Legal

Sub-processors

The third-party services we use to run CareOp. Last updated 5 September 2026.

What they do

A sub-processor is a company that handles personal information on our behalf so that we can operate the platform. We remain responsible for what they do with it.

Database, authentication and file storage
Sydney, Australia

The system of record: where everything the platform holds is kept.
What it holds: Everything the platform holds: participant records, notes, documents, worker and pay details.

Application hosting
Sydney, Australia

Serves the web application and its API.
What it holds: Data in transit while a request is served. Request logs, which may include IP addresses.

AI processing
Australia

The AI features described in section 6 of the privacy policy: checking and tidying shift notes, answering questions from a participant's record, writing pre-shift briefs, the daily briefing and report drafts, reading submitted notes for CareOp signals, proposing sleepover awake time, and reading uploaded care documents and worker certificates into drafts for review.
What it holds: Text from notes, records and uploaded care documents, with names and identifying details replaced by codes before it is sent (a person keeps the same code within your organisation), and images and text of worker employment documents. Not used to train models.

Email delivery
France

Sign-in links, invitations and notification emails.
What it holds: Email addresses and the contents of those emails.
This is an overseas disclosure. See section 7 of the privacy policy.

Push notification and app update delivery
United States

Delivers notifications to the mobile app, passed onward to the phone's own operating system push service for the final hop to the device. The same service supplies the app's over-the-air code updates when it opens.
What it holds: The device's push token and the text shown in the notification. When the app checks for an update on launch: an anonymous installation identifier, the platform and the app version. No account, participant or shift data.
This is an overseas disclosure. See section 7 of the privacy policy.

The last hop to a phone is made by its own operating system’s push service, which is why push delivery is listed as one entry rather than two. That service receives the device token and the words shown in the notification, and nothing else.

The two that are overseas

Everything of substance stays in Australia. The two exceptions are narrow and worth stating plainly, because “we use an overseas provider” sounds larger than what actually crosses a border:

• Email (France). An email address, and the contents of the email itself. A sign-in link, an invitation, or a line saying a shift changed.
• Push notifications (United States). A device token, and the text shown on the lock screen. You can keep this out of scope entirely by declining the notification permission, or turning notifications off in the app.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, as APP 8 requires.

When this list changes

We update this page when a sub-processor is added, removed or replaced. Where a change materially affects how personal information is handled, we tell providers before it takes effect.

Providers with a data processing agreement should refer to that agreement for the notice period and any right to object. It governs over this page.

Questions

This page describes each service by what it does and where it is located, which is what the Australian Privacy Principles require us to tell you. Providers carrying out vendor due diligence can have the list naming each provider, on request: privacy@careop.com.au.