Legal

Sub-processors

The third-party services we use to run CareOp. Last updated [date on publication].

The short version

  • Five services. Three are in Australia and hold the substance of the platform; two are overseas and hold very little.
  • Each one processes data only on our instructions, for the purpose listed. None of them may use it for their own purposes, and none of it is sold.
  • Participant records, care plans, notes, documents and pay information never leave Australia.

Who they are

A sub-processor is a company that handles personal information on our behalf so that we can operate the platform. We remain responsible for what they do with it.

Supabase
Sydney, Australia
Database, authentication and file storage — the system of record.
What it holds: Everything the platform holds: participant records, notes, documents, worker and pay details.
Vercel
Sydney, Australia
Application hosting. Serves the web application and its API.
What it holds: Data in transit while a request is served. Request logs, which may include IP addresses.
Google Cloud (Vertex AI)
Australia
The AI features described in section 6 of the privacy policy — tidying note text, and reading details off a photographed certificate.
What it holds: Note text with participant names and identifying details already replaced by placeholders, and credential images. Not used to train models.
Brevo
France
Email delivery — sign-in links, invitations and notification emails.
What it holds: Email addresses and the contents of those emails.
This is an overseas disclosure — see section 7 of the privacy policy.
Expo
United States
Push notification delivery to the mobile app, passed onward to Apple and Google for delivery to the device.
What it holds: The device's push token and the text shown in the notification.
This is an overseas disclosure — see section 7 of the privacy policy.
Before publishing
Confirm this list is complete at the date of publication, and set the “last updated” date above. Confirm too whether Apple and Google should be named in their own right as the operators of APNs and FCM — Expo hands the notification to them, so they are arguably sub-processors of a sub-processor.

The two that are overseas

Everything of substance stays in Australia. The two exceptions are narrow and worth stating plainly, because “we use an overseas provider” sounds larger than what actually crosses a border:

  • Email (France). An email address, and the contents of the email itself — a sign-in link, an invitation, or a line saying a shift changed.
  • Push notifications (United States). A device token, and the text shown on the lock screen. You can keep this out of scope entirely by declining the notification permission, or turning notifications off in the app.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, as APP 8 requires.

When this list changes

We update this page when a sub-processor is added, removed or replaced. Where a change materially affects how personal information is handled, we tell providers before it takes effect.

Providers with a data processing agreement should refer to that agreement for the notice period and any right to object — it governs over this page.

Questions

Vendor due-diligence questions and requests for this list in another format: privacy@careop.com.au.