Skip to content
Beta — early access. Founder self-certified for lean pilots (D19). Not solicitor-reviewed. Production generative AI uses Google Vertex AI in australia-southeast1 under Paid / no-train terms. Soft/dummy data and allowlisted beta providers only until you accept residual risk for real participant data.

Privacy Notice & Consent — AI tools

Version beta-1.0 · Effective 2026-07-19 · Beta — early access

For provider organisations. Org admins accept this notice in Admin → Settings before real participant data is entered.

1. Why this notice exists

Caira uses artificial intelligence and third-party infrastructure to help draft notes, summarise meetings, and run the product. Some of that processing involves sensitive information (including health and support details about NDIS participants) and some tools may process information outside Australia. Under Australian Privacy Principle 8.2, disclosures of sensitive information overseas generally need express informed consent.

By accepting this notice for your organisation, you confirm you understand these practices and will obtain any participant / nominee consents your organisation needs before using the features described.

2. What AI does in Caira

  • Text assistance: drafting progress notes, clarifying questions, and related documentation. Free-text is scrubbed of identifiers before it is sent to the model where supported — scrubbing reduces risk; it is not a guarantee.
  • Meeting recordings: when Meetings is enabled, raw audio is sent to Google Vertex AI (Gemini) in australia-southeast1 (Sydney) for transcription. Audio cannot be scrubbed first. Every person present must consent in-product before recording starts. Summaries use a scrubbed transcript afterward.
  • Images (if enabled): medication / odometer checks may send photos after on-device face blur; pill appearance and dashboard digits remain visible to the model.
  • AI output is assistance only. Humans must review and confirm records. Caira does not make clinical, funding, or NDIS Commission decisions.

3. Where processing happens

  • Primary care records: production Supabase on AWS Sydney (ap-southeast-2). Staging may use other regions — dummy / allowlist only.
  • Production generative AI: Google Vertex AI Paid in Sydney under no-customer-content-training terms (when configured).
  • May be outside Australia: PostHog analytics (default US host, consent-gated, non-essential), Stripe billing, Sentry error monitoring, Resend email, Vercel edge, Upstash counters, and Gemini Developer API if used for local/dev only.

Full sub-processor list: Data Processing Agreement.

4. What you agree as the Provider

  • You have authority to accept this notice for your organisation.
  • You will obtain express informed consent (APP 8.2 where required) from participants or their nominees before using AI features that may process their sensitive information overseas or via unscrubbed audio/OCR.
  • You remain the APP entity / controller for participant care records; Caira processes that data on your instructions (see Privacy Policy and DPA).
  • You will not enter real participant data until your organisation has accepted Privacy, Terms, DPA, and this AI notice in Admin Settings.

5. Related documents

Privacy Policy · Terms of Service · Data Processing Agreement