggests registration groups with keyword matching in your browser.
6.2 What we send. When you use a feature that uses AI, we send the AI service the content that task needs, in full. That can include your answers, a recording you make, a file you chose or its text, and your business details. We don't remove names before sending. Use participant codes to keep participant names out.
6.3 Where it's processed. AI services process this content outside Australia. Section 5 explains how we choose and oversee overseas providers.
6.4 You're in control. AI output is a draft. You confirm or change every suggestion, and every drafted policy section stays a draft until you approve it.
6.5 No training on your data. We don't use your data to train AI models. In the live service, we use AI services only under terms that stop them from using the content we send to train their models.
6.6 Test environment. Our test environment is a separate copy of CareHelm for trying features. Its AI services may use what is sent to improve their products, and they process it outside Australia. Use test data only there: made-up businesses, people and files. The app shows "Test environment: use test data only." next to every AI draft. We test AI features the same way, with made-up data only.
6.7 Changes. We may change the AI services we use. Sections 6.2 to 6.5 apply to every AI service we use.
7. Automated decisions
7.1 From 10 December 2026, Australian privacy law requires us to tell you when we use a computer program, using personal information, to make decisions that could reasonably be expected to significantly affect your rights or interests.
7.2 Decisions made solely by automated processes:
| Decision | Personal information used | Effect | What you can do |
|---|---|---|---|
| Blocking sign-in after repeated failed attempts or suspicious activity (Firebase Authentication), and locking a staff sign link after too many wrong codes | Sign-in records, IP address, device information, the codes entered | Temporary lock-out | Wait and retry, ask your employer for a new link, or contact us |
| Stopping a new organisation from being created when an organisation with the same ABN already uses CareHelm, or when a free trial was used for that ABN in the last 90 days | The ABN you enter | You can't create a second organisation for that ABN. The existing owners are told someone tried, so they can invite you | Ask the existing owner to invite you, or contact us |
| From when paid plans open: changing your account to read-only when a trial ends without a subscription, or when a payment remains unpaid 14 days after notice | Account, subscription and payment status | You can view and export, but not edit | Subscribe or update payment details; contact us if you think it's wrong |
| From when paid plans open: Stripe's fraud screening (Stripe Radar) declining a payment it assesses as high-risk | Payment card details, billing address, IP address, device information | The payment may not go through | Contact us and we'll look at other ways to pay |
7.3 Decisions where a program does something substantial but a person decides. CareHelm uses fixed rules and AI drafts. A person confirms them:
- Registration groups, audit type and applicable requirements, worked out by fixed rules from your answers. You can change the answers.
- Coverage percentages and "what to do next" lists, calculated by fixed rules from your answers.
- Whether a certificate or screening check has expired, worked out from the dates entered.
- Whether an incident may need to be reported to the NDIS Commission, suggested by fixed rules from the answers in the report. You decide.
- Staff answers to policy questions, marked right or wrong against a fixed answer key. A wrong answer shows the explanation and never stops a staff member signing.
- AI-drafted text and AI suggestions, such as a category or a date. Each one stays a draft until a person confirms it.
These relate to your business's compliance work. We don't use them to make decisions about your participants or your staff.
7.4 We don't make decisions about individuals' eligibility, employment or access to NDIS supports.
8. How long we keep it
| Information | How long |
|---|---|
| Checker answers in your browser | Until you close the tab. We don't store them |
| Checker answers passed to a new account | Up to 7 days, then deleted |
| Your email address for the checker tips | Until the tips series ends, you unsubscribe, or you sign up, whichever comes first. Then the address is removed |
| Records of marketing consent and unsubscribes | Kept, with a one-way code in place of your email address, so we can keep respecting your choice |
| Emails we send | The recipient address and content are removed from our database once the email is sent. A masked address (such as "p•••@example.com") and a one-way code of the address are kept 30 days for support |
| In-app notifications | 60 days. Incident notifications: 400 days |
| Records of a blocked sign-up (section 7.2) | 1 year. They hold no ABN, email address or name |
| Recordings of interview answers | Deleted once transcribed. Any other recording is deleted after 1 day |
| Draft transcripts of recordings | 30 days, then deleted automatically |
| Answers you confirm from a recording | Kept with your account, like typed answers |
| Data exports ("Download all your data") | The download link works for 7 days, then the file is deleted |
| Audit packs and other export files | Deleted from storage after 30 days. You can create a new one at any time |
| What visitors enter in the demo workspace | Deleted when the workspace resets, every day |
| Accounts before paid plans open | While you use CareHelm. If you ask us to close your account, we delete it within 30 days |
| Customer accounts (from when paid plans open) | For your subscription, then a 90-day export period, then deleted within 30 days, unless the law requires us to keep it |
| Staff files marked as left | 7 years after the worker leaves, then deleted automatically (NDIS record-keeping rules) |
| Legal acceptance records | For the life of the account, plus 7 years, so we can show what was agreed |
| Billing and tax records | At least 5 years, as required by Australian tax law |
| Research-call recordings | Deleted within 90 days; written notes kept without contact details after 24 months |
| Google Cloud request and error logs | 30 days |
Today we delete closed accounts by hand, on request or at the end of the export period, within the times above. When we no longer need personal information, we delete it or de-identify it.
9. How we protect it
- Encryption in transit (TLS) and at rest (Google Cloud default encryption).
- Separation between customer organisations, enforced by database security rules and tested automatically.
- Role-based access (Owner, Admin, Staff). Staff see only their own documents and their organisation's name.
- Two-step verification is available for every account.
- An audit log of changes and administrative actions in each organisation.
- Only authorised Data Nebula personnel can access production systems, and only when needed for support or security. Our support console shows them account contact details (name, email address, role, organisation, when the account was created and last used) so they can help you. It doesn't show your policies, evidence, incident records, interview answers or staff records. Every change made from the console is logged.
- A written data breach response plan (section 11).
No system is perfectly secure. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
10. Your rights
10.1 Access and correction. You can see and update most of your information in CareHelm. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing privacy@carehelm.com.au. We'll respond within 30 days. There's no charge. If we refuse, we'll tell you why in writing and how to complain.
10.2 Staff of our customers. If you're a staff member of one of our customers and want to access or correct information your employer put into CareHelm, please contact your employer first. We'll help them respond. You can also contact us.
10.3 Emails. You can turn off reminder, monthly check-in, rule change and account emails in CareHelm's notification settings. Incident deadline alerts, invitations, sign-in emails, codes and billing notices always send, because your account or your legal duties need them. To stop marketing emails, use the unsubscribe link in any of them, our email preferences page, or the "Product news and offers" setting in CareHelm.
10.4 Closing your account. Email support@carehelm.com.au. Section 8 explains what happens next.
11. Data breaches
11.1 We have a written data breach response plan. If we suspect a data breach, we act straight away to contain it and assess it. We complete our assessment as quickly as possible, and within 30 days at most.
11.2 If a breach is likely to result in serious harm to anyone (an "eligible data breach"), we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, as required by the notifiable data breaches scheme.
11.3 If a breach affects data you put into CareHelm, we'll also notify you (the customer) within 72 hours, as set out in our Data Processing Addendum, so you can meet any obligations you have.
12. Cookies and usage statistics
12.1 We use essential cookies and browser storage to keep you signed in and to make the Service work. We don't use advertising cookies.
12.2 Google Analytics. Our website and the CareHelm app use Google Analytics, a service of Google LLC, to count visits and see which features are used. Google Analytics sets cookies and stores this data on Google's servers outside Australia, including in the United States.
12.3 What we send. We send no personal or health information to Google Analytics: no names, email addresses, answers you type, or participant or staff details. Your organisation appears only as a one-way code that can't be turned back into its name. We have turned off Google's advertising features and Google signals. Pages whose address holds a sign-in link or a staff sign link send nothing.
12.4 Opting out. You can install the Google Analytics Opt-out Browser Add-on, block cookies in your browser, or use a content blocker. The Service works the same without it.
13. Children
The Service is for businesses and adults. It's not intended for people under 18, and we don't knowingly collect their information.
14. Contact and complaints
Privacy contact: privacy@carehelm.com.au
Post: Data Nebula Pty Ltd (ABN 63 684 548 598), Sydney NSW 2008
If you have a concern about how we've handled your personal information, please email us with details. We'll acknowledge your complaint within 5 business days and aim to respond in full within 30 days.
If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.
15. Changes
We update this policy when our practices change. Each version has a version number and an effective date at the top. When the version changes, CareHelm asks you to accept it the next time you sign in, and Settings shows the version you accepted. If a change is significant, we'll also email account holders at least 30 days before it takes effect.