1. ABOUT THIS POLICY
1.1 LAMA Solutions Group Pty Ltd ABN 27 652 876 125 (LAMA Care, we, us, our) provides the LAMA Care care management platform, website and mobile apps. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1.2 We handle personal information in two different roles:
(a) about our own customers, their users, website visitors and people who contact us, where we decide how that information is handled; and
(b) about participants, staff and others whose information our customers (care provider organisations) enter into LAMA Care (Client Data), where we hold and process that information on behalf of the provider and in line with their instructions and our Subscription Terms and Conditions.
1.3 This policy explains what we collect, how we use and protect it, where it is stored, how automated processing is used, how long we keep it, and how you can access it or make a complaint.
2. INFORMATION WE COLLECT ABOUT CUSTOMERS AND USERS
2.1 We collect: names, job titles, organisation details, email addresses and phone numbers; login and account details; billing details; records of support requests and communications with us; and information about how the Platform and our website are used, such as device type, browser, IP address and pages viewed.
2.2 Card payments are processed by Stripe. Card details are entered into Stripe’s secure form and we do not see or store your full card number.
3. CLIENT DATA HELD ON BEHALF OF PROVIDERS
3.1 Providers use LAMA Care to record information about the people they support and their workforce. Depending on how a provider uses the Platform, Client Data may include:
(a) about participants: names, contact details, date of birth, funding scheme numbers, plans and budgets, goals, support needs, health and disability information, case notes, incident reports, service agreements and documents;
(b) about participants’ representatives and other contacts: names, relationships and contact details; and
(c) about staff and contractors: contact details, qualifications, screening checks and expiry dates, availability, shift and timesheet records, pay rates and award classifications, payroll details, and device location at the time of clocking in or out of a shift in the mobile app.
3.2 Health and disability information is sensitive information. We only hold it as part of Client Data, protect it with the security measures in section 9, and do not use it for our own purposes.
3.3 The provider is responsible for collecting Client Data lawfully, giving collection notices and obtaining any consents required. If you are a participant or a provider’s staff member and have a question about your information, please contact the provider first. We will help them respond.
4. HOW WE COLLECT INFORMATION
4.1 We collect information when you sign up, use the Platform, contact us, attend a demo or webinar, subscribe to our newsletters or visit our website. Client Data is entered by providers and their users, or imported from systems they connect, such as Xero.
5. HOW WE USE INFORMATION
5.1 We use personal information to:
(a) provide, maintain, support and secure the Platform;
(b) manage accounts, billing and payments;
(c) communicate with customers about their account, service changes, trials and renewals;
(d) improve the Platform, using de identified and aggregated data that does not identify any provider, participant or staff member;
(e) send marketing to business contacts, who can opt out at any time; and
(f) comply with our legal obligations.
5.2 We only use Client Data to provide the Platform to the provider, as instructed by the provider, or as required by law. We never sell personal information.
6. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE
6.1 Artificial intelligence. LAMA Care does not currently use artificial intelligence models to process personal information. If we introduce AI features, we will update this policy before they are used, including which providers are involved, what information they use and where they process it.
6.2 Computer programs that assist decisions. Some features apply the provider’s own settings and rules to personal information and produce results that the provider uses when making decisions that may affect individuals:
(a) payroll and award calculations, which use staff shift and timesheet records, award classifications, pay rates and allowance settings to calculate pay amounts that the provider reviews and approves;
(b) invoicing and claiming checks, which use participant funding details, service records, case note completion and timesheet approval status to calculate claim amounts and prevent a claim being generated until required records are complete; and
(c) compliance tracking, which uses staff qualification and screening check records and expiry dates to flag missing or expired items, which a provider may use when deciding who can be rostered.
6.3 LAMA Care does not use computer programs to make decisions about participants or staff without a person at the provider being involved. Decisions are made by the provider. If you are affected by a decision, you can ask the provider to explain it and to review it.
7. WHO WE SHARE INFORMATION WITH
7.1 We share personal information only as needed to provide the Platform, with:
(a) our hosting provider, Amazon Web Services, which stores data in its Sydney, Australia region;
(b) Stripe, our payment processor;
(c) Xero and other services a provider chooses to connect;
(d) providers of our email, support and marketing tools;
(e) our staff and contractors, including support, administration and development personnel, who access information only on a need to know basis and are bound by confidentiality obligations; and
(f) professional advisers, insurers and regulators, or where required by law.
7.2 If our business, or part of it, is sold or restructured, personal information may be transferred to the new owner, who must handle it in line with this policy.
8. OVERSEAS DISCLOSURE
8.1 Client Data is stored in Australia. Some personal information may be accessed, stored or processed overseas:
(a) in the United States, by Stripe, Xero (where a provider connects it), and our email, support and marketing tool providers; and
(b) in Vietnam and the Philippines, by our support, administration and development personnel.
8.2 We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, including through contractual confidentiality and data protection obligations.
9. KEEPING INFORMATION SECURE
9.1 We protect personal information with measures including encryption in transit and at rest, role based access permissions, audit logging of changes to records, restricted staff access, and security monitoring. No system is completely secure, but we work to prevent misuse, interference, loss and unauthorised access, modification or disclosure.
10. HOW LONG WE KEEP INFORMATION
(a) Client Data is kept while the provider’s subscription is active. After a subscription ends, or a free trial ends without converting to a paid subscription, it is kept for 30 days so the provider can export it, then permanently deleted, including from backups within 90 days, unless the law requires us to keep it.
(b) Customer account, billing and transaction records are kept for 7 years to meet tax and accounting obligations.
(c) Support and communication records are kept for as long as the customer relationship continues and for 2 years afterwards.
(d) Marketing contact details are kept until you unsubscribe or ask us to delete them.
10.1 Providers remain responsible for keeping their own records for the periods required by their funding schemes and the law.
11. DATA BREACHES
11.1 If we become aware of a data breach involving Client Data, we will notify the affected provider within 72 hours and work with them to assess it. Where a breach is likely to result in serious harm, we or the provider will notify the affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
12. ACCESS AND CORRECTION
12.1 You can ask to access or correct personal information we hold about you by emailing info@lamacare.com.au. We will respond within 30 days and will not charge you for making a request.
12.2 If your request relates to Client Data, we will refer it to the relevant provider, as they control that information, and help them respond.
12.3 We may refuse access in limited circumstances allowed by the Privacy Act, and will tell you why in writing.
​
13. MARKETING
13.1 We send marketing emails to business contacts in line with the Spam Act 2003 (Cth). Every marketing email includes an unsubscribe link, or you can email info@lamacare.com.au. We never use Client Data for marketing.
14. WEBSITE, COOKIES AND MOBILE APPS
14.1 Our website uses cookies and analytics tools to understand how it is used and to improve it. You can change your browser settings to refuse cookies, although some features may not work.
14.2 Our mobile apps collect device information needed to operate securely. The support worker app records device location only at the time of clocking in or out of a shift, so providers can verify service delivery. We do not use location information for advertising and do not track location at other times.
​
15. COMPLAINTS
15.1 If you have a concern about how we have handled your personal information, please contact our Privacy Officer using the details below. We will acknowledge your complaint within 5 Business Days and aim to respond within 30 days.
15.2 If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
16. CHANGES TO THIS POLICY
16.1 We may update this policy. The current version and its effective date will always be available at lamacare.com.au. We will notify customers by email of material changes.
​
17. CONTACT
17.1 Privacy Officer, LAMA Solutions Group Pty Ltd, 1/210 Stirling Street, Perth, Western Australia 6000. Email: info@lamacare.com.au.
​​