Tech preview. In force from 30 October 2026 for the HealthOS SaaS tech preview. We will review and update these documents as the service matures, and give workspace managers at least 30 days’ notice of any change that is materially worse for them.
Who this covers
This policy explains how HealthOS Pty Ltd, ABN 81 697 460 889 (we) handles personal information under the Privacy Act 1988 and the Australian Privacy Principles. It covers this website and the HealthOS SaaS products: Code Navigator and Code Captain, the Aged Care Government Reporting Gateway and the Live Home Care Budget Calculator.
Health information in a workspace. When a provider subscribes, the information it puts into its workspace, or has us read from government services for it, about the residents, clients, patients and staff it looks after, is handled on that provider’s behalf and on its instructions. The provider decides why it is collected and how it is used, and its own privacy policy applies. If you are one of those people, please contact the provider first; we will help them answer you.
What we collect
- Account details. The name and work email address of each person in a workspace, their organisation, role and the products they use, and records of sign-ins (time, IP address and browser) kept for security.
- Billing details. Your organisation’s name, ABN, billing contact and subscription history. Card details go to Stripe and are held by Stripe, not by us.
- Workspace data. What a subscriber enters, uploads or connects. Depending on the product this can include health information: residents’ and care recipients’ names, dates of birth, care recipient ids, AN-ACC or Support at Home classifications, budgets and contribution rates, and My Aged Care referrals; staff names, employee numbers and contact details from rosters and timesheets; and the text of clinical documents for coding, which the browser strips of identifying details before it is sent.
- Support messages. What you tell us when you email or call us.
- Website use. If you accept analytics cookies, Google Analytics records how the website is used. If you ask for the developer guide, the name, email address and organisation you enter. See Cookies.
How we collect it
- From you, when you sign up, use the service or contact us.
- From your organisation, when a manager invites you or your colleagues add information.
- From government services on a subscriber’s behalf, using that subscriber’s own credentials: ACWS through its PRODA device, and GPMS (including My Aged Care referrals) through its machine credential.
- From rostering, payroll or other systems a subscriber connects.
- From your browser, on this website, through cookies you accept.
Why we use it
- To provide the service: sign you in, run the products and do what the subscriber asks, including lodging reports with government services.
- To bill the subscription and keep the records tax law requires.
- To support you, and to tell you about the service, changes to it and to these documents.
- To keep the service secure: detecting misuse, keeping audit trails and investigating incidents.
- To understand how the website is used, if you allow it.
- To meet our legal obligations.
We do not sell personal information. We do not use workspace data for marketing. We send marketing email only to people who have agreed to it, and every message lets you unsubscribe.
Who we share it with
- Sub-processors who help us run the service, under contracts that limit what they may do with it. They are listed on the Sub-processors page.
- Government agencies, at the subscriber’s direction, when the service lodges a report or reads a record for them.
- Anyone the law requires, such as a regulator or a court.
Overseas disclosure
Workspace data is stored in Australia. Some of our sub-processors may handle information outside Australia:
- Stripe processes billing details and payments in the United States and other countries.
- Microsoft Azure AI Foundry, used only by Code Captain, may process the redacted document text it codes in Azure regions outside Australia, including the United States.
- Postmark sends some of the service’s emails (sign-up links, invitations, sign-in codes) from the United States, so it handles the recipient’s name and email address.
- Google runs Google Analytics (only if you accept it), YouTube (only when you play a video) and the fonts this website uses, from servers in the United States and elsewhere.
- Formspree receives the developer guide request form, in the United States.
Storage and security
The service runs in Microsoft Azure in Australia. Each workspace is kept apart from every other by row-level security in the database itself. Information is encrypted in transit and at rest, and access to it is logged. Our Trust and security page has more detail.
How long we keep it
- Personal details in a workspace are removed every night once they are older than the period the subscriber chooses: 1 day (the default), 7 days or 30 days. Details already lodged with GPMS or exported go at the next night’s purge. What a workspace is set up with, and totals that name nobody, are kept.
- A closed workspace is kept for 90 days after access ends, so it can be reopened or exported on request, and then deleted.
- Audit trails recording who did what are append-only and kept as the subscriber’s obligations require.
- Account and billing records are kept for as long as tax and corporations law requires.
- Backups are kept for 35 days and then overwritten.
Access and correction
You can ask for the personal information we hold about you, and ask us to correct it, by emailing privacy@healthos.net.au. We will confirm who you are, and respond within 30 days. Most account details can be changed in the service yourself. For information in a provider’s workspace, ask the provider; we will help them.
Complaints
If you think we have mishandled your personal information, email privacy@healthos.net.au. We will look into it and reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Data breaches
If a breach is likely to cause serious harm, we will tell the affected subscribers promptly and help them notify the people involved and the Commissioner under the Notifiable Data Breaches scheme. Where the information is ours, we notify directly.
Changes and contact
We will publish any change here with a new version date. Contact our privacy officer at privacy@healthos.net.au.