Privacy Policy

Effective date: 7 November 2026  ·  Last updated: 7 November 2026

Kin Tho (ABN 37 320 140 514) ("we", "us", "our") operates the For Samuel mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our App. We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

For Samuel is developed and operated by Kin Tho (ABN 37 320 140 514), an Australian sole trader. For privacy enquiries, contact us at privacy@forsamuel.com.au.

2. Information we collect

We collect information you provide directly, information generated through your use of the App, and limited technical information.

• Account information: Your name and email address. If you sign in with Google or Apple, we get your name and email from them. If you use a password, our sign-in provider stores it scrambled, and we never see it.
• Website waitlist: If you use the website form to register your interest, we collect the email address you enter, the time it was submitted, the page/source, and the collection-purpose wording/version shown to you. This is separate from an App account and does not subscribe you to launch emails or marketing.
• Care data: Care logs, shift records, family events (shared Care Hub reminders, family outings), appointments (therapy, GP, school, kinder, daycare, hospital visits) including any external provider name you choose to record, Team posts, inventory entries, the Care Hub Guidebook (equipment notes, routines, instructions you record for the people who care for your loved one), and any other data you choose to enter about a care recipient. That includes the details you keep about the person: their date of birth and, if a baby was born early, their weeks at birth; their funding plan type and the dates and budgets of their past plans; and, if someone has passed away, that they have and the date. This data is sensitive and is stored encrypted in transit and at rest in our hosted database. If you share a calendar subscription link with another calendar app (Apple, Google, Outlook), that link exposes event titles, child name, and external provider name to anyone who holds the link until you revoke it from Calendar Settings.
• Contact details of other people: The Care Guidebook lets your Care Hub record emergency contacts — the name and phone number, plus an optional relationship label and note, of someone to ring during a shift: a grandparent with a spare key, a GP, a specialist on-call line. This is personal information about a person who may not hold a For Samuel account and who did not give it to us themselves. We use it only to display and dial that number inside the Care Hub that entered it. It is never used for marketing, never shared with the sub-processors listed below other than the hosting provider that stores it, and never used to train AI models. If you add someone as an emergency contact, you are responsible for making sure they know and are content for their details to be held this way. Contacts can be deleted from the Guidebook at any time and follow the deletion schedule in section 6. If that person contacts us directly at privacy@forsamuel.com.au and asks us to remove their details, we will do so.
• Care Plan data (paid feature): If you subscribe to Care Plan Pro (My Care Plan), we also store: plans you create (title, period, status), section bodies you draft, legislative citations you have selected as relevant, evidence links you create between plan sections and care logs / appointments / Guidebook entries, plan-level health scores, aggregated Care Snapshot summaries, and the structured documents and assessments you generate from your records — Lived Experience Statements, Annual Review submissions, Access Request letters, Variation request letters, Cover Letters of Joy, Care Snapshots, Wellbeing (Caregiver Strain Index) assessments, and Regulation monthly reports. These are compiled from your own logs, calendar, Guidebook, care stock, and plan content — For Samuel does not invent content and does not use your data to train AI models. All Care Plan data is treated as sensitive health and personal information and stored alongside your other care data.
• Provider / invoicing details (provider role only): If you use For Samuel as a support worker or sole-trader provider, we additionally collect your ABN, business name, address, bank account details (for inclusion on invoices you generate), funding scheme provider registration number where you choose to record one, and the invoices and line items you generate. If you set your own agreed rates for a person in a Care Hub, we keep those prices so they fill in on your invoices; they are deleted when you leave that Care Hub or delete your account.
• Details of your clients (provider role, Provider Pro): If you invoice someone who does not have a For Samuel account, you can record their name, email address, funding reference and plan type. With Provider Pro you can also keep dated care notes about them. This is personal and health information about a person who did not give it to us themselves. We hold it for you, to invoice and to look after that person. It is never used for marketing, never shared with the sub-processors listed below other than the hosting provider that stores it, and never used to train AI models. If you add a client, you are responsible for making sure they know you hold these details and why. A client can ask you what you hold. If they contact us at privacy@forsamuel.com.au and ask us to remove their details, we will do so.
• Photos: Photos you add (profile, logs, milestones, Team posts, Guidebook, About Me) are kept in private storage in Australia. Only people in your Care Hub can see them, and some are narrower: incident photos only their author and the hub’s admins can see, and photos on sensitive Guidebook entries and team reports only the hub’s admins.
• Device information: Device push token (for notifications), device platform (iOS/Android), app version, a short-lived app integrity token (see section 4), and—only if you choose to enable it—device-calendar write permission so For Samuel shifts can appear in your phone calendar. We do not read or import your existing device-calendar events.
• Voice input (optional): If you use the voice-to-text shortcut to dictate care log entries instead of typing, your device microphone is on only while you are dictating. Your phone’s own speech service (Apple or Google) turns your voice into text, and may send the audio to their servers to do it. We never receive or keep the audio, only the text you confirm, which becomes the saved log entry. The microphone is never used when you are not dictating, and every voice-enabled field can be completed by typing instead.
• Audit log: A record of sensitive operations (account deletion requested, household membership changes, invoice send / mark-paid, care plan delete, evidence-link create / delete, variation lifecycle changes) including a timestamp, the action you performed, and your source IP address. This audit log is kept to support customer-support investigations and meet our reasonable-steps obligation under APP 11. It is included in your data export. When your account is anonymised, the details that identify you — your account identifier and IP address — are removed from this log; a de-identified record that the action occurred may be retained for up to 7 years to meet disability-support audit obligations.
• Usage analytics: Pseudonymous usage events (such as screens visited and features used), linked to a one-way hashed app identifier so we can understand feature adoption and reliability without sending your name or contact details to analytics. Events can show which features and log types are used (for example, that a medication entry was saved), but never what was entered, nothing about the health of the person cared for (such as a missed dose, a symptom or an incident), and not the kind of care your hub is set up for. This data does not include health or care record content, free-text notes, or document content. We do not sell or share this data.
• Crash reports: In production builds, anonymised crash reports and stack traces are collected to help us identify and fix bugs. These reports do not contain health or care record content. The crash reporter keeps a random identifier for each install of the app. It is not linked to your account, and we never send it your account ID.
• Server logs: Our servers keep technical logs (the time of a request, which part of the app was called, errors and the IP address it came from). We keep these logs for 30 days.

3. How we use your information

• To provide and operate the For Samuel service.
• To send care-related notifications you have requested.
• To generate invoices and care reports on your instruction.
• To record and measure interest in For Samuel when you join the website waitlist.
• To improve the App through aggregated, pseudonymous analytics.
• To respond to your support requests.
• To comply with legal obligations.

We do not use your personal information for direct marketing, and we do not sell or rent it (APP 7). Because For Samuel is a shared care record that links carers to the people they support, the service cannot be used anonymously or under a pseudonym — an identified account is required to attribute care entries and control who can access them (APP 2.2(b)).

4. Data sharing

We do not sell your personal information. People in your Care Hub see what is shared there, based on the role the admin gives them. If you share a document, an invoice or a calendar link, whoever you send it to can see it. We use the service providers listed below to run the app. We will only disclose your information to anyone else if the law requires it (for example a court order), or to lessen a serious threat to someone’s life, health or safety. We will tell you if we are allowed to.

• Authentication provider — Google Firebase Authentication (USA) — stores your email address and your sign-in credentials (a scrambled password, or your Google or Apple link). This is hosted in the United States.
• Database and file storage provider — Supabase (on Amazon Web Services in Sydney, Australia) — stores your care records and photos. Your health and care data remains in Australia.
• Usage analytics platform — PostHog (EU) — receives pseudonymous usage events only, linked to a one-way hashed app identifier. No health or care record content, free-text notes, document content, name, or contact details are shared. You can turn analytics off in the app.
• In-app purchase platform — Adapty (USA) — receives your purchase records, an account ID and basic device details, so paid features switch on. No care data is shared.
• Crash reporting service — Google Firebase Crashlytics (USA) — receives anonymised crash logs and stack traces in production builds only. No intentionally included health data. It keeps a random installation identifier for the app install; it is not tied to your account and we never send it your account ID.
• App integrity check — Google Firebase App Check (USA), using Google Play Integrity on Android and Apple App Attest or DeviceCheck on iPhone — when the app talks to our server it sends a short-lived token that shows the request comes from a genuine copy of For Samuel on a real device. To issue the token, Google and Apple see a device integrity signal and the app’s identifier. They do not receive care records. We use it to keep bots and tampered copies of the app off the service. It is not used for advertising or tracking.
• Push notification service — Expo (USA) — app updates, and delivering notifications to Apple and Google. Our server sends each push notification to Expo’s push service with your device’s push token, so a notification’s text passes through Expo, Google and Apple on its way to your phone. We keep these texts general, like “A scheduled care item is overdue”, and never put care notes in them. Expo does not receive your care logs, records, or Care Plan content.
• Push notification delivery — Google Firebase Cloud Messaging and Apple Push Notification service (USA) — deliver push notifications to Android phones and iPhones respectively. They receive the same notification content and device push token as above, and nothing else.
• App updates — Expo (EAS) (USA) — delivers over-the-air app updates. No personal care data is processed.
• Sign-in providers — Sign in with Google and Sign in with Apple (USA) — if you choose one of these, Google or Apple confirms who you are and shares your email address with our authentication provider (Google also shares your name; Apple may give a private relay address instead of your real one). They do not receive any care data.
• Food search — USDA FoodData Central and Open Food Facts (USA and France) — when you search for a food or scan a barcode, our server sends only the search words or the barcode number to these public food databases. No account details, care recipient details or care logs are sent.
• Public holidays — Nager.Date (date.nager.at) (Germany) — the app asks this public service for your country’s public holidays. Only the country and the year are sent. No account details, care recipient details or care logs are sent.
• App settings — Google Firebase Remote Config (USA) — the app fetches on/off switches and settings from it (for example which countries are open). Like other Firebase services it sees a Firebase installation identifier and basic device details; it receives no care data.
• Application hosting — Google Cloud (Cloud Run and Functions), Sydney region (australia-southeast1) — runs the For Samuel server at api.forsamuel.com.au. Your data is processed on it when the app talks to our server, and our server logs (including IP addresses) are kept here for 30 days.
• Public website hosting — Cloudflare (global network) — hosts forsamuel.com.au and handles the waitlist form on it, including your IP address as part of normal web traffic.
• Waitlist storage — Google Cloud Firestore (Google Cloud, outside Australia) — if you join the waitlist on our website, your email address and the time you signed up are stored here. It is used only to record your interest; it does not subscribe you to marketing emails.
• Apple and Google — app downloads, payments, and, if you dictate, speech-to-text on your phone.
• Email — Google Workspace — handles our email, when you write to us.

Before we use an overseas provider, we check that it protects information in a way that is similar to Australian law, and our agreements with them say so. If we change a provider, we will update this policy with the new provider’s name.

5. Sensitive information

Health information and other people’s information. Most of what you record is health information about someone else: the person you care for. You can only record it if you are allowed to, for example as their parent or guardian, their nominee or decision maker, or with their agreement if they can give it. We ask for your consent before you start recording health details. For a person who can manage their own affairs, talk with them about what you record and who can see it.

Care data entered into For Samuel may constitute sensitive health information under the Privacy Act. We treat all care data as sensitive: it is stored in a household-scoped, access-controlled database, never used for advertising, never shared beyond the people in your Care Hub and the service providers listed above, and never used to train AI models.

6. Data retention

We retain data in accordance with the following schedules:

• Care records (health and support data): We keep your records while you use For Samuel. Each record is deleted automatically 7 years after it was made.
• Shift and invoice records: Invoices are kept for 7 years after they are paid, because tax law requires it. Shift records are deleted 7 years after the shift. Travel log addresses stay with these records.
• Audit log: The record of sensitive operations described in section 2 is retained for 7 years from the date of each event, then automatically purged. When you delete your account, the identifying details (your account identifier and IP address) are removed during the 30-day anonymisation, leaving only a de-identified record that the action occurred.
• Website waitlist: Waitlist emails record interest only and are not used for launch emails or marketing. Identifiable entries are deleted when the waitlist closes; we may retain a non-identifying aggregate count. You can ask us to remove your waitlist email sooner by emailing privacy@forsamuel.com.au or hello@forsamuel.com.au.
• Account deletion: When you delete your account from More → Leave or delete → Delete my account, we delete your sign-in and personal details after 30 days. You can change your mind until then. After 30 days your sign-in is permanently deleted, and your email, business details, bank details, profile photo, funding scheme registration number, address, and any participant identifiers are removed. Things you added to a shared Care Hub stay there, shown as “Former member”, so the rest of the team keeps its history. If you are the only admin of a Care Hub, the Care Hub is scheduled for deletion after another 30 days. Travel log exception (RET-KM-1): Kilometre and travel log entries are retained for 7 years for tax substantiation purposes (ATO travel-deduction record-keeping). The from and to addresses in those records are not scrubbed at account-deletion time because removing them would make the entries unsubstantiable during the financial retention window. Those records hard-delete on the 7-year financial schedule. If you need earlier erasure of your travel log addresses, contact us at privacy@forsamuel.com.au.
• Asking us to delete your records: You can ask us to delete your records at any time. We will do it, unless a support worker or a funding body has their own copy they need to keep, such as an invoice they issued.
• Backups: Our database provider maintains automated rolling backups for operational recovery. Anonymised data ages out of the backup window within 30 days of anonymisation — no separate request is required to purge backups.
• Third-party service data: Data held by our third-party service providers — such as anonymised crash reports and pseudonymous usage analytics — is subject to those providers' own retention schedules, which may be shorter than the above. On account deletion, we issue right-to-be-forgotten requests to our analytics provider and in-app purchase provider as part of the same 30-day anonymisation flow. This data does not include health or care records.
• Reports about Team posts: When someone reports a Team post we keep the reason, any note they add and what was decided; the hub's admins (other than the post's author) and For Samuel can read it, the author is never told who reported, and a report is deleted 90 days after it is dealt with (or with the post), while deleting your account removes your name and note from reports you made.
• Inactive devices and expired invitations: Push notification tokens are deleted after 90 days of inactivity; unused invitation codes expire after 60 days.
• Things you delete inside the App: When you delete an item in the App it disappears from view straight away, and it is permanently removed 30 days later. This covers care log entries, Team posts, calendar events and appointments, About Me items, care plans, plan variation requests, the documents and saved templates you create in My Care Plan, saved recipes, Guidebook emergency contacts, and the custom labels your Care Hub adds (such as a therapy type or a regulation trigger or strategy). Some of these can be restored from within the App during those 30 days; others cannot. Once the 30 days have passed the item is gone and we cannot recover it.
• When a deletion is held to the longer schedule instead: The 30-day window above describes deleting one item on its own. If you also remove the person a record belongs to from your Care Hub, or you close the Care Hub itself, before those 30 days are up, then that person's care log entries, appointments, care plans, plan variation requests and My Care Plan documents stop following the 30-day window and are held to the care records schedule above instead. That is deliberate: removing someone's profile should not quietly shorten how long the care record behind it is kept. Shift records and invoices were never in the 30-day window at all — they follow the 7-year schedules above.
• Closing a Care Hub: An admin can close a Care Hub from More → Leave or delete → Close this Care Hub. Everyone in it gets 30 days’ notice, the hub is read-only until then, and any admin can keep it open. After 30 days the hub is closed for good and its name is removed. Photos, About Me, emergency contacts, join requests and invitations are deleted. Care entries, appointments, care plans and the other care records stay on the 7-year care records schedule above, and shift records and invoices on their own 7-year schedules, unless you ask us to erase them sooner at privacy@forsamuel.com.au. Invoices are kept for 7 years because tax law requires it.
• Details of your clients: When you delete a client they disappear from your list straight away. Their name, email address and funding reference are permanently removed 7 years later, the same schedule as the invoices that name them, or sooner when your account is deleted. Care notes you kept about a client follow the care records schedule above.
• If For Samuel discontinues: If we permanently close the App, we will give you at least 90 days’ notice (by email and in the app) before any of your records are deleted. For the final 30 days of the notice period the App is read-only, so you can still view and download everything but cannot add new entries. During the whole notice period you can download a complete copy of your data via More → Sync & Data → “Download my data.” At the end of the notice period, the personal information held in connection with your account will be deleted or anonymised in line with the retention schedules above. Audit-trail records may be retained in de-identified form for up to 7 years where this is required to meet disability-support audit obligations. The closure process is described in section 8 of the Terms of Service.

7. Data security

All data is encrypted in transit using TLS 1.2+. Data at rest is encrypted using AES-256 by our infrastructure providers. Access to your care data is restricted to members of your Care Hub: every request must carry a valid sign-in, and our servers check the household you are asking for against the households you belong to before any record is read or written.

In addition:

• App Lock: You can require a PIN and/or biometric (face or fingerprint) authentication every time you re-open the app, with a configurable timeout. Your PIN is hashed and stored in the device's secure keychain — we never see it.
• Sensitive-operation audit: Account deletion, household membership changes, invoice send, care plan delete and other sensitive operations are recorded in a tamper-evident audit log. This both helps customer support investigate any unexpected state and meets our reasonable-steps obligation under APP 11.
• Confirming it is you before deleting your account: Before your account is deleted, we confirm it is you. In the app, that means signing in again with your password, Google or Apple, so someone holding your unlocked phone cannot delete your account. If you can’t open the app, you can email privacy@forsamuel.com.au from the email address on your account, or have a current admin of your Care Hub confirm it is you. If you signed in with Apple and hid your email, see forsamuel.com.au/support#delete-account.
• Cross-household authorisation: Server-side checks confirm that the household your request targets is one you actually belong to, regardless of any value sent from the device.

8. Your rights

Under the Privacy Act 1988 and the APPs you have the right to:

• Access the personal information we hold about you (APP 12). You can download a complete, machine-readable copy of your data yourself at any time from More → Sync & Data → "Download my data" (a short cooldown applies between downloads). The same export is available to developers by calling GET /api/account/data-export while signed in. If you are unable to sign in, contact us at the email below and we'll help you regain access so you can download it yourself.
• Correction of inaccurate information (APP 13). Your profile, care records, calendar, invoicing and Care Plan content are editable in-app. Your Care Hub's details — its name, who it is for, and location — can be corrected by a care-hub administrator at More → Care Hub → Care Hub Settings. If you spot something you can't edit yourself, contact us and we'll correct it or show you how.
• Deletion of your account and associated data — More → Leave or delete → Delete my account. Your data enters a 30-day grace period (cancellable in the same screen) and then deletes your sign-in and personal details automatically, as section 6 explains. If you can’t open the app, email privacy@forsamuel.com.au from the email address on your account (see forsamuel.com.au/support#delete-account). We confirm account deletion requests within 2 business days.
• Opt out of analytics collection in App Settings.
• Complain if you believe we have breached your privacy.

It is free to ask for your information or to correct it. For anything you can’t do in-app, contact us at privacy@forsamuel.com.au. We acknowledge general privacy requests within 5 business days, confirm account deletion requests within 2 business days, and respond in full within 30 days.

How to complain. To make a privacy complaint, email privacy@forsamuel.com.au and tell us what happened. We will confirm we have got it within 5 business days and give you our answer within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

9. Children and children's data

For Samuel accounts are for adults (18+). We ask you to confirm your age when you sign up. If you tell us you are under 18, we remove the new account straight away. Information about children is entered and controlled by the adults who care for them. The App is not listed in any app-store “Made for Kids” or “Made for Families” category, and it contains no advertising of any kind.

We ask you to confirm you are 18 or older; we do not ask your date of birth. Creating an account requires ticking “I’m 18 or older” (or, for Google and Apple sign-in, answering the same question). We deliberately collect no date of birth — a data-minimisation choice: an adult-directed service does not need it, so we do not hold it. If someone says they are under 18, the account is not kept.

Care data about a child is entered by their authorised carers (parents or guardians), who hold responsibility for that data. The account-holding adult controls those records as far as our service is concerned, including their correction, export, and deletion.

United States (COPPA). Because the App is directed at adults and any information about a child is provided by the responsible adult account holder, we do not knowingly collect personal information directly from a child under 13. If you become aware that a child under 13 has independently created an account, contact us at privacy@forsamuel.com.au and we will delete the account and its data.

Privacy by default for every account (this also reflects the UK Children's Code and the California Age-Appropriate Design Code): only data you choose to record is stored; profiling for advertising is never performed; geolocation is never collected; there are no dark-pattern nudges to share more; and the highest-privacy protections (App Lock, Care Hub-scoped access only) are available to every user without an upgrade.

10. Your rights by region

The rights described in section 8 reflect the Australian Privacy Principles. If you reside outside Australia, the following additional or equivalent rights apply.

• United States. California residents have the rights in the CCPA/CPRA: to know what personal information we hold, to request deletion and correction, and to opt out of any sale or sharing of personal information. We do not sell or share personal information, we do not use "financial incentives" tied to personal information, and we will not discriminate against you for exercising any right. Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and Oregon) have substantially similar rights of access, deletion, and correction, which we honour for all US residents through the same routes: the in-app data export and account deletion flows in section 8, or privacy@forsamuel.com.au. Care and health information is sensitive-category data under several of these laws; we process it only at your direction, to provide the service you signed up for — never for advertising, profiling, or sale. For Samuel is not a HIPAA covered entity or business associate; records you keep in the App are your own consumer records, not medical records held by a health provider.
• European Economic Area & United Kingdom (GDPR / UK GDPR). Where GDPR or UK GDPR applies, our lawful basis for processing your data is performance of a contract with you (Article 6(1)(b) — providing the care coordination service) and your consent for optional analytics. Care records are health data (special category, Article 9): we process them on the basis of your explicit consent (Article 9(2)(a)) — you provide that consent by deliberately entering care information into the App for your household's coordination purposes, and you can withdraw it at any time by deleting the relevant records or your account (section 8). Where you record information about another person (the person you care for), you confirm you are entitled to do so — for a child, through parental responsibility; for an adult, with their knowledge and agreement wherever they are able to give it. You have rights of access, rectification, erasure, restriction, portability, and objection; data export (section 8) provides portability in a machine-readable format. Complaints may be lodged with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
• Canada (PIPEDA / provincial equivalents). Canadian users have rights of access and correction equivalent to those in section 8, and may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). British Columbia, Alberta, and Quebec residents are additionally covered by provincial private-sector privacy laws with substantially equivalent rights.
• New Zealand (Privacy Act 2020). NZ users have access and correction rights equivalent to section 8 under the New Zealand Information Privacy Principles, and may complain to the Office of the Privacy Commissioner (privacy.org.nz).

We do not respond to legacy Do-Not-Track browser signals (no widely-adopted standard exists), but we do not engage in cross-site tracking or sale of personal information, which is what those signals were intended to address.

11. International transfers

Your care records and health data are stored in Australia (Sydney). Our servers and database are in Sydney too. Some of our service providers are overseas, in the United States and the European Union: section 4 lists each one and what it receives. Data is encrypted with TLS in transit. Before we use an overseas provider, we check that it protects information in a way that is similar to Australian law, and our agreements with them say so.

12. Changes to this policy

We may update this Privacy Policy from time to time. The app shows you a notice the first time you open it after a change. If we make an important change, we will tell you in the app or by email at least 14 days before it takes effect.

If For Samuel is sold or passed to someone else, we will tell you before your information moves, and the new owner must follow this policy.

13. Contact us

For privacy questions, to exercise your rights, or to report a suspected security issue or data breach affecting your information:
Email: privacy@forsamuel.com.au
Kin Tho (ABN 37 320 140 514), Australia

Security researchers and members of the public who identify a vulnerability that could affect personal information held in For Samuel are invited to email the same address. We respond to good-faith disclosures within five business days and will not take adverse action against researchers who follow responsible disclosure practice. If a suspected breach triggers our obligations under the Notifiable Data Breaches scheme, we will assess it within 30 days of becoming aware of it, and if it is likely to result in serious harm we will notify affected users and the Office of the Australian Information Commissioner as soon as practicable.

See also: Terms of Service  ·  Refund Policy  ·  Return to For Samuel