CarePulse™ Privacy Policy

This Privacy Policy explains how Brand Insight Pty Ltd (ABN 63 631 544 968), trading as Brand Health, handles personal information in connection with CarePulse™.

CarePulse™ is a product of Brand Insight Pty Ltd. In this Privacy Policy, CarePulse, we, us and our mean Brand Insight Pty Ltd.

This Privacy Policy applies to:

1. the public website at carepulse.au;
2. the subscriber dashboard at app.carepulse.au;
3. enquiries, demo bookings and business communications with CarePulse; and
4. personal information handled in connection with the CarePulse service.

1. Privacy framework

CarePulse is an Australian-facing product marketed to Australian aged care providers.

CarePulse handles personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and any other applicable Australian privacy laws to the extent they apply.

To the extent CarePulse is not required by law to comply with a particular Australian Privacy Principle, CarePulse nevertheless aims to handle personal information in a manner materially consistent with the Australian Privacy Principles.

CarePulse does not target individuals outside Australia and does not intend to offer goods or services to, or monitor the behaviour of, individuals overseas. On that basis, overseas privacy regimes such as the European Union General Data Protection Regulation are not expected to apply to CarePulse’s ordinary Australian operations.

2. The CarePulse research-data model

CarePulse operates a syndicated consumer brand-tracking subscription product for the Australian aged care sector.

The research is conducted using a panel provider, currently Pureprofile Australia Pty Ltd. The panel provider recruits and manages survey respondents.

CarePulse does not collect survey respondents’ names or contact details from the panel provider.

Respondent personal information, such as survey participants’ names and contact details, is collected and held by the panel provider and is not disclosed to CarePulse.

CarePulse receives de-identified survey response data and makes only aggregated, de-identified outputs available to subscribers through the dashboard.

Subscribers do not receive respondent names, contact details or individual respondent records.

CarePulse applies aggregation, access controls and suppression processes designed to reduce re-identification risk.

3. Personal information CarePulse collects

CarePulse’s own personal-information footprint is limited primarily to low-sensitivity business contact information and dashboard user account information.

Where practicable, you may deal with us anonymously or by using a pseudonym. However, we may need to identify you in order to provide our services, manage user accounts, respond to enquiries, administer subscriptions, comply with legal obligations, or ensure the security and integrity of our platform. If we cannot identify you when reasonably required, we may be unable to provide some services or respond to your request.

CarePulse may collect the following types of personal information.

3.1 Pricing enquiries

When you submit a pricing enquiry through carepulse.au, CarePulse may collect:

1. your name;
2. your work email address;
3. your company name; and
4. the Australian state or states and Aged Care Planning Region or Regions of interest.

Pricing enquiries are submitted to HubSpot using its Forms API.

3.2 Demo bookings

When you book a demo through carepulse.au/book-demo, CarePulse may collect:

1. first name;
2. last name;
3. email address; and
4. meeting time and booking details.

Demo bookings are made through an embedded HubSpot Meetings scheduler.

3.3 Dashboard accounts

For authorised dashboard users, CarePulse may collect:

1. name;
2. work email address;
3. login credentials or authentication information;
4. subscriber organisation;
5. access permissions;
6. account activity and security logs; and
7. records of your acceptance of the CarePulse Terms of Use, including the version accepted and the date and time of acceptance.

3.4 Email correspondence

If you email CarePulse, including at hello@carepulse.au, CarePulse may collect your email address, name, role, organisation and the content of your correspondence.

3.5 Automatically collected technical information

When you use the Platform, CarePulse and its service providers may collect technical information such as:

1. IP address;
2. browser type;
3. device information;
4. approximate location derived from technical information;
5. pages visited;
6. access times;
7. referring website; and
8. cookie or similar technology identifiers.

The extent of this collection depends on the technologies enabled from time to time, as described in the cookies section below.

4. How CarePulse collects personal information

CarePulse collects personal information:

1. directly from you when you submit a pricing enquiry, book a demo, create or use a dashboard account, or correspond with CarePulse;
2. from the subscriber organisation that authorises your dashboard access;
3. from service providers used to operate the Platform, including HubSpot, Supabase, Google Workspace and hosting providers; and
4. automatically through cookies and similar technologies, where those technologies are used.

CarePulse does not intentionally collect sensitive information through its public website or ordinary dashboard account processes.

5. How CarePulse uses personal information

CarePulse may use personal information to:

1. respond to pricing enquiries;
2. arrange and conduct product demos;
3. assess potential subscriber requirements;
4. provide, administer and support the CarePulse subscription service;
5. create, authenticate and manage dashboard accounts;
6. manage user permissions and access controls;
7. provide technical support;
8. communicate with subscribers and authorised users;
9. send service-related communications;
10. send marketing communications where permitted;
11. manage business relationships;
12. maintain records;
13. monitor security and prevent misuse of the Platform;
14. improve the Platform, website, dashboard and service offering;
15. comply with legal obligations; and
16. enforce CarePulse’s legal rights and contractual rights.

6. Marketing communications and consent

CarePulse may use business contact details submitted through pricing enquiries, demo bookings or business correspondence to contact you about your enquiry, the CarePulse service and related CarePulse updates.

If we use or disclose your personal information for direct marketing, you may ask us to identify the source of the personal information used for that marketing. We will respond to that request within a reasonable period, unless it is impracticable or unreasonable for us to do so.

CarePulse may send marketing communications where it has consent under the Spam Act 2003 (Cth), including express consent or inferred consent, or where otherwise permitted by law.

CarePulse’s marketing communications will identify CarePulse as the sender and include a functional unsubscribe facility where required.

You may unsubscribe from marketing communications at any time by using the unsubscribe link in the relevant message or by contacting hello@carepulse.au.

CarePulse may continue to send non-marketing service communications where necessary, including communications about dashboard access, subscription administration, security, meetings, invoices or support.

7. Disclosure of personal information

CarePulse may disclose personal information to:

1. personnel, contractors and advisers who need the information for CarePulse business purposes;
2. CRM and booking providers, currently HubSpot;
3. dashboard database and authentication providers, currently Supabase;
4. panel and fieldwork providers, currently Pureprofile, noting that Pureprofile does not disclose respondent names or contact details to CarePulse;
5. hosting and infrastructure providers, currently including Vercel and AWS infrastructure used by Supabase;
6. email and productivity providers, currently Google Workspace / Gmail;
7. analytics providers, currently Google;
8. professional advisers, insurers and auditors;
9. regulators, courts, tribunals, law enforcement agencies or government bodies where required or permitted by law; and
10. other persons with your consent or as otherwise permitted by law.

CarePulse does not sell personal information.

8. Current service providers and data locations

As at the date of this Privacy Policy, CarePulse uses the following key service providers.

Provider	Role	Data handled	Location
Supabase	Dashboard database and authentication	Subscriber user accounts and aggregated de-identified survey data	Australia, using AWS Sydney region
HubSpot	CRM, website pricing-form submissions, demo bookings and website analytics	Prospect and subscriber contact details, company details and demo booking details	Hosted in HubSpot Australia (AP1) region. HubSpot is a United States company and its personnel may access data from outside Australia for support, security and administrative purposes.
Pureprofile Australia Pty Ltd	Panel and fieldwork	Respondent personal information held by Pureprofile and not disclosed to CarePulse	Australia, AWS Sydney
Vercel	Website and static app hosting	Static site delivery; no intended storage of personal information by CarePulse in Vercel	CDN, including Sydney edge locations
Google Analytics	Public website analytics	Technical information about visits to the public website, including IP address, device and browser information, pages visited and approximate location derived from technical information	United States. Google may store or process this information outside Australia.
Google Workspace / Gmail	Business email	Email correspondence and business contact information	May be stored or accessed outside Australia

CarePulse may change service providers from time to time, provided it continues to handle personal information in accordance with this Privacy Policy and applicable law.

9. Cross-border disclosure

CarePulse is an Australian-facing product. Research data and dashboard data are hosted in Australia through Supabase on AWS Sydney infrastructure. Pureprofile has confirmed that respondent personal information is not disclosed to CarePulse.

Some personal information may be disclosed, stored or accessed outside Australia, including:

1. business email and correspondence handled through Google Workspace / Gmail;
2. support, security, administrative or operational access by service providers; and
3. analytics providers, including Google Analytics, and any advertising, remarketing or tag-management providers introduced in the future.

Where CarePulse discloses personal information to an overseas recipient, CarePulse will take reasonable steps required by the Australian Privacy Principles to ensure the recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception applies.

Those overseas recipients are likely to be located in the United States. The countries in which overseas recipients are located may otherwise vary depending on the service provider’s infrastructure, support and processing arrangements.

10. Cookies and similar technologies

10.1 What cookies are

Cookies and similar technologies are small data files, identifiers, pixels, scripts, local storage objects or similar tools that may be placed on or accessed from your device when you use the Platform.

They can be used for security, authentication, functionality, analytics, performance measurement, marketing, advertising and remembering preferences.

10.2 Categories of cookies and similar technologies

CarePulse may use the following categories of cookies and similar technologies.

Strictly necessary cookies

These are required for the Platform to operate, including security, authentication, load balancing, form submission, dashboard access and fraud prevention.

Examples may include authentication cookies, session cookies and security-related identifiers.

Functional cookies

These support enhanced functionality, such as remembering preferences, supporting booking flows, or improving the usability of forms and scheduling tools.

HubSpot appears in this category because of its forms and Meetings scheduling: cookies and browser storage set so that a pricing enquiry or a demo booking works. HubSpot also appears under analytics and performance cookies below, for a different mechanism. Both are accurate, and clause 10.3 names which cookie belongs to which.

Analytics and performance cookies

These help CarePulse understand how visitors use the public website and Platform, measure performance, identify errors and improve content.

CarePulse uses Google Analytics 4 on the public website to measure traffic, understand how visitors use the site, identify errors and improve content.

CarePulse also uses the HubSpot tracking code on the public website. This is a different mechanism from the HubSpot forms and Meetings cookies described under functional cookies above: the tracking code measures how visitors move through the public website, and one of its cookies links that activity to a contact record once a form is submitted. Clause 10.3 sets out each cookie and what it does.

The HubSpot tracking code runs on the public website at carepulse.au only. It is not used on the subscriber dashboard at app.carepulse.au, and its cookies are limited to the website that sets them rather than being shared across subdomains.

CarePulse does not currently use Vercel Analytics.

Marketing and targeting cookies

These may be used to measure marketing campaigns, build audiences, deliver relevant advertising, conduct remarketing, or understand engagement with CarePulse content.

CarePulse does not currently use third-party advertising or remarketing cookies. CarePulse may introduce marketing, advertising, remarketing or tag-management tools in the future.

10.3 Current cookies and tools

As at the date of this Privacy Policy, the following cookies are used on the public website at carepulse.au.

Cookie	Set by	Purpose	Category	Expiry
_ga	Google Analytics	Distinguishes one visitor from another so visits can be counted	Analytics and performance	13 months
_ga_W5KQPDRNF1	Google Analytics	Keeps track of a visit in progress for the CarePulse property	Analytics and performance	13 months
__hstc	HubSpot	The main HubSpot tracking cookie. Records when a visitor first arrived, when they last arrived, and how many times they have visited	Analytics and performance	6 months
hubspotutk	HubSpot	Identifies a visitor's browser. If that visitor submits a form or books a demo, this cookie links the pages they viewed on the website to their contact record in the CarePulse CRM. It is what allows CarePulse to see which pages an enquiry or subscription came from	Analytics and performance	6 months
__hssc	HubSpot	Tracks a single visit, so HubSpot can tell when a new visit has begun	Analytics and performance	30 minutes
__hssrc	HubSpot	Records whether the visitor has restarted their browser, which HubSpot uses to decide whether a visit is new	Analytics and performance	End of browser session
parentHubspotUtk	HubSpot	Not a cookie. A visitor token passed to HubSpot's booking scheduler when the demo booking page loads, so a booking can be matched to the visitor. Where no tracking cookie exists, a new token is generated for that page load and is not linked to any earlier visit	Sent in every consent state, including after declining	Not stored. Exists only for that page load

The HubSpot cookies above are set by the HubSpot tracking code and are limited to carepulse.au. They are not set on, and are not shared with, the subscriber dashboard at app.carepulse.au.

Loading HubSpot's scripts, and its booking scheduler, causes HubSpot's own domains to set cookies of their own. These include __cf_bm, a Cloudflare bot-management cookie set on hs-scripts.com, hs-banner.com, hs-analytics.net and hubspot.com, which lasts about 30 minutes and is used to tell automated traffic from real visitors. Cookies set on HubSpot's domains cannot be read by CarePulse and are governed by HubSpot's own privacy notice rather than this one.

Booking a demo loads HubSpot's Meetings scheduler inside a frame served by HubSpot. Any cookies set inside that frame are set by HubSpot on its own domain rather than by CarePulse on carepulse.au, and are governed by HubSpot's own privacy notice.

The CarePulse subscriber dashboard at app.carepulse.au sets no cookies. It uses browser storage on the subscriber's own device to keep them signed in and to remember their selections within the dashboard. That information stays in the browser and is cleared when browser data is cleared.

CarePulse does not currently use Vercel Analytics.

10.4 Changes to cookies and tools

The specific cookies, tools and service providers used by CarePulse may change from time to time. CarePulse will update its cookie disclosures where appropriate.

10.5 Cookie consent mechanism

CarePulse uses a cookie consent banner on the public website at carepulse.au. The banner allows visitors to:

1. accept all cookies;
2. reject non-essential cookies; and
3. manage cookie preferences by category.

Strictly necessary cookies may remain active because they are required for the Platform to function.

Cookies are set when a visitor arrives. If a visitor declines, tracking stops and the cookies are removed. A single cookie is retained to record that choice.

CarePulse does not currently use marketing, advertising, remarketing or tag-management cookies. If it introduces any of those technologies, they will be covered by the same consent mechanism.

10.6 Managing cookies

You can control cookies through your browser settings. If you disable certain cookies, some features of the Platform may not operate properly.

11. Security

CarePulse takes reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Those measures may include:

1. dashboard hosting using Supabase on AWS Sydney infrastructure;
2. per-user access controls;
3. row-level security controls;
4. access limited to authorised personnel and authorised subscriber users;
5. encryption in transit;
6. credential-based authentication;
7. monitoring and logging; and
8. internal access controls.

No method of transmission or storage is completely secure. CarePulse does not guarantee that the Platform or any personal information will be free from unauthorised access, cyber incidents or technical failure.

12. Data breaches

If CarePulse becomes aware of a suspected or actual data breach involving personal information, CarePulse will assess and respond to the incident in accordance with its legal obligations.

Where the Notifiable Data Breaches scheme applies and an eligible data breach occurs, CarePulse will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

CarePulse may also notify relevant subscriber organisations where a security incident affects dashboard accounts, subscriber users or the subscriber relationship.

13. Retention

CarePulse retains personal information for as long as reasonably necessary for the purposes for which it was collected, including to:

1. respond to enquiries;
2. manage demo bookings;
3. administer subscriber accounts;
4. provide support;
5. maintain business records;
6. comply with legal, accounting and regulatory obligations;
7. resolve disputes; and
8. enforce agreements.

CarePulse may retain de-identified and aggregated information for research, analytics, service improvement and commercial purposes.

14. Access and correction

You may request access to personal information CarePulse holds about you.

You may also request correction of personal information if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests should be sent to:

CarePulse Privacy Contact
Brand Insight Pty Ltd
443 King Street
West Melbourne VIC 3003
Australia
Email: hello@carepulse.au

CarePulse may need to verify your identity before responding.

CarePulse will respond within a reasonable period and in accordance with the Australian Privacy Principles where they apply.

15. Complaints

If you have a privacy complaint, you may contact CarePulse at:

CarePulse Privacy Contact
Brand Insight Pty Ltd
443 King Street
West Melbourne VIC 3003
Australia
Email: hello@carepulse.au

Your complaint should include enough detail for CarePulse to understand and investigate the issue.

CarePulse will aim to acknowledge your complaint within a reasonable period and respond after making appropriate enquiries.

If you are not satisfied with CarePulse’s response, you may contact the Office of the Australian Information Commissioner.

Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Phone: 1300 363 992

16. Changes to this Privacy Policy

CarePulse may update this Privacy Policy from time to time by publishing an updated version on the Platform.

The updated Privacy Policy applies from the date it is published, unless stated otherwise.

17. Contact

For privacy questions, requests or complaints, contact:

CarePulse Privacy Contact
Brand Insight Pty Ltd
443 King Street
West Melbourne VIC 3003
Australia
Email: hello@carepulse.au