Sproutful Privacy Policy

Last updated 23 September 2026

What this policy covers

This policy explains how Sproutful Pty Ltd handles personal information about people who use Sproutful. It covers our websites, our web application, and our iOS and Android apps.

Most people use Sproutful as a member of a team that someone created for an organisation, a service or a household, and invited them to join. We call the organisation, service or household the team belongs to the account holder. It decides what information goes into Sproutful and who in the care circle can see it. Where a team records information about a person they support, our agreement with the account holder sets out its responsibility for the notices and consents that cover that information. This policy describes what we do with information once it reaches us.

If you have a question about why a particular record exists or who can see it, the account holder is usually the right place to start. We will help them answer you.

How you agree to this policy

Creating a Sproutful account, creating a team, or joining one, means you accept the way this policy says we will handle personal information.

Terms used in this policy

• We, us and our mean Sproutful Pty Ltd (ABN 87 687 351 604).
• Sproutful or the app means our web application, our iOS and Android applications, and the related services you can use once you have an account.
• Our website means sproutful.app.
• You and your mean a person who uses Sproutful.
• Account holder means the organisation, service provider or household that a team in Sproutful was created for. If you created a team for yourself, you are the account holder.
• Participant means a person whose care, support or progress is recorded in Sproutful. In the app we call a participant a Sprout. The two words mean the same thing, and this policy uses participant throughout. A participant may have their own account, but often will not.
• Personal information has the meaning given in the Privacy Act 1988 (Cth). Broadly, it is information about an identified individual, or an individual who is reasonably identifiable.
• Health information has the meaning given in the Privacy Act. Notes, tasks, medication records and session records kept about a participant will usually be health information, and we treat them accordingly.

What personal information we collect and hold

We collect personal information about people who use Sproutful and about the people whose care is recorded in it. The main kinds are:

• Account information — your name, contact details, sign-in credentials, your role in the account, and a profile photo if you add one
• Information entered into Sproutful — the notes, tasks, records, messages and attachments that you and others in your account create as you use the app
• Information about participants — where you record information about a person you support, it is held in your account and will usually include health information about that person
• Payment information — subscription status and billing contact. Card payments are processed by our payment provider and we do not receive or store card numbers
• Technical information — device, browser and app details, IP address, and information about how the app is used, including diagnostic reports
• Support correspondence — what you send us when you contact us, and our replies

When and how we collect it

We collect personal information:

• when you create an account, or when you join a team by invitation
• as you use Sproutful and enter information into it
• when you communicate with other people through the app
• automatically from your device and browser as you use the app
• when you contact us for support, or respond to us
• from our payment provider, which tells us whether a subscription is active

We do not buy personal information, and we do not collect it from data brokers or from public sources.

If the information needed to create and secure an account is not provided, we will not be able to give you access to Sproutful.

How we use personal information

We use personal information to:

• operate Sproutful and provide the features your account uses
• sign you in, verify who you are, and keep accounts secure
• show records to the people in a care circle who have been given access to them by the account holder
• respond to support requests and help resolve problems
• send service messages, such as changes to the app, security notices and outages
• manage subscriptions and billing
• understand how the app is used so we can diagnose faults and improve it
• identify misuse, investigate security events and enforce our terms
• meet our legal obligations and establish or defend legal claims

Where we rely on your consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect anything we did lawfully before you withdrew it, and it may mean parts of Sproutful no longer work for you.

Marketing

We send marketing about Sproutful only where you have agreed to receive it, and every marketing email has an unsubscribe link. Unsubscribing does not stop service messages about your account, which we still need to send.

AI features

Sproutful includes features that use artificial intelligence to help your team, for example by drafting a summary of the notes recorded for a participant. Where an AI feature has been enabled for a participant, information held in the account may be used to run it.

These principles apply to every AI feature we offer:

• An AI feature only touches information for the participants it has been enabled for
• AI never makes a decision on its own. It drafts, suggests or flags, and a person on your team decides what to do with the result
• Anything an AI feature produces carries a label saying so, and sits alongside the original record rather than replacing it
• We do not use your content to train AI models
• For Australian accounts, AI processing takes place in Australia
• Before enabling an AI feature, the account holder is responsible for telling participants or their nominees, and for obtaining whatever consent the law requires

Our AI & Data Usage Policy, at https://sproutful.app/ai-data-usage, explains each feature in detail: what leaves Sproutful and what stays, which providers we use and where they process, how long AI output is kept, and the controls available to you. That document forms part of this policy.

What we do not do

• We do not track your location. Sproutful does not request location permissions from your device, does not use GPS, and does not attach a location to notes.
• We do not use your information for advertising, and we do not let third parties use tracking technologies on our services to advertise to you.
• We do not sell personal information.
• We do not use the content in your account to train AI models.

How we protect information

We take reasonable steps to protect personal information from loss, misuse, interference, unauthorised access, modification and disclosure. Those steps include:

• encryption of information in transit and at rest
• role-based access within an account, so people see only what the account holder has given them access to
• multi-factor authentication on the administrative accounts we use to run the service
• a managed authentication provider rather than passwords we handle ourselves
• contracts with our service providers covering the security of information they hold for us
• limiting access by our staff and contractors to what is needed to support and operate Sproutful, subject to confidentiality obligations

Before we act on a request for access to information, we will check that the person asking is who they say they are.

Please contact us straight away at security@sproutful.app if you believe information in Sproutful has been lost, altered, or seen by someone who should not have seen it.

Who we share information with

We pass personal information to a third party only when we need to in order to run Sproutful for you, when the law requires or permits it, or when you or your account holder have asked us to. In practice that means the providers who host and operate parts of Sproutful for us, and the provider that processes payments, each of which may use the information only for the work we have engaged them to do.

We may also disclose personal information in connection with a sale, merger or transfer of our business, in which case the recipient would be bound to handle it consistently with this policy.

Where your information is stored

Your account information and everything entered into Sproutful is stored in Australia. Some technical information about how the app is used is processed by a service provider outside Australia, in the European Union. It does not include notes, records or health information.

How long we keep information

We keep personal information for as long as it is needed for the purposes set out in this policy, and for as long as we are required or permitted to keep it by law.

Records entered by an account holder about a participant form part of that account holder's own records. Organisations working in disability and care are generally subject to their own record-keeping obligations, which in some states include minimum retention periods for health records and may include obligations to keep records of the supports they deliver. We keep those records available to the account holder for the life of their account, and we act on their deletion instructions where we can do so consistently with our own legal obligations.

When we no longer need personal information, we delete it or de-identify it. Where deletion is not immediately possible, for example because information exists in backups, we isolate it from further use until deletion is possible.

Accessing and correcting your information

If you have an account, most of your own details can be viewed and changed from your account settings. For anything you cannot see there, you can ask us what we hold about you and ask us to fix anything that is inaccurate.

If you do not have an account, you can still ask. A participant, or a person authorised to act for them, may ask for access to or correction of information we hold about that participant. Because those records belong to the account holder supporting the participant, we will usually refer the request to that organisation and help them respond. Where we are required to respond to you directly, we will.

Send requests to privacy@sproutful.app. We will verify identity before acting on a request, and we aim to respond within 30 days.

There are situations where the law allows us to refuse access or correction. If that happens we will tell you why in writing, and explain how to complain about that decision.

Complaints

If you think we have mishandled your personal information, or breached the Privacy Act or the Australian Privacy Principles, tell us. You can complain by email to privacy@sproutful.app or by post to the address below.

Complaints are handled in confidence. We will acknowledge yours within 5 business days, one of us will get in touch to understand what has gone wrong and talk through what can be done about it, and we aim to have it resolved within 30 days.

The Office of the Australian Information Commissioner (oaic.gov.au) can take up a complaint about our handling of personal information if 30 days have passed since you raised it with us and it is still unresolved, or if you are not satisfied with how we dealt with it.

Depending on where you live, a state health complaints body may also be able to consider a complaint about the handling of health information.

If something goes wrong

We have a process for assessing suspected data breaches. Where a breach of personal information we hold is likely to result in serious harm, we will notify the individuals affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme in the Privacy Act. We will also tell the relevant account holder.

If you suspect a breach involving Sproutful, contact us at security@sproutful.app.

Changes to this policy

We may revise this policy as our services, our practices or the law change. A revision takes effect as soon as it is published, and the date at the top shows which version you are reading.

We will make a reasonable effort to draw your attention to changes, and it is worth checking back from time to time. If you keep using Sproutful after a revision is published, you accept it.

How to contact us

For questions about this policy, to make an access or correction request, or to make a complaint:

Sproutful Pty Ltd
ABN 87 687 351 604
35 Caledonian Ave, Maylands WA, 6051
Email: privacy@sproutful.app