Privacy Policy

Last updated: 2 November 2026

At Mura, we understand that coordinating care for a family member or loved one is a deeply personal and often overwhelming responsibility. We are committed to protecting the privacy of your family and the security of the sensitive health and financial information you entrust to us.

1. Who We Are and How to Contact Us

Mura is operated by PZero Pte Ltd, a company incorporated in Singapore (“Mura”, “we”, “us”, or “our”). Mura provides family care coordination and administrative management tools across Australia and Singapore.

Contact Details:

Privacy Officer / Data Protection Officer

Email: privacy@withmura.com

Registered Address: #12-07 Suntec Tower One, 7 Temasek Boulevard, Singapore 038987

Phone: +65 8911 6350

2. Information We Collect

Mura is organized around care profiles. We collect information necessary to coordinate care across our supported profile types:

For Care Team Members (Users):

  • Identity and Account Data: Name, email address, login credentials, and your role in the Care Team (Coordinator or Member).

For Care Recipients:

Mura supports four profile types: Elderly, Adult, Child, and Pet. Depending on the profile type and your jurisdiction, we collect:

  • Identity Data: Full name, date of birth, emergency contact details, relationship, and profile photos.
  • Sensitive Health Information: Medication schedules and logs, treating doctor and specialist contacts, clinical documents (prescriptions, care plans, hospital discharge summaries, and aged care Notice of Decision letters), health expense records (service dates, provider names, costs, and claim status), and private health fund details (fund name and encrypted membership number).
  • Government Funding and Financial Records: For Australian aged care recipients receiving Support at Home or CHSP funding: funding levels (Level 1–8), aged care provider invoices, extracted billing line items, quarterly budget caps, and expenditure discrepancy reports.
  • Pet Profiles: Animal name, species, breed, and veterinary administrative records (vaccination logs and medication reminders). Records regarding animals are administrative care records and not health information about an individual, though associated receipts may contain the owner’s contact details.

Device Permissions and Accessed Data:

Our mobile application requests specific device permissions to function:

  • Camera: Used solely to scan medication packaging for logging prescription details and scanning physical invoices/receipts for budget tracking.
  • Photo Library: Accessed only when you choose to upload images or documents, such as a profile picture for a care recipient or invoice attachments.
  • Biometrics: Enabled optionally for secure, device-level authentication (FaceID or Fingerprint). Biometric verification is processed entirely on your local device and is never stored, accessed, or transmitted to our servers.

Waitlist Sign-ups (withmura.com):

If you join the Mura waitlist on our website, we collect only your email address and the date and time you signed up. You do not need a Mura account to join. Your waitlist email is stored in Sydney, Australia.

3. How We Collect Information

Most information is provided directly by you when you create a profile, upload documents, log medication, or enter data into the app.

Collection via Authorized Representatives:

When a family member uploads health or financial information about a care recipient, they warrant under Section 4 of our Terms of Service that they have lawful authority or informed consent to do so — whether as the recipient themself, under an Enduring Power of Attorney, as an appointed guardian, under section 6AA of the Privacy Act 1988 (Cth) as a “responsible person”, as a parent with parental responsibility, or under an equivalent authority in Singapore.

4. Why We Collect Information (Primary Purpose)

We collect and use this information for the primary purpose of care coordination and administrative management. This includes:

  • Centralizing medical, government, and care records as a single source of truth for the Care Team.
  • Tracking aged care budgets, health expenses, quarterly caps, and rollover balances.
  • Scheduling care visits, tasks, and medication reminders.

Automated Processing and Decision Assistance: Mura uses automated algorithms, rule engines, and artificial intelligence models to assist you in parsing invoices, extracting service line items, and comparing them against government funding parameters or budget caps. All extracted figures, discrepancy flags, and budget classifications are draft suggestions only and require human-in-the-loop review and verification by you before you dispute a charge, withhold payment, or make care decisions. We do not make automated decisions that produce legal or significant effects without human involvement.

No Secondary Use: We do not sell your personal or health information, and we do not use your records for marketing, profiling, or third-party advertising without your explicit consent.

Waitlist: If you joined the waitlist, we use your email address only to tell you when Mura is available and about its launch. Every such email includes a way to unsubscribe, and you can ask us to remove you at any time by emailing privacy@withmura.com. We do not use your waitlist email for any other purpose or share it with anyone for their own marketing.

5. Who We Disclose Information To

We only share information in the following circumstances:

  • Your Care Team: Data is visible to coordinators and members according to the visibility and role permissions set by the Coordinator.
  • Care Providers: Only if you explicitly choose to export or share specific logs, summaries, or reports with your relative’s care provider.

Technical Sub-processors:

  • Supabase: For secure cloud database and document storage hosted in Sydney, Australia (ap-southeast-2).
  • Stripe: For payment processing of web subscriptions.
  • Google Play and Apple App Store: For in-app purchase billing and mobile subscription transactions.
  • RevenueCat: For in-app subscription lifecycle management and receipt validation.
  • Document extraction: Not currently in use. Automatic invoice extraction is switched off and no AI or document-extraction provider receives your documents. We will update this policy, name the provider and ask for your consent before that changes.

6. Overseas Disclosure

Your records — account details, care records and uploaded documents — are stored in Sydney, Australia (ap-southeast-2), and the application servers that handle your requests run in Sydney.

Some personal information is disclosed to, or accessible from, other countries:

  • Singapore — Mura is operated by PZero Pte Ltd from Singapore. Authorised personnel may access personal information from Singapore to operate and support the service.
  • United States — Stripe, if you subscribe on the web (Stripe collects your payment details directly); Google Play or the Apple App Store, if you subscribe in the app (under the store’s own privacy terms); RevenueCat — on Android, a pseudonymous identifier for your Care Team whenever you are signed in, and, if you subscribe in the app, a pseudonymous identifier for your account and your purchase records (no care records or documents); Expo, Google and Apple, to deliver push notifications you have turned on (your device token and the notification text); and Sentry, for error reports.
  • European Union — PostHog (Germany), for product analytics using pseudonymous identifiers.

We take reasonable steps, including contractual terms, to ensure these recipients handle your information consistently with the Australian Privacy Principles and the Singapore PDPA.

7. How We Store and Protect Your Data

We take the security of health and financial data seriously:

  • Data Residency: All database records and files are hosted on Australian-based cloud servers (AWS Sydney / ap-southeast-2).
  • Encryption: Data is encrypted in transit (TLS) and at rest. Sensitive fields, such as private health insurance membership numbers, are protected with application-layer AES-256-GCM encryption.
  • Government Identifiers (APP 9): Mura does not adopt Commonwealth government identifiers (such as Medicare numbers, Tax File Numbers, or Centrelink CRNs) as our own identifiers. An automated scanning system actively scrubs and redacts detected government identifiers from invoice text before data is permanently persisted.
  • Access Control & MFA: We enforce Row-Level Security (RLS) in the database and role-based permissioning. Multi-Factor Authentication (MFA) is optional. Once you turn it on, you are asked for a code when you sign in, unless you have chosen to trust that device.

8. Retention

Your records are deleted by default. Australian Privacy Principle 11.2 and section 25 of the Singapore PDPA require us to destroy or de-identify personal information once we no longer need it for the purpose we collected it — so for us, retention is the exception, not the rule.

When you close your account or delete a profile, we purge records within 30 days (subject to standard backup rotation cycles). We retain only a limited set of administrative records under stated legal bases:

  • Consent ledger entries — kept 7 years, to evidence lawful authority to hold records.
  • Billing and payment records — kept 5 years, for tax record-keeping obligations.
  • Security and access audit logs — kept 2 years, for data breach investigation obligations.
  • Records subject to legal hold or court order — kept as directed by law.

Uploaded medical documents, care notes, medication logs, and provider invoices are not kept in our archives after deletion.

Waitlist emails: We delete your waitlist email address when you unsubscribe or ask us to remove it, and in any case no later than 12 months after we tell you Mura is available.

9. Your Rights: Access, Correction, and Deletion

Under applicable privacy laws, you have the right to:

  • Request access to the personal information we hold about you or the care recipient.
  • Request that we correct inaccurate or incomplete information.
  • Request the deletion of your account and all associated personal information. You can initiate an account and data deletion request at any time by emailing our Privacy Officer at privacy@withmura.com or using the delete account option in your application settings.

We will acknowledge your request within 5 business days and respond within 30 days.

10. Notifiable Data Breaches (NDB) Scheme

If we experience a data breach that is likely to result in “serious harm” to you or the care recipient, we are required by law to notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. We will provide recommendations on the steps you should take in response.

11. Complaints

If you have a concern about how we handle your privacy, please contact our Privacy Officer (details in section 1). If you are not satisfied with our response, you may lodge a formal complaint with the OAIC at www.oaic.gov.au.

12. Additional Provisions for Singapore Residents

If you are based in Singapore, the following provisions apply in addition to the above, under the Personal Data Protection Act 2012 (PDPA).

Legal basis for collection: We collect and process your personal data with your consent, provided during onboarding and setup, and as necessary to fulfil the care coordination services you have requested.

Your rights under the PDPA:

  • Access: You may request a copy of the personal data we hold about you.
  • Correction: You may request that we correct inaccurate or incomplete personal data.
  • Withdrawal of consent: You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal, but may affect our ability to provide services.
  • Data portability: Where technically feasible, you may request that we transfer your data to another organisation in a machine-readable format.

Data Protection Officer (DPO): We have designated a Data Protection Officer responsible for ensuring compliance with the PDPA. Contact: privacy@withmura.com.

Cross-border transfers: Where personal data is transferred outside Singapore, we ensure the recipient organisation provides a standard of protection comparable to that under the PDPA, via contractual agreements and strict sub-processor safeguards.

Data Breach Notification: In addition to the Australian NDB obligations in Section 10, if we assess that a data breach affecting Singapore individuals is notifiable under the PDPA, we will notify the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after that assessment (PDPA s 26D), and notify affected individuals where the PDPA requires it.

Retention: Section 25 of the PDPA requires us to cease retaining personal data, or anonymise it, as soon as it is reasonable to assume the purpose for which it was collected is no longer served by retention. When you close your account, we will delete or anonymise your data within 30 days, subject to the limited categories described in section 8 above.

Complaints: If you have a complaint about how we handle your personal data under the PDPA, you may contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.