Privacy, collection and retention

We handle your email address, authentication identity, account role and session information to sign you in, protect access and maintain your Points balance. Email/password authentication is handled by Supabase. If you choose Google sign-in, Google shares the basic profile and verified identity permitted by that sign-in; we do not request access to your Gmail messages, Drive files or contacts.

Necessary session cookies keep you signed in. Hosting and authentication services process technical information such as requests, IP addresses and security events. Page analytics and operational records help us diagnose failures and understand use. Our application analytics strip unapproved query parameters; AI input and output are not intentionally included in analytics events. Authentication emails require your address and verification or recovery links to be handled by the configured email service.

Opening a supported DOCX file for basic checks reads its contents in your browser. Basic checks alone do not upload the document, call AI or save it to your account. Unsaved work in the page is lost when you leave or refresh; keep your original file.

When you choose to save template history, extracted source text, your working document and any included report and review decisions are sent to our service and saved under your account. This saved content is separate from the original DOCX file on your device.

When you explicitly submit an AI review, the reviewed structured fields and relevant template context are sent through our service to OpenAI. The original DOCX file is not sent to OpenAI. Remove identifying details and review what you submit before either saving history or requesting AI review.

Opening the composer does not call OpenAI. Input review and the privacy preview run in the browser. After you confirm your authority and submit, our server validates the facts and requests a draft. Automated checks cannot guarantee anonymity or detect every sensitive detail.

When you submit, CaresLink sends your reviewed facts to OpenAI to generate a draft. Processing may take place outside Australia. API data is not used for model training by default; abuse-monitoring logs may retain inputs and outputs for up to 30 days by default. Saved drafts are stored in our Sydney database.

Our generation requests use store:false; this does not guarantee zero retention by OpenAI or remove its applicable security and legal retention obligations.

We use Supabase for authentication and the Sydney database, Vercel for the website and application hosting, Google when you choose Google sign-in, and OpenAI when you submit an AI request. Providers receive information needed for these functions. Hosting in Sydney does not mean every part of authentication, email delivery, support, security logging or AI processing stays in Australia.

Information may be processed outside Australia, including in the United States, depending on the service and its infrastructure. The AI submission notice explains this before you proceed. Do not submit information unless you have the necessary authority for that handling.

Successful Communication Note drafts are automatically saved to your account and remain until you delete them. They do not expire after 30 days. Template history you manually save, including source text, reports and decisions, also remains until you delete it.

Temporary template AI results expire 30 days after successful generation. Expired results cannot be newly saved to history; cleanup removes their content. A separately saved history copy is not deleted by this expiry.

You can delete your own documents and template history in their workspaces. Account information remains while the account is active; contact us for account closure or other deletion requests. Points transactions, request identifiers and necessary security records may remain to reconcile usage, prevent duplicate charges and investigate abuse. Deleting a document does not reset Points or erase the usage ledger.

Deletion does not instantly erase backups, provider logs or copies already downloaded. Backup and service-provider retention can differ from the live application. Keep required official records in your authorised record system; CaresLink AI is not your sole record archive.

You can view, edit and export available documents in your account. For account information, access or correction requests, account closure or a privacy complaint, contact us using the email below. Include your account email and the type of request, but do not send passwords or identifiable care records.

We will check your identity where necessary, review the request and explain the outcome or any information needed to proceed. If a privacy concern remains unresolved, you can contact the relevant privacy regulator, including the Office of the Australian Information Commissioner where applicable. Material changes to this notice will be identified with an updated date and communicated through the service as appropriate.