Privacy Policy
Last updated: August 2025
Nautilus Media Group Pty Ltd (ACN 164 132 781), an Australian corporation and its international subsidiaries CaringLife UK Ltd and CaringLife USA LLC (hereafter referred to as CaringLife, we, us, our) is the owner, operator and licensor of the Website and the Service.
Our Terms of Service and our Privacy Policy are collectively referred to as the Agreement ("Agreement").
CaringLife provides this Privacy Policy to help you make an informed decision about whether to use or continue using the CaringLife Website, the Software and/or the Service. If you do not agree to our practices, please do not use the Website, Software or Service.
This Privacy Policy is subject to the Terms of Service. Your use of the Website, Software and the Service and any personal information you provide on the CaringLife Website or Service remains subject to the terms of this Agreement.
Capitalised terms defined in CaringLife’s Terms of Service have the same meaning in this Privacy Policy.
We know how important security and privacy is to you. They are at the heart of CaringLife and as such we strive to make things as safe and clear as possible for everyone involved.
This Privacy Policy sets out how CaringLife ("we") treat the privacy of those who use our Website and associated services and others with whom we interact.
Please take a moment to read this Privacy Policy so you understand how we process Personal Data.
Summary: CaringLife collects and uses your personal info. If you disagree, please don't use our services.
Part A: Privacy Policy
- Application
This Privacy Policy refers to all "Personal Information" or "Personal Data" as information or an opinion about an identified individual, or an individual who is reasonably identifiable:
- whether the information or opinion is true or not; and
- whether the information or opinion is recorded in a material form or not.
This Privacy Policy applies to all Personal Data processed by CaringLife, including, but not limited to, Personal Data submitted by Authorised Account Holders and Users through the Service.
Important Notice
CaringLife is designed as a digital life story platform for children and young people in care. It is not a medical records system and must not be used to upload or store health or medical records, or other categories of sensitive data such as genetic, biometric, or criminal record information. Agencies and Authorised Account Holders remain responsible for storing such information in their own statutory or health systems as required by law. Uploading health or medical records to CaringLife is a breach of this Privacy Policy and may expose the uploader to legal liability.This Privacy Policy does not apply to the practices of companies that CaringLife does not own or control, or to individuals whom CaringLife does not employ or manage, including any of the third parties to which CaringLife may disclose user information as set forth in this Privacy Policy.
- Changes
From time to time we will review our Privacy Policy to keep pace with changes in our Service and any data protection and privacy laws applicable to the processing of Personal Data that we are committed to comply with, including:
- (a) the Privacy Act 1988 (Cth, Australia);
- (b) the Privacy Act 2020 (New Zealand);
- (c) the Personal Information Protection and Electronic Documents Act, SC 2000, c5 (federal, Canada);
- (d) the Personal Information Protection Act (Alberta, Canada)
- (e) the Personal Information Protection Act (British Columbia, Canada);
- (f) all applicable United States federal and state privacy laws, including, but not limited to, the California Online Privacy Protection Act (CalOPPA), Early Learning Personal Information Protection Act (ELPIPA);
- (g) the General Data Protection Regulation (EU);
- (h) the Data Protection Act 2018 (UK);
- (i) any other applicable privacy legislation.
(the above collectively referred to as "Data Protection Laws")
This Privacy Policy is our most recently updated Privacy Policy. Your continued use of the Website and Service constitutes your agreement to this Privacy Policy and any amendments. We encourage you to read our Privacy Policy carefully.
- Collection of Personal Data
We may collect your personal information if you:
- speak with us directly over the phone or via our support service;
- have contact with us in person;
- participate in public or closed surveys, questionnaires, or events;
- register for face-to-face or online events (such as webinars);
- interact with us online, via our website, email, or mobile applications;
- apply for a position with us (either as an employee, volunteer, or contractor).
The collection of your personal information may be required in order for you to:
- join our website as a registered user;
- receive information from us including alerts via email or SMS communications;
- register to use a forum or digital application;
- download our online resources;
- register as a volunteer;
- access services or resources;
- receive information about or become involved in our programs, campaigns, or initiatives; and/or
- work with us.
Categories of Personal Data we collect
(a) Personal Data you voluntarily provide:
When you give us your Personal Data directly (face-to-face, by telephone, email, post, through social media, or in any other way), or when you register to become an Authorised Account Holder, you are voluntarily giving us Personal Data that we collect.Categories include: name, email address, login credentials, feedback and suggestions, IP address, billing information (in line with our Terms of Service), occupation, employer, job title, and area of responsibilities.
(b) Communication list data:
When you become an Authorised CaringLife Account Holder, have an activated Carer or Child account, or sign up to our email communication list, we may collect your name, email address, and preferences. This data will only be used for our direct communications with you and will not be sold or disclosed to third parties for marketing.(c) Automatically collected Personal Data:
We may automatically collect log files linked to CaringLife Accounts. This may include your IP address, date/time of use, device/browser details, and interaction with the Service (including Content uploads, comments, and usage statistics).(d) Personal Data uploaded by Account Holders:
We collect Personal Data uploaded or transferred to the Service by Authorised Account Holders, such as when an Account Holder:- creates a Child Profile, or invites another person to become an Authorised Account Holder or User;
- uploads/transfers Content that contains Personal Data (including photographs, videos, or documents of Children or others);
- posts comments or tags Content containing Personal Data of another person.
Authorised Account Holders are responsible for ensuring they have obtained valid consent to upload and share the Personal Data of others, particularly children, before using our Service.
Statistical and technical information:
We may collect aggregated, non-personal statistical information to improve the features and user experience of the Service. Examples include: pages accessed, links clicked, session times, and browser/operating systems.Cookies and tracking:
We may use cookies and similar technologies to:- recognise your device;
- greet you on return visits;
- track services viewed;
- measure traffic and engagement patterns;
- improve our content and resources.
If you do not wish to receive cookies, you may adjust your browser settings. However, some features of the Service may not function properly without them.
What personal information do we collect?
We may collect:
- name, address, age/date of birth, phone number, organisation/service details, and email address;
- communication preferences;
- title, department name, company information, and demographic data;
- preferences for receiving program updates, initiatives, or service-related notifications.
The choice of how much information you provide is yours. However, some information is required to access certain services. Where possible, you may interact with us anonymously or by using a pseudonym.
Prohibited categories of data
CaringLife is not designed or intended to store health or medical records or other forms of sensitive information (such as racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, trade union membership, or criminal records). Agencies and Account Holders must not upload such information. Uploading medical or health records is a breach of this Privacy Policy and may result in legal liability.
Summary: We collect Personal Data through direct interactions, online activities, and account uploads. This may include names, emails, job titles, IP addresses, and child-related content. Health and medical records, and other sensitive data, must not be uploaded. Agencies and Account Holders are responsible for obtaining valid consent and complying with privacy laws when uploading any information about others.
- Use of Personal Data
We collect your Personal Data for the primary purpose of providing our services to you. We may also use your Personal Information for secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use or disclosure.
We process Personal Data for the following purposes:
- (a) to administer CaringLife Accounts;
- (b) to enable the features of the Services to be utilised and enjoyed, subject always to our Terms of Service. This may, for example, entail incidental posting of photographs/videos of a Child on another Child's Profile. Those posts may remain viewable even once a Child's Authorised Account Holder no longer uses the Service as long as the relevant Child Profile is retained;
- (c) to analyse user behaviour (in respect of the Website) and Authorised Account Holder behaviour (in respect of the Service) for the purposes of:
- (i) determining Service developments;
- (ii) inviting Users or Authorised Account Holders to explore other features within the Website or Service, and otherwise to generally promote our Service;
- (iii) ensuring the security of the Website and the Service; and
- (iv) combating and preventing breaches of our Terms of Service, other user agreements, this Privacy Policy and our other policies;
- (d) to respond to enquiries, feedback or complaints received from you;
- (e) to perform authorised financial transactions with you and to help us to manage our CaringLife Accounts and administrative services;
- (f) to verify your identity;
- (g) for directly communicating to you (including by email, post, other means, or through functionality within the Service) with information about our Service;
- (h) on an aggregated non-identifiable basis, to:
- (i) help CaringLife understand its market position;
- (ii) assist with marketing our Service to others, including in respect of any online communications; and
- (iii) deliver a statistical result to help with general CaringLife announcements;
- (i) to protect our legal interests and fulfil our regulatory obligations (if and to the extent necessary);
- (j) to ensure the trust and safety of any Child and Users of the Service; and
- (k) in other circumstances, provided we comply with applicable Data Protection Laws.
Summary: We use your Personal Data to provide and improve our services, respond to your requests, process payments, and communicate with you. We also use it to keep the Service safe, ensure the trust and safety of children, meet our legal and regulatory obligations, and make improvements based on usage trends. Data may also be used in aggregated and anonymised form to help us understand our market and improve CaringLife.
- Lawful Basis for Processing
Performance of a contract: You acknowledge and agree that the processing identified below is necessary for the performance of a contract to which the data subject is party (being the Agreement):
- (a) to carry out User and CaringLife Account administration tasks;
- (b) to manage and deliver the Service; and
- (c) to manage any disputes (including disputes over invoices or delivery of Service).
Legitimate interests: In respect of all other processing of Personal Data detailed in this Privacy Policy (including direct marketing activities), such processing is necessary for the purposes of a legitimate interest pursued by CaringLife, and we have assessed that such interests are not overridden by the interests or fundamental rights and freedoms of the persons to whom the Personal Data relates. You have the right to object to the way we process your Personal Data where the processing is based on legitimate interests. For more information see "Your Rights" section below.
Data Processor: For Personal Data uploaded and transferred to the Service by Authorised Account Holders, CaringLife is the Data Processor. The Authority/Agency or other organisation licensing the CaringLife Service is the Data Controller. The Authorised Account Holder is responsible for determining the legal basis for processing that Personal Data. Please see Part B (clause 15) below for the Authorised Account Holder's obligations.
- Direct Communication
All those with whom we interact have the option to opt-out of receiving direct email communications from us. If you do not wish to continue to receive direct communications from us and/or selected third parties, you should opt-out by clicking on the “unsubscribe” link in any email communications that we might send you.
Please note that some features of the Service may involve us providing, through the functionality within the Service, recommendations or suggestions for goods, services or benefits that we offer.
Summary:
You have the option to stop receiving direct email communications from us. If you wish to unsubscribe from these emails, you can do so by clicking the “unsubscribe” link in any email we send you.However, please note that some features of our Service may still provide you with recommendations or suggestions for goods, services, or benefits that we offer.
- Retention and Deletion of Personal Data
We will retain your Personal Data for as long as the CaringLife Account associated with you is active, or as long as needed to provide you with our Service.
We will destroy or de-identify unsolicited personal data if it is lawful and reasonable.
We take steps to regularly destroy Personal Data, however we may:
- (a) In some cases, retain a copy of your Personal Data to comply with our legal obligations, resolve disputes, enforce our agreements and to comply with our trust and safety obligations. Personal Data retained for this purpose will be archived and stored in a secure manner after your CaringLife Account has been closed, and will not be accessed unless required for any of these reasons; and
- (b) Retain Personal Data in an aggregated, de-identified or otherwise anonymous form, such that there is no reliable way of identifying you from the information.
Unless a longer period is required by law, CaringLife will delete or anonymize Personal Data within 12 months of account closure or termination. Data retained for legal, regulatory, or safeguarding reasons will be archived securely and only accessed if required.
Summary: We keep your Personal Data as long as your CaringLife Account is active or as needed to provide our services.
If we get personal data we didn't ask for, we'll destroy or anonymize it if allowed.
We regularly destroy Personal Data, but may:
- Keep a copy to meet legal requirements, resolve disputes, and ensure safety. This data will be securely stored after your account is closed and only accessed if needed.
- Keep data in a way that it cannot be used to identify you.
- Disclosure of Personal Data
CaringLife discloses Personal Data only in accordance with this Privacy Policy and applicable law. We limit the information we share to what is necessary for specific purposes and ensure that third parties meet appropriate privacy and security standards. CaringLife will never sell or rent your Personal Data.
- (a) Authorised Account Holders: At the direction of an Authorised Account Holder, the Service may disclose Content (which may contain Personal Data) to other Authorised Account Holders. For example, a Child’s photo or video uploaded by one Authorised Account Holder may be shared with another who has authorised access. Authorised Account Holders are responsible for ensuring they have obtained lawful and appropriate consent before directing CaringLife to share any Personal Data. If you no longer want to be contacted by an Authorised Account Holder, please contact your Agency or CaringLife directly.
-
(b) Service Providers: We may share limited Personal Data with trusted third-party service providers that support our operations, including payment processors, hosting providers, IT and security partners, communication platforms, and content delivery networks. These providers are contractually bound to:
- use Personal Data only for the services we request;
- maintain confidentiality; and
- meet privacy and security standards required by law.
- (c) Business Changes: If CaringLife or substantially all of its assets are acquired by a third party, Personal Data may be transferred as part of the transaction. In such cases, government and agency licensees will receive at least 30 days’ prior notice, enabling them to make appropriate decisions about the continuation of service or data migration consistent with their legal obligations.
- (d) Legal Obligations: We may disclose Personal Data where required to do so by law, regulation, or court order, including to comply with legal obligations, enforce our Terms of Service, protect the rights, property, or safety of CaringLife, our users, or third parties, or to prevent, detect, and investigate fraud or security incidents. Where legally permissible, CaringLife will notify affected users or agencies before disclosing Personal Data to regulators or law enforcement.
Children’s Data
Because CaringLife is designed to support children in care, disclosures of child-related Personal Data are strictly limited to authorised carers, agencies, and account holders. All such disclosures must comply with applicable child data protection frameworks, including the UK Age Appropriate Design Code (Children’s Code) and the US Children’s Online Privacy Protection Act (COPPA). No child’s Personal Data will be disclosed for marketing, profiling, or unrelated purposes.
Summary: We only share Personal Data to deliver our Service, comply with legal requirements, or support legitimate operational needs. Third parties only receive what they need to perform essential functions and must meet strict privacy obligations. Agencies and authorised users are responsible for lawful consent before directing disclosures. Child-related data receives the highest level of protection under applicable child privacy laws.
- Trans-border Personal Data Flows
CaringLife is a global service, but we ensure that all Personal Data is processed and stored within the region or country of the Child’s residence. Data is never transferred internationally outside of the Child’s country or designated storage region. This approach ensures that Personal Data remains subject to the privacy and data protection laws of the Child’s jurisdiction.
By maintaining all processing and storage locally, CaringLife avoids cross-border transfers and ensures that Personal Data receives consistent and appropriate protection under the laws and safeguards that apply in the Child’s home country or region.
Summary: CaringLife does not conduct international processing of children’s data. Personal Data is always stored and processed in the country or region of the Child, ensuring compliance with local data protection requirements.
- Security of Personal Data
CaringLife takes the security of Personal Data very seriously. We apply technical, organisational, and administrative measures to protect Personal Data against loss, misuse, unauthorised access, disclosure, alteration, and destruction.
Our security measures include:
- encryption of data in transit (SSL/TLS) and at rest;
- secure data centres with off-site backups;
- restricted access controls so that only personnel with a legitimate business need can access Personal Data;
- multi-factor authentication for administrative accounts;
- regular monitoring, logging, and auditing of systems;
- selection of technology partners and service providers based on their security and privacy certifications (such as ISO27001, SOC2, or equivalent);
- continuous review and improvement of our security practices.
Passwords are encrypted and never stored in plain text. Authorised Account Holders are responsible for maintaining the confidentiality of their login credentials and should never share their passwords. CaringLife is not responsible for any loss of data or breach of privacy resulting from an Authorised Account Holder sharing their password or failing to secure their account.
While no system can guarantee 100% security, CaringLife follows industry best practices to minimise risks and respond promptly to incidents. In the event of a personal data breach under our control, we will investigate immediately and take all required steps to mitigate the impact.
Where required by law, including under the GDPR and the UK Data Protection Act 2018, CaringLife will notify the relevant supervisory authority within 72 hours of becoming aware of a breach, and notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
Summary: CaringLife protects Personal Data using strong encryption, strict access controls, secure infrastructure, and internationally recognised standards. Users must also play their part by securing their accounts. In the event of a breach, we comply with all legal obligations for timely notification.
- Your Rights
You may decline to submit Personal Data through the Website or the Service, in which case CaringLife may not be able to provide certain services to you. If you do not agree with our Privacy Policy or Terms of Service, please discontinue use of the Service. Your continued usage of the Service will signify your assent to and acceptance of our Privacy Policy and Terms of Service.
You have the right to:
- (a) access and correct your Personal Data that is held by us at any time.
- (b) request the erasure of any or all of your Personal Data;
- (c) restrict or object to the processing of any or all of your Personal Data;
- (d) request the porting of any or all your Personal Data to another organisation; and
- (e) withdraw any consent to processing that you have previously given in respect of any or all of your Personal Data.
Please contact CaringLife (see contact details at the end of this Privacy Policy) with any questions or comments about this Privacy Policy, your Personal Data, your consent, access, correction requirements, or your opt-in or opt-out choices.
Please note that where we are not, or are no longer, in a position to identify you within the information we hold (including because of any de-identification techniques we may have employed), then your rights as described above shall not apply.
We will respond to any request made in respect of the above in accordance with the applicable Data Protection Laws where you are resident.
We will respond to any request made in respect of the above without delay, but in any case within one (1) month of a request, or two (2) months where the requests are complex or numerous (in which case, we will inform you of such delay).
Summary:
- You don't have to give us your Personal Data, but we may not be able to provide some services if you don't.
- If you don't agree with our Privacy Policy or Terms of Service, please stop using our Service.
- By using our Service, you agree to our Privacy Policy and Terms of Service.
You can:
- See and correct your Personal Data.
- Ask us to delete your Personal Data.
- Ask us to stop or limit how we use your Personal Data.
- Ask us to send your Personal Data to another organisation.
- Withdraw your consent for us to use your Personal Data.
Contact CaringLife if you have questions or want to exercise your rights.
If we can't identify you (for example, if your data is anonymised), these rights may not apply.
We will respond to your requests within one month, or two months if the request is complicated. We will let you know if we need more time.
- Maintaining the quality of your personal information
CaringLife is committed to ensuring that the Personal Data we hold is accurate, complete, and up to date. We take reasonable steps to maintain data quality through our systems and administrative practices.
Authorised Account Holders and Agencies are responsible for ensuring that any information they upload to CaringLife about children, carers, or other individuals is accurate and regularly updated. CaringLife provides tools within the Service to allow corrections and updates to be made quickly and securely.
If you believe the Personal Data we hold about you is incorrect, incomplete, or out of date, you may contact us at any time to request a correction. We will respond to such requests promptly and in accordance with applicable privacy laws, including the GDPR, UK GDPR, the Australian Privacy Act 1988, and the New Zealand Privacy Act 2020.
Summary: We strive to keep Personal Data accurate and current. Agencies and account holders must ensure uploaded information, especially about children, remains correct. Individuals can request corrections at any time, and CaringLife will act promptly in line with legal requirements.
- Notifiable Data Breach Scheme
In the event of any unauthorised access, disclosure, or loss of Personal Data that is likely to result in serious harm, CaringLife will investigate promptly and take immediate steps to mitigate any impact.
Where required by law, CaringLife will notify:
- the relevant supervisory authority within the legally mandated timeframe (for example, within 72 hours under the GDPR and UK GDPR);
- he Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme;
- the New Zealand Privacy Commissioner under the Privacy Act 2020; and
- any other regulatory body as required by applicable US state or federal privacy laws or other international laws.
If the breach is likely to result in a high risk to the rights and freedoms of affected individuals, CaringLife will also notify those individuals without undue delay, using clear and transparent language.
Summary: If a data breach occurs that could cause serious harm, CaringLife will investigate immediately, notify regulators within the required timeframes, and inform affected individuals when necessary, in line with all applicable global privacy laws.
- Cancelling Your CaringLife Account
If your CaringLife Account is terminated for any reason, the Personal Data associated with it will no longer be accessible to you. However, any Content or Personal Data you have shared with other Authorised Account Holders may remain accessible to them, as it forms part of their authorised records.
CaringLife retains residual copies of data for a limited period to support secure backups and disaster recovery processes. These residual copies are stored in encrypted form and are not actively used. They will be permanently deleted or anonymised within 12 months of account termination, unless a longer retention period is required by law or necessary to meet regulatory, safeguarding, or legal obligations.
Summary: When an account is cancelled, you will lose access to your Personal Data, though information already shared with others may remain visible to them. Backup copies are kept securely for up to 12 months and then permanently deleted or anonymised, unless the law requires longer retention.
- Uploading and Transferring Other People’s Personal Data through the Service
When you use CaringLife to upload or transfer Personal Data about other people, including children, you act as the Data Controller for that information. CaringLife acts only as the Data Processor. This means that you are responsible for ensuring that all uploads and transfers comply with applicable privacy and data protection laws.
By using the Service, you agree that you will:
- (a) Comply with applicable law: You must comply with all relevant data protection laws, including but not limited to the GDPR, UK GDPR, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, and relevant US state privacy laws.
- (b) Obtain valid consent: You are responsible for obtaining all necessary and valid consents for CaringLife to process the Personal Data you upload or transfer. Consent must be obtained from the appropriate person, such as a parent, guardian, or agency with legal authority in the case of children.
- (c) Manage withdrawals of consent: If an individual withdraws their consent or objects to the processing of their Personal Data, you must notify CaringLife without undue delay. This includes where a child withdraws consent or objects to processing.
- (d) Keep Personal Data Accurate: You must ensure that Personal Data you upload is accurate, complete, and kept up to date, and correct it when requested by the person to whom it relates.
- (e) Report security incidents: If you become aware of a security incident or suspected breach affecting Personal Data you uploaded, you must notify CaringLife immediately and provide all relevant details. (f) Prohibition on sensitive data: You must not upload or transfer sensitive data, including information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, or criminal records, unless strictly required by law and with explicit consent. CaringLife is not designed or intended to store health or medical records. Agencies and Account Holders must never use the Service as a repository for medical information. Uploading such records is a breach of this Privacy Policy and may expose you to legal liability.
- (g) Use the Service securely: You are responsible for the secure use of the Service, including protecting login credentials, encrypting or securely transferring data, and backing up information where appropriate.
- (h) Review and stay updated: You must review CaringLife’s security and privacy documentation and ensure that the Service meets your requirements. CaringLife may update its Terms of Service and Privacy Policy from time to time, and you agree to remain informed of the latest version.
- Questions and Comments
If you have any questions or comments, or want to access, update, or delete the Personal Data we hold about you, or have a privacy concern, you may contact us at:
Australia/New Zealand
The Privacy Officer
Nautilus Media Group Pty Ltd
PO Box 1004
Elwood Victoria 3184
Email: hello@caringlife.comUnited Kingdom
Data Protection Officer
CaringLife UK Ltd
128 City Road
London EC1V 2NX, United Kingdom
Email: ukprivacy@caringlife.comUnited States
Data Protection Officer
CaringLife USA LLC
16192 Coastal Highway
Lewes, Delaware 19958, USA
Email: usprivacy@caringlife.comPlease provide sufficient detail about the information in question to help us locate it.
We will respond to any privacy request in compliance with the applicable Data Protection Law, including the UK GDPR, EU GDPR, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, and relevant US state laws.
We aim to respond to all valid requests without undue delay and within one (1) month of receipt, or within two (2) months where requests are complex or numerous, in accordance with UK GDPR standards. If we require additional information to verify your identity or clarify your request, we will contact you promptly.
If you are not satisfied with our response, you may lodge a complaint with your local data protection authority, such as the UK Information Commissioner’s Office (ICO), the Office of the Australian Information Commissioner (OAIC), or any other relevant supervisory authority.
Part B: Your Responsibilities
Summary: When you upload others’ Personal Data to CaringLife, including children’s data, you are legally responsible for obtaining valid consent, keeping information accurate, and ensuring compliance with privacy laws. Sensitive data must not be uploaded except where strictly required by law and with explicit consent. CaringLife processes such data only under your instructions as the Data Controller.