Privacy Policy

1. About this policy

Caduo is an Australian dating service for doctors, healthcare professionals and people training for healthcare careers. This Privacy Policy explains how Caduo ("Caduo", "we", "us" or "our") collects, holds, uses, discloses and protects personal information when you use the Caduo mobile application, website, support channels and related services (the "Service").

We manage personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable privacy, consumer and online-safety laws.

Contact our Privacy Officer at admin@psychtrack.com.au using the subject “Caduo privacy request”. Use the subject “Caduo safety report” for safety matters.

2. Information we collect

2.1 Account and contact information

We collect information used to create and secure your account, including your email address, Apple sign-in identifier, Firebase account identifier, login events, authentication tokens, device identifiers and account status.

2.2 Profile information

You may provide your first name, date of birth, age, gender, pronouns, sexual orientation, height, general location, hometown, education, languages, family plans, drinking and smoking preferences, interests, dating intentions, biography, prompt responses, opening moves, availability, work pattern, profession, professional discipline, career stage, workplace, years of practice, photos, profile video and a profile voice prompt.

Your chosen profile information may be displayed to other eligible Caduo members. Your exact date of birth, email address, professional registration number, precise coordinates, identity evidence and report history are not public profile fields.

2.3 Sensitive information

Some information you choose to provide may be sensitive information under Australian law, including sexual orientation, professional association or registration information, identity documents and biometric information if Caduo later introduces automated biometric verification. We seek express consent before collecting sensitive information and use it only for the purposes explained at collection, purposes directly related to those purposes, or as otherwise permitted by law.

Caduo does not currently create biometric templates or perform automated facial recognition. A verification selfie is reviewed as an image by authorised reviewers unless we give you a new collection notice and obtain any consent required before introducing a biometric verification service.

2.4 Verification information

If you apply for professional verification, we collect your legal name, professional register, association, employer or training institution and the relevant reference, professional evidence such as a membership certificate, employment letter or enrolment confirmation, government-issued photo identification, verification selfie, submission dates, capture source, reviewer decision and related review notes. We may compare this information with public professional registers and other authoritative sources.

Verification evidence is stored separately from public profiles and is available only to authorised reviewers and service providers that require access to operate the verification process.

2.5 Location information

With device permission, we collect your device coordinates to apply your distance preferences and calculate an approximate distance to other members. We do not display your precise coordinates to other members. You may deny or withdraw location permission in iOS settings, but distance-based discovery may be less accurate.

2.6 Dating activity and communications

We collect likes, passes, matches, blocks, profile reactions, messages, message reactions, read status, typing status, media and voice messages, date plans, safety check-ins, private post-date feedback, community-event interactions, subscription entitlements and consumable credit balances. Post-date feedback may include whether a date occurred, whether you felt safe, whether the profile was accurate and whether you would meet again. Message and feedback content is processed to deliver the Service, improve recommendations, provide safety features, investigate reports, prevent abuse and comply with law.

Messages are not end-to-end encrypted. They are protected in transit and at rest using the security controls of Caduo and its service providers.

2.7 Safety, moderation and support information

We collect reports, report reasons, supporting evidence, moderation decisions, appeals, review notes, blocked-account relationships and communications with support. A report may contain information about both the reporter and the reported member. We may preserve relevant records where reasonably necessary to protect members, investigate misconduct, prevent repeated abuse, establish or defend legal claims, or comply with law.

2.8 Technical, diagnostic and analytics information

The Service collects operational information required for security and functionality, such as IP address, device and operating-system information, app version, App Check and device-attestation results, push notification tokens, crash events, performance diagnostics and security logs.

Optional product analytics are off by default. If you enable “Help improve Caduo”, we collect interaction events such as onboarding completion, screen views, discovery actions, messages sent, verification submissions and subscription events. You can withdraw optional analytics consent in Privacy Controls. Caduo does not use third-party advertising trackers and does not sell personal information.

2.9 Purchases

Apple processes payment-card details for subscriptions and one-time in-app purchases. Caduo receives transaction identifiers, product identifiers, entitlement status, subscription expiry, revocation information, consumable credit balances and an account-linked App Store token. We do not receive your full payment-card number.

2.10 Profile writing assistance and photo guidance

Profile writing suggestions are generated on the device using Apple’s on-device model where available, or from built-in guided templates. The writing assistant is given only the profile choices already visible on the editing screen and is instructed not to use registration numbers, exact workplaces, photos or patient information. Caduo does not send writing-assistant prompts or outputs to an external generative-AI provider. You decide whether to use or edit every suggestion.

Photo quality guidance is calculated on the device from basic image properties such as resolution and average brightness. Caduo does not use this feature for facial recognition, identity matching, emotion inference or biometric templates.

2.11 Information from other sources

We may receive information from Apple, Firebase, other members, professional registration bodies, public registers, safety organisations, law enforcement and people contacting us about suspected misuse. We take reasonable steps to ensure information used for decisions is accurate, complete, current and relevant.

3. Why we collect and use information

We collect, use and disclose personal information to:

• create, authenticate and secure accounts;
• provide profile, discovery, matching, messaging, community events, subscription, consumable and date-safety features;
• personalise recommendations using your stated preferences, profile compatibility, approximate distance, availability, private outcome feedback and service activity;
• verify identity and professional status;
• detect fake accounts, scams, harassment, prohibited content, security incidents and misuse;
• receive, investigate and resolve reports, complaints and appeals;
• send transactional messages, safety alerts, match and message notifications and service notices;
• process and validate subscriptions and one-time purchases, maintain consumable balances and prevent payment fraud;
• maintain, troubleshoot, measure and improve the Service where you have provided any required consent;
• meet legal, regulatory, accounting, insurance and recordkeeping obligations;
• protect the rights, safety and property of members, Caduo and the public; and
• establish, exercise or defend legal claims.

If you do not provide information marked as required, we may be unable to create your account, verify you or provide the relevant feature.

4. Recommendations and automated processing

Caduo uses software to rank discovery profiles. The ranking may consider your explicit age, distance, profession, gender and relationship preferences; mutual preference eligibility; shared interests and availability; dating intention; professional verification; profile completeness; approximate distance; blocks, passes, prior likes and active matches; and a small consistency factor used to avoid identical ordering.

Recommendation software determines presentation order and eligibility under your filters. Workplace exclusion, verified-only visibility, incognito mode and blocks may remove profiles from one another’s discovery results. It does not decide whether another person must date or communicate with you. You can change your discovery and privacy preferences, disable personalised recommendations, pause discovery, block a member or contact admin@psychtrack.com.au to ask for information about the operation of the recommendation system as it applies to you.

Automated security tools may restrict a request, require App Check or flag content for review. Account suspension, professional verification rejection and appeal outcomes are made or confirmed by an authorised human moderator. You may appeal a suspension from the app.

5. When we disclose information

We may disclose personal information to:

• other Caduo members, according to your profile choices and the operation of matching and messaging features;
• Google and Firebase services that provide authentication, databases, file storage, Cloud Functions, push messaging, App Check, analytics, crash reporting and performance monitoring;
• Apple for Sign in with Apple, device services, push notifications, App Attest and StoreKit subscriptions;
• authorised staff, contractors and moderators who need the information for their role and are subject to confidentiality and access controls;
• professional registration bodies and authoritative public registers when verifying professional status;
• professional advisers, insurers, auditors and infrastructure providers;
• law enforcement, courts, regulators, eSafety or emergency services where required or authorised by law, or where disclosure is reasonably necessary to address a serious threat to life, health or safety; and
• a purchaser or successor in connection with a proposed or completed merger, financing, reorganisation or sale, subject to confidentiality and applicable law.

We do not disclose verification documents to other members. We do not sell or rent personal information. We do not disclose personal information to third parties for their independent targeted advertising.

Other members may save or share information you make visible to them, including by taking screenshots. Their independent conduct is governed by the Community Guidelines and applicable law but is not technically controlled by Caduo.

6. Overseas processing

Caduo configures eligible Firestore, Cloud Storage and Cloud Functions resources in Australia. Some providers operate global infrastructure. Firebase Authentication processes data in the United States, and Firebase, Google and Apple may process information in Australia, the United States and other countries where they or their subprocessors operate.

Before disclosing personal information overseas, we take reasonable steps required by Australian Privacy Principle 8, including assessing providers, using contractual and technical safeguards and limiting the information disclosed to what is needed for the service.

7. Direct marketing and service communications

We may send essential communications about authentication, security, safety, purchases, policy changes, reports and operation of your account. These are service communications and may continue while your account is active.

We send promotional email, SMS or push messages only with the consent required by law. Marketing messages identify Caduo and provide a functional unsubscribe method. We action marketing opt-outs within five working days. You can also change push notification settings in the app or iOS settings. Opting out of marketing does not stop essential service or safety communications.

8. Storage, security and access controls

We use measures appropriate to the sensitivity of the information, including encrypted network transport, provider encryption at rest, Firebase Authentication, App Attest and App Check, server-enforced access rules, least-privilege moderator access, separate storage paths for verification evidence, audit records, input limits, deterministic access checks, subscription receipt verification, monitoring and deletion workflows.

No security measure removes all risk. If a data breach is likely to result in serious harm, we will investigate, take containment and remediation steps and notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

9. Retention and deletion

We retain information only for as long as reasonably necessary for the purposes in this policy and the periods in the Caduo Data Retention Schedule. In summary:

• active account and profile information is retained while the account operates;
• unresolved likes are retained for up to 12 months;
• active matches and messages are retained while the match remains active;
• unmatched conversations are scheduled for deletion after 90 days;
• identity document and selfie files are scheduled for deletion 30 days after a verification decision, while the decision record is retained for up to seven years;
• closed safety reports are retained for up to seven years where needed for safety, repeat-offender detection, legal claims or regulatory obligations;
• optional analytics follow the retention settings applied to the analytics service; and
• operational backups and provider logs expire under controlled backup and provider retention cycles.

You may delete your account in the app. Account deletion removes the active account, public profile, media, likes, passes, matches and messages from operational systems. Limited transaction, moderation, fraud-prevention, security, legal-hold and audit records may be retained where reasonably necessary or required by law. Retained records are access-restricted and are not used to restore your dating profile.

10. Your choices and rights

You may:

• edit and correct profile information in the app;
• change discovery, visibility, notification, analytics and activity-status settings;
• withdraw consent to optional analytics or other consent-based processing;
• pause discovery;
• block or report another member;
• request access to personal information we hold about you;
• request correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information;
• request account deletion; and
• complain about our handling of personal information.

Send access, correction or privacy requests to admin@psychtrack.com.au with the subject “Caduo privacy request”. We may verify your identity before responding. We normally respond within 30 days. If access or correction is refused, we will provide written reasons and available complaint options unless the law permits otherwise.

Withdrawal of consent does not affect processing that occurred before withdrawal. If the information is necessary to provide a feature, withdrawing consent may require us to disable that feature.

11. Privacy complaints

Email admin@psychtrack.com.au with the subject “Caduo privacy complaint”, your name, account email, a description of the concern and the outcome you seek. Our Privacy Officer will acknowledge the complaint, investigate it fairly, keep you informed where more time is required and ordinarily provide a written response within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au, after giving us a reasonable opportunity to resolve the matter.

12. Children

Caduo is only for people aged 18 or older. We do not knowingly permit children to create accounts. If we learn that a person under 18 has provided personal information, we will suspend the account, investigate and delete the information unless retention is required for child-safety reporting or law enforcement.

13. Changes to this policy

We may update this policy to reflect changes to the Service, providers or law. We will publish the updated version and effective date. We will give reasonable advance notice of material changes through the app, email or both, unless an urgent change is required for security, safety or legal compliance. Where a change requires new consent, we will request it before applying the new processing.

14. Contact

Privacy Officer, Caduo Privacy, safety and support: admin@psychtrack.com.au Website: https://caduo.app

Off Shift, private check-ins and profile review

Availability is optional. You choose date windows for the next two weeks; Caduo does not import your clinical roster or calendar. Only an active, unblocked match who also opts in can request the overlap. Your full availability is not sent to that member. Availability documents expire after two weeks.

Date proposals share the venue, meeting point, date, proposer and acceptance/change/cancellation status with the match. Your check-in time, safety notes and check-in response are stored separately and are not shared with your date. Recording a need for support does not alert your date, emergency services or a monitoring team. Contact your trusted person or emergency services directly. Private check-ins remain accessible after unmatching and normally expire 30 days after the check-in; deletion processing can take additional time.

You may privately list up to 12 workplaces for reciprocal workplace exclusion. Matching uses declared names and supported aliases; it cannot identify an affiliation a member has not disclosed. Privacy exclusions apply to discovery and new introductions. Existing connections remain until you unmatch or block.

When you edit an approved profile, the new submission waits separately for review. The last approved version can remain visible until approval, unless paused, blocked or restricted. Optional analytics, crash collection and performance monitoring follow your analytics consent. Discreet message previews are enabled by default; quiet hours silence social notifications in your chosen time zone while enabled safety/account updates may still arrive.

Report evidence and deletion processing — 9 September 2026

Reporting a message can preserve that message, up to 50 messages of relevant context and associated attachments in a restricted safety case. Reports receive a case reference. Account deletion removes ordinary account data but does not erase open safety cases or evidence under a documented hold. Authorised moderators with two-step verification can inspect case evidence; access and hold changes are logged. Closed cases follow the retention schedule. Interrupted deletion processing retries automatically.

Message attachments are checked before delivery; photos are re-encoded without embedded image metadata. Incoming attachments can be revealed by the recipient. Workplace privacy compares selected organisation IDs and declared names, including recognised aliases; it cannot discover undeclared affiliations. Availability sharing is optional and reveals overlapping windows only to active matches who both opt in.