Supabase Pte. Ltd.
- Service and purpose
- Primary database, authentication, file storage, and realtime infrastructure.
- Main processing boundary
- Sydney region for the Effica project; provider support and service metadata may involve other locations
Effica sub-processors
Last updated: 6 October 2026
Effica is operated by AI Core CRM Pty Ltd. The suppliers below may process personal information on our behalf to deliver and support the platform. Locations describe the relevant service configuration or provider processing boundary; they are not a claim that every support, log, network, or delivery activity occurs only in that location.
Effica is independent provider-management software for provider operations. It is not the NDIA or the NDIS Quality and Safeguards Commission, is not NDIS approved or endorsed by either agency, and is not a participant-provider marketplace. Effica may process claim and billing records for a provider, but does not hold or process NDIS plan funds as an intermediary. The customer provider remains responsible for its participant relationships, services, authorisations, regulatory and claim decisions, and submissions.
Where limited information is processed outside Australia, Effica uses the service only for the purpose listed below and applies data minimisation, contractual protections, access controls, and security safeguards appropriate to the information and risk.
Platform sub-processors
Google Cloud
- Service and purpose
- Web application hosting, regional load balancing, dynamic compute, background job scheduling, task delivery, worker execution, Effica's own document search model for private documents, document text recognition (OCR) for scans and photos of documents, encrypted backup copies, and a standby copy of the platform.
- Main processing boundary
- Sydney (australia-southeast1) for configured application and background processing and backups. Document search runs on Effica's own search model on our servers in Sydney, with a standby in Melbourne; no outside AI company sees those documents. Melbourne (australia-southeast2) for a live standby copy of the database (continuously copied, about 30 seconds behind), standby services, and hourly copies of the encrypted backups. Provider support and service metadata may involve other locations
Temporal Technologies, Inc. (Temporal Cloud)
- Service and purpose
- Background workflow orchestration. Temporal mainly holds record identifiers and job status; care records, notes and files stay in Effica. Workflow history is stored in Sydney.
- Main processing boundary
- Sydney (AWS ap-southeast-2)
Plus Five Five, Inc. (Resend)
- Service and purpose
- Transactional email delivery, which may process recipient addresses, generic or service-message content, links or codes, and delivery metadata.
- Main processing boundary
- United States
OpenAI OpCo, LLC
- Service and purpose
- AI models for optional features such as drafting, summarisation, information extraction, and transcription of recordings. OpenAI does not use API data to train its models, and its transcription service does not keep the audio. Effie and most in-app AI features call OpenAI directly under a signed data processing agreement.
- Main processing boundary
- United States
650 Industries, Inc. (Expo)
- Service and purpose
- Mobile app builds, over-the-air app updates (EAS Update), and push delivery. For push, Expo receives only a device push token, generic alert, opaque notification ID, and delivery metadata; notification details remain in Effica.
- Main processing boundary
- United States
Apple Inc. (Apple Push Notification service)
- Service and purpose
- Delivers push alerts to iPhones. Apple receives the device push token and the generic alert only.
- Main processing boundary
- Global Apple services
Google Firebase Cloud Messaging
- Service and purpose
- Delivers push alerts to Android phones. Google receives the device push token and the generic alert only.
- Main processing boundary
- Global Google services
Google Maps Platform
- Service and purpose
- Maps, geocoding, location display, and typed address or place suggestions.
- Main processing boundary
- Global Google Maps services
Customer-directed integrations
These services receive information only when a customer connects or uses the integration. The customer authorises the transfer and also has a direct account or relationship with the integration provider.
- Google Gmail and Google Calendar: A user-selected personal connection. Effica reads Gmail messages and Google Calendar events directly from Google as the user works, and sends requested changes to Google. Effica keeps encrypted access credentials, basic account, label and calendar details, preferences, and limited action records; it does not keep a separate mailbox or event history for ordinary views. This is separate from Google Analytics on public marketing pages.
- Microsoft 365 Outlook mail and calendar: A user-selected personal connection through Microsoft Graph. Effica reads Outlook mail and calendar events from Microsoft, sends requested changes to Microsoft, and receives Microsoft change alerts so the views stay current. The mailbox and calendar stay in the customer's Microsoft 365 tenant and its region. Effica keeps encrypted access credentials, basic account, folder and calendar details, preferences, and limited action records. To keep Outlook views quick, it also keeps an encrypted working copy of recent message details (such as subject, people and preview), recently opened messages and calendar events. That copy is deleted when the user disconnects.
- Xero: A customer-enabled accounting and payroll connection that may exchange contacts, invoices, financial reports, worker mappings, timesheets, and encrypted connection credentials.
- Employment Hero Payroll / KeyPay: A customer-enabled payroll connection that may exchange worker mappings, payroll reference data, and approved timesheet lines.
Sales, billing, and business services
The following services process provider business, enquiry, or subscription information rather than ordinary participant care records:
- Stripe: Effica provider signup and SaaS subscription billing, including related business contact and transaction metadata. This is Effica's own subscription charging; Stripe does not process NDIS plan funds for Effica.
- HubSpot: Contact and demo forms, prospect communications, and provider commercial account lifecycle records.
Website tools
These tools run only on the public website at effica.com.au. They never receive information from inside the Effica app.
- Google Analytics 4: Measures visits to the public website. On by default; a visitor can turn it off in Privacy choices.
- Storylane: Runs the interactive product tours on the public website. On by default; a visitor can turn it off in Privacy choices.
- Meta Pixel: Measures visits that come from Meta advertising. On by default; a visitor can turn it off in Privacy choices.
- Google reCAPTCHA: Loads with the contact form to stop spam. It runs whatever the visitor chooses in Privacy choices. Google services are global.
Australian core, with disclosed exceptions
Effica's primary database, authentication, file storage, and dynamic application compute are configured in Sydney. Core operational records are hosted in Australia, with a live standby copy in Melbourne. Selected email, AI, push, mapping, support, payment, enquiry, website, and background-processing services may process limited information overseas only for their stated functions and under appropriate contractual and security safeguards. Public and static content may be delivered globally.
Transactional email is delivered through Resend in the United States and may process recipient addresses, generic or service-message content, links or codes, and delivery metadata. Effica minimises email content and provides protected records through Effica-controlled secure access.
Privacy safeguards
AI with privacy safeguards and human oversight
Effica uses optional AI to take routine work off your team. You control it with an AI switch for your organisation and for every participant, customer data is never used to train AI models, and people stay responsible for reviewing the result.
- Purpose-limited. AI runs only for the feature it serves, such as a draft someone asked for or making an uploaded document searchable.
- Permission-bound. Effie follows each user's role and branch access, so it only works with records that person can already see.
- Switches you control. Switching AI off for your organisation stops every in-app AI feature. While a participant's own AI switch is off, AI features linked to their record are refused and Effie will not name or identify them.
- No training. Customer data is not used to train AI models. Effica has not opted customer data into model training.
- Where AI runs. Effie, every in-app AI feature and onboarding imports call OpenAI directly under a signed data processing agreement, after Effica Shield.
- Numbers hidden first. Effica Shield hides 10 kinds of government, health and financial numbers, such as tax file, Medicare and NDIS numbers, and blocks certain documents before AI sees them. Names and care details are not hidden.
- Human oversight. Authorised people review outputs before relying on them or taking action.
Care context is treated as protected personal information. Staff review AI output before relying on it.
Changes, questions, or objections
We update this page when the material processing arrangement changes and provide additional notice where a customer agreement requires it. Before activating a new material sub-processor for customer information, Effica will assess the service and update this list. For questions, available data-processing documentation, or an objection to a proposed change, contact info@effica.com.au.
See the Privacy Policy for individual rights, complaints, and further overseas-processing information.