This policy explains how {{provider.name}} (ABN {{provider.abn}}), trading as iShapps (**we**, **us**), handles personal information. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

## Who we are and our two roles

iShapps is a workforce management platform for aged care and disability care agencies. We handle personal information in two different roles.

- **For the agencies that use iShapps.** Each agency (our customer) uses iShapps to manage its workers, client organisations, participants, shifts and compliance documents. The agency decides what information is collected and why, and we hold and process it on the agency's behalf, under our agreement with it. If you are a worker, a job applicant or a participant of an agency, that agency is your main point of contact about your information. Its own privacy policy also applies to you.
- **For our own business.** We also collect information for our own purposes, for example about the people who contact us, visit our website, start a trial, or manage an agency's account and billing with us.

## What we collect, how and why

| Who | Information | Why |
| --- | --- | --- |
| Workers and job applicants (for an agency) | Name, contact details, date of birth, address, profession and qualifications, CVs and job applications, identity documents, police checks, professional registrations (such as AHPRA), other compliance documents, bank account and superannuation details, availability, shifts and timesheets, location at clock-in and during shifts, and electronic signatures on contracts and policies with their signing records (time, IP address and device) | So the agency can recruit, check compliance, contract, roster, track attendance and pay its workers |
| Agency staff and administrators | Name, contact details, role, login and activity records | To give them access to the platform and keep it secure |
| Client organisations and facility contacts | Name, contact details and business details | So the agency can arrange and invoice shifts |
| Participants (people receiving care, for an agency) | Name, address, contact details, and progress notes that may include health information | So the agency can plan and record the care it provides |
| Our own contacts and customers | Name, business details, contact details, billing details, accepted order forms and correspondence | To sell, provide, support and bill for iShapps, and to tell customers about changes to it |
| Website visitors | Device, browser and usage information, through cookies and similar tools | To run and improve our website and keep it secure |

**Sensitive information.** Police checks and health information are sensitive information under the Privacy Act. We handle them only for the agency that collected them and only to provide iShapps to that agency.

**Location.** The iShapps app records a worker's location when they clock in, and may record it during a shift, so the agency can confirm attendance. It does not track location outside shift times.

**How we collect it.** Most information is entered by agencies or by the person themselves, through the iShapps web application, the mobile app or an agency's careers page. We also collect information automatically when people use iShapps or our website. Bank and superannuation details are checked against public directories (such as the BSB directory and the ATO's Super Fund Lookup) when they are saved.

If you don't provide information, the agency may not be able to offer you shifts, or we may not be able to provide our services.

We do not sell personal information, and we do not use agency data for marketing.

## Who we share it with

- The agency the information belongs to, and the people it authorises, such as its administrators and the client organisations it works with.
- Service providers who help us run iShapps, under contracts that require them to protect the information:

| Provider | Service |
| --- | --- |
| DigitalOcean | Application and database hosting |
| Amazon Web Services | File storage and backups |
| Cloudflare | Website and application delivery, and bot protection |
| SMTP2Go | Email delivery |
| OneSignal | Mobile push notifications |
| Google | Address lookup and maps |
| Mobile Message | SMS notifications, if the agency enables them |

- Others where the law requires or allows it, for example a court order or to prevent a serious threat to someone's safety.

**Overseas disclosure.** Our main hosting, files and backups stay in Australia. Some providers above may process limited information, such as names, contact details and notification content, in the United States or elsewhere. We take reasonable steps to make sure they handle it in line with the Australian Privacy Principles.

## How we protect it

- Each agency's data is kept in its own separate database and file storage area.
- Data is encrypted in transit and at rest.
- Access is limited by role, and our staff access agency data only to provide support or run the service.
- Databases are backed up daily, and each backup is kept for 7 days.

If a data breach is likely to cause serious harm, we will notify the affected agency without delay. Together with the agency, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

## How long we keep it

We keep agency data for as long as the agency uses iShapps. When an agency leaves, it has 30 days to export its data, and we then delete it within a further 60 days. Our own business records are kept for as long as we need them, including to meet tax and legal obligations, usually 7 years.

## Access, correction and complaints

**Access and correction.** You can ask to see the personal information held about you, or to correct it. If your information is held for an agency, please contact that agency first; we will help it respond. You can also update much of your own information in the iShapps app. For information we hold for our own business, contact us below. We will respond within 30 days.

**Complaints.** If you are concerned about how your information has been handled, contact us first. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner on 1300 363 992.

**Contact us.** Privacy Officer, {{provider.name}} (iShapps), {{provider.address}} · {{support.email}} · {{support.phone}}.

**Changes.** We may update this policy from time to time. The current version is always at {{legal.url}}, with its effective date.