Doorside privacy policy

1. Who we are

Doorside is made by Muller Labs ("we", "us"). Doorside helps mobile allied health practices in Australia record the travel between home visits, bill it to the right funding scheme, and pay clinicians their mileage.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Doorside handles health information, which the Privacy Act treats as sensitive, so we collect only what the service needs and keep it to the practice that it belongs to.

2. Practices, clinicians and clients

• Practices sign up to Doorside and connect their practice management system (Cliniko at launch). Information about the practice's clients comes from that system. The practice decides what is collected about its clients and is responsible to them for it. We handle it on the practice's behalf, only to provide Doorside.
• Clinicians are invited by their practice and use the phone app. Their location is collected on their phone, by the app, as described below.
• Clients (the people the practice visits) don't use Doorside. If you're a client of a practice that uses Doorside and have a question about your information, ask the practice first; you can also contact us.

3. What we collect

Accounts

• Your name and email address, your role in the practice (for example clinician, admin, owner), and sign-in records.
• We don't use passwords. You sign in with a code we email you.

From the clinician's phone

• Location during drives, only while recording is on and within the hours the clinician sets. The individual location points stay on the phone, encrypted (see section 4).
• Trip totals for trips the clinician says were work: start and end times, distance, how it was measured, and which diary visit it was for. These are sent to the practice.
• The route of a confirmed work trip, encrypted on the phone before it's uploaded (see section 8).
• The clinician's home base is kept on the phone. The practice sees only the suburb.
• The clinician's answers in the app (for example, that a trip was personal, or that they drove to a visit) and the days they confirm.
• Device and app details needed to deliver notifications and fix problems (device type, app version, notification token).

From the practice's system

• The practice's appointments: date, time, clinician and appointment type.
• Client details needed to bill travel: name, funding (for example NDIS agency-managed, WorkSafe), NDIS number where the practice adds it, and the client's address. The address is used to work out distances and the client's remoteness zone, and is stored only encrypted.
• Invoice details, so Doorside doesn't bill the same travel twice.

From the practice's staff

• Billing decisions, travel terms agreed with clients, estimates, corrections and the reasons given for them.
• Exports: which travel lines went into which file, when and by whom.

On this website

• If you use the beta or partner form, or email us: your name, email, what you write, and the practice details you choose to give. We use it only to reply to you. The website doesn't use advertising or tracking cookies.
• The forms use Cloudflare Turnstile to check a person is sending them, not a bot. Turnstile looks at signals from your browser for that check only.

4. Location and the phone's permissions

The phone app asks for these permissions, and says why each time:

• Location, "while using the app" or "always". To measure work drives so travel can be billed and kilometres paid back. "Always" lets the app record a drive without being opened first; it's only used during the clinician's recording hours. A clinician can choose a mode that records only after they tap Start each day, or a mode that uses no location at all and estimates trips from the diary.
• Motion and fitness. To notice when a drive starts, so location is only used while driving.
• Notifications. For the end-of-day reminder and questions about trips.

Individual location points are stored encrypted on the phone and deleted soon after the day is confirmed. They don't leave the phone. Trips that don't match a work visit, stops, and anything the clinician marks private stay on the phone and are deleted with the rest. A clinician can pause recording at any time, and can change or withdraw their agreement in the app's Settings; recording stops straight away.

5. How we use it

• To match trips to diary visits and show the clinician their day.
• To work out travel charges under each scheme's rules and the practice's agreements, and produce the files and lists the practice bills from.
• To work out clinicians' mileage for the practice's payroll.
• To keep evidence of how a charge was worked out, if a scheme or client asks.
• To send sign-in codes, invitations and reminders.
• To keep Doorside secure, fix problems and improve it, using records without location or client names.

6. What we don't do

• We don't sell personal information, or use it for advertising.
• We don't measure or report a clinician's speed, driving, live location, attendance or productivity. The practice can't see where a clinician is.
• We don't put location or client names in logs or analytics.
• We don't use client information to train AI models.

7. Who it's shared with

Within the practice: staff see what their role allows. Admins see trip totals and billing, not maps. Payroll sees mileage, not client names. A work route can be opened only by someone allowed to, who has to give a reason; that's logged and the clinician is told.

Services that run Doorside for us, each only for what they do:

Some of these are overseas (APP 8). We send them only what their task needs; for example, Mapbox receives an address to place on a map, not who lives there. If we add a service (for example for payments or error reports), we'll add it here before it's used.

We'll disclose information if the law requires it, and tell the practice unless the law prevents that.

8. Where it's kept, and security

• Doorside's data is kept in Sydney.
• Client addresses, the practice's system key and confirmed work routes are encrypted with a key unique to each practice. That key is itself protected by AWS's key service; opening it is logged. Someone with access to the database alone sees nothing useful.
• Location on the phone is kept in encrypted storage.
• Exports need a fresh emailed code, and every export and download is recorded.
• Each practice's data is kept apart; every request is checked against what the person's role allows.

No system is perfectly secure. If a breach is likely to cause serious harm, we'll tell the people affected and the OAIC, as the law requires.

9. How long it's kept

• Location points on the phone: deleted soon after the day is confirmed.
• Practice records (trips, travel lines, mileage, the evidence behind them): kept for as long as the practice needs them for its legal and scheme record-keeping, for example 7 years for NDIS claims. The exact periods are part of the legal review.
• If a practice stops using Doorside, it has 30 days to download what it needs; then its data is deleted.
• Messages sent through the site's forms or to our email addresses: kept while we're in touch with you, and deleted within 12 months if nothing comes of them. Ask us to delete yours sooner at any time.
• Backups are kept for a limited time and then overwritten.

10. Your rights

• You can ask for a copy of the personal information we hold about you, and ask us to correct it.
• You can ask us to delete your account. Some practice records may need to be kept for the practice's legal obligations; we'll tell you what's kept and why.
• A clinician can see their own trips and mileage in the app, and export their work km record.

Email privacy@doorside.app. We'll reply within 30 days.

11. Children

Doorside's users are adults working for a practice. A practice's clients can include children; their information comes from the practice and is handled as described above, on the practice's behalf.

12. Changes

If we change this policy, we'll update this page and the date at the top, and tell practices before a significant change takes effect.

13. Contact and complaints

Privacy questions and requests: privacy@doorside.app. Anything else:hello@doorside.app.

If you're not happy with how we've handled a complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.