Privacy
Privacy policy
We hold personal and sensitive information about people who receive support. Looking after it properly is the core of what we do, not an afterthought. This policy explains, in plain language, what we collect, why, how we protect it, and the choices you have.
Effective 8 October 2026.
This policy is a working draft. It will be reviewed by an Australian privacy lawyer before public launch and may change as a result.
01Who we are and what this covers
The Care Plan Company (we, us, our) is an Australian business based in Melbourne, Victoria. We help families, carers and support providers turn what they know about a person into a personalised, anonymous printed book and related products.
This policy applies to our website, the questionnaire, customer accounts, the books and products we produce, and our communications with you. It is written to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where we handle health information about Victorians we also have regard to the Health Records Act 2001 (Vic).
Two kinds of people are described in this policy: you, the person using the site or holding the account, and the person you care for, who the book is about. Where the person you care for can take part in decisions about their own information, we expect you to involve them.
02What we collect
About you (the account holder)
- Your name, email address and phone number.
- A delivery address for printed products.
- Your relationship to the person you care for (for example parent, sibling, support coordinator).
- Your orders, approvals, change requests and messages to us.
- Sign-in details. Passwords are never stored in readable form.
About the person you care for
The answers you give in the questionnaire. These may describe the person’s disability, communication, sensory needs, daily routine, food and drink, relationships, what helps when things are difficult, safety needs, goals and dreams. We ask for a first name so you can recognise the book in your account; it is never printed in the book and never shared with our writing tools or print partner.
We deliberately do not ask for medication names or doses, the person’s address, or formal diagnoses beyond what you choose to describe in your own words. Please do not include Medicare, NDIS or other identifying numbers in your answers.
Payment information
Payments are processed by a payment provider that is certified to the Payment Card Industry Data Security Standard. Your full card number never reaches our systems. We receive a confirmation of payment, the last four digits of the card and the card type so we can show you your order history.
Usage and device information
When you use the site we record the pages you view, how far you get through the questionnaire, the links you came from, your browser type, screen size and an approximate location derived from your IP address. We do this ourselves, on our own systems. We do not use third-party advertising trackers, and we never sell data.
Information from others
If a support provider or another family member starts a book and later invites you to an account, we will hold the information they entered as well as yours. If you contact us on social media or by email we keep that correspondence.
03Sensitive information and consent
Most of what you tell us about the person you care for is sensitive information under Australian privacy law, including health and disability information. We only collect it with consent and only for the purposes described in this policy.
By completing the questionnaire you confirm that:
- you are entitled to share this information about the person, as a parent, guardian, nominee, support provider or with the person's own agreement;
- where the person can participate in the decision, they have been told what the book is for and have had a say in what goes in it;
- you will tell us about anything the person would not want included, which we will leave out; and
- you understand the book is anonymous and written in the first person, and does not replace formal clinical or support plans.
You can withdraw consent at any time by asking us to delete the care profile. Withdrawing consent does not affect anything we did before you withdrew it, and we may still need to keep order and payment records for the period described below.
04How we use information
We use information for these purposes and no others:
- To make the products you order. Structuring your answers into a care profile, drafting and editing the book, checking it, producing proofs, printing and delivering it.
- To run your account. Keeping the care profile so it can be updated, showing your orders and proofs, and letting you approve or request changes.
- To support you. Answering questions, resolving problems and telling you about the status of an order.
- To keep the service safe. Detecting misuse, securing accounts and meeting legal obligations.
- To understand and improve the service. Using de-identified or aggregated information about how the site and questionnaire are used.
Where we use automated tools to help draft the text of a book, those tools only ever receive de-identified answers (see section 5) and we do not allow providers of those tools to use your information to train their models. A member of our team reviews every book before a proof is released.
05The anonymous book
The finished book never contains the person’s name, age, address or any identifying number. Each book carries the same neutral title. We built the service this way so a book left in a lounge room, a day program or a hospital bag does not expose the person it is about.
Before any proof or print file is created, the text is checked automatically and by a member of our team for names and identifying details. If something is found, the book is held until it is resolved. You are also responsible for checking the proof before you approve it.
08Overseas disclosure
Your information and the care profile are stored in Australia. Some of our service providers, such as the payment provider, email delivery service and any drafting tools, may process limited information on servers outside Australia, most likely in the United States. Where that happens we take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles, including contractual protections, and we send only what the provider needs for its task.
09How we keep information secure
- Everything is encrypted in transit (TLS) and at rest.
- Infrastructure is hosted on Amazon Web Services in Sydney with network controls, managed patching and automated backups.
- Access within The Care Plan Company is limited to staff who need it to produce and review your book. Staff accounts require two-factor authentication, and every staff action on a customer record is logged.
- Passwords are stored as salted one-way hashes. Session tokens and cookie values are stored as hashes only.
- Information about the person you care for is kept separate from the book text, and identifying details are removed before text reaches any drafting tool or print file.
- We keep the amount of information we collect to the minimum needed, and we delete what we no longer need.
No system is perfectly secure. You can help by using a strong, unique password, keeping your sign-in details private, and checking proofs carefully before approving them.
10How long we keep information
| Information | Kept for |
|---|---|
| Care profile, drafts and proofs | While your account is open, so the book can be updated and reprinted. Deleted within 30 days of you closing the account or asking us to delete the profile. |
| An unfinished questionnaire without an account | 90 days from your last activity, then deleted. |
| Print files sent to our print partner | Deleted by the print partner after fulfilment in line with their retention period; we keep the approved edition while your account is open. |
| Orders, invoices and payment records | Seven years, as required by Australian tax law. These do not contain the care profile. |
| Website usage analytics | Raw events for 24 months; aggregated statistics indefinitely. |
| Support correspondence | Three years from the last message. |
| Backups | Encrypted backups are retained for up to 35 days and then overwritten. Deleted data may remain in a backup for that period. |
11Access, correction and deletion
You can, at any time:
- view and update the care profile and your account details in your account;
- ask us for a copy of the personal information we hold about you or the person you care for;
- ask us to correct anything that is inaccurate, out of date or incomplete;
- ask us to delete a care profile, or close your account and delete everything in it; and
- ask us not to send marketing emails.
To make a request, use your account or email hello@thecareplancompany.com.au. We will confirm your identity before releasing or changing information, respond within 30 days, and will not charge for a reasonable request. If we cannot do what you ask (for example because we must keep a tax record) we will explain why.
The person you care for, or someone authorised to act for them, may also contact us directly about information that concerns them.
12Marketing communications
We send transactional emails about your orders, proofs and account. We will only send marketing emails, such as news about new products, if you have opted in, and every one includes an unsubscribe link. We comply with the Spam Act 2003 (Cth). We never use information about the person you care for to target marketing.
13Children and people who cannot consent for themselves
Many books are about children, or about adults who cannot give informed consent on their own. In those cases we rely on a parent, legal guardian, nominee or another person with lawful authority to provide information and consent on the person’s behalf, and to take their wishes into account as far as possible.
You must be at least 18 to open an account or place an order. We do not knowingly collect information directly from children. If you believe a child has provided information to us directly, please contact us and we will remove it.
14Data breaches
If a data breach is likely to result in serious harm to you or the person you care for, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, explain what happened, and tell you what we are doing and what you can do.
15Questions and complaints
Privacy questions, requests and complaints can be sent to hello@thecareplancompany.com.au or through the Contact page. A person, not a form, will reply. We aim to acknowledge complaints within five business days and resolve them within 30 days.
If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Victorians may also contact the Health Complaints Commissioner about health information.
16Changes to this policy
We may update this policy as the service and the law change. The effective date at the top tells you when it was last changed. If a change materially affects how we handle information about you or the person you care for, we will email account holders before it takes effect. Continuing to use the service after that date means you accept the updated policy.