Haven

Draft. This policy is not final and is still being reviewed. Unfilled: [EFFECTIVE DATE], [OPERATOR NAME].

Haven privacy policy

Effective [EFFECTIVE DATE]

Haven is an app for people managing NDIS supports: participants, and the families and carers who help them. It holds information about disability, health and support, so we have tried to make this policy as plain and as specific as we can. If anything here is unclear, contact us at privacy@havenapp.com.au.

Haven is run by [OPERATOR NAME] ("we", "us").

The short version

Everything you add to Haven is stored on your phone, not by us. We have no accounts and no database of your information.
Haven's AI features send some of your information to Anthropic, the company whose AI Haven uses, in the United States. This only happens if you turn Haven AI on, and you can turn it off at any time.
Anthropic deletes what it receives within 30 days, and does not use it to train AI models.
We don't sell your information, show you ads, or track you.

What Haven stores, and where

Haven stores what you add to it: the names of the people whose plans you manage, their NDIS plan details, providers and their contact details, documents and their details, invoices, appointments, journal updates, and your own name and whether you're a participant or a carer.

All of this is kept in Haven's private storage on your phone, which iOS protects with your phone's passcode. We do not receive a copy. Original files you add, such as PDFs and photos, are copied into the same private storage and stay on your phone.

When information leaves your phone

Only when Haven AI is turned on. Haven asks before it is turned on, and explains what will be sent. Without it, the whole app still works: you fill in details yourself, and chat is off.

With Haven AI on, Haven sends:

Questions you ask Haven, together with a summary of the people, plans, providers, documents, appointments and recent updates it needs to answer.
The text of plans and documents you add, so Haven can fill in their details (such as dates, amounts and who sent them) and notice any appointments they mention.
The text of emails you paste in, for the same reasons.
Suggestions shown on your Home screen, to word them more naturally. These can include the names of people and providers.

Haven does not send:

photos;
any document you add with "Haven won't read it", or mark "Keep this on my device" before Haven reads it;
the original files themselves — only the text read from them;
anything at all while Haven AI is turned off.

If you mark an existing document "Keep this on my device", Haven stops using it from then on. It cannot recall text it has already sent.

Who receives it

Anthropic, PBC, a company in the United States, processes what Haven sends in order to produce Haven's replies and readings. Under Anthropic's terms for businesses using its service:

it deletes the information within 30 days;
if its automated safety systems flag something as a possible breach of its usage policy, it may keep that for up to two years, and may keep it longer where the law requires;
it does not use the information to train its AI models.

You can read Anthropic's own policy at https://www.anthropic.com/legal/privacy.

On its way to Anthropic, information passes through Haven's server, which is hosted by Expo (EAS Hosting, which runs on Cloudflare). Our server does not store the content of what passes through it. Like most web services, the hosting platform may keep standard technical records, such as the time of a request and the address it came from, for security and to keep the service running.

We don't give your information to anyone else.

Sending information overseas

Because Anthropic is in the United States, using Haven AI means your information is disclosed outside Australia. Turning Haven AI on is your agreement to that. United States privacy law is not the same as the Australian Privacy Principles, and you may not have the same rights there. If you would rather your information stayed in Australia, leave Haven AI turned off.

What we don't do

No accounts or sign-in.
No analytics, usage tracking or crash reporting.
No advertising, and no tracking across other apps or websites.
No selling, renting or trading of your information.

Information about other people

Many people use Haven on behalf of someone else, often a child or an adult they support. That means Haven may hold information about a person who isn't the one using the app. Please only add information you are entitled to manage for them, and think about whether Haven AI is right for their information before turning it on.

Haven is not designed for children to use themselves.

Your choices

See and correct your information: it's all in the app, and you can edit any of it.
Delete it: delete anything within the app, or delete the app, which removes everything Haven stores. Because we don't hold a copy, there is nothing else for us to delete.
Turn Haven AI off: More, then Haven AI and privacy.
Information already sent to Anthropic is deleted by Anthropic within 30 days, as described above. Because Haven has no accounts, we can't identify or retrieve an individual's information from Anthropic.

Security

Information stays on your phone in Haven's private storage. When Haven AI sends anything, it travels encrypted (HTTPS). Haven's server only accepts requests from the Haven app.

No system is perfectly secure. If something went wrong that put your information at risk, we would tell you through the app and at havenapp.com.au, and notify the Office of the Australian Information Commissioner where the law requires.

Changes to this policy

If we change how Haven handles your information, we will update this policy and its date. If the change affects what Haven AI sends, Haven will ask for your agreement again before sending anything.

Contact and complaints

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

online: https://www.oaic.gov.au
phone: 1300 363 992