StrongHERside Daily ("we", "us", "our") is operated by Gair Media Pty Ltd (ABN 62 690 161 301), founded by Hannah Gair. We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), including the heightened protections for sensitive information, which includes health information. Depending on where you live, state and territory health records legislation may also apply (for example NSW HRIPA, VIC HRA, ACT HRPAA), as do the Healthcare Identifiers Act 2010 (Cth) protections for Medicare and NDIS numbers. This App is designed for Australian carers and is intended for use in Australia. If you access it from outside Australia, your local laws may differ and may not be addressed by this policy.
Information you provide directly: your first name; your child's identification details (name, date of birth, NDIS number, Medicare number) for use in reports you generate; your child's profile (additional needs, diagnoses, goals, school); care information (medications, appointments, care team contacts, notes, documents); files you upload (PDFs and images such as medical reports, school letters, assessments, which are encrypted, stored with Cloudinary in the USA, and cached on your device for offline use); wellbeing self reports (capacity, mood, sleep, brain dump); setup survey responses (every question optional and skippable); and feedback you submit (with any optional name or email).
AI Features (six). We use Anthropic Claude (US hosted) to power six AI Features. The AI Features are switched off until you turn them on through a single opt in, and you can pause them at any time in Settings, Privacy. In every case, only the specific text or image needed for that feature is sent; your full Care Record is never transmitted. Anthropic processes the data to produce the output and, under its commercial API terms, does not use it to train its models.
If a document or note you send to an AI Feature contains a Medicare number, an NDIS number, or another person's information, that information is included in what is sent, unless you remove it first. See "A child's medical information" below.
Two further calm technology surfaces run entirely on your device and send nothing to Anthropic: predictive nudges (local pattern detection) and read aloud reflection (browser SpeechSynthesis).
Information collected automatically: an anonymous device ID (a random identifier on your device); page views and feature usage events tagged with your first name (Vercel Web Analytics); browser type, screen size, and approximate region; the date and version of the consent you provided, and your confirmation that you are 18 or older; and a per session anonymous device capability snapshot (no personal data). Cookies: only essential cookies plus Vercel first party analytics; no third party cookies, no cross site tracking, and no advertising identifiers. We do not use Google Analytics, Meta or TikTok pixels, or any advertising technology. The iOS native build uses no cookies and raises no App Tracking Transparency prompt, because we do not track you across other companies' apps or sites. These usage analytics are used only to run and improve the App; they are never used for advertising and are never combined with data from other companies.
Information we do NOT collect: your full name (unless you enter it); your email (unless you provide it); your IP address (not stored); My Health Record identifiers (we do not connect to My Health Record); payment card details (held by Apple, Google or Stripe); your camera roll, location or contacts; and audio recordings (we only ever see transcribed text).
We treat the following as sensitive information: your child's medical conditions, diagnoses and medications; NDIS plan details and disability information; your wellbeing data (mood, sleep, capacity, brain dump, reflections); your onboarding survey answers about your caring situation; and files you upload containing medical, clinical or assessment content. We collect sensitive information only with your express consent, given through the onboarding consent screens, and you can withdraw it at any time by clearing your data (Reset App) or emailing us.
You can use much of the App without telling us who you are. Giving your first name is optional, and you do not need to provide your email unless you choose to, for example to send yourself a report or to give feedback. Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym. Some features need certain details to work (for example, emailing a report needs a recipient address, and connecting a calendar needs your consent to that account), and we tell you when that is the case.
Because the App exists to help a carer coordinate a child's care, a child's medical information is central to it. This section explains, specifically, how that information is handled as it is stored, comes in, and goes out.
Storage. A child's Care Record (profile, diagnoses, medications, NDIS and Medicare numbers, notes) is stored, encrypted at rest, in our secure Australian cloud (MongoDB Atlas, AWS Sydney), and is also cached on your device so you can use the App offline. Where you set a PIN, the copy on your device is additionally encrypted with AES-GCM-256, and that PIN protected copy cannot be read by us. The cloud copy is encrypted at rest and is readable by our systems in normal operation, to provide the App to you. Files you upload (medical reports, assessments) are stored, encrypted, with Cloudinary (USA) and cached, encrypted, on your device.
Information coming IN from third parties. When you photograph, upload or paste a third party's document (an NDIS plan, a paediatrician's letter, a school IEP), that document, which may contain a child's health information, enters your Care Record. For Photo to Care File and the AI Document Importer, the image or text is sent to Anthropic Claude (USA) to extract fields, and you review the result before it is saved. You are responsible for having the right to bring that document in. If it contains a Medicare or NDIS number and you do not want that sent to the AI, remove or cover it first, or enter the details manually.
Information going OUT to third parties. When you generate and email or share a report, a Handover Pack, a GP letter, an NDIS evidence pack or the Care Record, you are disclosing a child's sensitive health information to a recipient you choose (a respite carer, a school, a clinician, an NDIS worker). You decide the recipient and the content. Emailed documents are delivered via Resend (USA), encrypted in transit, and not retained by us beyond delivery. Email encrypts a message in transit; it does not encrypt the document once it reaches the recipient's inbox or once they save it. Once a document leaves the App it is outside our control; we cannot recall it and we are not responsible for how a recipient stores, secures, uses or further discloses it. Before you send, confirm the recipient is authorised, verify their address, and be comfortable with what the document contains (Terms clauses 9F and 9H).
Consent for sensitive cross border handling. Some processing of a child's health information occurs overseas: uploaded files at Cloudinary (USA); text and images sent to Anthropic (USA) when you use the AI Features; and emailed reports via Resend (USA). We ask for your express consent to this sensitive information cross border handling: at onboarding, and again, in context, when you first turn on the AI Features or first send a report overseas. You can avoid the AI Features (leave them off, or pause them in Settings, Privacy) and Voice Quick Capture (type instead) if you do not consent.
Medicare and NDIS numbers (Healthcare Identifiers Act 2010). You enter these voluntarily for your own use in reports. They are stored, encrypted, in MongoDB Atlas (AWS Sydney) and cached on your device. We use them only to populate reports you choose to generate; we never sell them, never use them for marketing, and never disclose them to any third party or government agency except as required by law. The only ways an identifier reaches a third party are: if you generate and send a report that contains it, or if you import a document that contains it into an AI Feature without removing it first. On Reset App or account deletion they are permanently deleted.
Not a clinical record. A child's information in the App is a personal organiser, not an authoritative clinical or legal record. Always verify against the original held by the treating professional.
If you add care team members, you may enter their name, role and professional contact details. By doing so you confirm that you have a legitimate reason to record their professional contact details, that you will only contact them through channels they have made available for that purpose, and that you will not share their details further without permission. We do not contact anyone you add.
We ask a short, fully optional set of questions to personalise the App and to understand carer load. Every question is skippable. Your answers personalise the App by default and are used for research only if you separately opt in (the toggle is off unless you turn it on). Sensitive answers are collected only with your consent. You can change, clear or delete your answers, or withdraw from research, at any time.
Only if you opt in (off by default), anonymised information you create across the App (survey answers, de identified usage patterns, wellbeing trends) may join our carer research dataset. Before any such use we remove everything that identifies you or your child (name, email, child's name, exact postcode, Medicare and NDIS numbers, and other direct identifiers). We may publish, share or sell this data only: as aggregated or de identified data, never anything identifying you or your child; to aligned organisations only (universities, researchers, government, and carer or health organisations); under agreements forbidding re identification; released only in cohorts no smaller than 5, with rare cases suppressed and free text removed; and never for uses that could disadvantage carers or families (insurance pricing, credit scoring, or marketing to vulnerable families). A child's clinical detail appears only as an aggregated pattern. We never sell anything that identifies you or your child. You can withdraw at any time in Settings, Privacy; data already shared cannot be recalled.
StrongHERside may grow through a merger, investment, restructure or sale. If that happens, your information (including your Care Record and any anonymised research data) may transfer to the new owner, who must protect it under this policy or one at least as protective; we will tell you in the App or by email; your access, correction and deletion rights continue unchanged; and our promise never to sell anything that identifies you or your child carries over. This does not permit anyone to sell your identifiable information.
Your Care Record is designed to grow with you for as long as you use the App; there is no automatic 30 day, 90 day or 12 month cut off. You decide when data is removed (Reset App, or delete individual entries). Data held centrally about you (analytics tagged to your name, feedback, opt in research, AI telemetry, logs, backups) is retained only as long as reasonably necessary and no longer than 7 years, unless a longer period is required by law; you may request deletion at any time (actioned within 30 days, subject to legal hold).
To run the App for you; to detect bugs and improve the App; to respond to your feedback; to set up and secure your account; and to produce reports you choose to generate. We never sell anything that identifies you or your child, and we do not use your information for advertising or combine it with profiles from other services.
We only send you marketing messages if you have opted in. Every marketing email includes an easy unsubscribe, and you can opt out at any time by using that link or by emailing us. We do not sell or rent your contact details to anyone for their own marketing, and we never use a child's information for marketing. Service messages that we must send to run your account, for example a security or billing notice, are not marketing and continue while you have an account.
| Type of data | Where it is stored |
|---|---|
| Care data, child profile, child identification (DOB, NDIS, Medicare), wellbeing notes | MongoDB Atlas (AWS Sydney, Australia), encrypted at rest and in transit, and cached on your device |
| Files you upload (PDFs, images, medical reports) | Cloudinary (USA), encrypted at rest and in transit |
| Account and login (authentication) | Supabase (AWS Sydney, Australia), encrypted |
| Analytics events tagged with your first name | Vercel Inc. (USA) |
| Feedback messages | Resend (USA) for email delivery; stored in our secure Australian backend |
| Reports you choose to email | Resend (USA), then to the recipient you specify |
| Text sent to the AI Features | Anthropic, PBC (USA), processed to produce the output |
| Images sent to Photo to Care File | Anthropic, PBC (USA), vision API |
| Read aloud reflection audio | Your device only (browser SpeechSynthesis) |
| Predictive nudge pattern detection | Your device only |
| Voice audio (Chrome or Android) for transcription | Google LLC (USA), browser Web Speech API; iOS Safari transcribes on device |
| Aggregated research data (opt in only) | Our secure Australian backend, de identified to the agreed cohort floor |
Your core data is hosted in Australia. Some providers process data overseas: Vercel (USA), Anthropic (USA), Cloudinary (USA), Resend (USA), Google (USA) (Web Speech, and Google Calendar if you connect it), Microsoft (USA or EU, if you connect Outlook), and Apple (USA) (App Store and on device speech). These providers have their own privacy commitments and we take reasonable steps to ensure they handle your information consistently with the APPs. The United States is a jurisdiction where privacy protections differ from Australia, including lawful access by US agencies under instruments such as the CLOUD Act and FISA. For sensitive information (a child's health information), we seek your express consent before it is first sent overseas; you can decline by not using the relevant feature. We remain accountable under APP 8 for how these providers handle information we disclose to them.
If you choose to connect Google Calendar, our use of information we receive from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We request read only access to your calendar events; we use that information only to show your appointments inside the App for you; we do not transfer or sell it; we do not use it for advertising; and we do not allow any human to read it, except as necessary for security, to comply with the law, or with your consent. You can disconnect at any time in Calendar, Connected calendars, which revokes our access and deletes the stored token. If you connect Microsoft Outlook instead, we handle that calendar information on the same read only, limited use basis.
On device encryption applies when you set a PIN. When you set a PIN, the sensitive information stored on your device (Care File, wellbeing journal, reflections, voice transcripts, capacity check ins) and the files you upload are encrypted with AES-GCM-256. Your PIN is never stored; we keep only a one way PBKDF2-HMAC-SHA-256 hash (100,000 iterations) with a random per device salt; the key is derived from your PIN, held in memory only while unlocked, and cleared on lock. The App auto locks after inactivity and slows repeated wrong PIN attempts. Because your PIN is the key, we cannot recover your on device encrypted data if you forget it. Setting a PIN is optional but recommended; without it, your device data relies on your device's own security.
In our cloud. Your Care Record is encrypted at rest and in transit in MongoDB Atlas (AWS Sydney). This cloud copy is encrypted with keys managed for our service, so that we can provide the App to you; it is not protected by your personal PIN. All connections use HTTPS and TLS. Server side stores use access controls, and calendar tokens are encrypted. The App sets standard web security headers, including a Content Security Policy. We design in line with OWASP MASVS and NIST guidance (SP 800-38D, SP 800-132). No system is 100% secure, so while we treat security issues as priority defects, we cannot guarantee absolute security.
No automated decision affecting your legal rights, eligibility, entitlements or material interests is made by the App. Every AI Output is presented to you to review and edit before it is saved, shared or used; you are the final author. Predictive nudges are informational suggestions with no legal effect. The AI Companion reflection is reflective writing, not a clinical assessment, and produces no diagnosis, triage or risk score. You may request an explanation of how any AI Feature produced an output by emailing us.
Voice transcription on iOS Safari is on device; read aloud and predictive nudges are on device. The six AI Features currently run via Anthropic Claude (US hosted). When the native iOS build is distributed and on device foundation models are available on enough devices, these features are intended to move on device via a normal App Store update, at which point your data for that feature stops reaching Anthropic. We will describe only capabilities that actually exist at the time.
You must be at least 18 years old to use the App. At onboarding you confirm that you are 18 or older, and we record that confirmation. The App is built for adult parents and carers. Children do not use the App, do not enter their own information, do not have accounts, and the App is not marketed to anyone under 18. By entering information about a child you give the warranties in clause 12A of the Terms of Use (lawful parental responsibility; no restricting court order; not for contested proceedings except under a court order; co guardian consent or lawful authority). We do not verify these warranties; if any is untrue you indemnify us under clause 13. Our own obligations to the child under the Privacy Act, and under the incoming Children's Online Privacy Code, are not discharged by your warranty; we apply the sensitive information protections in this policy to all of a child's information. You can delete a child's profile and all associated data at any time.
We comply with the Notifiable Data Breaches scheme (Part IIIC, Privacy Act 1988 (Cth)). If we become aware of an eligible data breach likely to result in serious harm, we will promptly assess and contain it; notify you and the OAIC as soon as practicable, and within the time the scheme allows for assessment; tell you what happened, what information was involved and how to protect yourself; and take steps to prevent recurrence. Where you have set a PIN, the copy of your data on your device is encrypted in a way we cannot read, which reduces the risk from loss of a device. The copy of your data in our cloud is encrypted at rest but is readable by our systems in normal operation, so a breach of our cloud could expose readable information; we assess and notify any such breach under the scheme.
You may access the information we hold; correct inaccuracies; delete your data (Reset App, or email us for central records); withdraw consent at any time with no consequences; and make a complaint, to us first, and then to the OAIC if it is unresolved. To make an access or correction request, email us at contact@strongherside.com. We do not charge you for making a request, we will help you if you need support to make one, and we may need to confirm your identity before we act. We will acknowledge a privacy complaint within 5 business days and respond substantively within 30 days.
We may update this policy; the version and date at the top will change. For material changes, in particular anything affecting what a child's information we collect, store, transmit or share, we will re present the policy and re seek your consent the next time you open the App.
Hannah Gair, StrongHERside Daily. NSW, Australia. contact@strongherside.com. If you are not satisfied with our response to a privacy concern, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, 1300 363 992.
© 2026 Gair Media Pty Ltd. All rights reserved.