Last updated:
Data processing and handling
MY TOUCAN PTY LTD provides mytoucan for practitioners and families. This draft does not replace a signed data processing agreement (DPA) or our privacy policy.
What information do we handle?
Practitioners and families may enter account and contact details, children’s profiles and health notes, sleep logs, messages and invoice information. We also create account, device and diagnostic records to provide access, communication, billing and support.
Practitioners control their client records: they decide what client information to collect and provide any notices or permissions their work requires. MY TOUCAN PTY LTD processes that information to operate the service on their behalf. The signed DPA will set out each party’s role in detail.
1. Where is data stored?
Our Supabase database is in Sydney, Australia (ap-southeast-2). Vercel Blob storage is also in Sydney (ap-southeast-2). We back up the database every six hours. A GitHub-hosted runner encrypts the backup before uploading it to Cloudflare R2, which our operator reports is in Sydney. The runner’s location is not fixed, and R2 location hints do not guarantee Australian-only storage. The web application is configured for Fly.io’s Sydney region.
Some data is processed outside Australia. We do not offer an Australia-only processing guarantee. Please discuss any residency requirement with us before using the service.
2. Which providers handle data?
The tables cover the web app, mobile app and marketing website. Locations show our selected region where confirmed, otherwise the provider’s documented hosting. Account-specific gaps are noted below. Backups, logs, caches and support access may involve other countries.
Scroll horizontally to see all table columns.
Subprocessors and service providers
| Provider | Purpose and data handled | Storage / processing location |
|---|---|---|
| Supabase | Database for client records, messages and health notes. | Sydney, Australia. |
| Vercel Blob | Invoice PDFs and company logos. | Sydney, Australia. |
| Fly.io | Application hosting and API processing. | Sydney region configured. |
| Cloudflare R2 | Encrypted database backups, uploaded every six hours. | Sydney (operator-reported; not a location guarantee). |
| GitHub Actions | Reads and encrypts the database before uploading the backup. | Not pinned to Australia; runner location not verified. |
| Clerk | Sign-in and identity management. | United States (documented hosting). |
| Stripe | Subscription and payment processing; the app does not handle card numbers. | International processing; countries depend on Stripe configuration. |
| Ably | Real-time update signals and contact identifiers; message bodies are not sent. | Global service; account routing not verified. |
| Novu | Notifications, including identifiers and message or comment content. | Account region not verified (US default). |
| Expo | Mobile push notifications and app delivery; pushes can include message or comment text, device tokens and navigation data. | United States (documented infrastructure). |
| Apple Push Notification service (APNs) | Delivers push notifications to Apple devices. | Processing locations not verified. |
| Google Firebase Cloud Messaging (FCM) | Delivers push notifications to Android devices. | Processing locations not verified. |
| Resend | Transactional email, including invitations and invoice emails with PDF attachments. | US account and email-log storage documented. |
| Trigger.dev | Processes invoice details and PDFs for email jobs, including job identifiers, results and logs. | US storage documented. |
| Sentry | Error monitoring and diagnostics; may receive account identifiers or content displayed in the app, depending on settings. | Account region not verified (US/EU available). |
| GrowthBook | Feature configuration; mobile uses local identity attributes for feature evaluation. | US infrastructure listed; we have not confirmed whether identity attributes leave the device. |
| Mapbox | Address search; receives the typed address search term. | United States (documented backends). |
| DiceBear | Avatar generation using a contact identifier as the image seed. | Europe (documented hosting/CDN). |
Marketing website services
| Provider | Purpose and data handled | Storage / processing location |
|---|---|---|
| Cloudflare | Website delivery and bot protection; Turnstile verification data. | Global network. |
| HubSpot | Marketing website enquiries only, including name, email, category and message. Not used by the web and mobile app. | United States. |
| Google Tag Manager | Consent-controlled website tags and measurement configuration. | Destination depends on the tags configured; active destinations are unverified. |
3. Is a data processing agreement available?
A draft DPA is available for review. It is not yet signed or effective and will not be binding until both parties agree to it. It covers instructions, confidentiality, providers, security, assistance with privacy requests, incidents and deletion.
4. When would customers hear about a breach?
We will notify the customer contact without undue delay and within 72 hours after we become aware of an actual or reasonably suspected breach affecting their data, in line with the GDPR’s breach notification timeframe. We will share available facts, containment steps and a contact point, then provide updates as the investigation develops. We also comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
5. Is data sold, shared or used for advertising or AI?
mytoucan does not sell customer information or use it to train AI or machine-learning models. We share information with the listed service providers and authorised users, and disclose it when legally required. A review of each provider’s terms covering advertising, profiling and secondary uses is in progress; we will publish the outcome on this page before the DPA is signed. Please do not include children’s health information in website enquiries sent to HubSpot.
Security, deletion and privacy requests
We do not claim end-to-end encryption or certification. Diagnostic tools may receive account identifiers and content displayed in the app, depending on their settings. Invoice PDFs are currently shared via links that do not require sign-in; we are reviewing this alongside how diagnostic data is handled, and will note the outcome here.
We will action deletion requests within 72 hours, covering deletion from active systems. Backup copies expire on the backup retention cycle, which will be confirmed in the DPA. For access, correction, export, deletion or privacy complaints, email hello@mytoucan.io. We may verify your identity and authority and coordinate with the relevant practitioner.
We will update this page when providers, locations or privacy commitments change. The signed DPA and privacy policy take precedence over this draft.