Privacy Policy

Last updated: June 2026

AcornSoftware Pty Ltd (ABN 52 686 441 449) ("Acorn Software", "we", "us") respects your privacy and is committed to protecting your personal information. This policy explains how we collect, use, disclose and protect information in connection with the Acorn Carelink mobile app and the Acorn Software provider platform (together, "the Services"), in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who this policy applies to

This policy applies to care workers ("suppliers") using the Acorn Carelink mobile app to record their in-home care visits, and to staff and administrators of aged-care providers using the Acorn Software provider platform.

The care recipients themselves ("clients") do not use the mobile app directly. Any personal information about clients is entered by their care provider and remains the responsibility of that provider under the Australian Privacy Principles.

2. Information we collect

Account information

When your care provider issues you a login, we hold your given name, family name, work email address, work mobile number and a supplier ID unique to your provider. Passwords are stored as one-way cryptographic hashes and are never visible to us.

Location data

The mobile app collects your device's precise GPS location only when you tap "Check in", "Check out" or "Confirm arrival" on a job. This is used to verify you were physically at the client's home, which is required for Support at Home compliance and payroll accuracy.

We do not track your location in the background, between visits, or when the app is closed.

Voice recordings

When you use the microphone button to dictate visit notes or missed-break explanations, the audio is captured on your device, transcribed to text via OpenAI's speech-to-text service, and then discarded. Only the resulting text is stored on our servers as part of your visit record. The original audio is never persisted.

Photos

Photos you attach to a visit (e.g. property condition, care delivery evidence) are stored securely alongside that visit's record. Photos are only visible to authorised staff at your care provider.

Visit and care data

We store the details of scheduled visits, breaks, check-in and check-out times, care notes, signatures, adverse incident reports and any other information you enter through the app in the course of your work.

Device and diagnostic information

We collect basic technical information about your device (operating system, app version) and diagnostic events (crash reports, error logs) to help us diagnose and fix issues. This data does not identify you personally.

3. How we use your information

We use the information we collect to:

• Authenticate you when you log in to the app.
• Provide your scheduled jobs and breaks each day.
• Record and prove your attendance at care visits.
• Deliver your notes, photos and reports to your care provider.
• Enable your care provider to meet their Support at Home compliance obligations.
• Detect and prevent fraud, error and unauthorised access.
• Fix bugs and improve the Services.

We do not use your data for advertising, profiling, or sale to third parties.

4. Who we share your information with

Your information is shared only with:

• Your care provider (agency) — they are the primary controller of the data you enter and can access it through the Acorn Software provider platform.
• Sub-processors that we use to run the Services — currently Microsoft Azure (data hosting, Australia East region) and OpenAI (transient speech-to-text transcription only, no data retained by OpenAI for training).
• Australian government agencies or regulators where we are legally required to disclose information, including for Support at Home compliance audits.

We do not sell your personal information to any third party, ever.

5. Where your data is stored

All persistent data is stored in Microsoft Azure data centres located in Australia (Australia East region). Your data does not leave Australia except for the transient speech-to-text transcription described above.

6. Security

We protect your information with:

• Encrypted transport (HTTPS/TLS 1.2+) for all communication between the app and our servers.
• Encrypted storage of data at rest in Azure SQL Database.
• Password hashing using industry-standard algorithms.
• Role-based access controls limiting which staff can see which records.
• Multi-factor authentication for administrative access to the platform.
• Regular security patching of servers and dependencies.

No system is completely secure, but we take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, modification or disclosure.

7. How long we keep your data

Care visit records must be retained for at least seven (7) years under Australian aged-care regulations. When you leave a care provider, your login is deactivated but visit records you contributed to are retained by that provider for the mandatory retention period.

Diagnostic logs are retained for no more than 90 days.

8. Your rights

Under the Australian Privacy Principles, you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete your account (see below).
• Make a complaint about how we've handled your information.

To exercise any of these rights, email AcornSoftware@proton.me with the subject line "Privacy enquiry".

Account deletion

You may request deletion of your login at any time by tapping Profile → Delete My Account in the Acorn Carelink app, or by contacting us at the email address above. Deleting your login removes your ability to sign in and disassociates future activity from you. Visit records you contributed to during your engagement with a provider will be retained by that provider under the seven-year aged-care record-keeping obligation.

9. Children

The Services are intended solely for use by adult care workers and adult provider staff. We do not knowingly collect information from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll change the "Last updated" date at the top and, for material changes, notify you inside the app or by email.

11. Complaints

If you believe we've breached the Australian Privacy Principles and are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

www.oaic.gov.au  · 1300 363 992

12. How to contact us

For any privacy question or request: