Privacy Policy

Blue Marble Health Services (“BMHS”, “we”, “us” or “our”) operates the BMHS Care Display platform (“the Platform” or “this app”), a centralised system for healthcare facility signage, digital information displays, shift notes, medication management, participant records and workforce reporting. This Privacy Policy explains how we collect, use, store and disclose personal and health information when you interact with the Platform.

By accessing or using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Types of Information We Collect

We collect the following categories of information:

• Participant information: name, date of birth, NDIS number, address, contact details, emergency contacts, support coordinator details, health and medical notes, medication information, behavioural records, incident reports and care notes.
• Worker information: name, email, phone number, role, house assignments, employee reference codes, shift and KPI records, submitted forms and shift notes, and activity logs.
• Account credentials: email address and password (stored as an irreversible hash), and role-based access permissions.
• Usage data: device identifiers, IP addresses, browser type, access times, form access logs, QR code access events and interaction data with the Platform.
• Communication records: kiosk communications, messages, SMS logs and call transcripts.
• Uploaded files: documents, scanned forms, medication charts and images uploaded to the Platform.

3. How We Collect Information

We collect information directly from you when you create an account, submit forms, record shift notes, upload documents, send communications, or otherwise interact with the Platform. We also collect information from third-party systems such as Brevity (for roster and shift note sync), Google Workspace (for user synchronisation) and external referral sources where authorised. Some information is collected automatically through device sessions, kiosk interactions and analytics.

4. How We Use Your Information

We use the information we collect to:

• Provide and manage participant care, including medication administration, shift notes, incident reporting and behavioural tracking.
• Generate NDIS and compliance reports for participants and stakeholders.
• Coordinate support worker shifts, house allocations and workforce management.
• Communicate with you about your account, care delivery and platform updates.
• Maintain records required for NDIS compliance, clinical governance and auditing.
• Monitor platform security, performance and usage to improve the service.
• Send urgent alerts, notifications and office follow-ups where required for participant safety.

5. Legal Basis for Processing

We process personal and health information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We rely on your consent, the performance of a contract (service delivery), compliance with legal obligations (including NDIS and healthcare regulations), and our legitimate interests in operating a safe and effective care platform. Sensitive health information is collected and handled with your consent or as required for the provision of healthcare services.

6. Disclosure of Information

We may disclose your information to:

• NDIS planners, support coordinators and stakeholders with authorised access via the stakeholder portal.
• PBSP (Positive Behaviour Support Plan) specialists who have been granted access by management.
• External systems including Brevity and Google Workspace for data synchronisation and reporting.
• Third-party service providers who support the Platform (e.g. hosting, SMS, video calling, analytics) under appropriate data processing agreements.
• Regulatory bodies, law enforcement or government agencies where required by law.

We do not sell your personal information to third parties.

7. Data Security

We implement industry-standard security measures to protect your information, including encrypted data transmission, role-based access controls, row-level security on participant records, secure authentication, regular backups and audit logging. Access to health information is restricted to authorised personnel with appropriate roles. Despite these measures, no system can be guaranteed completely secure, and we cannot guarantee the security of information transmitted over the internet.

8. Data Retention

We retain personal and health information for as long as necessary to fulfil the purposes described in this policy and to comply with our legal and regulatory obligations under NDIS, healthcare and records management requirements. Participant records may be retained for the period required by applicable law. You may request deletion of your data where permitted by law; note that certain records must be retained for compliance purposes.

9. Your Privacy Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information where permitted by law.
• Withdraw consent to certain processing activities.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the Privacy Act.

To exercise these rights, contact us using the details in section 11.

10. Cookies and Tracking

The Platform may use cookies and similar technologies to maintain sessions, remember preferences and collect usage analytics. You can control cookies through your browser settings, but disabling them may affect Platform functionality.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the Platform or by other means. The “Last updated” date at the top of this page indicates when the policy was last revised.