Privacy Policy

StaffReady is software for Australian healthcare staffing agencies, based in Melbourne, Victoria. We are responsible for the personal information handled through StaffReady, and we are who to contact about it.

We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles. Where your agency handles health information, the Act's health-information rules apply, and some states add their own (for example the Health Records Act 2001 in Victoria).

This matters more than anything else on this page. When your agency stores a nurse's police check in StaffReady, your agency decides why it was collected, how long it is kept, and who inside your organisation may see it. Your agency is the entity with the direct relationship to that worker.

We hold and process that information on your instructions, to provide the service you subscribe to. We do not decide what to collect about your workers, we do not use their information for our own purposes, and we never sell it or use it to train machine-learning models.

In practice: if one of your workers asks to see or correct their data, that request belongs to your agency, and the tools to answer it are in the product. If they contact us directly, we will point them to your agency and tell you that they asked.

Agency and account information. Your business name, ABN, address, phone, labour hire licence number and state, the email and name of each person you invite to your team, and your subscription status. We need this to run your account, produce compliant invoices, and bill you.

Worker information, entered by your agency or by the worker. Name, date of birth, contact details, address, employment type, role and specialisations, availability, pay rates, AHPRA registration number, shift and timesheet history, and the credential documents you upload.

Credential documents are the sensitive part. Immunisation and vaccination records are health information under the Privacy Act and carry a higher standard of protection than ordinary personal information. Police checks and working-with-children checks are also sensitive. We collect these only because your agency has a legal and contractual need to evidence them, they are stored in private buckets, and they are only ever served through short-lived signed links to people in your agency who are signed in.

Facility information. Facility names, addresses, contact and approver names and emails, and the rates agreed with them.

Technical information. Standard server logs: IP address, user agent, time and path of requests, and the error messages our servers record when something breaks.

We do not use advertising trackers, and we do not run third-party analytics that build a profile of you across other websites.

In Australia. The StaffReady database and file storage run in Amazon Web Services' Sydney region (ap-southeast-2), through Supabase. This is a deliberate choice: healthcare agencies are asked about it constantly, and the answer should be simple.

Some supporting services are operated by companies headquartered overseas, and a small amount of data necessarily passes through them. Australian Privacy Principle 8 requires us to name them, so we do, in the next section.

We keep this list short on purpose. Each of these has a specific job and sees only what that job needs.

• Supabase: the database, authentication and file storage. Holds everything you put in StaffReady. Your project runs in AWS Sydney. Supabase is a US company that can access infrastructure for support and maintenance.
• Cloudflare: serves the application and protects it from attack. Sees request metadata (IP, URL, headers) and the content of pages in transit. Cloudflare is a US company with a global network.
• Resend: sends transactional email: shift offers, timesheet approval links, worker portal invitations, credential reminders and invoices. Sees the recipient's email address and the content of that email. US company.
• Stripe: takes your subscription payment. Sees your billing contact and card details. We never see or store your card number. US company, PCI DSS Level 1.

We do not add a sub-processor that handles worker information without updating this page. If you need a formal data processing agreement or a sub-processor notification commitment for your own compliance, email privacy@staffready.com.au and we will put one in place.

Every table is protected at the database level, not just in the interface. A signed-in user can only ever read rows belonging to an agency they are a member of.

• Owner — everything, including billing, team, agency settings, export and deletion.
• Coordinator — day-to-day operations: workers, shifts, timesheets, credentials. Not billing, settings, team or deletion.
• Read only — can view and export reports, cannot change anything.
• Worker — their own profile, their own shifts, offers, timesheets and credentials. A worker can never see another worker, and can never see what you bill a facility.

While your account is open, we keep your data so the product works and your records stay complete. Employment, payroll and workplace records generally must be kept for seven years under the Fair Work Act, and your own professional and insurance obligations may require longer for credential evidence. You decide what to delete and when.

When you delete your agency, we place it in a 14-day recovery window, during which you can change your mind. After that the data is destroyed permanently: workers, credentials, documents, shifts, timesheets, invoices, pay runs and the audit log. This cannot be undone. When deletion is requested we email the owner the date it will happen. Until then the audit log can be downloaded from Settings → Agency → Export data, and you should download it if you may need it later: it is often the record you are asked to produce, and it does not survive the deletion.

Under the Australian Privacy Principles you can ask for access to the personal information we hold about you, and ask us to correct it if it is wrong. Most of this is self-service:

• Export everything. Settings → Agency → Export data. Produces a complete bundle of your agency's records.
• Workers export their own data. Worker portal → Profile → Download my data.
• Correct anything. Edit it in the product. Every change is recorded in the audit log.
• Delete the account. Settings → Agency → Delete agency.

If you cannot get what you need from the product, email privacy@staffready.com.au. We will respond within 30 days, which is the standard the Privacy Act sets. There is no charge for a reasonable request.

If you are unhappy with how we handle a privacy matter, tell us first and we will try to fix it. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Encrypted in transit (TLS) and at rest. Row-level security on every table. Credential documents in private storage reachable only by short-lived signed links. Passwords are hashed by Supabase Auth and are never visible to us. Every change to a record writes an append-only audit entry.

Our security practices are described in more detail on the security page. To report a vulnerability, email security@staffready.com.au.

We are covered by the Notifiable Data Breaches scheme. If a breach involving your data is likely to cause you or your workers serious harm, we will:

• contain it and assess the scope, promptly;
• notify affected agencies without undue delay and within 72 hours of becoming aware, telling you what happened, what data was involved, and what to do;
• notify the OAIC where the scheme requires it; and
• give you the detail you need to meet your own notification duties to your workers.

We will tell you even where the breach turns out not to meet the threshold for regulatory notification, if your data was involved.

StaffReady is a business tool and is not intended for anyone under 16. Your agency may hold records about workers under 18; those are handled the same as any other worker record.

If we change this policy in a way that materially affects you, we will email the account owner before it takes effect. The current version is 2026-10-02. Continuing to use StaffReady after a change means you accept the updated policy.

Privacy enquiries: privacy@staffready.com.au
Security reports: security@staffready.com.au
Everything else: hello@staffready.com.au
StaffReady, Melbourne, Victoria, Australia