Privacy Policy

1. About OlderRide

OlderRide is a community transport platform operating across the Wheatbelt region of Western Australia. We connect older Australians with local, verified drivers to provide affordable, door-to-door transport services. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

We collect the following personal information:

• Riders: Full name, email address, mobile phone number, My Aged Care number, pick-up and drop-off addresses, travel dates and times.
• Drivers: Full name, email address, mobile phone number, driver's licence details, vehicle registration, vehicle insurance documents, National Police Check.
• Trip data: Start and end times, distance travelled, trip notes, co-contribution amounts.
• Account data: Login credentials (passwords are encrypted and never stored in plain text).

3. How We Use Your Information

We use your personal information to:

• Arrange and confirm transport bookings
• Match riders with suitable local drivers
• Verify driver identity and eligibility
• Record and process trip details for payment and compliance purposes
• Communicate booking confirmations and updates by phone or email
• Comply with My Aged Care and government funding requirements
• Improve our platform and services

4. Aged Care Information

We collect My Aged Care numbers to comply with Commonwealth Home Support Programme (CHSP) and Home Care Package (HCP) funding requirements. This information is handled with strict confidentiality and is only shared with relevant government agencies as required by law or funding agreements.

5. How We Store Your Information

Your data is stored securely using Supabase, a SOC 2 Type II certified cloud database provider. All data is encrypted in transit (TLS) and at rest. Driver documents are stored in secure, access-controlled file storage. We retain your information for as long as necessary to provide our services and comply with legal obligations.

5a. Australian data residency

OlderRide is designed for Australian aged-care and community transport. Primary application data (profiles, bookings, trip records, and audit logs) is hosted in Supabase's Sydney region (ap-southeast-2)where configured for production. The public website is served via Vercel's global edge network; static pages and assets may be cached outside Australia, but aged-care personal information and trip records remain in the Australian database region.

We do not sell personal information. Cross-border disclosure occurs only where required to operate the platform (e.g. email delivery) and is governed by contractual safeguards with subprocessors listed below.

5b. Security controls

• Row Level Security (RLS) on database tables — users only access their own data.
• Server-side mutations — booking and trip changes run through secured server actions.
• Rate limiting and bot protection on online booking submissions.
• Security headers — HSTS, frame denial, and content-type protection on all pages.

6. Sharing Your Information

We do not sell your personal information. We may share your information with:

• Assigned trips: Once a driver is assigned, the rider and driver can see each other's name and phone number (plus pick-up address and destination for the driver) so they can coordinate the trip directly. OlderRide admin only steps in for urgent issues (for example a no-show or a cancellation after the driver has arrived).
• Administrators: OlderRide staff who manage bookings and driver verification.
• Government agencies: Where required by aged care funding agreements or legal obligations.
• Service providers: Technology providers who assist us in operating the platform, under strict data processing agreements. See subprocessors below.

6a. Subprocessors

We use the following subprocessors to operate OlderRide:

• Supabase: Database, authentication, and file storage (primary data in the Sydney region where configured).
• Vercel: Hosting and delivery of the website and application.
• Resend: Transactional email (booking updates, account messages, and operational alerts).
• Stripe: Card payments for private (non-CHSP) bookings via Stripe Checkout.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and data
• Complain about how we handle your information

To exercise any of these rights, contact us at hello@olderride.com.

8. Cookies

Our platform uses essential cookies to maintain your login session. We do not use tracking or advertising cookies. You can disable cookies in your browser settings, but this may affect your ability to log in.

9. Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. This includes encrypted password storage, secure HTTPS connections, role-based access controls, and regular security reviews. No system is completely secure, and we encourage you to use a strong, unique password for your account.

10. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us first at hello@olderride.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. Contact Us

For any privacy-related questions, please contact: