App privacy, cookies & ad measurement

Draft version: 9 October 2026

Review notice: This expanded app policy is a draft awaiting business and legal review, including the complete provider processing locations. It describes the current product and documented hosted configuration. It is not a certification of privacy or NDIS compliance. For questions or a copy in another format, email hello@thimblecare.com.

1. What this policy covers

This policy explains personal information handled through the ThimbleCare website and mobile app, worker subscriptions, participant and family accounts, and support requests. “We” means Joshua William Coleman trading as ThimbleCare, ABN 97 507 616 423, the operator of the app and website. Workers use the app to administer their own services; their handling of participant information is also subject to their own privacy and record-keeping responsibilities.

The worker terms and participant terms cover use of the product. This policy is information about privacy practices, not consent to every possible use of your information. A specific permission or consent request may apply when you upload, share or act on a record.

If you joined the earlier waitlist, the earlier waitlist privacy policy remains available for the information supplied at that time.

2. Information we collect and hold

The information depends on your role and which features you use. It can include:

• Account and contact information: names, email addresses, phone numbers, sign-in and account identifiers, account roles, preferences and invitations.
• Worker business information: ABN, business details, credentials and expiry dates, tax or GST settings, rates, income, expenses, receipts, financial reports, subscription references and payment status. Invoices and uploaded financial documents can contain bank payment details supplied for those records.
• Worker identity verification information, when that feature is enabled and you choose to use it: identity document details and photos, a matching live-capture selfie, verification references and results. The Stripe Identity handling described below is separate from device unlocking.
• Participant information: name, date of birth, NDIS number, contact details, state, plan details, goals, funding amounts, authorised representatives and support-team permissions.
• Support and business records: service agreements, signatures and acceptance records, scheduled and completed shifts, notes, timesheets, corrections, disputes, invoices, incidents and documents uploaded or generated in the app. These records may contain health, disability and other sensitive information.
• Authority and consent information: nominee or guardian evidence where supplied, consent choices, changes to access and the actions taken on behalf of someone else.
• Support and technical information: messages you send us, device or browser details, network and request information, authentication and security events, audit records, delivery status and error logs. If push notifications are enabled, the app can register a device delivery token and your notification choices.
• Website campaign information: the limited campaign and click-reference fields described in the cookies section below.

Stripe receives the payment details you enter at subscription checkout. ThimbleCare holds subscription and transaction references and status rather than a copy of your full payment-card number. Device biometric templates used for Face ID or fingerprint unlocking stay with the device's biometric system; the app uses the authentication result and does not receive those templates. That device-only statement does not apply to an identity verification selfie supplied to Stripe.

3. How information reaches us

We collect information when you create or use an account, upload a document, record support work, accept an invitation, sign or dispute a record, choose a subscription, or ask for help. Some information comes from the worker providing your support, a participant, an authorised representative or a person you permit to see or act on records. Payment and delivery providers return status information needed to run those features.

Workers and representatives must have a lawful basis for the information they supply. They should explain what is being recorded, why it is needed and who will see it. Health and disability information requires particular care, including informed consent where required by law. Being a family member or receiving an invitation does not automatically authorise decisions for another person. We may ask for evidence of authority.

You can ask a general question without giving your full name. To operate an identified account, verify authority, sign a record, deliver messages or administer a subscription, some identifying information is necessary. If you choose not to provide a required field or withdraw a necessary permission, the affected feature may be unavailable. We can explain the consequence and discuss alternatives. Do not upload information unrelated to your use of the service.

4. Why we use information

We use information to provide accounts and authorised access; keep and display support and business records; prepare documents and invoices; support signing, corrections and disputes; deliver sign-in codes, invitations and service messages; administer worker subscriptions; answer requests; maintain security and audit trails; troubleshoot failures; and fulfil applicable legal duties.

We do not sell participant care records or send care records to advertising tags. Website ad measurement is separate from care records, can be turned off, and does not permit unrelated use of health or disability information. Marketing choices do not determine whether you can use the trial.

App support tickets

Where the app support form is available, it collects the reply email, topic and description you enter, the app platform and version, and an error request reference only if you choose to provide one. It does not automatically attach care records, screenshots or device logs. A signed-in request can be associated with the submitting account in our private support records. Enter only what is needed to explain the problem; avoid passwords, payment details and identifiable care information.

The ticket is saved and forwarded through our email provider to the configured support inbox. A saved-ticket receipt confirms that we have recorded the request; it does not confirm email delivery or promise a response time. Any separately configured automated assistant must identify its replies and refer privacy, account authority, billing actions and uncertain issues for human review. Support emails do not verify account authority or grant permission to change records.

Email and text choices

Worker trial sign-up requires a phone number. Optional email and text updates have separate choices that start unchecked; supplying a phone number does not opt you into marketing. Participants can add a phone number and choose text updates through Email and text preferences.

When you choose these updates, we may send setup tips, reminders about your trial and plan offers, reminders to return to the app, and offers to rejoin. The timing can depend on your account role, trial dates, subscription status and last sign-in. The initial automated sequences cover new accounts after activation, rather than enrolling existing beta accounts automatically. Text sequences run only when text delivery is enabled and you have chosen text updates.

You can change either choice in Email and text preferences. Promotional messages also contain a link to stop that channel's optional updates. Changing these choices does not cancel your trial or subscription, close your account or erase your records. Essential sign-in codes, invitations and service emails are handled separately; a welcome email can confirm an account or accepted invitation without a marketing opt-in.

App rules automatically check account roles, consent and authority, required profile fields, record state, and trial or subscription status before allowing some actions. For example, a missing required identity field can stop an agreement signing action, and an expired trial can restrict a worker action until a subscription is chosen. When worker identity verification is enabled, the Stripe result can also affect completion of worker setup. These checks may affect access or record workflows. Ask support to review an incorrect result; supplying a document or changing a field does not itself mean an action is approved. Where document-field extraction is offered, the suggested values require human review. ThimbleCare does not decide NDIS eligibility, allocate NDIS funding or make clinical decisions.

5. Who may receive information

Within the app, information is shown to the worker, participant and other people whose current role and permissions permit it. Different supporters and nominees may have different rights. A worker or authorised user can deliberately share an invoice or other document with a plan manager or another recipient. Check the intended audience before sharing. Someone who receives or downloads a copy may keep it outside ThimbleCare, where their own responsibilities apply.

Authorised operational personnel and service providers may handle information needed to host, secure and support the service. The services register describes the providers and purposes. Providers receive information relevant to their function, which can include technical metadata as well as content they host or deliver.

We may disclose information when required or authorised by law, to respond to a lawful regulatory request, or where legally permitted to address a serious safety or security risk. The app does not routinely submit your records to the NDIS, NDIA or NDIS Commission on your behalf. You remain responsible for any reporting or claims you must make.

6. Providers, Australian storage and overseas handling

The documented hosted configuration places the main Supabase database and private document storage in its Sydney region (ap-southeast-2). Google Cloud runs backend and document services and the document encryption key service in its Sydney region (australia-southeast1). These are the locations configured for core product storage and services; they are not a guarantee that every copy, request, log, support operation or provider subprocess stays in Australia.

Other configured services include:

• Vercel: hosts the web app, including requests and rendered pages, and provides the limited marketing analytics described below. Its published terms allow processing in the United States and other countries where it or its providers operate. Web hosting can therefore involve information and technical metadata outside the core Australian database.
• Resend: sends sign-in codes, invitations, notifications and configured app support ticket emails, including recipient details, message contents, links and delivery logs. The documented domain sends from the Tokyo region in Japan. Resend states that stored email data is held in the United States regardless of the sending region.
• ClickSend, when text delivery is enabled: sends optional account, setup, trial and plan-update texts to people who choose them. It handles the destination phone number, message and links, and delivery information. ClickSend and its delivery partners may handle information outside Australia; an Australian phone number or sender does not promise Australian-only processing. See ClickSend privacy and its subprocessor list.
• Stripe: processes worker subscription checkout, payment information and billing status. When worker identity verification is enabled, Stripe Identity also handles the identity document and matching selfie check. Stripe operates internationally and may process information in countries where it and its providers operate. Its account country does not establish a country for every processing activity, and no Australian-only location is promised for identity verification.
• Advertising providers: Meta, Google and TikTok receive the limited website measurement information described below when the relevant tag is configured and measurement is on. Measurement is on by default unless you turn it off or your browser sends a Do Not Track or Global Privacy Control signal.

Providers may use their own infrastructure and subprocessors. Their policies include Supabase privacy, Google Cloud privacy, Vercel privacy, Resend privacy and Stripe privacy. Resend's storage distinction is explained on its security page.

The complete country list for all vendor support and subprocessors has not yet been verified; we do not claim Australian-only processing. Ask us about a particular data flow before using it if an overseas location affects your decision. We need to assess overseas handling and the protections applicable to it; this policy does not ask you to waive protections or accountability under Australian privacy law.

Worker identity photos and selfies

When this verification feature is available and you choose to proceed, the Stripe verification interface collects an accepted government identity document, such as a driving licence, passport or identity card, and a live-capture selfie. Stripe checks the document and compares the face images; this can involve sensitive biometric information. Read the notice and consent choice in that interface before submitting. Your ThimbleCare account reference is associated with the verification so the result can be applied to your setup.

The app integration records the verification reference, result and a limited failure category rather than copying the raw ID photos or selfie into ThimbleCare's own records. Stripe retains verification data and may make images and extracted details available to authorised business users through its dashboard. See Stripe's explanation of identity verification and access to verification results.

You can stop before submitting and contact us about an alternative or an incorrect result; an alternative verification process is not promised to be available in the app. Contact us about the ThimbleCare verification record and contact Stripe through its privacy options about information it handles, biometric consent or deletion. Provider retention and lawful requirements may affect what can be deleted. Cancelling a ThimbleCare account does not automatically redact a Stripe verification session.

7. Storage, devices and security

The product uses authenticated access, role and permission checks, encrypted transport, private document storage, document encryption and audit records. Different kinds of data and operational metadata use different protections. These controls reduce risk but cannot guarantee that misuse, loss or unauthorised access will never occur.

The mobile app can keep encrypted local copies for permitted offline use. Downloaded PDFs, screenshots, email and files you export may remain on your device or in services you choose outside the app. Protect those copies, keep your device and email secure, and avoid sharing sign-in codes. Optional device permissions, such as notifications or camera access for a feature you choose, can be managed through your device settings.

Tell us promptly if you believe a record was accessed incorrectly. We will investigate suspected breaches and take action appropriate to the circumstances. Where the Notifiable Data Breaches scheme or another law requires notification, we will notify the affected people and authority as required. We do not promise that an account lock or link revocation erases copies already downloaded.

8. How long information is kept

Retention depends on the record, its purpose and applicable legal duties. Keeping an account active is not the only reason a record may need to remain. Signed documents, service, financial, consent, incident and audit records may need to be retained after a worker-participant relationship or account ends.

The app assigns retention categories to records. Some incident records are configured for seven years from the incident; incident records relating to a person who was under 18 at the time are configured to be kept until their 25th birthday. Other categories may run from a service date or account closure. These categories do not mean every record is automatically deleted on a single seven-year deadline, or determine every worker's legal retention duty.

Basic app support tickets expire in our application database 90 days after submission and are removed by routine processing. Email copies in the receiving support inbox and provider systems can have a different retention period; the database expiry does not erase those copies or metadata-only security and audit records.

You can ask us to explain retention for a particular record and request deletion or de-identification of information no longer needed. We will assess the request, including lawful retention, another person's rights, disputes, security records and backup cycles. We will explain what can be removed, what must remain and why. Closing an account, ending billing or withdrawing consent are separate actions and do not automatically delete all records.

9. Access, correction, consent and account closure

To request deletion without signing in or reinstalling the app, use Delete your ThimbleCare account or data. That page explains how to submit a request, what happens next and which records may need to remain.

You can view records within your authorised account. To request other information we hold about you, a correction, a copy, deletion, a restriction on sharing, withdrawal of consent or account closure, email hello@thimblecare.com. State what you need and a safe way to contact you. Do not email passwords, one-time codes or unnecessary health documents.

We may need reasonable identity or authority checks so we do not disclose someone else's information. We will respond within a reasonable period, aiming for 30 days, and explain any delay. There is no charge to make a privacy request. We will tell you in advance if a lawful, reasonable charge for providing access would apply. If access or correction cannot be granted, we will explain the reason and available complaint options, subject to any legal restriction.

Some signed or audited records need a correction or a statement of dispute instead of replacing the original. Existing NDIS number and date-of-birth fields may require support to correct once saved. We will explain the appropriate process. Where appropriate, ask the worker who created the record as well; that does not prevent you contacting us directly about information ThimbleCare holds.

Withdrawal of consent applies to future handling that relies on that consent. We will explain any effect on the relevant feature and any information that must lawfully remain. If you need help to understand or make a request, you can ask a chosen support person to assist, with suitable authority and without giving them your password.

10. Privacy complaints

Email hello@thimblecare.com with “Privacy complaint”, what happened and the outcome you seek. We will acknowledge the complaint, investigate, seek any information reasonably needed and explain our response and options. We aim to provide a substantive response within 30 days and will explain if more time is needed.

If you are unhappy with our response, you can contact the Office of the Australian Information Commissioner. The OAIC generally asks you to complain to the organisation first and allow a reasonable time, usually 30 days, for a response. Its jurisdiction and other applicable complaint channels depend on the circumstances. You may also contact an appropriate health privacy or other regulator where applicable.

11. Website cookies and ad measurement choices

When you arrive from an ad, we save the campaign details and ad click reference in a first-party cookie called tc_attrib. It lasts for 30 days. It helps us understand which ads lead to a free trial. We pass these details to worker sign-up and save them with the new worker account. We keep only the campaign and click fields, with a limit of 200 characters per field. The account copy is distinct from the browser cookie and is not automatically erased when that cookie expires.

We use Meta Pixel and the Google tag, and may use TikTok Pixel, on our marketing pages and worker sign-up page when the relevant tag is configured. Ad measurement is on by default, and you can turn it off at any time. The tags measure page views, clicks to start a trial, a started free trial and a worker’s first subscription payment. Those last two are measured on the two worker app pages that confirm them, with the page address only. We do not send your name, email, password, participant information or care records in these events. We do not use advanced matching or send form values to advertisers. Ad providers may receive browser and device information, the page address and their own cookie or click references. They may process this information outside Australia.

If your browser sends a Do Not Track or Global Privacy Control signal, ad measurement stays off. You can choose “Turn off” on the notice, or use the button below, and still start your trial. We save your choice in a cookie called tc_ad_measurement for 12 months. A different website host may show the notice again. Turning it off stops new ad events. Clearing cookies removes saved campaign details and your choice from this browser, and turns ad measurement back on unless your browser sends one of those privacy signals. It does not withdraw information already sent to a provider or delete an account record.

Ad tags never load on participant, supporter or admin pages, or on worker app pages other than the two confirmation pages above. Public rate cards also stay free of ad tags. We keep ad events separate from care records. Provider information is available from Meta, Google and TikTok.

Vercel Analytics measures visits only on the home, trial and retired waitlist entry routes. It uses no analytics cookies. We remove query strings and fragments from permitted analytics page addresses and reject private, authentication, invitation, agreement, public document-share, rate-card and other routes. Vercel receives technical information about permitted visits, such as browser/device type and approximate geography; its analytics privacy information explains that handling. This traffic analytics is separate from the advertising measurement choice.

Account cookies and secure app session storage are used to keep you signed in. Blocking or clearing essential session storage can sign you out or prevent account features from working.

12. Changes and contact

We will date changes to this policy and explain material changes to information handling through an appropriate notice. A new policy does not itself grant a new sensitive-information or advertising consent. Any required consent must be sought separately.

For privacy questions, requests or an accessible copy, email hello@thimblecare.com.