Privacy policy

Who we are

KinLoom is a product of Riyo Studio Pty Ltd (ABN 71 697 865 802), a Western Australian software company. In this policy, “KinLoom”, “we” and “us” mean Riyo Studio Pty Ltd when it provides KinLoom. Riyo Studio also builds other products. This policy covers KinLoom only: the website at kinloom.com.au, and the branded apps and websites it runs for NDIS providers.

KinLoom is software as a service (SaaS). NDIS providers subscribe to it and use it to run their organisation under their own name: rostering, verified shifts, shift notes, incidents, timesheets, compliance and a document library. Their staff use an app that carries the provider’s own name, logo and colours.

We are a technology company, not an NDIS provider. We don’t deliver supports, employ support workers or make decisions about anyone’s care. In this policy, “provider” always means the NDIS provider that uses KinLoom.

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). KinLoom is not affiliated with the National Disability Insurance Agency (NDIA) or the NDIS Quality and Safeguards Commission.

Two kinds of information, two roles

Records a provider keeps in KinLoom

When an NDIS provider (“the provider”) uses KinLoom, it records information about its staff and the participants it supports. The provider decides what to record and why, and must have the consent and authority it needs. That includes consent from a participant’s nominee, guardian or parent where that applies. We hold and process these records on the provider’s behalf and only on its instructions, to run KinLoom for that provider. We never use them for our own purposes.

Each provider is responsible for its own privacy policy, which explains how it collects and uses participants’ and staff information. This policy explains how KinLoom, as the provider’s software supplier, looks after that information inside KinLoom.

If you are a participant, a family member or a support worker, the provider that supports you or employs you is responsible for your records. Please contact them first about your information. They control it, and we will help them respond.

Our own customers and website visitors

We are directly responsible for the information we collect to run our business. That means the people who sign up for KinLoom, manage a provider’s account, contact us or visit kinloom.com.au.

What we collect

People who sign in

For owners, administrators, coordinators and support workers we hold:

• name, email address, phone number and role;
• a password, which our sign-in service stores as a one-way scrambled value that nobody at KinLoom can read.

A provider may also record staff details:

• employment type, award level, skills and start date;
• availability and leave;
• timesheets, including times worked, kilometres and expenses;
• compliance documents such as NDIS Worker Screening, Working with Children Check, first aid and CPR certificates, including their numbers, dates and copies.

Participants

A provider may record:

• a participant’s name, preferred name, date of birth, NDIS number, contact details and home address;
• plan dates and how the plan is managed, goals and budgets;
• care information, such as support and communication needs, risks, medication and behaviour support summaries, access notes and emergency contacts;
• service agreements and other documents.

Support workers record shift notes, the participant’s own words, mood, medication outcomes, incidents and any use of restrictive practices.

Much of this is health information and other sensitive information under the Privacy Act. It is collected only so the provider can deliver supports and meet its NDIS obligations, and it receives the strongest protection described below.

Customers, enquiries and website visitors

When you sign up, ask us to connect a domain or contact us, we collect your name, business name, email, phone number and anything else you choose to tell us. Our systems also process technical information, such as IP addresses, browser type and the pages requested, to deliver the site and protect it from abuse.

How we collect it

Most information is entered into KinLoom by the provider and its staff. The rest comes from you directly, when you sign up, accept an invitation, use the app or contact us. Some is generated as KinLoom is used, such as the time a shift starts, its location check and the activity log. We don’t buy personal information or collect it from data brokers.

How we use and disclose it

We use personal information to:

• provide KinLoom to the provider, by showing each person only what their role allows, sending notifications, checking shifts against the roster and keeping the activity log;
• keep KinLoom secure, by verifying sign-ins, detecting automated attacks, limiting repeated requests and investigating misuse;
• support customers, and tell them about their account, their trial and changes to the service;
• meet our legal obligations.

We disclose personal information only to the technology suppliers listed below, which help us run KinLoom, or where the law requires it. We never sell personal information, use it for advertising, or market to participants or support workers.

We do not report to the NDIA or the NDIS Commission on a provider’s behalf. Providers make their own reports.

Location

When a support worker starts or finishes a shift, the app asks the phone for its location once. It records that position, how accurate it is and the distance from the participant’s home, so the provider has evidence the support happened where it was meant to. The phone asks the worker for permission first. KinLoom doesn’t track location at any other time.

To set a participant’s home location, a coordinator uses their own phone while at the address. KinLoom does not send participants’ addresses to outside mapping services.

Automated decisions

KinLoom uses rules written into its software to help providers run shifts safely and fairly. Some of these decisions can affect whether a person is offered work, so we explain them here. Providers set the requirements these rules check, and providers make the final call on anything unusual.

Decisions KinLoom makes on its own

• Who can be rostered. A support worker can’t be put on a shift, or offered an open shift, if a check the provider requires is missing or expired on the date of the shift, if they’re on approved leave, or if they’re already rostered at that time. This uses the worker’s compliance records and expiry dates, leave and roster.
• Approving on-time timesheets. A timesheet is approved automatically when the shift started and finished on time, at the participant’s address, with no incident or expenses. This uses the shift times, the location check and the shift report. KinLoom never rejects or reduces a timesheet on its own. Anything outside these conditions goes to a person to review.
• Access to participant information. A support worker can see a participant’s care information while they’re rostered with that participant, and access ends automatically a short time after their last shift. This uses the published roster.

Information KinLoom gives people who make decisions

• Warnings to coordinators about short breaks between shifts, very long shifts or leave a worker has asked for.
• Flags for review when a shift starts away from the participant’s address, starts late or finishes early.
• Deadlines for notifying the NDIS Commission about reportable incidents.

If you think one of these rules has affected you unfairly, talk to the provider, who can review the records behind it. You can also contact us using the details below.

Where it’s stored and who helps us

Each technology supplier below receives only what it needs. If we add or replace one that handles providers’ records, we will tell providers at least 30 days beforehand.

Before paid plans begin, we will add our payment provider to this list.

Overseas disclosure

Providers’ records, including participants’ care information, shift notes and incidents, are stored in Australia. Some supporting services handle limited information outside Australia, most likely in the United States, as the table shows. That information is sign-in details, email addresses, names in emails and technical data. We use established suppliers that are contractually required to protect it, and we share only what each needs.

How we protect it

• Every connection to KinLoom is encrypted, and our hosting providers encrypt stored data.
• Each provider’s records are kept separate. The database itself enforces this, not just the screens of the app.
• Access follows each person’s role. Support workers see care information only for participants they’re rostered with. They can’t see other staff members’ records, compliance documents or notes.
• Files are downloaded only after a check confirms the person is allowed to see them. KinLoom does not create public links to documents.
• Changes to roles, approvals, adjustments and other important actions are recorded in an activity log that the provider’s administrators can review.
• Signing out removes the app’s saved copy of records from the device.

No system is perfectly secure. Please use a strong password that you don’t use anywhere else, and sign out of shared devices.

When our team accesses records

A small number of authorised Riyo Studio staff can access KinLoom’s systems. They look at a provider’s records only when the provider asks for help, when it’s needed to keep the service secure or working, or when the law requires it. They keep what they see confidential.

Your device and cookies

The app keeps some information on your device so it loads quickly and keeps working where reception is patchy, such as your sign-in session and recent records. Unfinished shift notes stay on the phone until they’re sent. Signing out clears all of this. We use no advertising cookies, no cross-site tracking and no third-party analytics on our website or apps.

How long we keep it

We keep a provider’s records for as long as its KinLoom account is open. The provider is responsible for keeping the records it needs for its NDIS and other legal obligations, and it can ask us for a copy of its records at any time.

When an account is closed, we delete the provider’s records within 90 days, unless the provider asks us to do it sooner or the law requires us to keep something. In-app notifications delete themselves after 30 days. Technical records used to stop abuse delete themselves within a few days.

Access and correction

You can ask for the personal information we hold about you, or ask us to correct it. For records a provider keeps in KinLoom, such as a participant file or staff record, please contact that provider first, and we’ll help them respond. For anything else, contact our Privacy Officer at privacy@kinloom.com.au. We respond within 30 days, and we may need to confirm who you are first. There’s no charge to make a request.

Data breaches

If a data breach affects records in KinLoom, we will contain it, investigate it and tell the affected providers without delay, and within 72 hours of becoming aware of it. Where a breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. For providers’ records, we will do this together with the provider.

Other matters

• Using a pseudonym. You can ask us general questions without giving your name. To use KinLoom, though, we need to know who you are.
• NDIS numbers. We store NDIS numbers only because providers record them. We don’t use them to identify people for our own purposes.
• Information we didn’t ask for. If we receive personal information we didn’t request and don’t need, we destroy it or remove the identifying details.
• Marketing. We send product news only to people who manage a provider’s KinLoom account. Every message includes a way to opt out. We never market to participants or support workers.

Complaints

If you’re concerned about how we’ve handled personal information, email our Privacy Officer at privacy@kinloom.com.au. Tell us what happened and how we can contact you. We’ll confirm we’ve received it within 5 business days and respond within 30 days. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We update this policy when the way we handle information changes. The date at the top shows the latest version, and we tell providers about significant changes before they take effect. If you would like this policy in another format, contact us and we’ll provide it free of charge.

Contact us

Privacy Officer, Riyo Studio Pty Ltd (ABN 71 697 865 802), trading as KinLoom
Email: privacy@kinloom.com.au · General enquiries: hello@kinloom.com.au