Legal

Privacy Policy

Version 1.6 · Effective 7 October 2026

1. Who this policy is about

CareOp is operated by Orion Technology Pty Ltd (ABN 51 701 742 690), of 4530 G/470 St Kilda Road, Melbourne VIC 3004. That company is the one that contracts with providers, and “we”, “us” and “CareOp” in this policy all mean it. This policy explains how it handles personal information, including health information.

CareOp is a software platform used by disability service providers, including registered and unregistered NDIS providers. Two different relationships run through it, and the difference decides who is answerable for what:

The provider

Your employer, or the organisation delivering supports. They decide what information is recorded, who may see it, and how long it is kept. For most questions about the content of a record, they are the right people to ask, and they have their own privacy policy.

CareOp

We build and operate the platform and hold the information on the provider’s behalf. Australian privacy law does not treat that as a purely technical role: because we hold health information, we carry obligations under the Privacy Act directly, and this policy is how we meet them.

This policy covers support workers and other staff who use the CareOp Worker app or the web application, participants and their representatives whose information is recorded in it, and visitors to our website.

A note for workers in particular. Employers are, in general, exempt from the Privacy Act for their own employee records. That exemption is theirs, not ours. It does not travel with the data to a third party who holds it. Your information in CareOp is covered by this policy, and the rights in section 11 are yours to use against us.

2. The law we work under

We handle personal information in accordance with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles;
• the Health Records Act 2001 (Vic) and its Health Privacy Principles, which apply to health, disability and aged care information handled in Victoria by private organisations;
• the equivalent State and Territory health records laws where a provider operates elsewhere, including the Health Records and Information Privacy Act 2002 (NSW); and
• the NDIS Practice Standards and the NDIS Code of Conduct, which set expectations about privacy, dignity and record keeping for providers using this platform.

We do not rely on the small business exemption in the Privacy Act. That exemption is not available to an organisation holding health information in connection with a health service, and we would not rely on it in any case.

3. What we collect and hold

What follows is what the platform actually collects. Not every provider turns on every feature, so some categories may not apply to you.

If you are a support worker or other staff member

Account and identity

Name, preferred name, work email, phone number, and your photo if you upload one.

Employment details

Employment type, start date, role, qualifications and skills, availability, leave, your manager, and emergency contact details you provide.

Credentials

Certificates and checks your employer requires, for example a first aid certificate, driver licence or NDIS Worker Screening Check, including the document image or PDF you upload, and its expiry date.

Shift and timesheet records

Rostered and actual start and finish times, breaks, travel claims, and the reason recorded when a clock time is adjusted.

Location

A single set of coordinates at the moment you clock on or off, start or check in on a safety timer, or send a duress alert. See section 4.

Pay information

Where your employer uses CareOp for payroll: bank account details, superannuation details and tax file number. A tax file number is held under the stricter rules that apply to it and is never displayed back once stored.

What you write

Progress notes, incident reports, forms, messages, acknowledgements, signatures you type or draw on documents, and feedback you send us from the app, including who wrote them and when.

Device and technical

Sign-in times, the device type, and a push notification token if you allow notifications. If the app stops working, it sends us the technical details of that failure by itself (the error, the screen you were on, and the app version) so we can fix it without you having to report it. We do not use advertising identifiers and we do not track you across other apps or websites.

If you are a participant or their representative

Identity and contact

Name, date of birth, contact details, address, NDIS number, and the people in your support network and their relationship to you.

Health and support information

Care and support plans, goals, risk assessments, behaviour support plans, medications and medication administration records, observations, allergies, health conditions, appointments, progress notes and incident records. This is sensitive information under the Privacy Act and health information under State health records law, and it carries the highest protections in this policy.

Funding and service records

Plan details, budgets, service agreements, service bookings and claims made against your plan.

Documents

Files your provider stores about you, including assessments, reports and signed agreements.

How we collect it

Almost always from your provider or from you directly: typed into the app, uploaded, or recorded as part of a shift. We also collect information generated by using the platform, such as the time a note was submitted. Where we collect information about you from someone else, for example a support coordinator sending a referral. We do so because your provider has arranged the support and it is unreasonable or impracticable to collect it only from you.

4. Location, specifically

Location is the permission people ask about most, so it gets its own section.

• Location is captured only at these moments: clocking on, clocking off, starting or checking in on a “Check on me” safety timer, and sending a duress alert.
• It is a single point each time, not a trail. The app does not record where you go between those moments.
• The app requests foreground location only. It holds no background location permission, so it cannot collect your location while it is closed or in your pocket.
• It is optional. If you decline the permission, or there is no signal, clocking on still works and the record simply shows no coordinates. Your pay does not depend on a GPS fix.
• Your provider can see the coordinates attached to your clock records, and may use them to confirm attendance. Where a shift has a geofence, a clock event outside it is flagged for a human to look at. It is never blocked automatically.

5. Why we collect and use it

We use personal information to:

• deliver the platform: rosters, shifts, notes, timesheets, documents and messaging;
• let providers meet their record keeping, incident reporting and compliance duties;
• keep people safe: lone worker check-ins, duress alerts, incident escalation, and medication and allergy warnings;
• calculate pay and process NDIS claims, where a provider uses those features;
• authenticate you, secure accounts and investigate misuse;
• notify you about your shifts, approvals and tasks;
• support and troubleshoot, when a provider asks us for help; and
• improve reliability and performance, and meet our own legal obligations.

We do not sell personal information. We do not use it for advertising, we do not disclose it for anyone else’s marketing, and we do not use participant or worker information to train AI models. See section 6.

6. Artificial intelligence and automated decisions

Not every provider uses every feature below, so some may not apply to you. Your provider can tell you which ones they use.

What the AI does

• Drafting. It tidies up notes a person has written and points out what a note leaves unanswered. It also drafts forms, agreements, handovers, answers to questions about a record, and participant reports from the notes and incidents of the report’s period, every claim citing the record it rests on. Where a provider turns it on, it also drafts a worker’s shift note from that shift’s own records (clock times, tasks, medication given or refused, awake time and incidents) and the points the worker adds, every sentence citing where it came from. A person reads the draft, and nothing is saved until they accept it.
• Reading documents. It reads the details off a certificate or check a worker uploads. Where we have switched it on for a provider, it also reads a participant’s plan, support or health documents. Where a provider uses it, it also reads an emailed referral someone asks it to read. Each detail it reads is a suggestion, and nothing is saved until a person confirms it.
• Suggesting awake time. Where a provider turns this on, it reads sleepover notes and suggests awake time to be claimed. A person approves or rejects every suggestion.
• CareOp signals. Each progress note is read when it is submitted, for things a coordinator should know, such as a fall, a medication problem or a possible reportable incident. What it finds is put in a queue for a reviewer at the provider, who decides what to do. It changes no record and starts no incident by itself. Providers can turn it off. It also keeps a short summary of each note, with names left as codes, so CareOp’s AI can read that instead of the whole note later. Nobody is shown it, and it is deleted when the note is changed or the person’s record is erased.
• Record digests. Overnight, it keeps a short summary of each incident, clinical assessment, complaint and coordination case note written or changed that day, with names left as codes, so CareOp’s AI can read that instead of the whole record later. A complainant’s name and contact details are never sent. Nobody is shown the summaries, and they are deleted when the record is changed or the person’s record is erased. Providers can turn it off.
• Pre-shift and morning briefs. It writes a short summary of a participant’s recent notes, incidents, goals and care plan, which staff who can already see that participant’s care plan read before a shift. It also writes a morning summary for office staff. Nobody checks these before they are shown. The pre-shift summary is labelled as written by AI, a line that cannot be traced to a record is left out, and it is for reading only. The care plan is still the instruction.

The rules we hold ourselves to:

• AI does not decide anything about anyone. It drafts, reads, flags and summarises. Anything it produces that would change a record waits for a person to accept it. What it does without anyone checking first, the flags and the summaries above, only informs people. It never approves, refuses, pays or changes anything.
• Names are replaced before text leaves CareOp. The names of participants, staff and the family and representatives recorded against a participant are swapped for codes, along with addresses, email addresses, phone numbers, NDIS and Medicare numbers, and dates written as day/month/year. So are names that follow a relationship or a title (“Mum Sarah”, “Dr Patel”) and the names of organisations such as schools and clinics. The originals are put back inside CareOp afterwards. A name recorded nowhere else and written without such a cue (a friend named in passing, for example), a name typed in lower case, or a date written another way, can still get through. Participant documents are sent as text, with names replaced the same way. A certificate may be sent as a picture, which shows the worker’s own name and details. An emailed referral someone asks to have read is sent with names replaced the same way, including a name or date written after a label such as “Name:” or “Date of birth:”. One thing is sent as written, without names replaced: a request someone types asking for a form, agreement or policy to be drafted.
• Processing happens in Australia. We use an Australian-hosted AI service, and the processing runs in Australian data centres. The service is described by function and location on our sub-processors page.
• It is not used to train models. Our provider does not use what we send, or what comes back, as training data. It may be retained briefly: up to 24 hours for caching, and for abuse monitoring.
• Voice stays on the phone. Speech is converted to text on the device. No audio is uploaded or stored.
• We log that it happened, not what was in it: a scrambled reference, a size and a response time, never the content.

Automated decisions

The Privacy Act asks us to say where a computer program makes, or does a substantial part of, a decision that could significantly affect you, and what personal information it uses. Most of these are not AI. They are fixed rules that run on a schedule. None of them disciplines anyone.

Decisions the software makes by itself

Approving a timesheet that matches the roster

Off unless your provider turns it on. Each morning, a timesheet is approved if its clock times are within your provider’s tolerance of the rostered times, it has a break where a long shift needs one, and its clock-on location was not flagged. Uses: clock-on and clock-off times, breaks, whether the location was flagged, and the rostered times. Hours are paid the same way as when a person approves: a small difference from the roster, within the tolerance, is paid at the rostered time. A timesheet entered by hand, closed automatically, queried or being corrected is never approved this way. You are told when it happens. An approver can reverse it, and you can query approved hours until the pay period ends.

Taking you off a shift you did not confirm

Only if your provider asks workers to confirm shifts and chose to release unconfirmed ones. If you have not confirmed a shift within the time your provider set, and it has not started, you are taken off it and it goes back to the office to fill. Uses: when the shift was given to you, whether you confirmed it, and its start time. You and the office are told.

Leaving a worker out of automatic shift offers

When a coordinator sends a shift out to be filled, workers already rostered at that time, on approved leave, or marked unavailable are not offered it. Uses: your roster, leave and unavailability. A coordinator can still offer you the shift directly.

Accepting a clock-on

Always on. A clock-on is refused more than an hour before the shift starts, more than two hours after it ends, or while you are still clocked on to another shift. Uses: the clock time, your rostered times and your other open shifts. Your provider can record the times for you instead.

Marking a service agreement expired

Always on. Once a participant’s service agreement has passed its end date, it is marked expired. Uses: the agreement’s end date. Your provider can reactivate it.

Adopting new award rates and NDIS price limits

On unless your provider turns it off. When a new SCHADS award rate table or NDIS price guide comes into force, CareOp’s tables are updated on that day. This changes the rates workers are paid and the limits on what can be charged to a participant’s plan. It does not look at any individual person. Rates a provider has entered itself are never changed.

Decisions a person makes with the software’s help

Closing a shift nobody clocked off

Always on. Twelve hours after a shift was due to end, if the worker is still clocked on, the clock-off is recorded at the rostered finish and the hours are worked out from the roster. The timesheet is marked as closed automatically and waits for an approver, who decides what is paid. It is never approved automatically. You and the approvers are told.

Choosing who is offered a shift first

When a coordinator starts filling a shift, workers are ranked and offered it three at a time, 15 minutes apart, and the first to accept gets it. Uses: whether you have worked with the participant in the last 90 days, your skills, your availability, credentials due to expire before the shift, the hours you are already rostered that week, and, where your provider checks it, whether your NDIS Worker Screening Check is valid on the day. Ratings and performance are not used. The coordinator can stop it at any time.

CareOp signals and note patterns

Described above. A reviewer at the provider decides whether anything needs following up, including whether an incident is reported. Uses: the note, with names replaced, the kind of note and shift, and whether the participant has an authorised restrictive practice. The same checks point out a worker whose notes on different days are nearly identical, for a reviewer to look at. The worker is not shown these flags.

Compliance and attendance flags

A compliance score for each worker, based on their credentials, checks and required documents; a flag on a clock-on or clock-off outside a shift’s set area; and a flag on timesheets left unapproved. These tell a person what to look at, and never block anyone by themselves.

If one of these decisions affects you, ask your provider to have a person look at it again. You can also contact us at privacy@careop.com.au.

7. Who we share it with

Within the platform, access is restricted to the provider’s own people, and by permission. A support worker sees the participants they are rostered to, not the whole client list. Providers are separated from one another at the database level; one provider’s records cannot be read by another.

We disclose personal information outside the provider only:

• to the service providers described below, who process it on our instructions;
• where you consent, or where you would reasonably expect it;
• where required or authorised by law, including reporting obligations to the NDIS Quality and Safeguards Commission, a court order, or a lawful request from a regulator; and
• to lessen or prevent a serious threat to someone’s life, health or safety, where the law permits.

Our service providers

We use a small number of third-party services to run the platform: hosting, the database, email delivery, push notifications and the AI features in section 6. Each processes personal information only on our instructions and for the purpose it is engaged for, and we remain responsible for what they do with it.

The current list (what each service does, where it is located and what it holds) is at careop.com.au/sub-processors. It is kept there rather than here so it can be updated when a service changes without reopening this document. Providers carrying out vendor due diligence can request the list naming each provider.

Overseas disclosure

Personal information is stored in Australia. There are two exceptions, both narrow:

• Email delivery: France. Email addresses and the contents of the emails we send you.
• Push notification delivery: United States. Your device’s push token and the text shown in the notification.

Participant records, care plans, notes, documents and pay information are not sent overseas.

Before disclosing information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, as APP 8 requires. You can keep push notifications out of scope entirely by declining the notification permission, or turning notifications off in the app.

8. How we protect it

• Encrypted in transit and at rest.
• On mobile, your sign-in session is held in the device’s secure hardware store, the iOS Keychain or Android Keystore, not in ordinary app storage. You can add a Face ID, fingerprint or passcode lock to the app itself. That check is performed by your phone’s operating system: CareOp receives only a yes or no, and never the face, fingerprint or passcode itself.
• Access is enforced in the database, not just the interface, so a bug in a screen cannot expose another provider’s records.
• Clinical, compliance and financial changes are written to a tamper-evident audit trail that records who did what and when. Audit entries store a reference to the changed field rather than the value itself.
• Our staff access provider data only where necessary to operate or support the platform.

No system is perfectly secure. If a data breach occurs that is likely to cause you serious harm, we will notify the affected provider and, as the Notifiable Data Breaches scheme requires, the Office of the Australian Information Commissioner and affected individuals.

9. How long we keep it

Providers are subject to record keeping rules that override any wish to delete early, and we hold records for as long as they require. In particular, under the Health Records Act 2001 (Vic) health information must generally be kept for at least seven years after the last occasion a service was provided, and where the information was collected while the person was a child, until they turn 25.

Other records follow their own rules: employment and pay records under the Fair Work Act, and NDIS claiming records under the provider’s NDIS obligations. When a provider stops using CareOp, we return or delete their data as agreed in their contract, subject to those periods.

10. Getting access, and correcting things

You can ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete.

Ask your provider first. They control the records and can usually act immediately, much of it you can see in the app already. If that is not possible, or you would rather come to us, contact us at privacy@careop.com.au.

We will respond within a reasonable period, and in any event within 30 days. We do not charge for making a request. If we refuse access or a correction we will tell you why in writing and how to complain. Where a record contains information about someone else (a note naming both a participant and a worker, for instance) we may need to remove or redact that part.

11. Deleting your data

CareOp accounts are created by an employer, not by you, and the platform has no sign-up. Your provider can deactivate your account and request erasure of your information.

You can also ask us directly, at any time, using the form at careop.com.au/data-deletion, which explains what can and cannot be deleted and how long it takes.

Some information cannot be deleted on request, because the law requires it to be kept. See section 9. Where that applies we will tell you which records are affected and why, and delete the rest.

12. Complaints

If you think we have mishandled your personal information, tell us first: privacy@careop.com.au. We will acknowledge your complaint within 5 business days and respond within 30 days. If you are not satisfied, you can take it further at no cost:

• the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992;
• in Victoria, for health information, the Health Complaints Commissioner: hcc.vic.gov.au, 1300 582 113;
• in New South Wales, the Information and Privacy Commission NSW; and
• for concerns about the conduct of an NDIS provider, the NDIS Quality and Safeguards Commission: 1800 035 544.

13. Children and young people

Some participants are children. Where a participant cannot consent for themselves, a parent, guardian or authorised representative acts for them, and the same rights apply. We take particular care with information collected about a child, including the longer retention rule in section 9. The CareOp Worker app is for employed support workers and is not directed at children.

14. Dealing with us anonymously

You can contact us anonymously or under a pseudonym with a general question. You cannot use the platform anonymously. It is a record keeping system for regulated supports, and a record of care has to say who provided it.

15. Changes to this policy

We may update this policy. The current version is always at this address, with its version and effective date at the top. Where a change materially affects how we handle your information we will tell providers in advance, and show a notice in the app.

16. Contact us

Privacy enquiries, access requests and complaints: privacy@careop.com.au.

Or by post:
Orion Technology Pty Ltd
4530 G/470 St Kilda Road
Melbourne VIC 3004
Australia