Sproutful Privacy Policy

Last updated 6 November 2026

What this Policy Covers

This Privacy Policy (Policy) is tailored for Sproutful, an Australian family care-record digital platform which enables parents, carers and authorised professionals to share and access child and family wellbeing records. It is designed to align with the Privacy Act 1988 (Cth) (Act), Australian Privacy Principles (APPs, accessible at the Office of the Australian Information Commissioner’s website, https://www.oaic.gov.au/privacy/australian-privacy-principles) and health-information obligations.

This Policy sets out how we comply with the Act, including the APPs.

The full listing of APPs is located at the website: https://www.oaic.gov.au

Under APP1, we are required to have a clearly expressed and up-to-date privacy policy about how we manage personal information.

This Policy outlines how we handle personal information and how we comply with the APPs set out in Schedule 1 of the Act. It covers the Sproutful web application, our website at sproutful.app, our iOS and Android apps, and the related services you can reach once you have an account.

This Policy explains how we handle Personal Information and Health Information. It applies to Account Holders, Care Circle members, Contributors, Participants and Visitors.

Most people use Sproutful as a member of Care Circle that someone created for an organisation, a service or a household, and invited them to join. The Account Holder decides what information goes into Sproutful and who in the Care Circle can see it. Where a Care Circle records information about a Participant, our agreement with the Account Holder sets out its responsibility for the notices and consents that cover that information. This Policy describes what we do with information once it reaches us.

If you have a question about why a particular record exists or who can see it, the Account Holder is usually the right person to contact. We will help them provide answers to you.

Within our permission model, the Account Holder decides who in the Care Circle sees what. But we determine what the platform collects, how long we keep it, who we disclose it to, where it is hosted and what the defaults are. Those are our decisions and our obligations.

We cannot guarantee that information entered by Care Circle members is accurate, complete or clinically appropriate. This Policy does though set out how we handle corrections and disputes.

Please note that we are not a substitute or replacement for a formal health record: the Participant’s authoritative clinical record remains with the treating provider and is that record.

How You Agree To This Policy

Creating a Sproutful account, creating a Care Circle, or joining one, means you accept the way this Policy says we will handle Personal Information and Health Information.

Terms Used In This Policy

• Account Holder means the person, organisation, service provider or household that a Care Circle in Sproutful was created for and who administers that account. An Account Holder creates an account, invites and removes Care Circle members, sets permissions, exports and deletes data and can nominate a successor. If you created a team for yourself, you are the Account Holder.
• Care Circle means people whom an Account Holder invites to use Sproutful, with permissions which an Account Holder sets.
• Contributor means a clinician, carer, support worker or administrator who uploads or views information through Sproutful.
• Health Information has the meaning given in the Act, being any personal information about one’s health or disability entered into Sproutful by an Account Holder, Participant, Care Circle member or Contributor. Notes, tasks, medication records and session records kept about a Participant will usually be Health Information and contain medical history, treatment records, assessments, referrals and health service information, and we treat them accordingly.
• Our website means sproutful.app.
• Participant means a person whose care, support or progress is recorded in Sproutful. In the app we call a Participant a Sprout. The two words mean the same thing, and this Policy uses Participant throughout. A Participant may but need not be an Account Holder.
• Personal Information has the meaning given in the Act. Broadly, it is information about an identified individual or an individual who is reasonably identifiable.
• Sproutful or the app means the Sproutful web application, our website at sproutful.app, our iOS and Android apps and the related services you can use once you have an account.
• Visitor means anyone browsing Sproutful or contacting us for support.
• We, us and our mean Sproutful Pty Ltd ABN 87 687 351 604.
• You and your mean a person who uses Sproutful either as one who administers that account or as part of a Care Circle.

Defined words in this Policy are capitalised and some are defined in our Terms and Conditions where they are not set out above.

Why We Use Information

We use Personal Information to:

• provide the Services, in creating accounts, storing and displaying records, enforcing permissions, syncing across devices, sending notifications and reminders, processing subscriptions and providing support;
• keep the Service safe and working, prevent fraud and abuse, monitor security, review access-logs, debugging, capacity planning and disaster recovery;
• improve Sproutful, by aggregated and de-identified analytics about feature usage;
• meet legal obligations, such as responding to lawful requests, complying with current laws and maintaining records of consents and disclosures and
• communicate, using service announcements, security alerts, and - with your consent - product news.

What Information We Collect And Hold

We collect Personal Information and Health Information about people who use Sproutful and about Participants. The main kinds are:

• account information - your name, date of birth, gender and pronouns, contact details, sign-in credentials, your role in the account, and a profile photo if you add one;
• information entered into Sproutful - the notes, reminders, records, messages, forms and attachments which you and others in your account create as you use Sproutful;
• information about Participants - where you record information about a person you support, it is held in your account and will usually include Health Information about that person;
• Care Circle data - invitations, permission grants, access logs, comments, task assignments and messages;
• payment information - subscription status and billing contact. Card payments are processed by our payment provider and we do not receive or store card details or full card numbers, except for card brand and the last 4 digits of a card so that you can identify your card;
• technical information - device, browser and app details, IP addresses, and information about how Sproutful is used, including diagnostic reports, website analytics, cookies and digital service information; and
• support correspondence - what you send us when you contact us and our replies.

We may hold your Personal Information and Health Information in a number of ways, including:

• in our computer systems or databases;
• in paper records, and/or
• in social media and surveys.

When and How We Collect Personal Information and Health Information

We collect Personal Information and Health Information:

• when you create an account, or when you join a Care Circle by invitation;
• as you use Sproutful and enter information into it;
• when you communicate with other people through Sproutful;
• automatically from your device and browser as you use Sproutful;
• when you contact us for support, or respond to us; and
• from our payment provider, which tells us whether a subscription is active.

We do not buy Personal Information and Health Information and we do not collect such information from data brokers or from public sources.

We may collect information about your visit to Sproutful and use cookies to assist us to measure and improve the Services and understand how to improve them.

Cookies are small information files that an end user’s web browser places on their computer when a website is visited. For information on disabling cookies, please go to the privacy settings section within your browser.

We retain the content and associated data of any email that you send to us if we believe we have a legal requirement to do so. Your email message content may be monitored by our employees and our response to you may also be monitored for quality assurance issues.

If the information needed to create and secure an account is not provided, we will not be able to give you access to Sproutful.

How We Use Personal Information and Health Information

We hold Personal Information and Health Information to provide an Account Holder, Participant, Care Circle member and Contributor with the ability to use Sproutful.

We use Personal Information to:

• operate Sproutful and provide the features your account uses;
• sign you in, verify who you are, and keep accounts secure;
• show records to the people in a Care Circle who have been given access to them by an Account Holder;
• respond to support requests and help resolve problems;
• send service messages, such as changes to the app, security notices and outages;
• manage subscriptions and billing;
• understand how Sproutful is used so we can diagnose faults and improve it;
• keep Sproutful safe and prevent misuse: automated systems check uploaded images for explicit content, unless the Account Holder has switched these checks off, and we may cover a flagged image, decline it, or limit who can see it until the Account Holder, or someone they have authorised, has reviewed it;
• identify misuse, investigate security events and enforce our separate Terms and Conditions; and
• meet our legal obligations and establish or defend legal claims.

Where we rely on your consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect anything we did lawfully before you withdrew it, and it may mean parts of Sproutful no longer work for you.

Marketing

We send marketing about Sproutful only where you have agreed to receive it, and every marketing email has an unsubscribe link. Unsubscribing does not stop service messages about your account, which we still need to send.

What We Do Not Do

• We do not track your location. Sproutful does not request location permissions from your device, does not use GPS and does not attach a location to notes.
• We do not use your information for advertising, and we do not let third parties use tracking technologies on our Services to advertise to you.
• We do not sell Personal Information or Health Information or rent mailing lists.
• We do not collect, use or disclose Health Information regardless of whether it is necessary for research, the compilation or analysis of statistics, is relevant to public health or public safety. We certainly never do so to data brokers, insurers, employers or debt collectors, or use it for credit scoring.
• We do not use the content in your account to train artificial intelligence (AI) models.

How We Secure and Protect Information

We take reasonable steps to protect Personal Information and Health Information from loss, misuse, interference, unauthorised access, modification and disclosure. Those steps include:

• encryption of information in transit and at rest;
• role-based access within an account, so people see only what the Account Holder has given them access to;
• multi-factor authentication on the administrative accounts we use to run the Service;
• continuous logging and alerting, with anomaly detection on access patterns;
• independent penetration testing at least annually and after major architectural change;
• a vulnerability disclosure programme;
• vendor security assessment before onboarding and annually thereafter;
• mandatory annual privacy and security training for all staff, plus role-specific training for engineers and support;
• documented incident response plan tested at least annually;
• using a managed authentication provider rather than using passwords which we handle ourselves;
• contracts with our service providers covering the security of information they hold for us; and
• limiting access by our staff and contractors to what is needed to support and operate Sproutful, subject to confidentiality obligations.

We also take reasonable steps to keep information accurate, up-to-date, complete and relevant to the extent we control it. Because much of the content is user-entered, we provide tools - prompts to review stale entries, conflict flags, version history and correction workflows - rather than guarantee accuracy.

Every entry carries an author, timestamp and version history. Deletions are soft by default with a 30-day recovery window and the audit log records deletions. We do not silently alter user content.

Before we act on a request for access to information, we will check that the person asking is who they say they are.

Please contact us immediately at security@sproutful.app if you believe that information in a Sproutful account has been lost, altered or seen by someone who should not have seen it.

Who We Share Information With

We disclose a Participant’s Personal Information to Care Circle members according to the permissions which an Account Holder sets.

We can disclose a Participant’s Health Information to a Responsible Person where:

• the Participant lacks the capacity to consent or is unable to communicate consent; and
• the disclosure is either necessary to provide appropriate treatment, or is made for compassionate reasons.

We pass Personal Information to a third party only when we need to in order to run Sproutful for you, when the law requires or permits it, or when you or your Account Holder have asked us to. In practice this means the providers who host and operate parts of Sproutful for us, and the provider which processes payments, each of whom may use the information only for the work we have engaged them to do.

We may also disclose Personal Information:

• where there is a serious and imminent threat to someone's life, health or safety, limited information to emergency services or a treating provider. We log every such disclosure and review it afterwards; and
• in connection with a sale, merger or transfer of our business, in which case the recipient would be bound to handle it consistently with this Policy. We will notify an Account Holder and give them an opportunity to export or delete all material before any transfer takes effect, and the buyer or counterparty will be bound by this Policy.

Where Your Information Is Stored

Your account information and almost everything entered into Sproutful is stored in Australia. Some technical information about how the app is used is processed by PostHog, a service provider, in the Federal Republic of Germany. It does not include notes, records or Health Information. Stripe, a payment provider, receives only your billing details which are processed in the United States of America and other countries in which Stripe operates.

Unless the Account Holder has switched explicit content checks off, images are checked automatically for explicit content by Google Cloud Vision, a service provider, on infrastructure in the European Union. Google uses an image only to perform the check, does not use it to train its models and does not keep it afterwards. An image may include Health Information about a Participant; nothing else about the Participant is sent with it.

Before disclosing information to an overseas recipient, we must take reasonable steps to ensure the recipient does not breach the APPs, or obtain the recipient’s express consent not to do so. We rely on contractual safeguards, our assessment of the recipient's practices and on their express consent.

How Long We Keep Information

We keep Personal Information and Health Information for as long as it is needed for the purposes set out in this Policy, and for as long as we are required or allowed to keep it by law.

Records entered by an Account Holder about a Participant form part of that Account Holder's own records. Organisations working in disability and care are generally subject to their own record-keeping obligations, which in some Australian States and Territories include minimum retention periods for health records and may include obligations to keep records of the supports they deliver. We keep those records available to the Account Holder for the life of their account, and we act on their deletion instructions where we can do so consistently with our own legal obligations.

We may retain information where required by law, to resolve a dispute, to enforce our Terms and Conditions, to prevent fraud, or where another Care Circle member holds an independent copy. We tell you what we have retained and why.

Where information is subject to litigation, investigation or a regulatory request, deletion is suspended for the affected data only.

When we no longer need Personal Information, we delete or de-identify it. Where deletion is not immediately possible, for example, because information exists in backups, we isolate it from further use until deletion is possible.

We do not hold data hostage to a subscription. Users may export their records as follows:

• notes: an Account Holder may at no cost export a Participant's notes, including reminder notes, from Sprout’s web app at any time, for any date range and with filters, in CSV and/or PDF formats; or
• audit logs: an Account Holder with audit logs permission for their Care Circle may at no cost request a CSV log of Care Circle members' activity and changes to Participants and their information (being notes, reminders, profile, chat, posts) by emailing support@sproutful.app. We aim to provide these logs within 15 business days; or
• other account information not covered above may at no cost be requested via support@sproutful.app. We aim to provide these logs within 15 business days of our receiving your request; or
• bespoke requests needing manual compiling: we may charge a reasonable administrative fee which we quote for in advance.

An Account Holder may delete individual entries, sections or an entire account. On confirmed of account deletion we delete content from production within 30 days and from backups within a rolling backup window. We provide written confirmation of deletion on request.

Account Holders may nominate a successor who gains administrative control of an account on an Account Holder’s verified death or incapacity.

Accessing and Correcting Your Information

We take reasonable steps to make sure that the Personal Information which we hold is correct at all times.

If you have an account, most of your own details can be viewed and changed from your account settings. For anything you cannot see there, you can ask us what we hold about you and ask us to fix anything that is inaccurate.

If you do not have an account, you can still ask us. A Participant, or a person authorised to act for them, may ask for access to or correction of information which we hold about that Participant. Because those records belong to the Account Holder supporting the Participant, we will usually refer the request to that person, organisation, service provider or household and help them respond. Where we are required to respond to you directly, we will.

Please send your requests to privacy@sproutful.app. We will verify identity before acting on a request, and we aim to respond within 30 days.

There are situations where the law allows us to refuse access or correction. If that happens we will tell you why in writing, and explain how to complain about that decision.

Complaints

If you think we have mishandled your Personal Information or Health Information, breached the Act or the APPs, you should tell us. You can complain by email to privacy@sproutful.app or by post to the address below.

Complaints are handled in strict confidence. We will acknowledge yours within 5 business days, we will get in touch to understand what has gone wrong and talk through what can be done about it, and we aim to have it resolved within 30 days.

The Office of the Australian Information Commissioner (oaic.gov.au) can take up a complaint about our handling of Personal Information if 30 days have passed since you raised it with us and it is still unresolved, or if you are not satisfied with how we dealt with it.

Depending on where you live, an Australia State or Territory health complaints body may also be able to consider a complaint about the handling of Health Information.

If you are not satisfied, you may contact:

• Office of the Australian Information Commissioner (OAIC): 1300 363 992; www.oaic.gov.au
• Australian Competition and Consumer Commission (ACCC): 1300 302 502; https://www.accc.gov.au/ (for service or contract concerns), or your State or Territory consumer protection body.

The OAIC generally expects you to raise the matter with us first, but you may approach a regulator directly.

Data Breaches

We have a process for assessing suspected data breaches. Where a breach of Personal Information we hold is likely to result in serious harm, we will notify the individuals affected as soon as practicable, with a description of the breach, the information involved, recommended protective steps and our contact details and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme in the Privacy Act. We will also tell the relevant Account Holder.

Where we cannot reach individuals directly, we will publish a prominent notice in the app and on our website.

If you suspect a breach involving Sproutful, contact us at security@sproutful.app.

Changes To This Policy

We revise this Policy as our Services, our practices, hosting locations or the law change. A revision takes effect as soon as it is published, and the date at the top shows when the current version was last updated.

The current version is always at https://sproutful.app/privacy-policy. Where a change materially affects how we handle your information, we will notify Account Holders by in-app notification. Where we are required to do so, we will notify Account Holders by email at least 30 days beforehand, and give Account Holders the opportunity to export and delete information.

How To Contact Us

For questions about this Policy, to make an access or correction request, or to make a complaint:

Sproutful Pty Ltd
ABN 87 687 351 604
35 Caledonian Ave, Maylands WA 6051, Australia
Email: privacy@sproutful.app