®1. Who we are
MACH Health is operated by Mach Health Pty Ltd (ACN 669 796 892, ABN 60 669 796 892), based in Ormeau, Queensland 4208, Australia ("MACH Health", "we", "us"). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For people in the United Kingdom, we also comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Our privacy contact is Mark Carter, who you can reach at mark@machhealth.com.au.
2. Who this policy covers
- Nurses and other staff who use the MACH Health app
- Leaders and staff of organisations that use MACH Health dashboards and reports
- Visitors to this website and members of the Nurse Collective
- People who contact us, including about briefings, reports or the waitlist
3. What we collect
If you use the app
- Account details: your name, work email and employer, and work details such as role, band or grade, specialty and ward
- Check-in answers: how you rate your physical state, emotional state, sleep and nutrition before a shift
- Use of the app: which content you open, and when
- Requests for help, if you choose to make one
Your check-in answers are health information, which is "sensitive information" under the APPs and "special category data" under UK GDPR. We only collect it with your consent, and you can stop at any time.
If you contact us or visit this website
- Your name, email address, organisation and anything you choose to tell us when you email us
- Basic technical information our hosting provider needs to run the site securely (see our cookie policy)
This website does not take payments, and we do not use your location to show advertising.
The Nurse Collective
Our Nurse Collective groups run on Facebook and LinkedIn, and live sessions run on Zoom. Those platforms handle your information under their own privacy policies.
4. Why we use it
- To give you your check-in, support matched to your answers, and your own trend
- To give organisations de-identified, combined insight about their workforce
- To act on a request for help, only when you ask
- To run, secure and improve the service
- To answer enquiries and send information you have asked for
- For research and evaluation using de-identified, combined data, including publishing findings such as our pilot results. Published findings never identify an individual.
Legal bases (UK)
Where UK GDPR applies, we rely on your explicit consent to process the health information in your check-ins. We rely on our agreement with your organisation, and our legitimate interests in running and improving a safe and secure service, for account and usage information. We rely on our legitimate interests to respond to people who contact us.
When we provide MACH Health to an organisation, our agreement with that organisation sets out who is the controller and who is the processor of each type of information.
Automated decisions
The app uses automated rules to choose which support suggestions to show you, based on your check-in answers. It also flags when a team's combined scores are trending towards risk. These rules do not make decisions about you as an individual: team alerts never identify anyone, and any action taken on an alert is decided by people.
5. Who can see your information
- You see your own check-ins and trend.
- Your organisation sees only de-identified, combined results for groups of 10 or more people, so no individual can be identified.
- If you ask for help, we share what you agree to share with the support pathway agreed with your organisation (for example, occupational health or an employee assistance program).
- Our service providers, such as our app platform, hosting and email providers, handle data on our behalf under contract and only to provide the service.
- Where the law requires it, or where we reasonably believe it is necessary to prevent a serious threat to someone's life, health or safety.
We do not sell personal information.
6. Where your information is stored
App data is stored on servers in Australia and the United Kingdom. If personal information needs to go to another country, we take reasonable steps to make sure it is protected to the standard the APPs require and, for people in the UK, that an approved safeguard under UK GDPR is in place.
7. How long we keep it
We keep identifiable check-in data while your organisation's agreement with us is in place. Within 12 months after the agreement ends, we delete it or permanently de-identify it. If you stop using the app, you can ask us to delete your data sooner.
We keep emails and enquiries for as long as we need them to respond to you and manage our relationship with you.
8. How we protect it
We protect personal information with technical and organisational measures, including restricted access, secure hosting and staff confidentiality obligations. Combined reports are checked so that small groups can't be used to identify anyone.
If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner and, where required, the UK Information Commissioner's Office.
9. Your rights
You can ask to see, correct or delete your information, withdraw your consent, or stop using the app at any time. In the UK you also have rights to restrict or object to processing and to data portability. Email mark@machhealth.com.au. We will respond within 30 days, or within one month if you are in the UK.
10. Not an emergency service
MACH Health is not a crisis or emergency service, and check-ins are not monitored in real time. If you or someone else is in immediate danger, call 000 in Australia or 999 in the UK. For support, Lifeline is available on 13 11 14 (Australia) and Samaritans on 116 123 (UK).
11. Complaints
If you are unhappy with how we have handled your personal information, please tell us first. Email mark@machhealth.com.au with "Privacy complaint" in the subject line.
- We will acknowledge your complaint within 30 days.
- We will look into it without undue delay and keep you updated.
- We will tell you the outcome and what we have done about it.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the UK, the Information Commissioner's Office (ico.org.uk).
12. Changes
We will post any changes here and, if they are significant, tell app users directly.
Effective date: 13 October 2026 · Privacy contact: Mark Carter, mark@machhealth.com.au