1. Our commitment to privacy
Esteem AI is an agentic care management platform for aged care, home care and disability support providers. It is operated by Homage Enterprise Pte Ltd (UEN: 202102328C), a Homage company ("Esteem AI", "we", "us" or "our"). We collect only the personal data we need, and keep it only as long as the law or the original purpose requires.
We comply with Singapore's Personal Data Protection Act 2012 ("PDPA"). Where we serve customers in Australia or Malaysia, we also comply with the Australian Privacy Act 1988 and Australian Privacy Principles, and Malaysia's Personal Data Protection Act 2010, as applicable.
This Privacy Policy applies to the Esteem AI website, the Esteem AI platform and apps, and any other channel through which we collect personal data (together, the "Platform"). It does not apply to third-party websites linked from the Platform.
Our two roles. This Policy covers personal data we collect for our own purposes: website visitors, people who request a demo, and the staff of care providers who use the Platform ("Users"). Care providers that subscribe to Esteem AI ("Customers") also upload data about their clients, families, caregivers and care workers ("Customer Data"). For Customer Data, the Customer decides what is collected and why, and we process it on the Customer's behalf as a data intermediary or service provider under our agreement with them. Questions about Customer Data should go to the relevant care provider first.
By using the Platform or submitting personal data to us, you agree to this Policy. Questions or complaints can go to our Data Protection Officer ("DPO") at data-privacy@esteemcare.ai.
2. Personal data we collect
"Personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information we have access to. It covers electronic and non-electronic records.
We collect personal data by fair and lawful means, only for the purposes set out in this Policy or notified to you at collection.
| Category | Examples | Collected from |
|---|---|---|
| Demo and enquiry data | Name, work email, phone, organisation, role, organisation size, message | Demo request and contact forms |
| User account data | Name, work email, phone, role, login credentials, permissions | Customer administrators and Users |
| Usage and device data | IP address, browser and device type, pages visited, features used, time spent, error logs | Website and Platform, automatically |
| Approval and audit records | Which User reviewed, approved or edited an AI agent's output, and when | Platform, automatically |
| Billing data | Billing contact, invoicing address, payment details | Customers |
| Support and feedback data | Support tickets, call recordings where notified, survey responses, complaints | Users and Customers |
| Marketing preferences | Subscriptions, opt-outs, records of withdrawn consent | Users and enquirers |
| Job application data | Name, contact details, CV, work history | Applicants |
Customer Data. On a Customer's instructions, the Platform processes data about care recipients, their families and primary caregivers, and care workers. This can include contact details, identity documents, assessments, care plans, visit and care notes, incident reports, consent records, rosters, qualifications, claims and invoices. Some of it is health or other sensitive information. Customers are responsible for having the consents and notices required to share it with us.
We do not permanently store full card details. Payments are handled by our payment processors.
3. How we use personal data
We use the personal data in Section 2 to:
- respond to enquiries and run demos, evaluations and onboarding;
- create and manage User accounts, verify identity and control access;
- provide, operate, maintain and support the Platform;
- bill Customers, process payments and keep financial records;
- monitor security, prevent fraud and misuse, and keep audit trails;
- analyse usage to fix issues and improve the Platform;
- send service notices, product updates and, with consent where required, marketing about Esteem AI and Homage;
- handle complaints, feedback and job applications;
- meet legal, regulatory and contractual obligations; and
- any other purpose we notify you of at collection, with your consent obtained no later than then.
AI agents. Esteem AI uses AI agents to prepare documentation, support rostering, follow up on compliance, answer routine enquiries and compile reports. Agents prepare work for Users to review; nothing is committed without a User's approval. Every agent action is logged with who approved it and when. Agents process Customer Data only to deliver the Platform to that Customer.
We do not use Customer Data to train AI models made available to other Customers, and we do not allow our AI model providers to train their models on it.
We use Customer Data only on the Customer's instructions and under our agreement with them. We may create aggregated or de-identified data that no longer identifies any individual, and use it to measure and improve the Platform.
Surveys. We may invite you to take part in surveys. We report results only in aggregate, without identifying you.
4. Disclosure of personal data
We do not sell personal data. We may disclose it to:
- Service providers acting for us, such as cloud hosting, AI model providers, CRM and email tools, customer support, payment processing and professional advisers. They may use the data only to provide their services to us and must protect it.
- Homage and its related corporations, to deliver, support and improve the Platform and, with consent where required, for marketing.
- The Customer and its authorised Users, for Customer Data and for activity within that Customer's account.
- Third parties a Customer connects to, such as government funding or claims portals, accounting tools or messaging services, when the Customer enables that integration.
- Authorities, including legal, regulatory, government, tax and law enforcement bodies, where required or permitted by law or where we reasonably believe disclosure is needed to meet a legal or regulatory obligation.
- Parties to a business transaction, such as a financing, merger, sale or transfer of all or part of our business or assets. They must handle the data in line with this Policy.
We may share aggregated or de-identified information that does not identify any individual with partners and the wider care sector.
5. Retention, security and overseas transfers
Retention. We keep personal data only as long as needed for the purpose it was collected for, or as required by law. Closing an account does not automatically delete billing, transaction and audit records we must keep for financial, legal and compliance reasons.
Customer Data is kept for the term of the Customer's agreement. When it ends, we return or delete Customer Data as the agreement sets out, unless the law requires us to keep it. Care records may be subject to minimum retention periods under aged care, disability or health record laws, which the Customer is responsible for meeting.
Security. We protect personal data with technical, administrative, contractual and physical safeguards. These include encryption in transit and at rest, role-based access controls, logging of access and agent actions, and confidentiality obligations on our staff and service providers.
No system is completely secure. Users should keep their login credentials confidential, use strong passwords and enable multi-factor authentication where available. Email is not a secure channel, so please do not send sensitive information to us by email.
Data breaches. If you suspect a breach involving Esteem AI, contact us immediately at security@esteemcare.ai. We will assess and notify affected Customers, individuals and regulators as required under applicable law, including the PDPA and Australia's Notifiable Data Breaches scheme.
Overseas transfers. Personal data may be stored or processed outside the country where it was collected and by service providers in other countries, such as our CRM provider in the United States. When we transfer personal data overseas, we take steps to ensure it receives protection comparable to the PDPA and other applicable law, for example through contractual safeguards.
6. Your rights and choices
Access and correction. You may ask to see the personal data we hold about you, how it has been used or disclosed in the past year, or to correct it. Users can update some account details in their settings. Send other requests in writing to our DPO with enough information to verify your identity. We may charge a reasonable fee for access where the law allows, and will tell you in advance.
We will respond within the time required by applicable law. If we refuse a request, we will explain why in writing, and you may challenge that decision.
Requests about Customer Data. If you are a care recipient, family member, caregiver or care worker whose data a Customer holds on the Platform, please contact that care provider. If you contact us, we will refer your request to them and help them respond.
Withdrawing consent. You may withdraw consent for any purpose in this Policy by contacting our DPO. We will tell you the likely consequences first. Withdrawal may mean we can no longer provide some or all of the Platform to you.
Marketing. To stop marketing messages, use the unsubscribe link in any email, tell us during a call, or email data-privacy@esteemcare.ai. We will still send service and account notices.
Do Not Call. Before calling or messaging Singapore numbers for marketing, we check the Do Not Call Registry unless we have your clear and unambiguous consent. Registry results are valid for a limited period, so you may receive a message shortly after registering.
Accuracy. Please keep the personal data you give us accurate and up to date. If you give us personal data about another person, you confirm you have their consent or are otherwise authorised to do so.