Atria Care Alliance
Last updated: September 4, 2026
This Privacy Policy applies to the websites and web application operated by Atria Care Alliance Pty Ltd in Australia. We refer to them together as the "Services". Through the Services, Atria supports home-care providers, care managers, workers, clients, representatives, and supporters with care management, billing, compliance, document processing, technology, and managed services.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where Atria or a related entity is a registered aged-care provider, its handling is also governed by the Aged Care Act 2024 and relevant health-record laws. Requirements in the Aged Care Rules 2025 may apply as well.
A care provider using our platform may control the purpose for which care-related information is collected and used. In that setting, Atria handles the information under the provider's documented instructions and its service agreement with us. You should also read that provider's privacy and collection notices where they apply.
The details Atria handles vary according to your role and the way you interact with us.
Health information and some other details listed above are sensitive information under Australian law. Atria handles sensitive information only for a specific, necessary purpose and where the law permits or requires it. We obtain consent when consent is required.
Information may come directly from you, from an authorised representative, your employer or provider organisation, another authorised user, or a service provider. Some technical information is generated automatically as you use the Services. Where lawful and necessary, we may also receive information from related bodies corporate, associated providers, health professionals, government bodies, regulators, and professional advisers. Only give us another person's information if you have authority to do so.
You can usually browse our public websites without identifying yourself and may use a pseudonym where that is lawful and practical. To use account, care-management, billing, or provider functions, you must supply the details needed to verify your identity and provide the requested service.
When the Aged Care Act 2024 applies, we use information about a person receiving funded aged care only to deliver that care, fulfil the reason the information was provided, carry out a purpose the person has authorised, or meet another purpose allowed or required by law. We do not use client records for direct marketing, public demonstrations, or evidence of provider-registration capability.
Personal information is not sold or rented by Atria.
A provider that engages Atria for technology or managed services remains responsible for its care-delivery purposes, collection notices, required consents, data accuracy, and the instructions it gives us. We use provider-controlled information only to perform the documented services, run and protect the platform, or comply with a legal obligation that applies to us.
If Atria or one of its related entities is the registered provider, that entity is accountable for the personal information it holds and for meeting its aged-care and privacy duties. Those duties are not transferred to a client or another provider through a service agreement.
The relevant agreement or collection notice names any provider, related body corporate, controlled provider, or associated provider that will receive information and describes what that entity does. A proposed acquisition or group arrangement does not change which entity is responsible until the transaction has legally completed and its new operational role has begun. Before a new entity starts collecting or receiving information, we revise the relevant notice.
Atria uses fully synthetic or appropriately de-identified records wherever they are sufficient for demonstrations, testing, training, quality review, registration, provider applications, or other external evidence.
Before material leaves the organisation, our documented release checklist must be completed by a named owner and reviewer. They verify authority, purpose, necessity, minimisation, de-identification, the intended recipient and location, access, retention, and disposal. We retain evidence of the approval, and the material cannot be released while any required check is outstanding.
Actual client material may be included in an external application or submission only if the disclosure is lawful, expressly authorised, necessary for a defined purpose, and limited to what that purpose requires. It cannot be uploaded simply to demonstrate operational capability.
Whether information is de-identified depends on the setting in which it will be released. We remove or alter direct identifiers and deal with any other data or access condition that could reasonably allow someone to identify the person again in that setting.
Atria discloses personal information for a stated purpose only when the law permits or requires the disclosure. Depending on the circumstances, recipients may include:
We do not disclose information about a person receiving funded aged care without their consent unless the disclosure is necessary to deliver or safeguard their care, is made to an associated or other registered provider for that purpose, or is otherwise allowed or required by law.
Where appropriate, contracts with service providers and other recipients set confidentiality, access, handling, return, and destruction requirements for the information they receive.
The application currently places only essential first-party cookies. They keep users signed in, remember the organisation they selected, apply access for their role, and help protect the Services. The application does not currently place advertising cookies or non-essential analytics cookies. Our Cookie Policy lists each cookie, why it is used, and how long it lasts.
You can ask to see the personal information Atria holds about you or to correct details that are wrong, incomplete, no longer current, irrelevant, or misleading. A person receiving funded aged care may also request records and information about the services they receive and their cost. If the record is controlled by another provider, we will either direct the request to that provider or work with it on the response. Before releasing information, we may confirm your identity and authority.
Other options may be available under the law that applies to your circumstances. These can include asking us to delete information or limit particular processing, objecting to particular processing, or withdrawing consent when consent is the basis for processing. Legal obligations may still require us to keep care, billing, audit, or other records. To stop marketing emails, use the unsubscribe option included in the message.
Requests for access or correction, and privacy complaints, should be sent to the Privacy Officer using the contact details in section 15. Tell us which information or conduct is involved and what resolution you are seeking. Our target is to acknowledge a complaint within 5 business days and issue a written response within 30 calendar days. If the investigation needs more time, we will explain the delay and keep you informed. A decision not to provide access or make a correction will be accompanied by written reasons and the review or complaint options available to you.
After giving us a reasonable opportunity to address the concern, you can take an unresolved privacy complaint to the Office of the Australian Information Commissioner (OAIC). A concern involving an aged-care provider, worker, or responsible person can also be raised with the Aged Care Quality and Safety Commission by calling 1800 951 822.
Atria keeps personal information for the period needed to deliver the relevant service, follow a provider's documented instructions, comply with legal and regulatory duties, maintain billing and audit records, resolve disputes, and enforce agreements. Once the information is no longer required for those purposes, we securely delete, destroy, or de-identify it.
A limited amount of information may remain in backup and disaster-recovery copies until those copies reach their scheduled expiry. They are not used for routine access. The applicable legal requirements, service, and agreement determine the retention period.
Our administrative, technical, and physical safeguards are selected according to the risks presented by the information. Measures include authentication, role-based and least-privilege access, security logging, protected transmission, storage and backup controls, confidentiality duties, and data-breach procedures. Client information is available only to authorised people and service providers who need it for an identified purpose.
Safeguards reduce risk but cannot eliminate every risk involved in storing or transmitting information. If a breach is suspected, we will work to contain it, assess what happened, and address the consequences. Affected people and regulators will be notified when the applicable law requires notification.
When an authorised user requests document extraction, the uploaded invoice or receipt is sent to the Gemini 3.1 Flash-Lite model through Google Cloud Vertex AI. The feature produces draft structured data, which can include the document type and number, dates, supplier and customer details, line items, totals, payment information, notes, confidence scores, extraction issues, and an indication of whether the document appears to be an invoice or receipt.
The draft results are returned to an authorised user, who must check them against the original document and decide whether to accept or correct them. The feature does not approve, reject, pay, or submit an invoice. It also does not change anyone's care, funding, access, or contractual rights, or make another final decision that has a significant effect on a person.
This application does not currently use personal information for any other fully automated or computer-assisted decision that could reasonably be expected to significantly affect a person's rights or interests. Before introducing such a use, we will revise this policy and the collection notice that applies to it.
The Services support home-care operations and are not designed for children to use. A care record may still need to mention a family member, representative, supporter, emergency contact, or another person. Their information should be provided only with authority and only when needed for care, communication, safeguarding, or a legal purpose.
Atria's primary application infrastructure runs on Amazon Web Services in its Sydney, Australia region. The extraction process in section 10 sends an uploaded invoice or receipt to Google Cloud Vertex AI through a global endpoint. Gemini 3.1 Flash-Lite supports machine-learning processing in the United States and countries in the European Union, while the global endpoint does not promise a particular processing location. See Google Cloud's model-location information for the current details.
Before information is disclosed overseas, we take the reasonable steps required by applicable law and apply suitable contractual, access, security, and data-minimisation controls. We will revise this policy and the relevant collection notice before adding another overseas recipient or processing location.
Our websites may link to a website or service run independently by another organisation. Atria does not control that organisation's content or privacy practices. Read its privacy policy before you give it personal information.
We revise this page when our operations or relevant legal and regulatory requirements change. The date at the top shows when the policy was last updated. Check this page periodically to understand our current approach to personal information.
Email Atria's Privacy Officer at info@atriacare.com.au or write to 11 York Street, Sydney, NSW, Australia. Include enough detail for us to understand the request or complaint and to contact you if we need clarification. You can also ask for this policy in an accessible or alternative format.
© 2026 Atria Care Alliance — All rights reserved.
We are the first AI-as-a-Service platform transforming aged care globally.