Privacy Policy

1. Who we are

CareLocate is an independent NDIS provider directory operated in Australia. We are not a disability service provider. We have no financial relationships with any provider listed on our platform.

This Privacy Policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What personal information we collect

The information we collect depends on how you use CareLocate.

Searchers and participants

• Name, email address, and phone number when you submit an enquiry to a provider
• Message content included in your enquiry
• Information you optionally provide about who needs support and your plan type
• Location data (suburb/postcode) when you use location-based search

Care matching (Find Care)

When you use our Find Care service to be matched with providers, we also collect the details you enter about the care you or the person you support needs — including care types, funding arrangements, frequency, urgency, location, and any notes you add. Some of this may be sensitive information (including health information) under the Privacy Act 1988 (Cth). We collect it only with your explicit consent, given at the time of submission, and we record the version and time of the consent you gave.

• Care details, funding type, frequency, urgency, and any free-text notes you provide
• Your name, email address, and phone number (your email is verified before your request is actioned)
• The suburb and postcode where care is needed

Providers

• Business name, ABN, NDIS registration number
• Contact name, email address, and phone number
• Business address and service areas
• Profile content you provide (description, photos, availability)
• Billing information for Pro subscriptions (processed by Stripe — we do not store card details)

All visitors

• IP address and browser type (collected automatically)
• Pages visited and search queries (analytics only, not linked to identity)

3. How we collect it

• Directly from you — when you submit an enquiry, submit a review, or claim and manage a provider profile
• From public sources — NDIS provider data from the NDIA's public register (name, registration number, service areas)
• Automatically — via cookies and analytics tools when you visit the site

4. How we use it

• To forward your enquiry to the provider you selected
• To send you a confirmation email when you submit an enquiry
• To allow providers to manage their profile and respond to enquiries
• To process Pro subscription payments
• To improve search relevance and site performance
• To detect and prevent fraud or abuse

We do not use your personal information for direct marketing without your explicit consent. We do not sell personal information to third parties.

5. Who we share it with

We share your personal information only in the following circumstances:

• The provider you contact — when you submit an enquiry to a specific provider, your name, contact details, and message are sent to that provider only. Your details are not shared with any other provider.
• Matched providers (Find Care) — when you use Find Care and verify your email, we may share your care request with more than one local provider we assess as a suitable match, so they can contact you about the support you need. We share your contact details only with providers matched to your request, and only with your explicit consent. See section 7 below.
• Stripe — for payment processing (Pro subscriptions). Stripe's privacy policy applies to payment data.
• Supabase — our database infrastructure provider. Data is stored in Australia where possible.
• Where required by law — if compelled by a court order or regulatory authority.

6. Enquiry data

When you submit an enquiry directly to a specific provider through CareLocate:

• Your enquiry details (name, email, phone, message) are sent to the provider you selected via email
• A copy is stored in our database for up to 12 months, after which it is deleted
• Your details are not shared with any other provider, advertiser, or third party
• We do not follow up on your behalf or contact you about the enquiry unless you ask us to

If instead you use our Find Care matching service, different handling applies — see section 7.

7. Care matching (Find Care)

Find Care is a service that connects you with local providers based on the care you need. It works differently from a direct enquiry, so please note:

• The care details you provide may include sensitive information (including health information). We collect and use it only with your explicit consent, and we record the version and time of that consent.
• We ask you to verify your email with a one-time code before your request is actioned. Unverified requests are not sent to any provider.
• Once verified, your request may be shared with more than one provider we assess as a suitable match, so they can contact you. It is not limited to a single provider.
• Providers receive the care details, funding, suburb and urgency first; your name and contact details are released to a provider so they can get in touch with you about your request.
• A copy of your request is stored in our database. You can withdraw it, or ask us to delete it, at any time by emailing privacy@carelocate.com.au.
• CareLocate remains independent — no provider pays to receive your request, and matches are based on your needs, not payment.

8. Reviews

When you submit a review on CareLocate:

• Your review is published with your first name and last initial only (e.g. "Sarah T.") — never your full name
• Your email address is collected for verification purposes and is never displayed publicly
• Reviews are moderated before publication
• Providers cannot delete or suppress reviews — only CareLocate can remove a review if it breaches our guidelines

9. Cookies and analytics

We use cookies and similar technologies to:

• Keep you logged in as a provider (session cookies)
• Understand how the site is used — pages visited, search terms, time on page (analytics)
• Improve search results and site performance

We do not use advertising cookies or sell analytics data. You can disable cookies in your browser settings, though some features (such as provider login) may not function correctly.

10. Data security

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, including:

• HTTPS encryption on all pages
• Access controls limiting who can access personal data
• Secure third-party infrastructure (Supabase, Stripe, Cloudflare)

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required under the Notifiable Data Breaches scheme.

11. Access and correction

You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or outdated information
• Request deletion of your personal information (subject to legal and operational requirements)

To make a request, email privacy@carelocate.com.au. We will respond within 30 days.

12. Complaints

If you believe we have mishandled your personal information, please contact us first at privacy@carelocate.com.au. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

13. Contact

For privacy-related enquiries, contact us at privacy@carelocate.com.au.