Care AI Privacy Policy

1) Introduction and Scope

Care AI Pty Ltd (ACN 681 904 512) (t/as “Care AI”, “we”, “us”, or “our”) provides access to artificial intelligence-powered agents built to assist healthcare providers with automation of administrative and communication tasks. ("Our Services"). At Care AI, we understand the importance of privacy and its security to You. We take privacy seriously and are committed to dealing with Personal Information in accordance with the requirements of the Privacy Act 1988 (Cth), the Notifiable Data Breaches Scheme, the Australian Privacy Principles and any other applicable privacy legislation.

This Privacy Policy outlines how Care AI collects, uses, and processes Personal Information in connection with Your use of the Services including using the Website, interacting with the AI model, and utilising third-party services integrated with our Platform. By providing Your Personal Information to Care AI, You agree and consent that we may collect, use and disclose Your Personal Information in accordance with this Privacy Policy.

Care AI maintains ISO certification and complies with data sovereignty, retention, and security requirements under Australian Privacy legislation.

2) Definitions

‘Third-Party Service Providers’ means vendors engaged by Care AI to assist in providing the Services, including but not limited to cloud providers, payment processors, analytics providers, and AI technology partners.

‘Personal Information’ is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable.

‘Platform’ means the ‘Care AI’ software platform located on the Website and associated serviced provided by Care AI.

‘Privacy Act’ means the Privacy Act 1988 (Cth).

'Sensitive information' is a sub-set of personal information that is given a higher level of protection. Sensitive information means information relating to your racial or ethnic origin, political opinions, religion, trade union or other professional associations or memberships, philosophical beliefs, sexual orientation or practices, criminal records, health information or biometric information.

‘Services’ means Our Services, the Website, or associated goods and services we make available to You through the Website.

‘Website’ means www.careaihq.com, or associated websites we have established for Your use.

‘You’ or ‘Your’ means any users of the Website, Platform or the Services.

3) AI Data Processing

For Users accessing Care AI’s standard deployment, Care AI may collect and process data:

• conversations, prompts, and responses;
• session data (usage patterns, time spent, common queries);
• de-identified insights used to improve service performance;
• AI-generated outputs; and
• documents uploaded for processing.

De-identified data may be used to improve accuracy, performance, and functionality in accordance with the Privacy Act and the Australian Privacy Principles.

For Users accessing Care AI’s Self-Hosted Server solution:

Care AI does not collect, access, or use any data from the Self-Hosted Server for AI model training, tuning, optimisation, analytics, or product improvement. For Users who deploy the Care AI Self-Hosted Server solution, all Personal Information and User Data processed through that environment is stored, processed, and retained entirely within Australia. Data processed in the Self-Hosted Server does not leave the User-controlled environment and is not transmitted to Care AI systems, third-party cloud providers, or external AI models unless expressly authorised in writing by the User for support or maintenance purposes

4) Third-Party Service Providers

Care AI engages third-party service providers to support its operations. These may include:

• Cloud and AI Infrastructure Providers: Hosting and computing resources used for data and AI processing, including Halo Connect and Amazon Cloud;
• Analytics Providers: Tracking website usage and improving service performance;
• Payment Processors: Processing transactions securely;
• Marketing and Customer Support Platforms: Sending communications and managing support inquiries.

5) How We Collect Personal Information

We collect personal information in a variety of ways, including:

• when you provide it directly to us, including face-to-face, over the phone (including through call recordings made for quality and training purposes), over email, or online;
• when you complete a form, such as registering for any events or newsletters, or responding to surveys;
• from third parties, including healthcare professionals who refer clients to our services, and billing and administrative purposes;
• when you use any software or website we operate, including our Platform, and make available to you (including from any analytics and cookie providers or marketing providers); and
• from publicly available sources

6) Types of Personal Information We Collect

We store Your data securely on our servers and use industry-standard measures to protect it from unauthorised access, use and disclosure. However, no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect Your data, we cannot guarantee its absolute security.

By accessing the Website or using the Services, all such users consent to the collection, use, disclosure, storage and processing of their information in accordance with this Privacy Policy.

In addition to the above information, we may collect, use and process:

• Private Information – personal details such as name, date of birth, and location that allow us to identify individuals.
• Contact Information – email addresses, phone numbers, residential and business addresses, and social media identifiers.
• Financial Information – payment details, including credit card and banking information, for processing transactions for the use of the Platform.
• Statistical Information – data related to user behaviour, usage analytics, and aggregated insights from interactions with the Platform.

The types of sensitive information Care AI collects includes:

• health information, including details about your needs for services and data input on the Platform;

7) Purposes for Collecting Personal Information

Care AI collects and uses Personal Information only for its intended purpose, including:

• Verifying identity.
• Communicating updates and responding to inquiries.
• Providing customer support and service notifications.
• Sending marketing communications (opt-in required).
• Improving services and user experience.
• Meeting legal and regulatory obligations.
• Any other use with prior user consent.

Care AI only collects, holds, uses and discloses sensitive information for the following purposes:

• any purposes you consent to;
• the primary purpose for which it is collected;
• secondary purposes that are directly related to the primary purpose for which it was collected, including disclosure to the below listed third parties as reasonably necessary to provide administrative support and facilitate your access to services; and
• if otherwise required or authorised by law.

Users can opt out of marketing communications at any time via the unsubscribe link in emails. We only use Personal Information for marketing in compliance with privacy laws.

Care AI retains Personal Information responsibly and in line with best practices for as long as necessary to fulfill the purposes outlined in this Privacy Policy and comply with the Privacy Act. We take steps to:

• Securely store data locally on encrypted servers in Australia;
• Implement multi-factor authentication to prevent unauthorised access;
• Regularly destroy Personal Information and sensitive data that is no longer required for the purpose it was collected;
• De-identify stored data where individual identification is not necessary; and
• Maintain ISO Certification [ISO 27001] in respect of data security.

8) Use and Disclosure of Personal Information

Care AI does not sell Personal Information. We use and disclose it only for:

• Providing, improving, and securing our Services.
• Verifying identity and processing transactions.
• Responding to inquiries and support requests.
• Complying with legal obligations.
• Enhancing Product functionality and performance.
• Sending marketing communications (opt-in required).

We may share Personal Information with:

• Third Parties: With user consent.
• Acquiring Parties: If Care AI is acquired, subject to this policy.
• Service Providers: Vendors supporting operations (e.g., payment processors, analytics tools, marketing agencies).
• Affiliates: Within our corporate group.
• Legal Authorities: If required by law or to protect our rights.

We limit third-party data access to what is necessary for service provision and require compliance with legal privacy standards. Personal Information may be de-identified for analytics and service improvements.

9) Security Measures

We take all reasonable steps to protect Personal Information, including through internal and external security, restricting access to Personal Information to those who have a need to know, maintaining technological products to prevent unauthorised computer access and regularly reviewing our technology to maintain security. We choose technology partners based on their security and privacy policies and practices.

In case of a breach of security safeguards, such as the loss of, unauthorised access to, or unauthorised disclosure of Personal Information under our control, we will notify You and the appropriate authorities in Australia pursuant to our obligations under the Privacy Act, as well as notifying any other organisation that may reduce the risk or mitigate the harm from the breach.

10) Right to be Forgotten

In the event that You decide that You no longer want us to hold Your Personal Information, You may notify us in writing of Your desire for us to delete Your Personal Information on record. We will use our best endeavours and comply with all legal requirements within a reasonable timeframe to delete Your Personal Information, unless we are required by law to retain such information.

11) International Data Transfers

Care AI stores all Personal Information on secure servers in Australia. Limited access may occur from outside Australia only when necessary for service delivery, operational needs, or legal compliance.

All cross-border data transfers comply with the Privacy Act and APP 8. Care AI ensures overseas recipients follow equivalent data protection standards.

For more details, please contact us.

12) Your Rights and Controlling Your Personal Information

Access: You may request access to the personal information that Care AI holds about you. An administrative fee may be payable for the provision of such information. Please note, in some situations, Care AI may be legally permitted to withhold access to your personal information. If Care AI cannot provide access to your information, Care AI will advise you as soon as reasonably possible and provide you with the reasons for the refusal and any mechanism available to complain about the refusal. If Care AI can provide access to your information in another form that still meets your needs, then Care AI will take reasonable steps to give you such access.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact Care AI using the details below. Care AI will take reasonable steps to promptly correct any information found to be inaccurate, out of date, incomplete, irrelevant or misleading. Please note, in some situations, Care AI may be legally permitted to not correct your personal information. If Care AI cannot correct your information, Care AI will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal.

Complaints: If you wish to make a complaint, please contact Care AI using the details below and provide us with full details of the complaint. Care AI will promptly investigate your complaint and respond to you, in writing, setting out the outcome of the investigation and the steps Care AI will take in response to your complaint. If you are not satisfied with the response, you may contact the Office of the Australian Information Commissioner.

13) Contact Information

You have a right to access the Personal Information we hold about You. To obtain a copy of the Personal Information we hold about You, update it, or if you have any questions, concerns, or complaints about this policy or our data privacy practices, please contact:

• Contact Name: The Privacy Officer
• Phone: +65 8898 5353
• Mailing Address: ‘Care AI’ '5' 24-28 Campbell Street Haymarket NSW 2000, Australia
• Email Address: melvin@careaihq.com

Please provide sufficient detail about the information in question to help us locate it. We will then use commercially reasonable efforts to promptly determine if there is a problem and take the necessary corrective action within a reasonable time. If a fee is charged for such access, we will advise you of the cost in advance.

14) Changes to This Privacy Notice

Care AI reserves the right to amend or replace this Policy at any time, with or without notice to Users, by posting an updated version on the Website, which shall become effective immediately upon posting. In the event that an updated Policy constitutes a material change to this Policy, we will make reasonable efforts to announce such change on the Website. Your continued use of the Services and/or Website following any amendment shall constitute your acceptance of any updated Policy. If you do not agree to any updated Policy, you must discontinue use of the Services and/or cancel your account (if applicable).

Acknowledgment and Consent

By using our services or submitting your personal information, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. This includes how we collect, use, disclose, and safeguard your information.

Data Storage, Retention & Deletion Policy

Care AI are committed to ensuring that the personal information collected is secure. In order to prevent unauthorised access or disclosure, Care AI have put in place suitable physical, electronic and managerial procedures, to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.

Encrypted system backups may temporarily include files that are in use at the time a snapshot is taken. Even if a file is deleted from the primary system, a copy may remain in a snapshot. All backup snapshots are automatically deleted after seven (7) days, after which no copies of the deleted file remain in any Care AI environment.

Standard Customers: Care AI will delete personal information in accordance with the timeframes and processes outlined in our Terms and Conditions. You can request deletion of your data by providing written confirmation via email to ethan@caregp.com.au. We will comply with all deletion requests unless we are legally required to retain the information or have other valid grounds for retention. When we cannot delete your data, we will notify you of the reason.

Enterprise Customers: For enterprise clients, Care AI can commit to enhanced data deletion practices as agreed in individual enterprise agreements. This may include deletion of data from backup systems and other storage locations as specifically contracted.

Limitations: Our deletion commitments apply to personal information that we can reasonably access and delete. This does not extend to:

• Information stored in systems that are not reasonably accessible or would require disproportionate effort to access
• Data that has been fully anonymised and can no longer identify individuals
• Information we are required to retain by law or regulation

Care AI will use commercially reasonable efforts to delete personal information within the agreed timeframes, but cannot guarantee deletion from all possible storage locations where data may exist in anonymised or technically inaccessible forms.