Privacy Policy
1. Overview
Clio Care is documentation and practice management software for Australian NDIS support workers. It generates case notes with AI, and it also handles participant records, shifts, invoicing, expenses, service agreements, documents and reports. It also has a separate app for support coordinators and psychosocial recovery coaches, which writes case notes and drafts NDIA reports. We are committed to protecting your privacy and the privacy of the individuals you support. This policy explains how we collect, use, and protect information. We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).
2. Who We Are
Clio Care is operated by Clio Health Pty Ltd (ACN 695 627 199, ABN 29 695 627 199), based in Australia. Contact: hello@cliocare.com.au.
3. Information We Collect
We collect the information necessary to provide the service. It falls into the groups below.
About you. Your name, email address and account credentials. Business details you choose to enter for invoicing, including your ABN, business name, business address, business phone number, and the bank account details you want your invoices to display. Documents you upload about your own work, such as certifications and clearances, including their expiry dates.
About the people you support. Whatever you choose to record in a participant's profile. This can include their name, date of birth, age, address, NDIS number, diagnosis, medications, allergies, goals, communication needs, sensory needs, support strategies, behaviour support plan details, restrictive practices, plan management type, and documents you upload such as NDIS plans and reports. It also includes your descriptions of support sessions, the notes and reports generated from them, photographs you attach, shifts you record, and invoices and expenses you create.
In the support coordinator app. Your name, email address, the organisation you coordinate for and your work phone number, which appear on your NDIA reports, and any note template you upload. About the people you support, whatever you record in their profile, including their plan dates, support level, goals and the people and providers involved in their supports, your descriptions of your work, the case notes written from them, and the NDIA reports drafted from those notes.
About other people connected to a participant. Contact details you record for guardians, emergency contacts, plan managers, support coordinators and medical contacts, and email addresses you save or send documents to.
About your use of the service. Messages you send to our in-app help assistant, records of documents sent and emails delivered, and general usage and analytics data that helps us improve the service.
Analytics and advertising measurement. Our website and app use Google Analytics and Google Ads conversion tracking. These collect an approximate location derived from your IP address, the pages and features you use, and identifiers set by Google in your browser or app. We use this to understand how the service is used and to measure which of our ads lead to sign-ups. This data is shared with Google for those purposes. It never includes your notes, your participants' information, or anything you enter about the people you support.
4. How We Use Your Information
We use your information to provide and operate the service, generate and store documentation on your behalf, produce and send the invoices, reports and agreements you create, improve the quality and reliability of the service, and communicate with you about your account and service updates. We do not use identifiable participant information for any purpose other than providing the service to you. We do not sell information to anyone. We never use your notes, your participants' information, or anything you enter about the people you support for advertising. We do use website and app usage data, as described in section 3, to measure which of our ads lead to sign-ups.
5. Sensitive Information
Much of what you record in Clio Care is sensitive information under the Privacy Act 1988, including health and disability information about the people you support.
We hold that information on your behalf so that you can do your job. We rely on you to have obtained the consent, or to otherwise have the authority, to record it and to provide it to us. We do not obtain that consent from participants ourselves, and we are not in a position to. See section 13.
6. Information We Collect Directly From Participants
In one situation we collect information directly rather than through you. When you send a service agreement for electronic signing, the participant or their representative receives an email with a secure link. If they sign, we record the name they enter, the date and time, and the fact that the link we sent was used. We hold that record so that both you and they have evidence of the signing.
We tell them, at the point of signing, who we are, what we record and how to contact us. The agreement itself is between you and them. We are not a party to it.
7. Service Providers and Overseas Disclosure
We work with third-party service providers to operate the platform. These providers assist with hosting and database infrastructure, AI processing, maps and address lookups, payment processing, email delivery and analytics. We require our service providers to handle information in accordance with the Australian Privacy Principles and applicable data protection standards, under written agreements. We do not sell your information to third parties.
Some of these providers are located outside Australia, principally in the United States. Where information is disclosed to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. Section 8 describes the most significant of these disclosures.
If you need to know the identity of a specific provider for your own compliance or informed-consent purposes, email us and we will tell you.
Addresses and travel (Google Maps)
Clio can work out the distance and driving time of the trips you make between shifts, so you can bill travel and keep a record of it. To do that, we use Google Maps, provided by Google, which processes information in the United States and other countries.
When you type into an address box that offers suggestions, what you type is sent to Google so it can suggest matching Australian addresses. When you pick one, Google returns the full address and an identifier for that place, which we save with the address. When you ask Clio to work out trips, the addresses (or place identifiers) at each end of each trip are sent to Google. These can be your usual place of work and the addresses of the participants you visited. At the same time, any participant address that has not been checked yet is sent to Google to find the one place it matches; when there is exactly one clear match, we save Google's full address and place identifier on that participant's profile. No names or other participant information are sent, and nothing is sent unless you type in an address box or ask for trips to be worked out.
We keep a record of each distance Google gives us for up to 30 days so the same trip is not looked up again. That record does not contain the addresses. Trips you choose to save are kept with your other records. "Check on Google Maps" links open Google Maps in your own browser or app, where Google's own privacy policy applies.
8. AI Processing and Automated Decisions
Clio uses AI to help with several tasks: writing case notes and reports from what you describe, suggesting improvements to your writing, reading receipts you photograph, setting up participant profiles from plan documents you upload, and answering questions in the in-app help and website chat. In the support coordinator app, it also drafts NDIA reports from your signed notes and reads a note template you upload. For each task, the information needed for that task is sent to Anthropic, the maker of Claude, for processing. Depending on the task, that can include the text you write, relevant participant profile information, or the document or image you upload. That processing takes place on servers located in the United States.
We have a data processing agreement in place with Anthropic. Under it, the information sent for processing is retained for no longer than 30 days and is then deleted, except where the provider is required to retain it by law. Your information is not used to train or improve AI models.
No other part of the service sends participant information overseas for AI processing. Your records themselves are stored in Australia, as described in section 9.
Automated decisions
Clio does not use automated processes to make decisions about you or about the participants you support. The AI prepares drafts and suggestions, such as a case note, a report, a flag for a possible reportable incident, or a suggested category for a receipt. You review each one and decide whether to use it, change it or discard it. A case note only becomes final when you sign it.
When Clio flags a possible reportable incident, it is prompting you to consider it. Whether an incident is reportable, and what action to take, is always your decision. Clio's AI is not used to decide anyone's eligibility, funding, supports, pricing or access to services.
9. Data Storage and Security
Your records and uploaded documents are stored on servers located in Australia. All data is protected by AES-256 encryption at rest, TLS encryption in transit, and access controls that restrict each account to its own data.
Two-factor authentication is available and we recommend turning it on. You can enable it from Settings.
10. Data Retention and Deletion
Your information is retained for as long as your account is active.
Clio Care stores the records you create and keeps them available to you. It is not a substitute for your provider's official record-keeping system, and if you are required to lodge documentation somewhere else, you should continue to do that.
You can delete your account yourself at any time. In the app, go to Settings, scroll to the bottom and choose Delete my account. You will be asked to type your email address to confirm. The deletion happens straight away and cannot be undone: your notes, reports, participant records, shifts, invoices, expenses, service agreements, documents and business details are removed, along with the files you have uploaded. If you subscribed on our website, your subscription is cancelled at the same time. If you subscribed through the App Store or Google Play, deleting your account does not cancel it. Cancel it in your App Store or Google Play account settings first, or you may continue to be charged.
If you cannot sign in, or you have already uninstalled the app, you can request deletion at cliocare.com.au/delete-account or by emailing hello@cliocare.com.au. We will delete your data within 30 days of the request.
After a deletion we keep a dated record that it took place, so we can confirm a request was honoured. It holds no name, no participant information and no content from your account. Your email address is stored only as a one-way fingerprint, which means we cannot read it, but if you contact us later we can check it against the address you give us and confirm the deletion and its date. We may also keep information where the law requires it, for example records related to payments.
If you shared a participant with other support workers, the participant record stays with the workers who remain, because it is information about the participant and is relied on by the people still supporting them. Everything you wrote is deleted.
11. Data Breaches
If we become aware of unauthorised access to or disclosure of personal information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Because much of the information we hold is about the people you support rather than about you, we will also tell you what has happened so that you can meet your own obligations.
12. Your Rights
Under the Australian Privacy Act, you have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact us at hello@cliocare.com.au. We will respond within 30 days. You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
If you are a participant, or someone acting for a participant, and you want to know what is held about you, contact the support worker or support coordinator who supports you in the first instance. The records are theirs and they can see, correct and delete them. You are also welcome to contact us and we will help.
13. Your Responsibilities
As the user of Clio Care, you are responsible for ensuring you have appropriate authority to record information about the people you support, and about anyone else connected to their supports, through this service. That includes telling them, where you are required to, that you use software to prepare your documentation and that it uses AI. This matters most in the support coordinator app, whose notes and reports carry no AI disclosure line.
You are also responsible for what you upload and who you send it to. Once an email has been sent from Clio Care on your behalf, we cannot recall it.
14. Changes
We may update this policy from time to time. Where a change materially affects your rights or how we handle information, we will tell you by email and in the app before it takes effect. Minor changes, such as corrections and clarifications, are made by updating the date at the top of this page. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.