Privacy Policy

Maree-CareFlow Pty Ltd  ·  Last updated: 8 June 2026

Contents

Important: Maree-CareFlow is a self-hosted software product. When your practice uses Maree-CareFlow, your client health records and practice data are stored on infrastructure that you control — not on Maree-CareFlow's servers. This policy covers how we handle information about you as a customer (practice owner, administrator, or subscriber) rather than the health records of the participants your practice serves.

1. About This Policy

Maree-CareFlow Pty Ltd ("Maree-CareFlow", "we", "our", or "us") is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.

This Privacy Policy explains how we collect, hold, use, and disclose personal information about:

This policy does not govern the health records or participant data managed by practices that use the Maree-CareFlow software. That data is held on the practice's own infrastructure and is subject to the practice's own privacy obligations under the Privacy Act 1988, applicable state health records legislation, and the NDIS Act.

2. Who We Are

Maree-CareFlow Pty Ltd is an Australian company that develops and distributes Maree-CareFlow — a self-hosted practice management platform for Australian allied health and NDIS providers.

We are bound by the Australian Privacy Principles and, where applicable, the Health Records Act 2001 (Vic) and equivalent state health records legislation.

3. Information We Collect

3.1 Information You Provide

We collect personal information that you voluntarily provide, including:

3.2 Information Collected Automatically

When you visit our website, our web server may collect:

We use this information for security monitoring, service improvement, and aggregate analytics. We do not use third-party advertising trackers.

3.3 Information We Do Not Collect

We do not collect or store:

4. How We Collect Information

We collect personal information:

Where it is lawful and practicable to do so, we will collect information directly from the individual concerned.

5. How We Use Your Information

We use personal information to:

We will not use your personal information for direct marketing unless you have consented. You may opt out of marketing communications at any time by following the unsubscribe link in any marketing email or contacting us directly.

6. Health Information

Maree-CareFlow is a self-hosted application. All health records, clinical notes, NDIS participant plans, and related sensitive health information managed within your Maree-CareFlow installation are stored on servers under your control — not on Maree-CareFlow's infrastructure.

As the operator of that infrastructure, your practice is the entity responsible for those health records under:

Maree-CareFlow provides the software tools and technical safeguards (access controls, audit logging, data retention enforcement) that help you meet these obligations, but the primary legal responsibility for participant health data lies with your practice.

7. Disclosure to Third Parties

We do not sell, rent, or trade personal information. We may disclose personal information to:

All third parties to whom we disclose personal information are required to handle it in accordance with Australian privacy law or equivalent protections.

8. Overseas Disclosure

Our marketing website and licence management systems may be hosted on infrastructure located outside Australia. Where personal information is transferred or stored overseas, we take reasonable steps to ensure that overseas recipients handle it in accordance with standards at least equivalent to the Australian Privacy Principles (APP 8.1).

We will not disclose personal information to an overseas recipient unless we are satisfied that the recipient provides adequate privacy protections, or you have consented to the transfer, or disclosure is required or authorised by law.

9. Data Residency (Your Client Data)

Because Maree-CareFlow is self-hosted, you decide where your client data is stored. You can install Maree-CareFlow on:

Maree-CareFlow does not transmit your clinical data to our servers or any third-party service without your explicit configuration (for example, enabling optional cloud integrations).

Enterprise customers can receive a written Australian data residency commitment on request — contact our enterprise team.

10. Security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:

If you become aware of a security vulnerability in Maree-CareFlow or suspect that your practice's installation has been compromised, please contact us immediately at security@maree-careflow.com.au.

11. Retention and Deletion

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

You may request deletion of your personal information by contacting us (see Section 17). We will delete or de-identify your information unless we are legally required or permitted to retain it.

12. Access and Correction (APP 12 & APP 13)

Under APP 12, you have the right to request access to the personal information we hold about you. Under APP 13, you have the right to request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

To make an access or correction request:

We will respond to access requests within 30 days. We will not charge a fee for making a request, but may charge a reasonable cost for providing access if the volume of information involved is large.

If we refuse an access or correction request, we will explain why in writing and advise you of your right to complain to the Office of the Australian Information Commissioner.

13. Complaints (APP 1)

If you believe we have handled your personal information in a manner inconsistent with the Australian Privacy Principles, you may lodge a complaint with us:

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC):

14. Cookies and Tracking

Our marketing website uses essential functional cookies only. We do not use advertising cookies, third-party tracking pixels, or behavioural analytics services.

Functional cookies we use:

You can disable cookies in your browser settings. Disabling cookies will not prevent you from viewing our marketing website.

15. Children's Privacy

Our marketing website and services are directed at allied health practice operators and administrators. We do not knowingly collect personal information from individuals under 18 years of age through our website. If you believe we have inadvertently collected information about a child, please contact us and we will promptly delete it.

Note: Maree-CareFlow software is used by practices that do work with children (e.g. paediatric OT, speech pathology). The privacy of those children's health records is the responsibility of the practice as the data controller on their own server.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

Your continued use of our website or services after the effective date of the updated policy constitutes acceptance of the changes.

17. Contact Us

Privacy Officer — Maree-CareFlow Pty Ltd

Email: privacy@maree-careflow.com.au
Security issues: security@maree-careflow.com.au
General enquiries: Contact form

We aim to acknowledge all privacy enquiries within 2 business days and to resolve complaints within 30 days.

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.