Privacy Policy

1. About this Policy

Cover Labs Pty Ltd (ACN 691 951 096) (“Cover Dental”, “we”, “us” or “our”) operates a job board and workforce administration platform, with web and mobile applications, that dental clinics use to advertise temporary shifts and to administer the professionals who work them (the “Platform”). This Policy explains how we collect, hold, use and disclose personal information when you use the Platform, visit our website or otherwise deal with us.

We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and by the Privacy (Tax File Number) Rule 2015.

Clinics that engage professionals through the Platform are employers, and they handle their employees' information under their own legal obligations. Each clinic's payroll records are held in that clinic's own payroll business with our payroll partner (see Section 8.2). Capitalised terms not defined here have the meaning given in our Terms of Service. This Policy does not form part of our Terms of Service.

2. Who this Policy covers

• Clinic users: owners, administrators, staff members and payroll administrators who use a clinic account.
• Dental professionals: dental assistants, dental receptionists, dental hygienists and oral health therapists who create a professional account.
• People connected to our users: referees and emergency contacts nominated by professionals, people invited to a clinic account, people who receive a referral link, and the directors and owners of a clinic business when we verify it.
• Visitors: anyone who browses our website, books a call or contacts us, and anyone who applied for early access before we opened.

3. Personal information we collect

What we collect depends on how you use the Platform. We only collect personal information that is reasonably necessary for our functions and activities.

3.1 Account and sign-in

Your name, email address and mobile phone number. Sign-in is handled by our authentication provider using one-time codes, so we do not store passwords. If you turn on Face ID or fingerprint sign-in, the biometric check happens on your device and we do not receive biometric information.

3.2 Clinics and clinic users

• Clinic details: clinic name, legal entity name and ABN, website, logo and images, amenities, timezone and sign-in instructions for professionals, together with publicly available information we extract from the clinic's website.
• Sites: the address and location of each practice, and the name, title, role and phone number of each site contact.
• Team members: names, email addresses and roles of the people invited to the clinic account.
• Pay run declarations: when a payroll administrator declares a pay run, their name, email address, the declaration text they signed, the date and time, IP address and device information.
• Billing: billing contact details. Card and bank debit details are collected and held by our payment processor, Stripe; we receive a customer reference and the details we need to issue invoices.
• Payroll bank account: the BSB, account name and last four digits of the account a clinic pays wages from. The full account details are held by our payroll partners.

3.3 Professional profile

Your legal, preferred and middle names, profile photo, bio, role, years of experience, home address and work radius, availability and time off, favourite clinics, timezone, and the name and phone number of an emergency contact. You can also set a health-condition indicator: a single yes/no flag telling clinics you have allergies or a health condition they should be aware of at work. We do not collect or store any details of the allergy or condition.

3.4 Identity verification

Our identity verification provider, Didit, collects images of your identity document, a selfie and liveness video, and compares your face with your document, directly from you. We send Didit the legal name and date of birth you gave us so it can check they match your document. We receive the result, the name as read from your document, reason codes if verification does not succeed, and a session reference. We do not store your identity document images or biometric information ourselves.

3.5 Credentials and referees

Your AHPRA registration number and details, professional indemnity insurance details, qualification certificates and other supporting documents, and their expiry dates and review outcomes. If you rely on referenced experience, the name, email address, phone number and workplace of your referee.

3.6 Payroll and tax (professionals)

• date of birth, gender, residency status and residential address;
• your Tax File Number (TFN), or TFN exemption reason, and your TFN declaration answers (such as the tax-free threshold and study and training loans), together with evidence of your signature: the date and time, IP address, and device and session identifiers;
• superannuation fund details: fund name, member number and USI;
• bank account details (BSB, account number and account name); and
• records of bank detail changes and the verification codes used to confirm them, including IP address.

3.7 Shifts and work records

• shifts and bookings posted, accepted and cancelled;
• clock-in records, including your device's location and distance from the clinic at the moment you clock in;
• timesheets, including start, finish and break times, rejections and their reasons, any changes the clinic makes when approving, and who ended a shift early;
• no-show records;
• pay calculations, pay run information and payslips;
• your acknowledgement that you received the Fair Work Information Statement and the Casual Employment Information Statement for each employment with a clinic: when you gave it, the wording you confirmed, the versions of the statements you were shown, and the app, device and IP address it came from. We keep it as an employment record for the clinic;
• ratings and written feedback that clinics and professionals give each other (written feedback is required for a rating of 3 stars or below, and is also shared with us); and
• messages exchanged in the app between a clinic and the professional engaged on a shift.

3.8 Referral program

Your referral code (based on your first name and last initial, or your clinic's name), who referred you, who you referred and their progress, and records of rewards, fee credit and reward payments.

3.9 Communications and support

Emails and support requests you send us, your notification preferences, feedback, and details of any call you book with us.

3.10 Early access applications

Our website no longer takes early access applications. If you applied before we opened, we hold what you gave us: your name, email address, role, how often you work or need shifts, suburb or location, the type of device you use, whether you agree to hear from us, and for clinics, the clinic's name and your job title. We also hold how you told us you heard about Cover and, if you arrived through one of our campaign links, which one. We keep it as set out in Section 15.

3.11 Device and usage information

IP address, device identifiers, operating system, browser and app version, pages and features used, crash and diagnostic logs, and push notification tokens.

3.12 Device permissions

With your permission, the mobile app uses your location (only while the app is in use, when you clock in), your camera, photos and files (to upload a profile photo and documents), your calendar (to add shifts, if you choose to), notifications and, only if a step of identity verification needs audio, your microphone (asked for at that step). You can withdraw these permissions in your device settings at any time.

3.13 Information from third parties

• identity verification results from Didit (Section 3.4);
• pay run, payslip, employee and superannuation contribution status from our payroll partners;
• payment status from Stripe;
• business details from the Australian Business Register, and bank branch details from the BSB directory;
• address and location data from Google Maps;
• information clinics provide about professionals they engage (such as timesheet adjustments, no-show records and ratings), and information professionals provide about clinics; and
• referral information when another user refers you.

3.14 Information about other people

If you give us personal information about someone else, such as an emergency contact, a referee, a team member or a director, you must be authorised to do so and should let them know about this Policy.

4. How we use personal information

We use personal information to:

• create and secure accounts and sign you in;
• verify professionals' identity and credentials, and decide whether they can accept shifts;
• surface shifts to professionals and notify them, based on their role, address and work radius, availability and experience;
• support each shift, including clock-in, timesheets, messaging, ratings, and no-show records;
• record each shift's Shift Schedule and when each professional's employment with a clinic starts and ends, take professionals through onboarding for each employment, record their acknowledgement of the Fair Work information statements, and send them, on the clinic's behalf, an onboarding pack with those statements and a link to the TFN declaration they made for that clinic;
• prepare each clinic's payroll, including calculating pay under the applicable award, sending employee, tax, superannuation, bank and timesheet information to our payroll partners, recording pay run declarations and making the clinic's payroll documents available to it;
• bill clinics, including Service Fees, Priority Boosts, invoices and referral fee credit;
• run the referral program, including paying cash rewards to the bank account in a professional's payroll details;
• send push, email and in-app notifications about shifts, timesheets, pay runs, payments, verification and security;
• respond to support requests, including concerns you raise about another user, help resolve disagreements, and enforce our Terms;
• protect the Platform and our users, including detecting fraud and abuse and logging access to sensitive records such as TFNs and bank details;
• understand how the Platform is used and improve it, using de-identified or aggregated information wherever practical;
• work out which of our ads, posts and other channels bring people to Cover, using the campaign link you arrived on and what you tell us about how you heard of us (Section 10);
• send marketing about Cover Dental, which you can opt out of at any time (Section 11); and
• comply with the law and respond to lawful requests from regulators, courts and law enforcement.

5. Automated decisions

Some decisions on the Platform are made by software. The table shows which decisions are made by software alone and which a person makes with software's help, and the personal information each one uses.

If you think an automated decision about you is wrong, contact us and a person will review it.

6. Sensitive information

Two kinds of information we handle are “sensitive information” under the Privacy Act: the health-condition indicator, and the biometric information Didit processes to verify your identity. We only collect sensitive information with your consent, and only where it is reasonably necessary. The health-condition indicator is shown only to a clinic you are booked with, from when you accept its shift until the timesheet is approved, and you can remove it at any time. Clinics must not use it to cancel, decline or stop offering you shifts. We do not collect details of health conditions or criminal history.

7. Tax file numbers

We collect your TFN only because a clinic, as your employer, needs it for tax and superannuation purposes. We use and disclose it only for those purposes: to our payroll partners, for the clinic's pay runs and reports to the ATO, and to superannuation funds where required. We never use your TFN to identify you for any other purpose. Your TFN is encrypted, access to it is restricted, and each time our staff or systems read it, the access is logged. We keep it while your account is open, so you can complete a TFN declaration for each new clinic without re-entering it. We send your TFN directly to each clinic's payroll business and do not keep a separate copy, and we delete your TFN when you delete your account. You do not have to provide your TFN, but if you do not, your employer may be required to withhold tax at the highest rate.

8. Who we disclose personal information to

8.1 Other users

• Clinics can see a professional's profile (name, photo, role, experience and bio), verification and credential status, and ratings. Once a professional has accepted a clinic's shift, and until its timesheet is approved, the clinic can also see their health-condition indicator and can reveal their emergency contact. Clinics contact professionals through in-app messages and do not see their phone number or email address. A clinic keeps the clock-in records and timesheets for its shifts, and receives the payroll information it needs as employer, including TFN, superannuation and bank details, in its payroll business. For each employment, the clinic can also see, and export as a record, your onboarding status, when you signed your TFN declaration for it, when you acknowledged the information statements and which versions, and when the statements were emailed to you.
• Professionals can see a clinic's profile, site details, rates and ratings and, for accepted shifts, the clinic's contact details and sign-in instructions.
• Messages are visible to the clinic and the professional in the conversation.
• Referrals: your referral link shows your first name and last initial (or clinic name). You can see the name, status and key dates of each person you referred, and they can see your name.
• Clinic team members can see the clinic account information their role allows.

8.2 Payroll partners

Paysense (provided by IOPayroll) runs each clinic's payroll in a payroll business that the clinic owns and controls. Beam processes superannuation contributions. MessageXchange lodges single touch payroll reports with the ATO on the clinic's behalf. Through them, information reaches the ATO and professionals' superannuation funds.

8.3 Others

• the service providers described in Section 9, which help us run the Platform;
• our professional advisers, such as lawyers, accountants and auditors;
• regulators, courts and law enforcement, where the law requires or permits it, or where we reasonably believe it is necessary to protect someone's safety or prevent fraud; and
• a buyer, investor or successor if we are involved in a merger, acquisition, financing, restructure or sale of assets.

We do not sell or rent personal information.

9. Service providers and overseas disclosure

We use service providers to help us run the Platform. They provide:

• hosting, database and file storage;
• payroll, superannuation and single touch payroll lodgement (Section 8.2);
• identity and business verification (Section 3.4);
• sign-in, one-time codes and account security;
• payments, invoicing and direct debits;
• email, push and in-app notifications, and email lists;
• product analytics and diagnostic logs;
• maps and address lookup, and call booking;
• collecting public information from clinic websites;
• internal team communication and alerts;
• managing app testing groups;
• bot and abuse protection across our website, web application and API; and
• tag management and advertising measurement on our marketing website, and measuring which Google ads lead to clinic sign-ups (Section 10).

Our service providers are bound by confidentiality and security obligations and may use personal information only to provide their services to us. The exception is advertising platforms: they also use the information we share under their own terms, as Section 10 explains.

Our database and file storage provider (Supabase, in its Australian region) and our payroll providers store information in Australia. Other providers store or access personal information overseas, mainly in the United States and the European Union (our product analytics provider, PostHog, stores data in the European Union), and some operate global networks that may process information in other countries. Where a provider stores or accesses personal information outside Australia, we take reasonable steps, including contractual obligations, to ensure it handles that information consistently with the APPs, and we remain accountable for how it does so. You can ask us for a current list of our service providers at any time (Section 20).

10. Cookies and analytics

The Platform uses cookies, local storage and similar technologies to keep you signed in, secure your account and remember your preferences. When you start signing up from a clinic referral link, we set a cookie for up to 30 days so the referral can be credited when you sign up. We use PostHog to understand how our marketing website and the Platform are used, such as which pages and buttons people use and where they stop when signing up. PostHog does not store your IP address. When you follow a link from our marketing website to the Cover web application, we add a random analytics identifier to the link so we can connect your visit to the website with your use of the web application. We use automated bot and abuse protection across our website and web application. You can block cookies in your browser, but parts of the Platform may not work if you do.

Advertising measurement on our marketing website. Our marketing website (cover.dental) uses Google Tag Manager to load advertising tags, including the Meta pixel. These tags use cookies and similar technologies to record the pages you view and the actions you take there, such as clicking through to sign up or to an app store, or submitting a form, along with your browser, device and IP address. We use this to measure whether our ads lead to visits, sign-ups and app installs, and to show our ads to people who are likely to be interested in them.

When you submit a form on our marketing website, the Meta pixel also uses a feature called Advanced Matching. It reads contact details you enter in the form, such as your name, email address, phone number and state, and converts them into a scrambled code (a hash) in your browser before sending them to Meta. Meta uses the hashed details to connect the visit to a Facebook or Instagram account, if you have one, so it can tell us whether our ads worked. We receive reports from Meta, not information about your Meta account.

Meta and Google use the information they collect through these tags under their own privacy policies, including to measure, deliver and improve ads, and may process it in the United States and other countries. You can control this by:

• changing your ad preferences in your Facebook or Instagram settings (Accounts Centre → Ad preferences), including the setting that controls ads based on activity from other businesses;
• changing your Google ad settings at adssettings.google.com; or
• blocking third-party cookies or using a tracking blocker in your browser.

Google Ads conversion tracking for clinic sign-ups. We use Google Ads conversion tracking. When you sign up a clinic in the Cover web application, a hashed version of your email address and phone number may be shared with Google to measure the effectiveness of our ads. Our servers convert the email address and mobile number on your Cover account into a scrambled code (a hash) before sending them, along with the Google click identifier from the ad that brought you to us, if there was one, and the fact that a clinic account was created. Google uses them to work out whether the sign-up followed a click on one of our ads, and we receive reports from Google, not information about your Google account. Google uses this information under its own privacy policy and may process it in the United States and other countries.

No advertising tags in our apps. The advertising tags described above run only on our marketing website. The Cover web application for clinics (app.cover.dental) does not use Google Tag Manager or advertising tags, and the Cover mobile apps do not contain advertising or ad-tracking tools, such as the Meta SDK. We do not use the apps to track you across other companies' apps or websites. Apart from the clinic sign-up measurement above, we do not share what you do in the apps with advertising platforms.

Campaign links. We keep a record of the campaign link that brought you to our marketing website in your browser for 30 days: its source, campaign and ad name, any click identifier Meta or Google added to it, the page you landed on and the site that referred you. If you follow a link from our marketing website to sign up in the Cover web application or to Google Play, we pass the campaign details along so we can tell which campaign led to a sign-up or an app install. A Google click identifier passed to the Cover web application is kept in a cookie for up to 90 days, so it can be used for the clinic sign-up measurement above.

11. Direct marketing

We may send you marketing about Cover Dental, such as product updates, promotions and referral offers. You can opt out at any time using the unsubscribe link in an email, by changing your notification settings in the app, or by contacting us. We will still send transactional and service messages you need to use the Platform.

12. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:

• encryption in transit (TLS) and at rest, with additional field-level encryption (AES-256-GCM) for TFNs, the bank account numbers professionals are paid into, and clinic sign-in codes;
• separation of each clinic's data, enforced in both the application and the database;
• access controls that limit our staff's access to what their role requires, with logging whenever our staff, our systems or a clinic access TFNs, bank details or verification documents, and whenever a bank payment file is downloaded;
• verification and a 24-hour security period before a professional's bank details change; and
• regular patching and monitoring of our systems.

No system is completely secure. Please keep access to your email and phone secure, because they are how you sign in.

13. How long we keep personal information

We keep personal information only for as long as we need it for the purposes in this Policy or as the law requires, and then delete or de-identify it.

14. Access and correction

You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of it can be updated directly in the app. You can also withdraw consent for things like marketing, device permissions or the health-condition indicator.

We respond to requests within 30 days. We may need to verify your identity first. In limited cases the law allows us to refuse (for example, where access would unreasonably affect someone else's privacy), and if we refuse we will explain why in writing.

15. Deleting your account

15.1 Professionals

You can delete your account in the app:

1. Open the Cover Dental app and go to Settings.
2. Tap Security.
3. Tap Delete Account.
4. Read the warning, then type DELETE to confirm.
5. Tap the confirmation button. Your account is deleted immediately and you are signed out.

Before you delete: you cannot delete your account while you have a shift that is accepted, in progress or awaiting timesheet approval. Any cash referral reward not yet paid will lapse. You can download your payslips in the app (Settings, then Payroll documents) before you delete.

If you cannot access the app, email support@cover.dental from the email address on your account. We may verify your identity, and we will action verified requests within 30 days.

15.2 Clinics

To close a clinic account and delete its data, a clinic administrator should email support@cover.dental. We will confirm the request is authorised, and pay runs for work already performed must be completed first. We will action verified requests within 30 days.

15.3 What we delete

When a professional's account is deleted, we delete:

• your payroll and tax details record, including your TFN, bank account, superannuation details, date of birth and residential address (some of these details also appear in the records we keep under 15.4);
• identity verification references, credentials and uploaded documents, and verified experience;
• your profile photo, bio, emergency contact and health-condition indicator;
• availability, time off and work radius;
• your message threads and the messages in them;
• ratings and feedback clinics gave you; and
• your sign-in account (Clerk), notification profile (Novu), email contact (Resend) and analytics profile (PostHog).

15.4 What we keep

15.5 Information held by others

Deleting your Cover Dental account does not delete information held by others. A clinic you worked for keeps your employee record in its payroll business, which it controls as your employer. Didit keeps your identity verification session under its own retention settings; email us and we will ask Didit to delete it. Superannuation funds and the ATO keep the information they received through the clinic's payroll.

16. Data breaches

We have processes to detect, contain and assess data breaches. If a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as the Notifiable Data Breaches scheme requires. To report a security concern, email support@cover.dental.

17. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect their personal information. If you believe we have, contact us so we can delete it.

18. Complaints

If you think we have not complied with this Policy or the APPs, contact our Privacy Officer at support@cover.dental. We will acknowledge your complaint, investigate it and respond within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

19. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will tell you through the Platform or by email before it takes effect. The date at the top shows when it was last updated.

20. Contact us

For questions about this Policy or your personal information, contact:

Privacy Officer Cover Labs Pty Ltd (ACN 691 951 096), trading as Cover Dental Email: support@cover.dental