Data Processing Addendum

Controller means the Provider organisation that determines the purpose and means of processing personal information entered into Caira. Processor means Edward Neppl (ABN 39 804 625 526), processing that information on the Controller’s documented instructions. Personal Information and Sensitive Information have the meanings given in the Privacy Act 1988 (Cth). Sub-processor means a third party engaged by Caira to process personal information as part of the service. Data Breach means an eligible data breach as defined by the Notifiable Data Breaches scheme.

For records the Provider enters or authorises (including participant health information), the Provider is the Controller and Caira is the Processor, acting only on the Provider’s documented instructions (these Terms, this Addendum, and in-product configuration). Where more than one Provider organisation holds records about the same participant, each Provider is an independent Controller for the entries its own workers make; Caira is Processor for each.

Caira processes personal information solely to provide, secure, support and improve Caira, for the duration of the Provider’s subscription, and for no other purpose.

• Process personal information only on the Controller’s documented instructions.
• Ensure personnel with access are bound by confidentiality obligations.
• Encrypt data at rest and in transit.
• Enforce tenant isolation at the database layer (row-level security) so one organisation cannot access another’s data.
• Apply role-based access control, scoped to the minimum access each role needs.
• Maintain an immutable audit log of sensitive actions (create/edit/delete, consent changes, role changes).
• Scrub structured personal identifiers from free-text care notes before AI text processing (emails, phone numbers, NDIS/Medicare numbers, dates of birth). Requests fail closed if structured identifiers remain after scrubbing.
• Gate cloud audio transcription behind AI_CLOUD_AUDIO_ENABLED (and Meetings UI behind NEXT_PUBLIC_ENABLE_MEETINGS). Meeting audio cannot be scrubbed before Vertex AI transcription; every attendee must consent in-product before recording starts. Meeting summaries use a scrubbed transcript after STT.

Caira uses the following sub-processors as at the date of this draft. The table states what categories of data each receives. We will give the Controller reasonable advance notice before adding or replacing a sub-processor that will process the Controller’s data, with an opportunity to object on reasonable grounds.

Primary care records are intended to reside in Australia (Supabase Sydney when production is confirmed). Several sub-processors may still process information outside Australia (default PostHog US host, Stripe, Sentry, Resend, Vercel edge, and Gemini Developer API if used). Production AI prefers Vertex AI in australia-southeast1.

For text-based AI calls, personal identifiers are scrubbed before transmission (residual risk remains). Unscrubbed audio/OCR, when enabled, requires Provider APP 8.2 express informed consent. Lower-sensitivity tooling (billing, consent-gated analytics without care content, scrubbed error logs) proceeds under APP 8.1 contractual steps. See the APP 8 matrix in the legal-review pack (Decision D14). Solicitor polish of this clause is deferred until revenue (D19); founder self-cert must confirm production residency and vendor no-train terms before real participant data.

Caira will assist the Controller, to the extent reasonably possible, in responding to a request from an individual to access, correct, or erase their personal information, including via the in-product right-to-erasure (de-identification) workflow.

Caira will notify the Controller without undue delay after becoming aware of a Data Breach affecting the Controller’s data — within 24 hours of identifying a potential breach, and in any event within 72 hours (documenting the reason if the 24-hour target cannot be met). Caira will cooperate with the Controller’s notifications to the OAIC and affected individuals under the Notifiable Data Breaches scheme. The Controller retains the primary decision on OAIC / individual notification for Controller data. See our internal data-breach response plan and Privacy Policy.

On reasonable notice, and no more than once per year absent a suspected breach, the Controller may request evidence of Caira’s compliance with this Agreement (e.g. a summary of security measures or relevant certifications), subject to reasonable confidentiality protections.

On termination of the Provider’s subscription, Caira will make the Controller’s data available for export for a reasonable period, then delete or de-identify it in line with the retention schedule described in our Privacy Policy, unless a longer period is required by law.

Liability under this Agreement is subject to the limitation of liability in our Terms of Service. This Agreement remains in effect for as long as Caira processes personal information on the Controller’s behalf.