Data Processing Addendum
Version 1.1 · effective 18 October 2026
Also read:Terms of ServicePrivacy PolicyAI and Acceptable Use Terms
Contents
This Data Processing Addendum ("DPA") forms part of the CareHelm Terms of Service between Data Nebula Pty Ltd (ABN 63 684 548 598) ("we", "us") and the Customer ("you"). Words defined in the Terms have the same meaning here. You accept this DPA when you accept the Terms.
1. Scope and roles
1.1 This DPA applies to personal information in Customer Data that we handle on your behalf when providing CareHelm ("Customer Personal Information"). Examples: your staff members' names, contact details, qualifications, screening check details and policy sign-off records, and the incident records you keep.
1.2 You decide what Customer Personal Information to put into the Service and why. We handle it only to provide the Service to you.
1.3 You are responsible for:
(a) having a lawful basis, and giving any notices or getting any consents needed, for the Customer Personal Information you upload;
(b) using participant codes in place of participant names where the Service allows it, and entering only the participant details your duties need, as set out in our AI and Acceptable Use Terms; and
(c) the accuracy of Customer Personal Information.
2. How we handle Customer Personal Information
2.1 We will:
(a) use Customer Personal Information only to provide, secure and support the Service for you, to follow your documented instructions (including instructions given through the Service's settings), or where the law requires;
(b) keep it out of any sale, out of our own marketing, and out of the training of generalised AI models;
(c) handle it consistently with the Australian Privacy Principles;
(d) make sure our personnel who can access it are bound by confidentiality and access it only when needed; and
(e) tell you if we believe an instruction from you would break the law.
3. Where data is stored, and sub-processors
3.1 Primary location. Customer Data is stored in Australia (Google Cloud, Sydney region, australia-southeast1).
3.2 Backups. We don't keep separate backups today. You can download a full copy of your Customer Data at any time (section 7.1). If we start keeping backups, we'll update this section to say where they are stored and how long they are kept.
3.3 Current sub-processors:
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Google Cloud / Firebase (Firestore, Cloud Storage, Cloud Functions) | Database, file storage, application servers | All Customer Data | Australia (Sydney) |
| Google Firebase Authentication | User sign-in and two-step verification | User email address, name (Google sign-in), password hash, IP address, device information, sign-in times | United States |
| Resend | Sending emails: invitations, staff sign links and codes, reminders | Recipient email address, email content (for example a reminder naming a certificate and its expiry date) | Japan (Tokyo) |
| AI services | Writing drafts and suggestions, reading uploaded documents and turning recordings into text, when a User uses a feature that does this. In the live service, only under terms that stop the provider from using the content to train its models | The content sent for the specific AI task, in full | Outside Australia |
| Stripe | Billing and payments, from when paid plans open | Billing contact and payment information (no staff data) | United States and other Stripe locations |
| Twilio | SMS codes and reminders. Not used today; used only if we turn SMS on | Recipient mobile number, message content | United States and other Twilio locations |
3.4 Changes. We'll give you at least 30 days' notice by email (and on this page) before adding or replacing a sub-processor that handles Customer Personal Information, or before we turn on one marked above as not used today. If you reasonably object on data protection grounds, tell us within that period. We'll try to address your concern; if we can't, you may cancel your subscription and we'll refund any prepaid fees for the period after cancellation.
3.5 Our responsibility. We choose sub-processors that provide data protection terms and security measures at least as protective as this DPA, and we remain responsible to you for their performance of our obligations.
3.6 Overseas transfers. Where Customer Personal Information is handled outside Australia (see the table above), we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles.
4. Security measures
We maintain reasonable technical and organisational measures, including:
| Area | Measures |
|---|---|
| Encryption | TLS in transit; encryption at rest (Google Cloud default) |
| Tenant isolation | Every record is tied to an organisation ID; database security rules block cross-organisation access; automated tests for these rules |
| Access control | Roles (Owner, Admin, Staff); least-privilege access; staff see only their own records and their organisation's name; two-step verification available for every account |
| Our personnel | Production access limited to authorised Data Nebula personnel and used only for support, maintenance or security |
| Logging | An audit log of changes and administrative actions in each organisation, kept for the life of the account; Google Cloud request and error logs, kept 30 days |
| Backups and recovery | No separate backups today. Customers can download a full copy of their data at any time |
| AI safeguards | Only the content the task needs is sent; every draft and suggestion stays marked as a draft until a person approves it; in the live service, AI services may not use the content to train their models. The test environment is for test data only and says so next to every AI draft |
| Deletion | Deletion with an audit trail during the subscription; permanent deletion after the export period (section 7) |
| Vulnerability management | Dependency updates and security patches applied promptly; automated tests before each release |
| Incident response | A written data breach response plan (section 5) |
We may update these measures as long as the overall level of protection doesn't decrease.
5. Data breaches
5.1 If we become aware of unauthorised access to, disclosure of, or loss of Customer Personal Information ("Security Incident"), we will:
(a) notify you without undue delay, and in any case within 72 hours after becoming aware, with the information we have at that time;
(b) give you further details as we learn them, including what happened, what information was involved, the likely consequences, and what we're doing about it;
(c) take reasonable steps to contain the incident and reduce harm; and
(d) cooperate with you so you can meet your own obligations, including any assessment or notification under the notifiable data breaches scheme.
5.2 Where the incident is an eligible data breach for which we're responsible for notifying, we'll assess it within 30 days at most and notify the OAIC and affected individuals as soon as practicable. We'll coordinate the wording and timing with you where reasonably possible, so affected people get one clear message.
5.3 Notifying you of a Security Incident is not an admission of fault.
6. Assistance and requests
6.1 If we receive a request from an individual to access or correct Customer Personal Information, we'll pass it to you promptly (unless the law requires otherwise) and help you respond. The Service lets you view and correct this information yourself.
6.2 If we receive a request from a regulator or law enforcement for Customer Personal Information, we'll tell you (unless the law prevents us) and disclose only what we're legally required to.
7. Return and deletion
7.1 During the subscription an Owner or Admin can download a full copy of your Customer Data at any time from Settings ("Download all your data"): records as CSV files, the files you uploaded and your published policies as PDF. You can also download your audit pack and policy documents at any time. If you can't get your export, email support@carehelm.com.au and we'll send a full copy within 10 business days.
7.2 After the subscription ends:
(a) your account stays read-only for 90 days so you can export Customer Data;
(b) after that, we delete Customer Data from live systems within 30 days, and from any backups we keep as they expire, within a further 35 days; and
(c) on written request, we'll confirm in writing that deletion is complete.
7.3 Early deletion. An Owner can ask us to delete Customer Data earlier. We'll ask you to confirm, because deletion can't be undone and you may have record-keeping obligations.
7.4 We may keep information we're legally required to keep (such as billing records), and de-identified aggregated data that doesn't identify you or any individual.
8. Audits and information
On reasonable request (no more than once a year, unless after a Security Incident), we'll answer a written security questionnaire about how we protect Customer Personal Information and give you a summary of our security measures and sub-processors' certifications.
9. Term and precedence
9.1 This DPA applies for as long as we handle Customer Personal Information.
9.2 If this DPA conflicts with the Terms regarding Customer Personal Information, this DPA applies.
9.3 The limits on liability in the Terms apply to this DPA.
Contact
Privacy and security: privacy@carehelm.com.au. Data Nebula Pty Ltd (ABN 63 684 548 598), Sydney NSW 2008. Support: support@carehelm.com.au