Privacy Policy

1. About this policy

Carevo is operated by Carevo Pty Ltd (ABN 69 696 950 919) ("Carevo", "we", "us"). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Carevo is a connection platform. We connect people seeking aged care and disability support with providers who may be able to help. We do not deliver care. When you make an enquiry, the central thing we do with your information is pass it to providers so they can contact you. Section 6 explains exactly how that works, because it is the most important thing to understand about using Carevo.

This policy covers carevo.com.au, app.carevo.com.au, and our phone and email channels. It does not cover how a provider handles your information once we pass it to them. Each provider is a separate organisation with its own privacy obligations and its own policy.

2. Information we collect

2.1 Personal information

Name, email address, phone number and postcode or suburb
Your relationship to the person needing support (for example, yourself, a parent, a client)
Enquiry content, including anything you type into a form or say on a call
Correspondence with us, including call recordings where we tell you a call is recorded
Account details if you register, including for providers: business name, ABN, and contact details

2.2 Sensitive information

Some of what we collect is sensitive information under the Privacy Act, which carries a higher standard of protection than ordinary personal information. This includes:

Health information, such as a condition, diagnosis, or the type of clinical support needed
Disability information, including support needs and functional requirements
NDIS information, including participant status, plan management type (self-managed, plan-managed or NDIA-managed), funding category and plan dates
Aged care information, including assessment status and Support at Home classification
Where you volunteer it: cultural background, language, religious requirements, or Aboriginal and Torres Strait Islander status, which we use only to match you with providers who can meet those needs

We collect sensitive information only with your consent and only where it is reasonably necessary to connect you with suitable providers. You can use Carevo without disclosing a diagnosis; the more you tell us, the more specific the match, and that trade-off is yours to make.

2.3 Technical information

IP address, device type, browser, operating system and approximate location derived from IP
Pages viewed, referring site, and interactions with the site
Cookies and similar technologies (see section 10)

3. How we collect it

Directly from you through enquiry forms, the Funding Pathway Guide, our tools and calculators, phone calls, email and SMS
Through lead forms on Facebook and Instagram, when you send a request from one of our ads. Meta passes us what you entered, plus a reference for the form and ad you used. Meta also keeps its own copy under Meta's privacy policy
Automatically through cookies and analytics when you use the site
From providers, where a provider tells us about the outcome of an enquiry you made
From public registers, for provider information only: the Australian Business Register, the NDIS Quality and Safeguards Commission register, and the Aged Care Quality and Safety Commission register
From a person acting for you, such as a family member, carer, support coordinator or hospital discharge planner. If someone makes an enquiry on your behalf, we rely on them having your authority to do so

4. Consent, and how to withdraw it

By submitting an enquiry you consent to us collecting the information you provide, including sensitive information, and disclosing it to providers as described in section 6.

You can withdraw consent at any time by contacting our Privacy Officer. Withdrawing consent stops future disclosure; it cannot recall information already sent to a provider, because that provider then holds it under its own obligations. If you withdraw consent we may be unable to continue connecting you with providers.

You can also manage marketing contact without withdrawing consent entirely, using the preference centre linked from any email we send, which lets you pause contact or limit how often you hear from us.

5. How we use your information

To match your enquiry to providers and pass it to them
To contact you about your enquiry by phone, email or SMS
To follow up on how an enquiry went, including asking for feedback about a provider
To operate, secure and improve the platform
To produce aggregated, de-identified statistics about demand and provider coverage. These are published on the site and cannot identify you
To meet legal obligations and respond to lawful requests

We do not sell your personal information.

6. Sharing your enquiry with providers

This is the core function of Carevo, so we set it out plainly.

What we send. When you submit an enquiry we disclose to matched providers: your name, contact details, suburb or postcode, and the details of your enquiry, including any health, disability, NDIS or aged care information you provided.

Who receives it. Providers whose registered service categories, funding types and service areas match your enquiry. More than one provider will normally receive it, so you can compare. We release enquiries in waves rather than to every provider at once, to limit how many organisations hold your details.

What providers may do with it. Contact you about your enquiry. Each provider is an independent organisation and handles your information under its own privacy policy and its own obligations under the Privacy Act. We require providers to use enquiry details only to respond to you, but once disclosed we do not control their systems.

Your control. You may ask us to limit which providers receive an enquiry, or to stop distributing it, by contacting us before or after you submit. You may also ask any provider directly to delete your details.

7. Automated processing and artificial intelligence

We use automated systems, including artificial intelligence, to operate the platform. Specifically:

Classifying enquiries. AI reads the text of your enquiry to identify the services requested, funding type and urgency, so it can be routed to relevant providers.
Matching and ranking. Automated scoring orders the providers shown on our pages, using signals including a provider's record of serving similar enquiries, their service area, registration status and response speed. Our ranking methodology is published separately.

This involves processing sensitive information by automated means. Enquiry text you provide, which may include health and disability details, is processed by these systems.

No solely automated decisions with legal effect. Nothing in this process decides your eligibility for the NDIS, Support at Home, or any government programme. Only the NDIA, Services Australia and My Aged Care make those decisions. Our tools, including the Funding Pathway Guide, are general guidance and do not assess eligibility.

Human involvement. Our team reviews enquiries and assists with matching. You can ask to deal with a person instead of an automated process at any time by calling us.

8. Service providers who process data for us

We use third parties to run the platform. They may access personal information only to perform their function for us:

Hosting and infrastructure — Cloudflare (content delivery, storage, bot protection), Amazon Web Services, MongoDB Atlas (database)
Product analytics — PostHog
Session analytics — Microsoft Clarity
Advertising and measurement — Meta (Facebook) and Google, via tags on our site. For requests made through a Meta lead form, we also tell Meta when the request was sent to providers, when a provider responded, and when you were connected. We identify the request only by Meta's own lead reference and send no details of your request
Communications — email and SMS delivery services, and telephony providers for our phone line
Artificial intelligence — AI providers used for the enquiry classification described in section 7

9. Overseas disclosure

Some of the providers listed in section 8 store or process data outside Australia, principally in the United States, and in some cases in the European Union or Singapore depending on the service and its routing.

Under APP 8 we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles, through contractual terms with each provider. You should be aware that overseas recipients are subject to the laws of their own jurisdiction, and those laws may permit access by foreign authorities in ways Australian law would not.

Care providers we connect you with are Australian organisations and receive your enquiry in Australia.

10. Cookies, analytics and session recording

We use cookies and similar technologies for essential site function, analytics and advertising measurement.

Session recording. Microsoft Clarity records how visitors interact with our pages, including mouse movement, scrolling and clicks, to help us find usability problems. These recordings can capture what you type into forms. We configure Clarity to mask form input, but you should not enter information into a form that you would not want captured for this purpose.

Advertising. Meta and Google tags let us measure advertising and reach people who have visited our site. These tags share limited event data with those companies.

Your choices. You can block or delete cookies in your browser, which may affect site function. You can opt out of Clarity recording and advertising measurement using your browser's Global Privacy Control or Do Not Track signal, which we honour where the browser sends it, and through Meta's and Google's own ad settings.

11. How long we keep your information

We keep personal information only as long as we need it, then delete or de-identify it.

Enquiry records, including sensitive information — 7 years from your last interaction, so we can respond to disputes and meet record-keeping obligations
Call recordings — 12 months
Marketing contact details — until you unsubscribe, then up to 12 months to honour the unsubscribe
Analytics data — up to 26 months, in a form that does not directly identify you
Provider account records — for the life of the account and 7 years after closure
Aggregated, de-identified statistics — indefinitely, as they cannot identify you

Where we are required by law to keep information longer, we do.

12. Access, correction and deletion

You may ask us to:

Access the personal information we hold about you
Correct anything inaccurate, out of date or incomplete
Delete your information, where we are not required to keep it
Tell you which providers received a particular enquiry

Contact our Privacy Officer using the details below. We will verify your identity before acting, and respond within 30 days. Access is free; if a request requires substantial work we will tell you any charge before proceeding. If we refuse access or correction we will explain why in writing and tell you how to complain.

Deleting information we already disclosed to a provider requires a request to that provider as well, since they hold their own copy. We will tell you who to contact.

13. Data security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include encryption in transit, access controls limiting staff access to what their role requires, and monitoring.

No system is completely secure. If an eligible data breach occurs we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

14. Complaints

If you think we have breached the Australian Privacy Principles, contact our Privacy Officer using the details below. Tell us what happened and how you would like it resolved. We will acknowledge within 5 business days and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992.

Complaints about a care provider's conduct are handled by the NDIS Quality and Safeguards Commission (1800 035 544) or the Aged Care Quality and Safety Commission (1800 951 822).

15. Changes to this policy

We may update this policy to reflect changes in how we operate or in the law. The effective date at the top of this page changes only when the text changes. Where a change materially affects how we handle your information, we will take reasonable steps to notify you before it takes effect.