Lucivion Pty Ltd (ABN 16 687 428 262, "Lucivion", "we", "us") provides reporting, dashboards and analysis to care providers. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
If you receive care from a care provider, or are family of someone who does, your care provider is responsible for your information, and its privacy policy applies to you. Our page for care recipients and families explains what we do on the provider's behalf.
Who this policy is for
This policy is for our clients, and for everyone whose personal information we hold for our own business: people who visit our website or contact us, the staff of our clients who use our client portal, and the people we work with at our suppliers.
Two kinds of information
Information we handle for our clients. Our clients are care providers. They send us information about their care recipients from their care and medication systems so that we can produce the reports and dashboards they ask for. Each client holds the relationship with its care recipients and decides how their information is used. We handle it on the client's behalf and on the client's instructions.
Information we hold for our own business. This is information about people who visit our website, contact us, or work for our clients and suppliers, including the people who sign in to our client portal.
What we collect
For our clients:
- care recipient and care information, such as identifying details, clinical and medication records, and care notes;
- the contact details of client staff who use our portal, and records of their sign-ins and activity.
For our own business:
- contact details of people who contact us or work with us;
- billing contacts for our clients;
- information about how our website is used, including through cookies.
How we collect it
Care recipient and care information comes from our clients, through connections to their care and medication systems or files they send us. We do not collect it from care recipients directly. Portal sign-in and activity records are created when client staff use the portal. Other information comes from you when you contact us, or automatically when you use our website.
How we use it
We use care recipient and care information to produce the reports and dashboards our clients have asked for, and to keep that service secure and working. Some reports use AI models that run in AWS Australia. Personal information is not used to train AI models.
We use other information to provide and support our services, communicate with you, invoice our clients, keep our systems secure, and meet our legal obligations.
We never sell personal information. We may publish aggregate figures that identify no care recipient, staff member, client or facility, such as how many facilities we support or broad trends across the sector.
Who we disclose it to
We disclose personal information only to the suppliers who help us provide our service, and to regulators or others where the law requires it. Our sub-processors, the suppliers that hold our clients' information, are listed on our Trust Centre at trust.lucivion.com. Each is bound by its terms with us to protect the information and use it only to provide its service to us. Before a new sub-processor receives care recipient information or reports, we tell our clients at least 30 days ahead.
Information that leaves Australia
Care recipient and care information is stored and processed in Australia: in AWS Australia, and in Microsoft Power BI and Microsoft 365 in their Australian regions.
Some information is handled in the United States:
- Accounting. Our accounting system holds our clients' business contact and billing details.
- Password manager. Our password manager holds our staff's, our systems' and our clients' credentials, end-to-end encrypted so that the provider cannot read them.
- Source code and private network. Our source code and build pipelines, and the private network our staff use to reach our systems, are run by providers in the United States.
- AI tools. Our engineers use AI tools from companies in the United States to build and maintain our service. They work on our source code and are never used to produce reports.
- Website. Our website is hosted in the United States, and information you enter on it or that its analytics collect is processed there.
How we protect it and how long we keep it
We protect personal information with encryption, multi-factor sign-in, database-enforced separation between clients, continuous security monitoring and the other controls described on our Trust Centre.
We keep client information while the client needs it for its reports, following our data retention schedule: the files a client sends us for 90 days after they are loaded, and clinical records and the reports made from them until three years after the period they cover. Within 90 days of a client's contract ending, we delete the files we hold for that client, and delete or, where deletion isn't technically feasible, de-identify its records in our database so they no longer identify anyone. That includes the names and email addresses of its portal users in our activity records. Backup copies expire up to 120 days after that. One record is kept longer: our cloud audit trail must be kept unaltered for seven years, and it records file names that can include care recipients' names.
Access and correction
Care recipients and their representatives should ask their care provider, which holds the care recipient's record. When a care provider asks us, we acknowledge within 5 working days and help it provide, correct or remove the information.
Anyone else can ask us for access to, or correction of, the personal information we hold about them by emailing privacy@lucivion.com. We will respond within 30 days.
Data breaches
If we suspect a data breach, we assess it under the Notifiable Data Breaches scheme, within 30 days. If it involves a client's information, we tell that client within 24 hours of confirming it, so that it can meet its own obligations. Where the people affected must be told, we and the client agree who tells them and the Office of the Australian Information Commissioner.
Questions and complaints
Contact us at privacy@lucivion.com or 1300 789 045. We will respond to a complaint within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
We review this policy at least once a year and whenever the way we handle personal information changes. The current version is always published at privacy.lucivion.com, with the date it took effect.