Privacy Policy

CLARITY DATA SOLUTIONS · ABN 15 005 130 394
APPLinkup 2026 · Draft prepared 23 September 2026

1. About this policy

CLARITY DATA SOLUTIONS (ABN 15 005 130 394), referred to as “we”, “us” or “our”, operates APPLinkup. We take our responsibilities under the Privacy Act 1988 (Cth) and the Australian Privacy Principles seriously. This policy explains how we collect, hold, use and disclose personal information in connection with APPLinkup, its website and related support services.

APPLinkup supports education, clinical placement administration, assessment, feedback and reporting. This policy applies to students, educators, university and placement organisation staff, administrators, support requesters and website visitors. Participating organisations also have their own privacy policies and responsibilities for the information they provide, access, export or otherwise handle.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. Some personal information, including health information, is subject to additional protections as sensitive information.

2. Information we collect

The information we collect depends on your role and how you use APPLinkup. It may include:

• Identity and contact information: names, email addresses, telephone numbers, student numbers and account identifiers.
• Account and organisation information: user roles, university or facility memberships, account status, preferences, language settings, authentication credentials and security settings.
• Education and placement information: university, program, cohort and stage details, placement organisations, placement dates, educator assignments, attendance or absence records and placement notes.
• Assessment information: questionnaire responses, self-assessments, educator assessments, scores, comments, feedback, submission history, ratifications, amendments and related requests.
• Consent and communication records: recorded consent choices, notices, messages, support enquiries, correspondence and files you or authorised users provide.
• Technical and activity information: IP addresses, browser and device information, session identifiers, pages or functions accessed, timestamps, sign-in events and records of access to or changes to information. An approximate country may be inferred from an IP address for operational and security purposes.

APPLinkup holds identifiable records. Although some reports contain aggregated statistics, this does not mean that the underlying account, placement, assessment or activity records are anonymous.

3. How information is collected

We collect information directly when you register, use APPLinkup, complete forms or assessments, update your details, or contact us. We also collect information from authorised universities, placement organisations, educators and administrators who create accounts, upload student or placement lists, record assessments or otherwise administer the service.

Existing account, placement, assessment and consent records may be transferred from earlier versions of APPLinkup to maintain continuity of the service. Technical and activity information is collected automatically when the service is used.

You may use a pseudonym for a general enquiry, but our public enquiries form requires a reply email address so we can respond. An APPLinkup account is not required. Identity verification may be necessary for requests involving personal or academic records. Identified accounts and accurate information are normally necessary for placement and assessment functions. If required information is not provided, we or your organisation may be unable to create your account, manage your placement, process your assessment or resolve your request.

4. Sensitive information and information about other people

Assessment comments, absence explanations, support enquiries and attachments may contain health or other sensitive information. We collect sensitive information only where reasonably necessary for our functions and with consent, unless collection is otherwise permitted or required by law.

Please provide only information necessary for the relevant task. Do not include identifiable patient information or unnecessary health, financial or identity documents in assessment comments, support messages or attachments. When providing information about another person, ensure you are authorised to do so and follow your organisation’s privacy requirements. Contact us if information has been supplied in error.

Where a separate consent is sought for a particular activity, its scope will be explained at that time. This policy is not a blanket consent to unrelated uses of your information.

5. How we use personal information

We use personal information to:

• Provide and administer APPLinkup, verify users and manage accounts and permissions.
• Coordinate placements, assessments, feedback, ratification and authorised education reporting.
• Deliver service messages, reminders, account recovery and security notifications.
• Respond to enquiries, investigate problems and provide administrative and technical support.
• Monitor reliability and security, investigate misuse, maintain audit records and resolve disputes.
• Maintain historical records where needed for a permitted purpose, and meet applicable legal obligations.
• Evaluate and improve the service, including through appropriate aggregated or de-identified reporting.

Other uses and disclosures occur only with consent or as otherwise permitted or required by law. Where we rely on a reasonably expected secondary purpose, that purpose must be related to the original purpose, or directly related where sensitive information is involved.

Optional promotional communications should be distinguished from necessary service messages. If we send optional marketing, you may opt out using the instructions provided or by contacting us. Essential account, placement, assessment and security messages may still be sent.

6. Access and disclosure

Information is made available according to authorised roles, organisational relationships and the relevant workflow. Depending on those permissions, recipients may include you, educators assigned to a placement or assessment, authorised university and placement organisation staff, and APPLinkup administrators and support personnel. Not every user in an organisation has access to every record.

Authorised administrators may access records to investigate issues and assist users. Administrative access and relevant actions may be recorded in audit logs. Participating organisations may generate reports or export information for their authorised education and administration purposes; their handling of those copies is also governed by their own obligations.

We may also provide information to contracted hosting, storage, communication, security and support service providers where needed to operate the service, and to professional advisers, regulators or other recipients where permitted or required by law. Service-provider arrangements must address appropriate handling and protection of personal information.

7. Reporting, benchmarking and research

APPLinkup supports authorised reporting on placements and assessments, including identifiable reports where needed by participating organisations. Aggregated benchmarking may be used to compare assessment outcomes across relevant groups.

Aggregation or removal of names alone does not necessarily prevent identification, particularly in small groups. Information should only be treated as de-identified after considering the risk of re-identification and the context in which it will be used or shared.

Any use or disclosure of personal information for research must have an appropriate legal basis and, where required, separate consent and ethics approval. This policy does not itself authorise unrestricted research use.

8. AI used in administrative support

AI is used only in administrator-facing functions. In the support workflow, APPLinkup uses OpenAI to help find relevant support guidance and prepare draft replies for review by authorised administrators. This can involve sending text from a support request and related correspondence, together with relevant support material, to the provider.

We take steps to remove common personal identifiers before this processing. However, free-text content can still contain personal information, and redaction cannot guarantee anonymity. The current support-drafting integration does not send ticket attachments to the AI provider.

AI-generated support replies are drafts for human review. This support feature cannot itself send replies or change accounts and is not used to determine student assessment results. We remain responsible for considering the privacy implications of the information supplied to the provider, even though the feature is available only to administrators.

Provider processing locations and retention arrangements are addressed in the overseas-processing review note below. We do not make a general promise that all AI processing occurs in Australia or that provider retention is eliminated.

9. Cookies and external services

APPLinkup uses cookies and similar browser storage to support functions such as authentication, session security and preferences. You can manage cookies through your browser, but blocking essential cookies may prevent sign-in or other functions from working.

Links and embedded content, such as instructional videos, may connect you with third-party services. Those services may receive technical information such as your IP address and browser details and may use cookies under their own policies. Review the relevant provider’s privacy information before using those services.

The public enquiries form uses Cloudflare Turnstile to help prevent automated spam and abuse. Cloudflare processes technical browser and device information and network information, including IP addresses, to perform this security check. Our server verifies the security token before accepting an enquiry. See Cloudflare’s privacy policy for information about its processing. We also apply submission limits and other anti-spam checks. These measures reduce abuse but cannot guarantee that every automated submission is detected.

Public enquiries are stored in our support ticket system. Authorised administrators respond to the supplied email address; no account or signed-in ticket access is required. To follow up, enter the supplied reference number and original email address on the Enquiries page. Your message is added to the existing enquiry. Replies to our outgoing notification emails are not monitored.

Any optional analytics or advertising technologies must be identified in this policy before use. This draft does not assume that Google Analytics or Google advertising is enabled.

10. Australian hosting and overseas processing

APPLinkup is hosted by Amazon Web Services (AWS) in an Australian region. Australian hosting does not, by itself, mean that every external service or support activity processes information only in Australia.

Service providers used for administrative AI, communications or other supporting functions may process personal information outside Australia. Overseas access by authorised participating organisations may also arise where those organisations or their staff are located overseas. Where overseas disclosure occurs, we take the steps required by applicable privacy law, including assessing relevant safeguards and contractual arrangements.

11. Retention, cold storage and deletion

Our proposed retention schedule for placement and assessment records is up to 25 years in total: seven years in the database, followed by up to 18 further years in cold storage. Archived records are stored in Amazon S3 and encrypted at rest, with access restricted to authorised personnel. This proposed schedule is subject to the review described below and does not mean that every category of personal information is kept for 25 years.

We retain archived placement and assessment records so that authorised university staff can retrieve historical records for academic recordkeeping and to verify and support student grades. Access remains subject to the relevant university relationship and user permissions. Cold storage is an archive: records remain held and may be retrieved by authorised personnel. Moving records to cold storage does not delete or de-identify them, and closing an account does not automatically remove its historical records. Under the proposed schedule, records will be securely destroyed or de-identified at the end of the applicable retention period, or earlier when no longer needed, unless continued retention is required by law or a court or tribunal order.

Retention must remain consistent with applicable privacy law. Personal information must not be retained merely because storage is available. Where information is no longer needed for a purpose permitted under the Australian Privacy Principles, we must take reasonable steps to destroy or de-identify it, unless a relevant legal exception applies. Legal holds and applicable statutory retention requirements may affect when records can be removed.

You can contact us about retention or request deletion. We will assess requests against applicable obligations and the continuing need for the records; a deletion request does not necessarily require deletion of all academic or audit history. Retained archived information remains subject to access controls and applicable access and correction rights.

12. Security and incidents

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Safeguards include account authentication, role-based access restrictions and audit logging. Security measures must extend to archives, backups, service providers and administrative access.

No system can guarantee absolute security. Protect your account credentials, use available additional authentication protections and report suspected unauthorised access promptly. We investigate suspected privacy incidents and take appropriate containment and response steps. Where the Notifiable Data Breaches scheme requires it, we notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

13. Access, correction and choices

You may request access to personal information we hold about you, including information supplied by an organisation or another authorised person, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact the Privacy Officer using the details below.

We may request reasonable information to verify your identity and clarify the records sought. We will respond within a reasonable period. Where a lawful exception limits access or correction, we will explain our decision and available complaint options as required by law. If a correction is disputed, you may ask us to associate a statement with the relevant information in accordance with applicable law.

For university-controlled academic information, we may need to coordinate with the relevant organisation. A request to correct personal information is distinct from an appeal against an academic judgement; your university’s assessment review procedures may also apply. Contacting your organisation does not prevent you from raising a privacy request with us.

You may ask about withdrawing a consent previously given. We will explain the practical consequences and any information we must or may lawfully continue to hold. Withdrawal does not undo processing that was lawful before withdrawal.

14. Contact and complaints

Privacy Officer — CLARITY DATA SOLUTIONS
ABN 15 005 130 394
Contact: APPLinkup enquiries form (no sign-in required).

Use the enquiries form to ask a privacy question, request access or correction, report a concern, or obtain a copy of this policy. Mark your subject “Privacy” and provide a reply email address. Your enquiry will be recorded in our support system for handling by authorised staff, and our response will be sent by email. Please describe the issue and the outcome you are seeking, without sending unnecessary sensitive documents. We may need to verify your identity before releasing or changing personal information.

We will acknowledge and investigate privacy complaints, seek further information where needed and explain the outcome. Our proposed response target is 30 days; if more time is needed, we will explain why and provide an expected response date. Complaint information will be shared only as needed to investigate and respond, or as permitted or required by law.

If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner for information about making a privacy complaint.

15. Changes to this policy

We may update this policy to reflect changes to APPLinkup, our practices or legal requirements. The approved policy will state its effective date. Material changes will be brought to users’ attention through an appropriate service notice or other communication. Any new consent required by law will be sought separately.

Outstanding approval checks

• Confirm the legal entity details and that authorised staff monitor enquiries, including privacy requests and complaints.
• Resolve the provider-country and retention notes above, document the basis and starting point for the proposed 25-year total retention period, and align operational retention settings with the approved schedule.
• Confirm production cookies, embedded services, security safeguards and the scope of administrative AI.
• Confirm benchmarking and research practices, institutional responsibilities and collection notices.
• Approve the proposed complaint response target and procedures for access, correction and deletion.
• Assess any qualifying automated decision-making against the privacy-policy obligations commencing 10 December 2026, including any computer-assisted decisions significantly affecting individuals.
• Obtain final privacy/legal review, set the effective date, remove review notes and arrange reviewed translations as required. This draft is in English.