Privacy policy

The short version

• Your data is stored in Sydney, Australia.
• Information about your clients belongs to you. We only use it to run Suvi for you.
• We never sell information, never show ads, never use your clients' information to train AI, and never contact your clients.
• Some services we rely on are run by companies in the United States. They are listed below.
• You can export your information at any time, including before you leave.
• If something goes wrong with your data, we will tell you quickly.

Who we are

Suvi is run by [to confirm: business name and ABN of whoever runs Suvi], based in Cairns, Queensland. In this policy, "we" and "us" means that business, and "you" means a person who has a Suvi account.

Contact us about privacy at [to confirm: contact email].

Two kinds of information

Suvi holds two different kinds of personal information, and we treat them differently.

Account information

Information about you as a Suvi user: your name, email, business details and how you use Suvi. We decide how this is used, as set out in this policy.

Client information

Information you enter about the people you support: their names, contact details, NDIS details, shifts and shift notes. You are responsible for this information and decide what goes in. We hold it on your behalf and only use it to provide Suvi to you, following your instructions. Our terms set out our promises about it.

What we collect

About you

• Your name and email address, used to sign in. Your password is stored only in scrambled (hashed) form, so we can't see it. If you turn on two-step sign-in, we keep the secret that links your authenticator app.
• If you sign in with Google or Microsoft: your name, email address and account ID from them. We don't get your password or access to your other Google or Microsoft data.
• If you join the waitlist: your email address and when you joined. We use it only to tell you about testing Suvi.
• When you join the waitlist or enter an invite code, a scrambled form of your IP address that can't be turned back into the address, to stop the forms being misused. It's deleted after a day.
• The devices you're signed in on (browser type and IP address), so you can see and sign them out.
• Your business details for invoices: business name, ABN, address, phone, GST registration, bank details for receiving payment, invoice numbering and payment terms.
• Your settings, such as your own service types and rates, and your payment reminder schedule.
• Checks and certificates you choose to add (for example worker screening, blue card, first aid and insurance), their numbers and expiry dates, and copies you upload. Copies are stored privately and only you can open them.
• Records of what happens in your account, such as when invoices were issued, sent or paid.
• Technical information: your device's IP address, browser type and error logs, kept by our hosting providers for security and fixing problems.
• From when paid plans start: billing details, handled by Stripe. We don't store full card numbers.

About your clients (entered by you, or by them through a setup link you send)

• Name, address, and contact details for the person and anyone who receives their invoices (for example a plan manager, family member or agency).
• Date of birth, key contacts (such as an emergency contact, guardian or support coordinator), plan dates and goals.
• NDIS participant number, funding type, service agreement details and agreed rates.
• "Important to know" notes, which can include health and disability information such as allergies, medication or access needs.
• Shift dates, times, locations and travel.
• Shift notes, which can include health and disability information, such as how the person was, support provided, or incidents. The law treats this as sensitive information and we protect it accordingly.
• Invoices and payments, and when an online invoice link was opened.
• Service agreements and their signatures: the signer's name, who they signed as, their drawn signature if they add one, an email address if they ask for a copy, and the time, IP address and device used to sign, kept as evidence of the signature.

Only enter what you need to run your business and meet your record-keeping duties.

How we collect it

Directly from you when you sign up and use Suvi. Client information is collected from you. If you send a client a setup link, the client (or someone helping them) fills in their own details, which go only to you; they must agree before sending, and nothing is added to your client records until you check and save it. Otherwise we don't contact your clients. Technical information is collected automatically when you use the app.

Why we use it, and what we never do

We use information to:

• provide Suvi: sign you in, store your records, calculate prices, produce and send invoices and notes when you ask
• keep Suvi secure, prevent misuse and fix problems
• contact you about your account, changes to Suvi or these policies
• charge for subscriptions, once paid plans start
• improve Suvi using information about how features are used, without looking at the content of your client records
• meet our legal obligations

We will never:

• sell or rent personal information
• use client information for advertising or marketing, or contact your clients
• use client information to train artificial intelligence models
• look at your client records, except when you ask us to help with a problem, to keep Suvi secure, or when the law requires it

If you don't give us the information needed for an account, we can't provide Suvi to you.

Who we share it with

We use these service providers to run Suvi. They handle information only to provide their service to us, under agreements that require them to protect it.

We will update this list before adding a provider that handles client information, and tell account holders by email.

Information also goes to people you choose to send it to, such as when you send an invoice to a plan manager. We may also disclose information if the law requires it (for example a court order), or to protect someone's safety.

Information sent overseas

Your records are stored in Sydney. Some providers above are companies based in the United States, and some information may be handled there:

• Resend sends sign-in emails from the United States, so your email address passes through it. Sign-in emails contain no client information.
• Vercel runs the app in Sydney, but Vercel staff and some of its systems are in the United States, and pages are delivered through a worldwide network.
• Stripe may process billing information in the United States, once paid plans start.

Before using these providers we check that their agreements require them to protect information to a standard comparable to Australian law.

How we protect it

• Information is encrypted when it travels over the internet and when it is stored.
• Each account can only reach its own records. This is enforced by the database itself, not just the app.
• Passwords are stored only in scrambled (hashed) form. You can turn on two-step sign-in with an authenticator app, and a code or link sent to your email is never enough on its own to reach your records.
• Access to systems is limited to the people who run Suvi, and only for the reasons in this policy.
• From when paid plans start, the database is backed up daily. During testing it is not, so keep your own copies of anything important.

Use a password you don't use anywhere else and turn on two-step sign-in in Settings. Protect your email account the same way, because password resets go to it.

How long we keep it

• We keep your information while your account is open.
• If you're only on the waitlist, we keep your email address until you ask us to remove it.
• If you close your account, you have 90 days to export your records. After that we delete them, and they leave our backups within a further 30 days.
• Shift notes keep every version when edited. That history is part of the record and is kept while your account is open.
• We keep records about you (such as subscription invoices) for as long as tax law requires, usually 5 years.

Seeing and correcting information

You can see and correct most of your account information yourself in Suvi. To ask for a copy of what we hold about you, or to correct it, contact us at [to confirm: contact email]. We will respond within 30 days and won't charge for the request.

If you are a client of someone who uses Suvi, please ask your support worker or provider first, because they control your records. If you contact us, we will pass your request to them and help them respond.

If you use Suvi for your clients

Most support workers and youth workers must follow privacy law for their clients' information, whatever the size of their business, because disability support counts as a health service under the Privacy Act. In Victoria, the Health Records Act 2001 also applies. So when you use Suvi, you need to:

• tell your clients what information you keep, why, and that you use software stored in Australia with some providers overseas (you can use the notice below)
• get your clients' consent before recording health or disability information
• only record what you need, and keep it accurate
• keep NDIS records for 7 years and tax records for 5 years

If something goes wrong

If we become aware that information in Suvi may have been accessed or lost without authorisation, we will:

• act straight away to contain it
• tell affected account holders within 72 hours, with what we know and what to do next, so you can meet your own obligations to your clients
• notify the Office of the Australian Information Commissioner and affected people where the Notifiable Data Breaches scheme requires it

Emails from us

We send emails you need, like sign-in codes and important account notices. With your permission, we may also send occasional news about Suvi. Every news email has an unsubscribe link, and we act on unsubscribes within 5 working days. We never send marketing to your clients or to anyone you send invoices to, and Suvi adds no advertising to invoices you send.

When you choose to, Suvi emails your invoices, payment reminders and service agreements for you, from your business name "via Suvi", with replies going to you. Payment reminders only go out for invoices you email from Suvi, follow the schedule you set, and stop when an invoice is marked paid or you pause them. We also email you reminders before your checks and certificates expire.

Cookies

Suvi uses only the cookies it needs to work: one to keep you signed in, one to remember your light or dark appearance setting, and while Suvi is invite-only, one to remember the invite code you entered until you create your account. We don't use advertising or tracking cookies.

Automated calculations

Suvi works out suggested NDIS support items and prices from the shift details you enter, using the published NDIS Pricing Arrangements. These are suggestions for you to check: you decide what goes on each invoice. Suvi doesn't make decisions about you or your clients that affect their rights, such as eligibility or funding.

During testing

Suvi is in testing with invited users. While it is, please enter made-up client details rather than real clients' information. Testing data may be cleared without notice.

Questions and complaints

Contact us at [to confirm: contact email]. We will acknowledge your complaint within 5 working days and aim to resolve it within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, phone 1300 363 992. In Victoria, health information complaints can also go to the Health Complaints Commissioner: hcc.vic.gov.au.

Changes to this policy

We will post any changes here with a new date. If a change matters to how your information is handled, we will email account holders at least 30 days before it takes effect.

A notice you can give your clients

You can copy this into your service agreement or give it to clients. Change the details in brackets.