Skip to main content
Memora.help

Privacy Policy

Last updated: 8 October 2026

1. Who we are

Memora.help is operated by Customer Experience Insight Pty Ltd (ABN 61 634 039 759) trading as WA AI Hub ("we", "us", "our"), an Australian company based in Western Australia. For users in the European Union or United Kingdom, we act as the data controller for the personal data described in this policy.

Our status under the Privacy Act. Many small businesses (annual turnover of $3 million or less) are exempt from the Privacy Act 1988 (Cth). We do not rely on that exemption. We provide a service that involves health information about people living with dementia, which brings us within the Act regardless of turnover, and we comply with the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme.

Contact for all privacy matters, including access, correction, review of automated decisions and complaints: support@memora.help (please mark your email "Privacy").

2. What this service is — and an important note about care data

Memora.help helps family members and carers support people living with dementia. This means you may record information about another person (the person you care for), including health-related information, which is sensitive information under the Privacy Act and special category data under the GDPR.

You must only add information about another person where you have their consent or other lawful authority to do so — for example, as their guardian, enduring guardian or other substitute decision-maker appointed or recognised by law (such as under the Guardianship and Administration Act 1990 (WA) or the equivalent law in your State or Territory). Even where someone else is authorised to decide, you should involve the person as far as they are able, and respect their views and preferences. The app asks you to confirm consent or authority before the reminiscence features that store media or use AI on a person's memories are used. You are responsible for the accuracy of those confirmations; we do not independently verify your authority.

3. What we collect, how, and why

  • Account information — your name, email address and password (stored as a secure hash; we never see your plain-text password), role, and any care institution you belong to.
  • Care records you create — profiles of the people you care for (which may include health and cultural background information), observation notes, care and behaviour-support plans, guidance conversations, session notes, escalations, and reminiscence memory descriptions.
  • Photos and audio recordings — media you choose to add to a person's Memory Vault, only after media-storage consent is recorded.
  • Voice input — if you use the microphone button, your recording is sent to a speech-to-text provider (see section 5) and we save the resulting transcript, a summary and suggested actions. We do not keep the audio of voice input.
  • Credits and payments — your credit balance and transaction history. Card payments are processed by Stripe; we do not receive or store your full card number.
  • Usage, security and audit records — security logs of significant actions (for example, who viewed a stored photo or recording, and when), IP address, rate-limiting and bot-protection signals, content-moderation flags, and anonymous page-view statistics from Vercel Web Analytics (see section 13).

We collect this information directly from you or from your use of the service. We do not buy data about you, and we do not use advertising trackers in the app. We use it to provide and secure the service you signed up for, to operate the AI and automated features described below, to process payments, to respond to you, and to meet our legal obligations. If you do not provide the information the service needs, parts of it may not work.

4. Where your information is stored and processed

We believe you deserve plain answers about where data physically lives. Different kinds of data are stored in different places:

  • Application servers — Sydney, Australia. Our web application runs on Vercel in its Sydney region, so requests are handled in Australia, but the records they read and write are held as described below.
  • Photos and audio recordings stored in the Memory Vault — Sydney, Australia. Media files are kept in private, access-controlled storage located in Sydney (Australia). They are never publicly accessible and are served only to signed-in members of the person's care team. Every access is logged.
  • Written records — United States. Our database (accounts, profiles, notes, plans, conversations, session history, transcripts and memory descriptions) is hosted on secure servers located in the United States (Neon, on AWS US East, Northern Virginia). This is a current infrastructure constraint and we disclose it rather than overstate Australian residency.
  • AI text processing and voice transcription — United States. When you use AI features, the text needed for that feature (and, for voice input, the audio recording) is sent to third-party AI providers and processed in the United States. Details are in section 5.
  • Other service providers — mainly the United States. We use providers for hosting and content delivery (Vercel), rate limiting (Upstash), bot protection (Cloudflare), transactional email (Resend) and payments (Stripe). They may process limited personal information, such as your email address, IP address and payment details, in the United States or other countries where they operate.
  • Voice input — United States. If you turn on voice input, your voice recording is sent to a speech-to-text service in the United States (Groq, or OpenAI if Groq is unavailable). Details are in section 5.

Cross-border disclosure (Australian Privacy Principle 8)

The disclosures described above are likely to be disclosures of personal information to overseas recipients, principally in the United States. Before we disclose personal information overseas we take reasonable steps in the circumstances to ensure the recipient does not breach the APPs in relation to it, including by choosing providers with strong security practices and contractual or published terms restricting their use of the data to providing the service to us. Under the Privacy Act we remain accountable for acts and practices of those recipients that would breach the APPs. Overseas recipients are also subject to the laws of their own jurisdiction, including laws that may permit government access. We do not claim, and you should not assume, guaranteed Australian data residency for the database or AI processing.

International transfers (GDPR/UK GDPR)

For users in the EU/UK, personal data is transferred to and processed in Australia and the United States as described above. Where we rely on third-party infrastructure providers, transfers are made on the basis of safeguards offered by those providers (such as standard contractual clauses and, where applicable, the EU-US Data Privacy Framework). You can contact us for more information about the safeguards applying to a specific transfer.

5. AI features — exactly what is sent, and when

  • Text features (carer guidance chat, care and behaviour-support plan drafting, voice summaries, and reminiscence prompts and session notes): the text you enter, together with relevant context from your account such as earlier conversation summaries and care-plan context, is sent to a large language model through an AI gateway. Our first-choice model is OpenAI's GPT-4o mini. If that model is unavailable or rate-limited, the request may be automatically routed to a model from Google, Anthropic or Fireworks AI. All are processed in the United States. Photos and Memory Vault audio files are never sent to AI services.
  • Voice input is optional. The first time you press a microphone button we explain what happens and ask before anything is recorded. We save the text with your conversation and do not keep the recording. Your browser may also show live captions using its own speech service (Chrome uses Google).
  • You control AI use in Settings, under Privacy. Turning off AI assistance or voice input takes effect on your next request: our servers check your choice every time and send nothing to an AI service while it is off. Your records and the Memory Vault keep working.
  • Voice input: if you use the microphone button, the audio recording is sent to Groq (primary) or OpenAI (fallback) to be converted to text, and is processed in the United States. If both fail, your browser's built-in speech recognition result may be used instead, which is handled by your browser or device provider under their own privacy terms.
  • Reminiscence prompt generation and session-note drafting use the written details of stored memories and your session observations, and only where AI-processing consent has been recorded for that person. If consent is declined, the feature uses our built-in prompt library and nothing is sent to an AI service.
  • AI-drafted session notes are saved as drafts and must be reviewed and approved by a person before they become part of the care record. Guidance, plans and summaries are suggestions only; you decide what to do with them.
  • AI output can be wrong or incomplete. It is general information and is not medical advice, diagnosis or treatment. You are told when you are interacting with an AI system, and AI-drafted content is labelled as such, in line with the EU AI Act transparency requirements.
  • Our AI does not make decisions about you or the person you care for. If anything it produced seems wrong, unsafe or unfair, use Ask a person to review (under guidance answers, voice summaries, or in Settings) or email support@memora.help. A member of our team will review it and reply within 30 days.
  • We use AI services for inference only. We do not sell your information, we do not use it to train AI models, and we do not authorise our AI providers to do so.

6. Automated decision-making (computer programs that make or inform decisions)

This section is our statement under APPs 1.7 to 1.9 of the Privacy Act about decisions made, or substantially informed, by computer programs. We apply it now, ahead of its legal commencement on 10 December 2026. We have included features that may not meet the legal threshold of "significantly affecting" someone's rights or interests, because people living with dementia are vulnerable and we prefer to over-disclose.

A. Decisions made solely by a computer program

These happen automatically, without a person at Memora.help reviewing each case. For each, the kinds of personal information used are listed. You can ask for a person to review any of these decisions by contacting us (section 1).

  • Access to AI features based on credit balance. Whether a request to generate guidance, a plan, a transcript, a summary or a note is allowed depends on your credit balance. If your balance is insufficient, the request is declined, and a refund is applied automatically if a paid step fails. Information used: account identifier, credit balance and ledger, and the feature requested.
  • Content moderation and security blocking. Text you enter and voice transcripts are automatically checked for abusive, hateful, sexual, violent, spam or nonsensical content and for attempts to manipulate the AI. If content is flagged, that request is refused and the event may be logged. Information used: the text or transcript you submit, your account identifier, and request frequency.
  • Rate limiting and bot protection. Requests may be automatically slowed or refused if they look automated or too frequent. Information used: IP address, account identifier and request patterns.
  • Payment fraud screening. Stripe, our payment processor, uses automated machine-learning tools (Stripe Radar) to assess each card payment and may automatically decline a payment it considers high risk. Stripe makes that decision under its own privacy terms. Information used: payment details, device and network signals, and your email address. If a payment is declined in error, contact us and we will help.
  • Consent gating. AI reminiscence features are automatically unavailable for a person unless AI-processing consent is currently recorded for them. Information used: the recorded consent status.

B. Computer programs that do things substantially and directly related to a decision

These outputs inform decisions that you, a family member, carer or clinician make about the care of a person living with dementia. They do not decide anything for you, and a person remains responsible for every care decision.

  • Carer guidance. An AI model generates suggested responses to carer questions. Information used: your messages, summaries of earlier conversations, and, where relevant, care-plan context.
  • Draft care and behaviour-support plans. An AI model drafts a communication or behaviour-support plan and suggests a plan type. Plans are created as drafts for your review. Information used: the situation you describe and context from your care history, which may include health-related information about the person you care for.
  • Reminiscence prompts and draft session notes. An AI model suggests conversation prompts from stored memories and drafts session notes from your observations. Notes require human sign-off. Information used: memory titles and descriptions, background and cultural notes, session observations and mood records.
  • Voice transcription, summaries and urgent-situation alerts. Speech is converted to text by AI, summarised with suggested actions, and checked by a keyword program for signs of an urgent situation (for example, emergency, self-harm, abuse, wandering or acute behavioural crisis). If a sign is detected the app displays crisis and emergency information. This keyword check is simple and can miss urgent situations or flag non-urgent ones, so do not rely on it. In an emergency call 000. Information used: the transcript text.

We do not use computer programs to decide whether to give or withdraw care or any government benefit or service, to decide anyone's eligibility for aged care, to assess anyone's capacity, or to profile you for advertising. If this changes we will update this policy before the change takes effect.

7. Why we process your information (purposes and lawful bases)

We process personal information to:

  • provide the service you signed up for, including care notes, plans, guidance, and reminiscence features (GDPR basis: performance of a contract, Art. 6(1)(b));
  • operate AI-assisted features, with the consent you give in the app where we ask for it (GDPR basis: consent, Art. 6(1)(a), and for health-related information explicit consent, Art. 9(2)(a));
  • keep the service secure and prevent abuse, including audit logging, content moderation and rate limiting (GDPR basis: legitimate interests, Art. 6(1)(f) — protecting vulnerable people's data from misuse);
  • process payments and keep financial records (GDPR basis: contract and legal obligation, Art. 6(1)(b) and (c));
  • comply with legal obligations (GDPR basis: Art. 6(1)(c)).

EU/UK: information about the person you care for. The household exemption in the GDPR can cover you personally as a carer, but it does not cover us as the operator of the service, so we need our own legal basis for the care records we hold about the person you care for. For ordinary personal data we rely on our legitimate interests in providing the service you request on their behalf (Art. 6(1)(f)). For health data (Art. 9) we rely on the explicit consent of the person, or, where they lack the capacity to consent, of their legal representative under the law that applies to them (Art. 9(2)(a)), which you confirm when you add them. If you cannot give or obtain that consent, do not add them to the service. Where the person has capacity, they may withdraw consent or object at any time by contacting us.

Where processing is based on consent, you may withdraw consent at any time in Settings or per person in the Consent panel; withdrawal does not affect processing that occurred before withdrawal. We use and disclose personal information only for the purposes above, for related purposes you would reasonably expect, or as permitted or required by law.

8. Who can see the data

  • Care records and media are visible only to the account that created them and, where an institution is configured, members of the same care institution. If you turn on sharing with care providers, the care plans and escalations you choose are shared with the providers you nominate.
  • Our infrastructure providers (database, media storage, hosting, AI gateway and AI model, speech-to-text, email, payments and security providers) process data on our behalf as described in sections 4 and 5. We do not authorise them to use your data for their own purposes.
  • We may disclose information where required or authorised by law (for example, a lawful request by an authority), or where we reasonably believe it is necessary to lessen or prevent a serious threat to someone's life, health or safety.
  • We do not sell personal information.

9. Security and data breaches

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including: private, access-controlled media storage; authentication on every request for stored media; per-user and per-institution access scoping; password hashing; parameterised database queries; consent gating for sensitive features; and audit logging of access to photos and recordings; HTTPS with HSTS on all pages; bot protection on sign-up; and optional two-step verification by emailed one-time code, which we recommend you turn on in Settings. Two-step verification is not currently mandatory. No internet service can guarantee absolute security, and we encourage you not to store financial details, government identifiers, passwords, or answers to security questions in care records or recordings.

If an eligible data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

10. Retention and deletion

We retain personal information while your account is active and for as long as needed to provide the service. When you delete a person's profile, their associated records and stored media are deleted, and a deletion event is recorded in our audit log. When you ask us to delete your account, we will delete or de-identify your personal information unless we are required to retain it (for example, payment and tax records, which we keep for 7 years as required by the Corporations Act 2001 (Cth) and tax laws, security audit records or other legal obligations). Backup copies held by our infrastructure providers are deleted in line with those providers' standard cycles. When personal information is no longer needed for any purpose for which it may be used or disclosed and we are not required by law to keep it, we take reasonable steps to destroy or de-identify it.

11. Your rights

Australia (Privacy Act 1988, APPs)

  • You may request access to the personal information we hold about you (APP 12).
  • You may request correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information (APP 13).
  • You may withdraw consent for optional processing at any time, including AI assistance and voice input (Settings, under Privacy).
  • You may request deletion of your data, subject to legal retention requirements.
  • You may ask for a person to review any automated decision described in section 6A, or anything our AI produced; we reply within 30 days.
  • You may deal with us anonymously or by pseudonym where it is lawful and practicable, although the service needs an account to work.

EU/UK (GDPR / UK GDPR)

  • Right of access (Art. 15) and right to rectification (Art. 16).
  • Right to erasure (Art. 17) and restriction of processing (Art. 18).
  • Right to data portability (Art. 20) for data you provided to us, where processing is based on consent or contract.
  • Right to object (Art. 21) to processing based on legitimate interests.
  • Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human intervention (Art. 22).
  • Right to withdraw consent at any time (Art. 7(3)).
  • Right to lodge a complaint with your local supervisory authority.

To exercise any right, email support@memora.help. We will respond to access and correction requests within 30 days (and within any other timeframe required by applicable law). We may need to verify your identity before acting on a request. If we refuse a request we will tell you why and how to complain.

12. Complaints

If you believe we have mishandled your personal information, please contact us first at support@memora.help and we will investigate and respond, ordinarily within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. EU/UK users may also complain to their local data protection supervisory authority.

13. Cookies and similar technologies

  • Strictly necessary: when you sign in, our authentication system sets a secure session cookie (HttpOnly, Secure, SameSite=Lax) that keeps you signed in for up to 7 days. Without it the Service cannot work. We set no cookies on our public pages for visitors who have not signed in.
  • Preferences: your browser may store your light or dark theme setting locally.
  • Security: our bot protection (Cloudflare Turnstile) runs on the sign-up and sign-in pages and may use limited browser data to tell humans from bots. It is not used for advertising.
  • Analytics: we use Vercel Web Analytics, which does not use cookies and does not follow you across other websites or build individual profiles. We do not use advertising, remarketing or social-media tracking tools.

Because we use only strictly necessary and similar privacy-preserving technologies, we do not show a cookie banner. If that changes we will ask for your consent first where the law requires it.

14. Children

Memora.help is for adults aged 18 and over. We do not knowingly collect personal information from children as account holders, and we explain how we treat information about children recorded by carers in our Children's Policy.

15. Changes to this policy

We may update this policy as the service, our infrastructure or the law changes. We will update the "Last updated" date above and, for material changes (including any change to where data is stored or processed, the AI providers we use, or the automated decisions described in section 6), we will take reasonable steps to bring the change to your attention in the app.