Our approach
EmpowerNotes is designed for Australian disability, community and care-service organisations. We treat participant, staff and health-related information as sensitive and apply privacy-by-design principles.
This policy describes EmpowerNotes' practices as a software provider. Each customer remains responsible for its own privacy notices, consents and lawful use of the platform.
Information we handle
- Account and contact information, including names, work email addresses, telephone numbers and organisation details.
- Customer content, including client profiles, progress notes, incident reports, documents, support information, rosters and billing records.
- Security and technical information, including authentication events, device information, IP addresses and audit logs.
- Subscription, payment status and service-support communications.
Why we use information
- Provide, secure, support and improve EmpowerNotes.
- Authenticate users, enforce roles and keep organisations separated.
- Process customer-requested AI assistance and document extraction.
- Manage subscriptions, service communications, support and legal obligations.
- Detect misuse, investigate incidents and maintain service reliability.
AI and service providers
When a user requests an AI-assisted feature, relevant content may be sent to an approved AI service provider for that request. EmpowerNotes does not authorise customer content to be used to train general-purpose models unless this is expressly agreed.
We use contracted infrastructure, authentication, payment, email and AI providers. Our Subprocessor Register identifies their purpose. Some processing may occur outside Australia, subject to contractual and security safeguards.
Access, correction and complaints
Individuals may request access to or correction of personal information, or raise a privacy concern, by contacting privacy@empowernotes.org. We may need to coordinate with the relevant customer organisation where it controls the record.
We assess eligible data breaches under the Privacy Act 1988 and the Notifiable Data Breaches scheme.