Privacy Act Information

Participant information is sensitive. This page explains what we can state about how Provider Shield handles it. It is not legal advice.

The Privacy Act 1988

The Privacy Act 1988 and the Australian Privacy Principles (APPs) set rules for how many Australian organisations handle personal information. Providers remain responsible for their own obligations under the Act and for how they use Provider Shield. For guidance, see the Office of the Australian Information Commissioner (OAIC).

What we can state today

• The site is served over HTTPS with HTTP Strict Transport Security (HSTS), so data is encrypted in transit.
• Participant records and notes require sign-in and are scoped to your account.
• Provider Shield uses Australian-region infrastructure for sensitive AI inference, document storage, database hosting and application compute. This covers participant documentation, progress notes, uploaded service records and the AI processing of them (Microsoft Azure OpenAI and Azure Blob Storage in Australia East, Neon database in Sydney, application servers in Sydney). Provider-operated safeguards such as Microsoft's service abuse monitoring and database backups are governed by those providers' terms.
• Specialist providers for payments, sign-in and account email may operate outside Australia and handle account, authentication and billing information only. Optional analytics run on public marketing pages only.

We do not currently publish statements about how long data is retained or about encryption at rest. If you need these details, please contact us before you sign up.

Data breaches

Organisations covered by the Notifiable Data Breaches scheme must notify affected individuals and the OAIC when an eligible data breach is likely to result in serious harm. See the OAIC website for details of how the scheme applies to you.