Privacy Policy

Last Updated: 14 October 2026

Webnity Care ("we", "us", "our") operates the Webnity Care software platform, including the web application at webnitycare.com.au and the Webnity Care mobile application available on iOS (Apple App Store) and Android (Google Play Store). This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using our platform, website, or mobile application, you consent to the practices described in this Privacy Policy.

Our role

Care provider organisations (our customers) decide what information about their participants and staff is recorded in Webnity Care. For that information, the care provider is responsible for how it is collected and used, and Webnity Care processes it on the provider's behalf to deliver the platform. Where we collect personal information for our own purposes (for example website enquiries, accounts and billing), we are responsible for it under this policy.

1. Information We Collect

1.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you:

• Register for an account (name, email address, phone number, business name)
• Complete your staff profile (date of birth, address, gender, emergency contacts, qualifications, compliance documents)
• Submit forms through our platform (incident reports, shift notes, leave requests, hazard reports, house safety assessments)
• Contact us via email, phone, or the contact form on our website
• Book a demo or request information about our services
• Subscribe to communications or newsletters

1.2 Information Collected Automatically

When you use our platform or mobile app, we may automatically collect:

• Device Information: Device type, operating system, unique device identifiers, browser type and version
• Location Data: GPS location when you clock in/out of shifts (used for geofenced attendance verification), and, for support workers, location points recorded during a shift and during trips you start with Start Travel (used to work out kilometres travelled)
• Usage Data: Pages visited, features used, time spent, interaction patterns
• Log Data: IP address, access times, error logs, and referring URLs
• Push Notification Tokens: Firebase Cloud Messaging (FCM) device tokens for delivering push notifications

1.3 Information from Third Parties

We may receive personal information from:

• Your employer or care provider organisation that uses Webnity Care
• NDIS and aged care regulatory bodies (for compliance verification purposes)
• Your organisation's identity provider, if single sign-on is switched on (your name, email address and a unique user identifier, so we can match you to your account)
• Files your organisation uploads when it moves records into Webnity Care from another system (for example spreadsheets of clients, workers and shifts)

1.4 Sensitive Information

In the course of providing our services, we may collect sensitive information including:

• Health and medical information (for participant/client care management)
• Working with Children Check and police clearance status
• Professional qualifications and certifications
• Disability and care-related information about participants

We only collect sensitive information with your explicit consent or where required or authorised by law (including the NDIS Act 2013).

2. How We Use Your Information

We use the personal information we collect to:

• Provide, operate, and maintain our platform and mobile application
• Process staff rostering, shift management, and attendance tracking
• Verify clock-in/out attendance using geolocation
• Manage compliance documentation and send expiry alerts
• Process billing, invoicing, and NDIS claims, including preparing claim files for the care provider to submit
• Record service agreements between a care provider and a participant, including their term, supports, rates and how and when they were signed
• Allow a care provider to export its own records and, if it chooses, to connect its own reporting tools (for example Power BI) to its data using access keys it creates and can revoke at any time
• Facilitate in-app communication between team members
• Send push notifications for shift reminders, updates, and important alerts
• Send transactional emails (shift confirmations, password resets, onboarding instructions)
• Provide customer support and respond to enquiries
• Improve our platform, develop new features, and enhance user experience
• Comply with legal obligations, including NDIS and aged care regulatory requirements
• Protect the security and integrity of our platform

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information with:

Recipient	Purpose
Your Employer/Organisation	To facilitate rostering, compliance, and care management within your organisation
Amazon Web Services (AWS)	Cloud hosting and file storage in the Sydney region. AWS SES will be used for email delivery from January 2027 (see Section 11)
Resend	Email delivery (password resets, onboarding and notification emails) until the move to AWS SES
Webnity SMS Gateway	Text message delivery. The gateway is operated by Webnity and hosted in Australia
Your organisation's identity provider	Single sign-on, only if your organisation turns it on
Xero	Invoicing and payroll synchronisation, only if your organisation connects its own Xero account
Google Firebase	Push notification delivery (FCM), crash reporting
Google (Gemini AI)	Only if your organisation turns on AI features: rewriting a shift note written in another language as an English note, and suggesting a client's weekly tasks from their goals. Names are replaced with ID codes first, and phone, email and ID numbers are removed, before any text is sent
NDIS/Government Agencies	Where required for regulatory compliance, audits, or legal obligations
Professional Advisors	Legal, accounting, or consulting services as necessary
Law Enforcement	When required by law, court order, or to protect safety

4. Data Storage and Security

4.1 Storage Location

Your data is stored on secure servers located in Australia. We use industry-standard hosting providers with appropriate security certifications.

4.2 Security Measures

We implement a range of security measures to protect your personal information:

• SSL/TLS encryption for all data transmitted between your device and our servers
• Multi-factor authentication with an authenticator app, passkey sign-in, and optional single sign-on through your organisation's identity provider
• A separate database for each care provider organisation, so one organisation's records are not mixed with another's
• Audit logs of sign-ins, changes and data exports
• Session management that lets an account holder see the devices signed in and sign any of them out
• Reporting access keys that give read-only access, are stored only as a one-way hash, and can be limited to chosen data, set to expire and revoked at any time
• Sensitive connection secrets (such as single sign-on client secrets) stored encrypted
• Role-based access controls limiting data access to authorised personnel
• Encrypted password storage using industry-standard hashing algorithms
• Regular security audits and vulnerability assessments
• Automated session management and token-based authentication
• Secure API endpoints with rate limiting and input validation

4.3 Data Breach Response

If we become aware of a data breach, we will assess it promptly. We will tell the affected care provider organisations as soon as practicable. Where a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988.

5. Location Data and Permissions

Our mobile application requests location permissions for the following purposes:

• Geofenced Clock In/Out: When support workers clock in or out of a shift, we verify their location is within the designated service area. This ensures accurate attendance records and compliance with care delivery requirements.
• Shift location log: From clock-in until the shift is completed, the app records location points so the organisation can verify the shift took place and calculate travel.
• Trips (Start Travel / End Travel): While you have a trip running, the app records your route to work out the kilometres for that trip. The app may also show a reminder on your phone ("Did you forget to start travel?") when it notices you are moving at driving speed during a shift. This reminder is worked out on your phone and is not sent to anyone.

Important:

• Location is recorded only during a clocked-in shift or a trip you have started. Outside of those times the app does not track your location
• While a shift or trip is running the app may keep recording while it is in the background, and your phone will show a notification or location indicator while it does
• Location data is stored securely and is accessible only to your employer/organisation's administrators
• You may deny location permissions, however you will be unable to use the geofenced clock-in/out and trip features

6. Push Notifications

We use Firebase Cloud Messaging (FCM) to deliver push notifications including:

• Shift reminders and schedule updates
• New shift assignments and changes
• In-app chat messages
• Compliance document expiry alerts
• Important system announcements

You can manage notification preferences in your device settings. Opting out of push notifications may affect your ability to receive timely shift updates.

7. Cookies and Tracking

Our website and web application use cookies and similar technologies to:

• Maintain your login session and preferences
• Analyse website traffic and usage patterns
• Improve our platform performance and user experience

You can control cookies through your browser settings. Disabling cookies may affect the functionality of our platform.

8. Your Rights and Choices

Under the Australian Privacy Act 1988, you have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or outdated personal information
• Complaint: Lodge a complaint if you believe we have breached the Australian Privacy Principles
• Opt-Out: Opt out of receiving marketing communications at any time
• Delete: Request deletion of your personal information, subject to our legal obligations and legitimate business needs

To exercise any of these rights, please contact us using the details in Section 13 below. Because care providers are responsible for the records they keep in Webnity Care, we may ask you to make a request to your care provider as well, or we may pass your request to them. Care providers can export a participant's complete record from the platform to respond to an access request.

9. Data Retention

We retain personal information for as long as necessary to:

• Fulfil the purposes for which it was collected
• Comply with legal, regulatory, and contractual obligations
• Resolve disputes and enforce our agreements

NDIS and aged care regulatory requirements may require care providers to keep certain records for a minimum of seven (7) years after the last service delivery date. This obligation rests with the care provider. To support it, when a care provider ends its use of Webnity Care, we keep its data for six (6) months, during which we export it from our system and give the complete export to the care provider. After that period we securely destroy or de-identify the data we hold, unless the law requires us to keep it. Information we collect for our own purposes is kept only as long as needed for those purposes and our legal obligations.

10. Childrens Privacy

Our platform is designed for use by care providers, support workers, and administrators who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 18 without parental or guardian consent. If we become aware that we have collected information from a child under 18 without appropriate consent, we will take steps to delete that information promptly.

Where our platform is used to manage care for participants under 18, this information is collected and managed by the care provider organisation in their capacity as the data controller, in accordance with applicable laws.

11. International Data Transfers

Your data is stored in Australia, in the AWS Sydney region, and text messages are sent through a gateway hosted in Australia. Some service providers may process limited information outside Australia:

• Resend delivers our emails and may process email content and recipient addresses outside Australia. We are moving email delivery to AWS SES, which we expect to complete by January 2027.
• Google Firebase delivers push notifications and crash reports.
• Google (Gemini AI) processes the text of a shift note or a client's goals, with names and contact or ID numbers removed, only when your organisation has turned these AI features on. A worker always reads and approves an AI-rewritten note, and an administrator reviews AI-suggested tasks before anyone sees them. We keep a count of how often the feature is used, but not the text.
• Xero, only if your organisation connects it.

Where this occurs, we take reasonable steps to make sure appropriate safeguards are in place in accordance with APP 8 of the Australian Privacy Principles.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website with a revised "Last Updated" date
• Sending an in-app notification or email for significant changes

We encourage you to review this policy periodically.

13. Contact Us

Privacy Officer: Rupesh Dahal, info@webnitycare.com.au

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to make a complaint, please contact us:

• Business Name: Webnity Care
• Email: info@webnitycare.com.au
• Phone: 08 8472 9519
• Mobile: 0420 769 229
• Address: Adelaide, SA 5000, Australia

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.