BEMO Privacy Notice
Privacy contact: support@bemo.com.au
1. Who we are and how this notice applies
Amanda Robinson T/A Barker IT operates BEMO, software used by businesses to administer supports and related records. This notice explains how we handle personal information when operating BEMO. We will comply with the privacy laws that apply to our activities, including the Privacy Act 1988 and Australian Privacy Principles where applicable.
The business providing your supports may separately collect and use your information through BEMO. It is responsible for its own notices, permissions and lawful handling. Contact that business first about its care decisions or records; you may also contact us about BEMO's handling of information. This distinction does not remove our own legal responsibilities.
2. Information we may handle
Depending on how BEMO is used, information may include:
- Account names, email addresses, business details, contact details, user roles and authentication records.
- Participant names, contact details, representatives, relevant identifiers, support arrangements, schedules and service history.
- Health, disability, care, support-note, incident or other sensitive information entered by authorised users.
- Worker details, availability, qualifications and other business records.
- Agreements, signatures, uploaded documents, invoices, receipts, payment references and financial records.
- Support enquiries, correspondence and information supplied during troubleshooting.
- Technical and security records such as IP addresses, browser information, session activity, audit events and errors.
Not every category is collected from every person. Businesses should enter only information necessary for their legitimate activities. Do not submit payment-card numbers or sensitive records through ordinary support email unless a suitable secure process has been arranged.
3. Where information comes from
We receive information from account holders, authorised business users, people who contact us, and individuals completing public agreement or signing workflows. Businesses may enter information obtained from participants, authorised representatives, workers, billing contacts or other lawful sources.
Connected services may supply information when an authorised user enables an integration. Technical information may be recorded automatically when the service is used.
You may browse public information without identifying yourself where practicable. An account, support response or particular service may require identification. If necessary information is not provided, the requested function may not be available. We will explain identity-verification requirements when relevant.
4. Why we handle information
We handle information to provide account access and business workflows, store and retrieve authorised records, produce requested documents and reports, support signing and communication functions, administer subscriptions, respond to support requests, maintain backups, investigate faults, protect the service, and meet legal obligations.
Sensitive information requires appropriate consent or another lawful basis where required. Acceptance of this notice alone is not blanket permission for unrelated uses. We will not sell participant information or use uploaded participant health or disability records for targeted advertising.
We will not introduce a new use of participant information for external AI services or AI model training solely on the basis of this notice. Any proposed feature requiring additional disclosures or consent must be assessed and explained before activation.
5. Who may receive information
Information may be accessible to authorised users of the relevant business according to their permissions. A business may direct BEMO to share information with participants, representatives, workers, billing contacts or other recipients through documents, exports, signing links or email.
We may use hosting, backup, email, technical support and security service providers to operate BEMO. Optional payment and calendar providers may receive information needed for an enabled integration. Access should be limited to what is necessary for the service or task.
We may disclose information where required or authorised by law, to respond to a valid legal process, to investigate unlawful activity, or to address a serious threat where the law permits. We do not provide blanket access to records merely because someone claims to be a relative, representative or another service provider.
6. Hosting and processing
The BEMO site and its associated email, backup and support services are hosted in Australia. Payment and calendar processing use global providers for integration. We currently use Google and Microsoft for calendar integrations, and Stripe and PayPal for payment integrations.
These providers may process personal information outside Australia under their applicable service terms and privacy policies. Where Australian privacy law applies to an overseas disclosure, we will comply with the applicable requirements.
7. Security and access controls
BEMO uses HTTPS for browser connections and account permissions to restrict access. System administration is restricted to a private Tailscale connection and retains application authentication and MFA. The service uses security logs and backups. These controls do not mean that every field is encrypted at rest or that every customer account is required to use MFA.
We take reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. No internet service is risk-free. Users must protect credentials, keep devices secure and promptly report suspected incidents to support@bemo.com.au. We assess suspected breaches and notify affected individuals and regulators where required by law.
8. Cookies, integrations and public links
BEMO uses essential session cookies and related security tokens to support login, session preferences and request protection. Persistent login may be used where the user selects that option. Blocking essential cookies may prevent authenticated functions from working.
Public signing links and exported documents can contain personal information. Only share them with the intended recipient. Linked or embedded third-party services may collect technical information under their own policies.
9. Retention, cancellation and deletion
When your paid subscription ends following cancellation, you will have 30 days from that end date to export your business and client records to fulfill your statutory NDIS and tax obligations. After 30 days, we reserve the right to permanently delete or de-identify this data, and BEMO accepts no liability for loss of records required for regulatory audits.
Nothing in this section excludes, restricts or modifies any liability, right or remedy that cannot lawfully be excluded, restricted or modified. Deletion and de-identification remain subject to applicable legal retention obligations.
Backups may temporarily retain information removed from active systems. Backup access is restricted, and information restored for recovery must remain subject to applicable deletion and retention decisions.
10. Access and correction
Contact support@bemo.com.au to request access to or correction of personal information we hold. Identify the information or issue without including unnecessary sensitive details. We may need to verify identity and authority using a proportionate secure process.
Where a request concerns a provider's records, we may coordinate with or refer you to that provider while addressing our own responsibilities. We aim to respond within 30 days. If access or correction is refused, we will explain the reason and available complaint avenues, unless the law prevents us from doing so. Where appropriate, we can associate a statement of disagreement with a record. Any access charge must be lawful and explained in advance; we do not charge simply to make a request.
11. Complaints and updates
Send privacy complaints to support@bemo.com.au with your contact details and a description of the concern. We will acknowledge the complaint, investigate and aim to provide a substantive response within 30 days. If more time is needed, we will explain why and provide an update.
If you are dissatisfied, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints or any other regulator with jurisdiction. The OAIC generally expects you to first complain to the organisation and allow a reasonable opportunity to respond.
We may update this notice when our practices or obligations change. The published notice will state its effective date. We will give appropriate notice of material changes and obtain additional consent where required; publishing a revision does not itself authorise an unrelated new use of sensitive information.