AlayaCare Privacy Policy

AlayaCare’s SaaS Platform Privacy Policy – for Our Customers

Overview

This section of our Privacy Policy describes how we collect, receive, use, store, share, transfer, and process Customer Data on behalf of our customers as part of our Services.

We collect, process and store Customer Data under the direction and control of our customers. We retain no ownership of, nor do we have control over the origination or validity of the Personal Information we process on behalf of our customers. We do not request, nor do we maintain, direct relationships with individuals whose Personal Information we maintain in the databases we host and manage as part of our Services to our customers. Accordingly, we do not directly request nor collect consents nor instructions to access, correct, update or delete personal information, which requests should be made directly to our customers. We will honor and support any instructions that our customers provide us with respect to Personal Information maintained in our databases.

We cooperate with our customers and our secure infrastructure providers to ensure that there is an open and transparent approach with respect to all privacy elements of the personal information maintained by our home care and health solutions (APP 1.1). This Policy, along with our open disclosures of key elements of the security and privacy of our solutions via our Websites at https://alayacare.trust.page further supports our collective approach to compliance with APP 1.1. Our customers are responsible for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent from their clients or workers prior to transferring Personal Information to AlayaCare and its software platform.

If you are a home care or home health service worker and have questions about personal or health information, either yours or a client’s, you should check with your home care/ home health agency.

Protecting Personal Information and Health-related Information

AlayaCare is a provider of hosted, electronic health record solutions to its customers who are health care providers and subject to laws and regulations governing the use and disclosure of Personal Information. In Australia, various laws govern the collection, handling of and access to Personal Information, including health information protected under the Health Records Act 2001 (see Table 1: Applicable Privacy Laws). Throughout this Privacy Policy we refer to the Australian Privacy Principles (APP), which help to guide us in all matters of data protection and privacy (APP 1.3).

We maintain AICPA SOC 2 certification for our software platform which embodies a comprehensive set of internal practices, policies and procedures which are reviewed by trained subject matter experts who review our controls and evidence of our compliance with them. This aligns with and demonstrates our commitment to APP 1.2. More information and a copy of the certified report can be requested via the AlayaCare Trust Center at https://alayacare.trust.page

Security, Threats and Breach Notification

AlayaCare’s software platform and the Services we deliver embody our commitment to APP 11.1 via the physical, administrative and technical security measures we have in place to protect against the loss, misuse, unauthorised access and alteration of data and Personal Information under our control. When the Services are accessed using current browser technology, Secure Socket Layer or SSL technology protects information using both server authentication and data encryption to help ensure that data is safe, secure, and available only to each specific customer. AlayaCare also implements a security methodology based on dynamic data and encoded session identifications and hosts the Service in a secure server environment which uses firewalls and other advanced technology to prevent interference or access from outside intruders. Unique usernames and passwords are also required and must be entered each time a customer logs into the Service. We are committed to educating our staff about the protection of Personal Information, and the importance of compliance with relevant privacy legislation and company policies. All employees and contractors are required to sign confidentiality agreements.

These safeguards help prevent unauthorised access, maintain data accuracy, and ensure the appropriate use of Personal Information; however, it is important to remember that no system can always guarantee 100% impenetrability. If we detect a threat to security or security vulnerability, we will contact our customers to recommend protective measures. Additionally, incidents of suspected or actual unauthorised handling of Personal Information are always directed to AlayaCare’s Legal and Compliance team, which is responsible for determining escalation and response procedures, depending on the severity and nature of the incident. Incidents involving unauthorised handling of Personal Information. If AlayaCare determines that Personal Information has been misappropriated or otherwise wrongly acquired, it will promptly issue a report to each affected customer.

For our customers who subscribe to or otherwise license Connected Services (as opposed to Embedded Technologies), it is important to note that the third parties who provide those services may have different procedures in place to protect Personal Information than the standards AlayaCare has implemented. AlayaCare cannot be responsible for their policies or their compliance with them, regardless of whether we have integrated their solutions into our Services and/or made them available to you.

Retention and Deletion

AlayaCare will retain Personal Information: as necessary for the purposes outlined in this Policy (APP 11.2);