Privacy policy

1. Who we are

Dawnby provides software for care providers and a discovery marketplace for families and workers in Australia. Registered entity details, ABN and postal address will appear here once confirmed. Until then, treat this document as a template only.

2. What we collect

Depending on your role, we may collect account details, contact details, organisational membership, roster and visit information, care notes shared with authorised accounts, enquiry messages, device and security logs, and support correspondence. We do not ask for card numbers to be stored in Dawnby, and we do not process NDIS plan money through the platform.

3. Why we collect it (APP 3 / APP 6)

We collect personal information to operate accounts, deliver the software features you use, support care coordination between authorised people, prepare claim files or invoices for providers to submit themselves, keep security logs, and improve the service with your consent where required.

4. Sensitive information and care records

Health and care information is sensitive. Care reads are gated by current consent and role permissions. Sensitive identifiers (for example Medicare or DVA numbers, where collected) are masked, need a separate permission to reveal, and record a reason in the audit log.

5. When we disclose information

We disclose information to people and organisations you authorise (your provider team, workers on a visit, family accounts with shared access), to service providers who host or support the product under contract, and when Australian law requires it. We do not sell personal information. We do not sell leads.

6. Overseas disclosure (APP 8)

Production hosting in Australia is planned. If any overseas disclosure becomes necessary, we will name the countries and the safeguards in the final policy before that processing begins. The local preview is not a hosted production service.

7. Automated assistance and AI

No AI features are live. If any are added, AI will only suggest and a person will confirm before anything is relied on for care. AI content will be labelled, AI will never send anything by itself, and providers will be able to switch it off. Outside AI services will not handle personal or health data without an owner privacy decision and consent.

8. Security (APP 11)

We use server-side sessions, fixed role permissions, two-step sign-in, scrypt password hashing, and financial and evidence records that cannot be edited (corrections are added as new records). On phones, only unsent pending items are stored encrypted today; encrypted drafts are planned. No security measure is perfect; please report concerns to the contact placeholder above.

We keep records for as long as the law requires (for care, incident and claim records, at least 7 years) and while a legal hold applies. After that, records are destroyed or de-identified only through an audited purge that the provider approves. Daily backups are kept 35 days and monthly backups 13 months, so purged information leaves every backup within 13 months. A deletion register keeps whose records were purged, the period covered and the deletion date.

9. Access and correction (APP 12 / APP 13)

You can ask to access or correct personal information we hold about you. Providers may also have obligations to their own clients under care and privacy law. We will explain how to make a request in the final policy.

10. Data breaches — Notifiable Data Breaches scheme

If we become aware of an eligible data breach that is likely to cause serious harm, we will assess it and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches (NDB) scheme.

11. Complaints

Contact us first using the privacy contact placeholder. If you are not satisfied, you may complain to the OAIC. Final contact pathways will be published when this policy comes into effect.

12. Changes to this draft

This draft will change after legal review. The version that is in effect will be dated and linked from the website footer.