Privacy Policy

1. Overview

Aged Care Circle (“we”, “us”, “our”) operates the website at agedcarecircle.com.au and is committed to protecting your privacy. This policy explains what information we collect when you use this website, how we use it, who we share it with, and your rights under the Privacy Act 1988 (Cth).

The short version: Our cost calculators process inputs in your browser when you use them anonymously. If you create an account, we collect and store personal information for account features — including saved providers, locations, Care Circles, care recipient details, and saved estimates. Analytics cookies and session recordings are optional (see the consent banner).

2. Information We Collect

2a. Calculator inputs

When you use any of our cost calculators (Residential Aged Care, Home Care Package, Support at Home, RAD vs DAP) without saving to an account, your inputs — including care type, region, income range, asset range, and accommodation preference — are processed entirely in your browser. Results are encoded into the page URL so you can share or bookmark your estimate. In that anonymous mode we do not transmit those inputs to our servers as part of the calculation itself.

If you are signed in and save an estimate, the inputs and results are stored in your account (see section 2e). Session recordings (if you accept analytics cookies) may also capture on-screen calculator values or URL-encoded estimate data — see section 2h.

2b. Account registration and profile

If you create an account, we collect and store:

• Your email address — used to send a magic link for passwordless login (no password is created or stored)
• A display name — automatically generated from your email address when you first log in; you may update this
• Your account creation date, subscription tier (Free or Premium), and subscription expiry date
• A Stripe customer ID — created if you upgrade to Premium, used to manage your subscription and avoid duplicate billing records

2c. Provider enquiries

When you submit an enquiry to a provider through the site, we collect and store your name, email address, contact number (optional), message, and the page from which the enquiry was submitted. This information is stored in our database and forwarded to the provider if they have a claimed listing. It is used for enquiry routing and moderation purposes.

2d. Provider reviews

When you submit a review of a provider, we collect your display name, your relationship to the facility (e.g. resident, family member, visitor), star ratings across up to six categories, and a written comment. We also collect your email address for verification purposes. Your email address is not stored in readable form — it is converted to a one-way cryptographic hash (SHA-256) before storage, which allows us to detect and prevent duplicate reviews from the same address but cannot be reversed to recover your email.

All reviews are held as pending until you verify your email address via a link we send you, and until a manual moderation check is completed. Unverified reviews are not published and are periodically deleted.

2e. Saved data (registered users)

When you use account features, we store:

• Saved locations — suburb name, postcode, and geographic coordinates (latitude/longitude) for locations you save to your account
• Shortlisted providers — the aged care facilities you save or add to your comparison list
• Care Circle data — your circle name, the email addresses of people you invite to your Care Circle, and their membership role (owner, editor, or viewer)
• Notes — any notes you add to providers or your journey
• Saved estimates — when you save a calculator result to your account, we store the estimate inputs and results (including income/asset ranges and derived fee figures) so you can revisit and compare them later
• Care recipient profile — if you enter details about the person receiving care (name, date of birth, address, care needs, health context, and financial ranges), these are stored and shared with members of your Care Circle according to the roles you set

This data is associated with your account and is not used for any purpose other than delivering account features to you.

2f. Anonymous browser data (pre-login)

Before you log in or create an account, the site stores shortlists and saved locations in your browser's local storage (not a cookie). This data never leaves your device. If you subsequently create an account, this anonymous data is automatically merged into your account and removed from local storage.

The site also uses session storage to track enquiry submission counts per provider within a single browsing session to prevent spam. This data is cleared when you close the browser tab.

2g. Analytics and usage data

We use several analytics services to understand how visitors use this site and to improve content, usability, and performance. By default (and if you decline cookies), product analytics is pseudonymous — linked to a random browser identifier rather than your name. If you accept analytics cookies while signed in, we may link PostHog events to your account user ID and email so we can understand how registered features are used. Google Analytics 4, Microsoft Clarity, and Google AdSense scripts load only after you accept analytics cookies.

Depending on the service, this may include:

• Pages visited, links clicked, and time spent on each page
• Scroll depth, mouse movements, and navigation paths
• General geographic region (country and state — derived from IP address, not precise location)
• Device type (mobile, tablet, desktop)
• Browser and operating system type
• How you arrived at the site (search engine, direct, referral)
• Site performance and error information

The analytics services we use are:

• Google Analytics 4 — aggregate usage measurement (IP addresses anonymised in our configuration)
• PostHog — product analytics and session replay, hosted in the United States
• Microsoft Clarity — heatmaps and session replay for usability diagnostics, hosted in the United States
• Vercel Analytics — aggregated traffic and performance measurement

This data is used only to understand and improve the site. It is not sold and not used for advertising (except where Google AdSense is separately described in section 14). See section 6 for links to each provider's privacy policy.

2h. Session recordings

PostHog and Microsoft Clarity may create session recordings that show how you interact with our pages — for example, where you click, how far you scroll, and which pages you visit. These are DOM-based replays (a reconstruction of the page and your interactions), not a video recording from your camera or microphone.

We use recordings only to diagnose technical problems, understand where visitors get stuck, and improve site design. We configure these tools to mask sensitive input fields (such as passwords and form fields) where technically possible. However, information visible on the page — including text you type into unmasked fields or data encoded in a page URL — may appear in a recording.

Session recordings start only after you accept analytics cookies. If you are signed in and have accepted cookies, a recording may be associated with your PostHog person profile (including account identifiers described in section 2g). Recordings are not used for advertising.

2i. Contact form

The contact form on this site is processed by Formspree. When you submit the form, your name, email address, and message are sent to Formspree's servers and forwarded to us. This information is used solely to respond to your enquiry and is not used for marketing or shared with any other party. Please review Formspree's Privacy Policy for details of how they handle submitted data.

3. Cookies and Local Storage

Cookies we set

When you log in to your account, our authentication provider sets a session cookie (auth-token) in your browser. This cookie is required for authenticated features and contains an encrypted session token. It is cleared when you log out.

Analytics and third-party cookies

The following services may set cookies or similar identifiers in your browser:

• Google Analytics 4 — analytics cookies used to measure usage patterns
• PostHog — first-party cookies (e.g. ph_*) used to distinguish visitors and link page views within a session
• Microsoft Clarity — first-party cookies (_clck, _clsk) and, in some cases, third-party Microsoft cookies used to link page views into a single session
• Google AdSense — advertising cookies used to serve and personalise advertisements

You can control or delete cookies through your browser settings. Disabling analytics cookies may limit our ability to improve the site but will not prevent you from using the cost calculators or other core features. To opt out of Google Analytics specifically, you can install the Google Analytics Opt-out Browser Add-on.

Browser local storage

As described in section 2f, the site uses local storage to temporarily hold anonymous shortlists and saved locations before account creation. This data is not transmitted to our servers unless you log in.

Disabling local storage may affect the anonymous shortlist and saved location features before you log in.

4. How We Use Your Information

We do not use your personal information for direct marketing. We do not sell, rent, or trade your personal information to any third party.

5. Transactional Emails

We send the following transactional emails using Resend (our email delivery provider):

• Review verification — a link to verify your email address when you submit a provider review
• Care Circle invitation — an invitation email when you are added to someone's Care Circle
• Enquiry confirmation — a notification to the relevant provider when you submit an enquiry
• Premium upgrade confirmation — a summary of features unlocked when you subscribe to Premium

These emails are sent in response to specific actions you take. We do not send newsletters, promotional emails, or any unsolicited communications.

6. Third-Party Service Providers

We share personal information with the following third-party service providers only to the extent necessary to deliver the service:

These providers are bound by their own privacy policies and applicable data protection laws. We do not authorise them to use your information for their own marketing purposes. Where a provider processes personal information on our behalf, we rely on their contractual data protection commitments — including (where applicable) a Data Processing Agreement with PostHog Inc. for analytics and session replay data processed in the United States.

7. Data Storage and Location

User account data, provider enquiries, reviews, saved locations, and shortlists are stored in Supabase, hosted in the ap-southeast-2 region (Sydney, Australia). Payment records are held by Stripe on their infrastructure.

Analytics and session recording data is processed by Google (United States), PostHog (United States), Microsoft Clarity (United States), and Vercel (United States) on servers outside Australia.

Some third-party providers listed above may process or store data outside Australia. Where this occurs, we rely on those providers' own data handling commitments, contractual safeguards (including our PostHog Data Processing Agreement), and applicable cross-border transfer mechanisms.

8. Data Retention

9. Your Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate, out of date, or incomplete
• Request deletion of your account and associated personal information (subject to retention obligations noted in section 8)
• Complain if you believe we have handled your personal information in a way that does not comply with the APPs

To exercise any of these rights, email us at support@agedcarecircle.com.au with the subject line “Privacy Request”. We will acknowledge your request within 5 business days and respond substantively within 30 days.

10. Data Breach Notification

We take reasonable steps to protect your personal information from unauthorised access, misuse, or disclosure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with our obligations under the Notifiable Data Breaches scheme.

11. Complaints

If you are not satisfied with how we have handled your privacy concern, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

12. Children's Privacy

This site is intended for adults and is not directed at children under the age of 13. We do not knowingly collect personal information from children.

13. External Links

This site contains links to external websites including servicesaustralia.gov.au, myagedcare.gov.au, and agedcare.health.gov.au. We are not responsible for the privacy practices of those sites and encourage you to read their respective privacy policies.

14. Advertising

This site displays advertisements through Google AdSense. Google may use cookies and similar tracking technologies to serve relevant advertisements based on your browsing behaviour. You can opt out of personalised advertising at Google's Ad Settings. For more information, see Google's Advertising Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when it was last revised. Continued use of this site after any changes constitutes acceptance of the updated policy.

16. Contact

For privacy-related enquiries, requests, or complaints, contact us at:

Email: support@agedcarecircle.com.au
Subject line: Privacy Request

17. Facility Portal — Data We Share

The Aged Care Circle provider portal introduces new data flows between families, Aged Care Circle, and facility operators. This section describes what data is shared, with whom, and under what conditions. For facility operators, see also our Facility Provider Terms and How our data works.

17a. Family enquiry data shared with facilities

When you submit an enquiry to a facility through Aged Care Circle, the following information is shared with the facility:

• Full name — as set in your Aged Care Circle account
• Email address
• Phone number — only if you choose to provide it (optional)
• Enquiry message text — as you typed it
• Enquiry type — “information enquiry” or “tour request”
• Journey stage — only if you explicitly tick “Share my current stage with this facility” (opt-in, not opt-out)
• Submission timestamp

The following information is not shared unless you give separate consent: your financial profile or cost estimate breakdown, your full Care Circle member list, your notes or questions log, or any information about other facilities you have viewed or shortlisted.

17b. Family data retained by facilities after an enquiry

Once your enquiry is delivered to the facility by email, the data is in their hands. Aged Care Circle can no longer control how the facility stores, uses, or shares your information. We encourage you to review the privacy policy of any facility you enquire with. Aged Care Circle retains a copy of the enquiry message in our own database for 24 months from the date of submission — so we can support you if there is a dispute about the enquiry — after which it is permanently deleted.

17c. Anonymous analytics on facility profiles

When families view a facility profile on Aged Care Circle, we record that page view using an anonymous session identifier (a cookie set in the visitor's browser). Session identifiers are never linked to a logged-in account or any personally identifiable information. Aggregate analytics — total profile views and total shortlist additions — are reported to facility operators via their portal dashboard. Operators never see individual session detail. See our data transparency page for more detail.

17d. Verification documents (facility operators)

Identity documents uploaded by facility operators during the claim verification process are stored in a private, access-controlled storage bucket on Aged Care Circle's infrastructure. They are accessible only to Aged Care Circle admin staff during the claim review process. They are not published, not shared with any third party, and are permanently deleted 12 months after the claim review is completed. If a claim is rejected, documents are deleted within 30 days.