Privacy policy | Yarrowee Home Care

Yarrowee Care Pty Ltd trading as Yarrowee Home Care · ACN 701 001 416 · ABN 45 701 001 416 · Version 1.6, effective 9 October 2026

We look after older people in their own homes. To do that safely we have to ask you personal questions, and some of the answers are health information. This page explains what we ask, why, who sees it, where it goes, how long we hold it and what you can do about it. It is written to be read, not to be skipped.

Who we are

Yarrowee Care Pty Ltd (ACN 701 001 416, ABN 45 701 001 416) trades as Yarrowee Home Care. We are a private-pay, non-clinical in-home aged care business based in Ballarat, Victoria. We are not a registered Support at Home provider and we do not deliver government-funded aged care.

Email: hello@yarroweecare.com.au
Phone: 03 4329 0128
Post: Yarrowee Care Pty Ltd, Ballarat, Victoria
Privacy contact: the Director, at the details above

Two privacy laws apply to us, and we meet both

Because we provide a health service and hold health information, we are covered by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles. The exemption that would otherwise apply to a business our size does not apply to us, and we do not rely on it.

We are also covered by the Health Records Act 2001 (Vic) and its eleven Health Privacy Principles, which apply to any Victorian organisation that handles health information, whatever its size. Where the two laws set different standards, we meet the higher one.

What we collect

About the person receiving care

Name, address, date of birth, phone number and email address.
Emergency contacts and the people you nominate for us to speak with.
What help is needed and when, including mobility, transfers, showering, dressing, toileting, meals, housework and getting out of the house.
Health information relevant to keeping the visit safe: mobility and falls, memory and behaviour, medication that needs prompting, allergies, and anything a carer must know before walking in the door.
GP name and contact details, which we hold for one reason only, so that we or an ambulance can escalate quickly in an emergency.
Information about the home as a workplace: access, stairs, pets, smoking, and anything that affects whether one carer can work there safely.
Visit records: who attended, when they arrived and left, what was done, and anything they reported.

About the person arranging the care

If you are arranging care for someone else, usually a parent, we collect your name, contact details, and your relationship to them and your authority to act. We tell the person receiving care that we hold information about them and where it came from.

Payment information

Card details are entered directly with our payment provider, Stripe. We never see, hold or store your full card number. We hold a record that a payment was authorised, captured or refunded, and the last four digits, so we can answer questions about your account.

We ask for the least we can. If a question on our form does not change a decision we have to make about your care or a carer's safety, it should not be there. If you think we are asking for something we do not need, tell us, and we will either explain why we need it or remove it.

How we collect it

Almost always directly from you, through the request form on our website, by phone, or from the carer who attends. Sometimes we collect information about a client from an adult child, a GP or a hospital discharge planner. When that happens we make sure the person receiving care is told what we hold and where it came from.

We hold it in Microsoft 365 with access limited to the people who need it. Carers see only the client they are assigned to, and only what they need to do the visit safely.

Why we collect it, and what happens if you do not give it

To decide whether we can take the request safely, and to decline it if we cannot.
To match a carer, brief them properly, and get them to the right place at the right time.
To deliver the care, keep visit records, and follow up on anything that goes wrong.
To take payment and issue receipts and tax invoices.
To meet our obligations as an employer for the safety of the carer we send.
To keep the records the law requires us to keep.

If you do not tell us about mobility, transfers, medication or behaviour, we cannot make the visit safe and we will decline the request. That is not a formality. A carer walks into a stranger's home alone, and what you tell us is most of what they know before they arrive.

Consent, and who can give it

Health information is sensitive information. We collect it only with express consent, given separately from the rest of our terms, and only where it is genuinely necessary to provide the service. Ticking our terms of service is not consent to collect health information; there is a separate tick for that, and you can read what it covers before you tick it.

Consent should come from the person receiving the care wherever they are able to give it. Where they cannot, we look for a person with legal authority to decide for them, such as an attorney appointed under an enduring power of attorney or a guardian. Being a son, daughter or spouse does not by itself make someone a substitute decision-maker, and we may ask to see the authority.

In progress. We are formalising our procedure for clients who cannot give their own consent, and the evidence of authority we ask a representative to provide. Until that is finished we take a cautious approach and ask more questions rather than fewer. If you think we have got this wrong in your case, tell us and we will fix it.

Who we share it with

The assigned carer gets what they need for that visit only, to deliver the care safely.
Emergency services and your GP get what is needed at the time, if someone is hurt or unwell during a visit.
Your nominated contacts get what you have told us they may be told, to keep family informed if you ask us to.
Our insurer, where we hold cover, gets information only if there is an incident or a claim.
Our software and payment providers get only what is needed to run the service: Microsoft 365 and Microsoft Azure, Stripe for payments, our website platform Wix, Geoscape for address search, and Meta and Google for advertising and website analytics.
A regulator or a court gets only what is required, where the law requires it.

We do not sell your information. We do not give your personal or health information to marketers. We do not use it to train anybody's artificial intelligence.

Overseas

Some of the services we use are run by companies based outside Australia, so your information is likely to be accessible from, or stored in, other countries.

Microsoft 365. Customer data is stored in Australian data centres. Microsoft is a United States company and its support staff in other countries may access data to resolve a fault.
Stripe, our payment provider. United States and Ireland.
Wix, our website, our request form, and our carer application form including any file attached to it. United States, Ireland and Israel.

Before information goes to any of them we take reasonable steps to make sure they handle it to Australian standards, principally through the contracts we hold with them. Under Australian law we remain accountable to you for what they do with it, and we do not ask you to sign that accountability away.

How long we keep it

The Health Records Act 2001 (Vic) requires a health service provider to keep a client's health information for at least seven years after the last occasion on which we provided a service to that person, and longer if the person was under eighteen when we collected it. We follow that rule. It means we cannot delete your file on request while that period is running, even if you ask us to.

When the period ends we destroy the record securely and note in a register that we have done so. If we ever transfer a record to another provider and do not keep a copy, we note that too.

Getting access to your information, and correcting it

You can ask to see the information we hold about you, and you can ask us to correct anything that is wrong, out of date, incomplete or misleading. Write to us at hello@yarroweecare.com.au or by post.

We will answer an access request as soon as we can, and within 45 days at the latest. If we refuse, we will tell you why in writing.
We will answer a correction request as soon as we can, and within 30 days at the latest.
We may charge a reasonable fee for the cost of giving you access, such as copying and postage. We will tell you the fee before we do the work, and there is no fee for asking or for a correction.
If we disagree that something is wrong, you can ask us to attach your statement to the record, and we will.

Automated decisions

We use an automated system to process care requests. We do not decline anyone on where they live. Where a request asks for care outside what one carer can safely do alone, or for a visit further ahead than we book (we book up to a week ahead), our system may decline it without a person reviewing it. Where we cannot find a carer for a request, our system may close it and tell you, again without a person reviewing it. The information the system uses includes your location, the type and timing of care asked for, and the care needs you tell us about.

If your request has been declined or closed and you would like a person to look at it, email us or ring us and we will review it. We would rather look again than have you go without help because a rule was too blunt.

Keeping it safe, and what we do if something goes wrong

Information is held in Microsoft 365 with multi-factor sign-in, access limited to those who need it, and carers restricted to their own clients. We do not keep paper client records. Carers are trained not to discuss one client with another.

If there is a data breach that is likely to cause serious harm, we are required to assess it promptly, and to notify the affected people and the Office of the Australian Information Commissioner. We have a written procedure for that, and we will tell you directly rather than letting you find out some other way.

If you are unhappy

Tell us first if you are willing to. Email hello@yarroweecare.com.au or ring 03 4329 0128. We will acknowledge your complaint within three working days, look into it properly, and aim to finish within 90 days, telling you where things are along the way.

You do not have to come to us first, and you can go to a regulator at any time.

Health Complaints Commissioner (Victoria), for complaints about our service or our handling of health records. 1300 582 113 · hcc.vic.gov.au
Office of the Australian Information Commissioner, for complaints under the Privacy Act. 1300 363 992 · oaic.gov.au

Changes to this policy

We will update this policy when the way we handle information changes, or when the law does. The version and date are at the top of this page. The current version is always available free of charge here, and we will give you a printed copy if you ask.

Your Client Hub account. If you sign in to the Client Hub on this site you can see the visits you have booked and the ones that have already happened, book another one, cancel one, read your care plan, read our summary of your first visit and ask us for the notes from any visit, see your own contact and address details and change them, and see what you have paid and ask us for another copy of a receipt or tax invoice. Some of that is health information — your care plan and your visit summaries are, and so is the fact that you receive a particular kind of care on a particular day. We treat it that way.
Where it is kept. Your care record is held in our own systems, in Microsoft 365 and Microsoft Azure data centres in Australia. When you open a page in the Client Hub, our own Australian server checks your sign-in with our website provider, works out which record is yours from the email address it gets back, reads that record and sends only your own information to your screen. Your care plan, your visit summaries, your address, your phone number, your emergency contact and everything you have told us about health or care needs are read from Australia each time and are never copied to the website.
The one copy that is on the website. So that the page can list your bookings quickly, a short copy of each booking is kept with our website provider, Wix. It holds your email address, the service you booked, the date, the start time and how long the visit is, the price quoted, your carer's first name once a carer is confirmed, where the booking has got to, the dates on which your card was held, confirmed, charged, refunded or the request was closed, whether the visit was cancelled and when and by whom, the outcome and amount of any cancellation charge, our own reference number for the booking and the date that copy was last updated. Nothing else — no address, no phone number, no care needs, no care plan, no visit summary and no notes. We count that short copy as part of your health information all the same, because the name of a service says something about the kind of help you receive, and we do not put anything further there. Wix is a company with operations in the United States, Ireland and Israel, so that short copy is likely to be accessible from outside Australia. Under Australian law we stay accountable to you for it, and we do not ask you to sign that accountability away.
Who can see it. You, when you are signed in. The person you have asked us to deal with, if you have arranged your care that way. Our director and operator. And the carer sent to your home, who sees only what they need for that visit and only for the visit they have been given. One person's sign-in can never show another person's record. Nobody at our website provider is given your care record, and the short booking copy above is set so that the page itself cannot read it — only our own server can.
How long it is kept. Your care record is kept for at least seven years after the last time we provided a service to you, because Victorian law requires it, and longer if you were under eighteen when we collected it. That means we cannot delete your file on request while that period is running, even if you ask us to. The short booking copy on our website provider is there so the Client Hub can show you your bookings. If you stop booking visits, ask us and we will remove it — your care record in Australia is not affected and is kept for the seven years.
Asking to see all of it. The Client Hub shows you a summary written for you. It is not everything. A carer writes a working note at the end of each visit, your care plan has a section about risks and how we manage them, and anything that went wrong is written up as well. All of that is your record and you are entitled to see it, and you do not have to give a reason. Email hello@yarroweecare.com.au and put Access request in the subject line, or ring 03 4329 0128 and we will write the request down for you. We will tell you we have it within three working days, and we will answer within 45 days at the very latest — in practice much sooner. If part of it is something we think would be hard to read on your own, we will offer to go through it with you, or send it to a doctor or another person you nominate, rather than simply refusing. If we do withhold any part, we will tell you which part, why, and how to complain about that decision, in writing.
Correcting it. If something we hold about you is wrong, out of date, incomplete or misleading, you can have it corrected. You can change your address, your phone number, your emergency contact and your access notes yourself in the Client Hub, and the change reaches the carer who is coming. Anything the Hub does not let you change — your name, who arranges your care, your care plan, a visit note — you can still have corrected: email hello@yarroweecare.com.au or ring 03 4329 0128. We will answer within 30 days at the latest, and there is no charge. If we disagree that something is wrong, you can ask us to attach your own statement to the record and we will.
About this photo. It is kept with the rest of your care record, in Microsoft 365 in Australia. It is never stored on this website. Only you, our operator, and the carer assigned to a visit can see it — and the carer sees it in the carer app, for a visit they have been given, not in an email or a message. We do not use it to identify you automatically and we do not use face matching. You can remove it from this page at any time and it stops being shown straight away. Removing it takes it out of use immediately; the record it sat in is kept for the seven years Victorian law requires, as the rest of your record is.
Your device. When you sign in to the Client Hub, we store a secure sign-in token on your device so you do not have to sign in again each time you open it. It is kept for up to 30 days, and signing out removes it from your device straight away. Once you are signed in, the Client Hub shows your name, your address, your visit times and your carer's first name. So on a shared or public device, or a phone you hand to someone else, sign out when you have finished.
Advertising on Facebook, Instagram and Google. Our website uses the Meta Pixel, a small piece of code from Meta, the company behind Facebook and Instagram. It tells Meta when a page on this site is viewed and when someone signs up to our Priority list or sends us a carer application, so that Meta can measure how our ads are working and show them to people who may be interested. We use Meta's restricted setting for health services, which removes the addresses of the pages you look at and any extra detail. We also use the Google tag from Google Ads, which tells Google when someone who reached us from one of our Google ads signs up to our Priority list, so we can see which ads work. Our Google Ads tag has ad personalisation switched off, so it isn't used to build advertising lists. We also use Google Analytics to see how people find and use our website, such as which pages are visited. Google Analytics may use Google signals, which can link visits across devices and use them for ad personalisation for people signed in to Google. You can control this in your Google Ad Settings at adssettings.google.com. Google Analytics doesn't receive your name, contact details or health information, and you can block it by blocking cookies in your browser or using Google's opt-out browser add-on. We never send Meta or Google anything about your health or the care you receive. Each may use what it receives under its own privacy policy. If you would rather they did not, you can change your ad settings in Meta's ad preferences in your Facebook or Instagram account or in Google's My Ad Center, or block or clear cookies in your browser settings.
If you apply to work with us. When you apply through this site we collect what you give us, including your experience, the resume file you attach, and the referee contacts you name. We use them to assess your application and to contact your referees. Your resume uploads through our website provider Wix, we copy it into our own systems and we delete the Wix copy, though a cached copy can stay reachable for up to six months by anyone holding the exact link. If we make you an offer we then ask for a police check and your First Aid and CPR certificates - we never collect those through this website. If your application is not successful we keep it for six months and then delete it. If you join us, your application becomes part of your employment record. We keep it for as long as we keep the rest of your employment record.
One change is already scheduled. New Commonwealth requirements about disclosing automated decision-making take effect on 10 December 2026. The automated decisions section above is written to meet them, and we will review it before that date.

Privacy policy v1.6 · 9 October 2026 · Yarrowee Care Pty Ltd trading as Yarrowee Home Care · ACN 701 001 416 · ABN 45 701 001 416