Effective date: 29th October 2026
Kaleidoscope is an assessment and data analytics platform that collects, analyses and shares information about individuals and healthcare services for a range of purposes, including digital health maturity, commissioning maturity and General Practice sustainability.
Kaleidoscope is operated and managed by Semantic Consulting.
Semantic Consulting is contracted by third parties to undertake assessments and report on assessment results. We collect and share personal information with these third parties.
An assessment link is emailed to you to give you access to the Kaleidoscope platform. In order to distribute assessments, we may collect your email address from the third party which contracted us. With the contracting party’s permission, we may check with an email verification service that your email address can receive email before the link is sent. The verification service may return other details it holds about your email address, such as a name, gender or location. We do not use or keep this information.
You may also be provided the link directly by the third party. You may be requested to provide your email address in order to receive your results. We do not verify your email address in this circumstance.
The personal information we collect as part of the assessment - typically your name and workplace details - may be used to contact you about the result of the assessment. Your assessment results, including any personal information collected, are shared with the third party who contracted us to undertake the assessment. We may also contact you if we believe there is an error with your assessment results.
Your IP address and other technical information is collected for audit purposes. For example, checking for unusual patterns of responses such as a significant number of responses from a single IP address.
We use the assessment results to prepare reports for the contracting organisation. This includes, for example, the distribution of results for each question. These reports do not include identified information.
Following the assessment, you may be provided with information about your results and suggested resources relevant to the assessment. We monitor how you interact with this information to improve our products and to provide feedback to resource developers on how their resources are used.
Aggregated, de-identified reports may be shared with other organisations, for example Commonwealth and State Governments for reporting purposes and peak bodies to inform their advocacy work.
We may also combine aggregated information across assessments. This information is general in nature and does not identify particular people or organisations. Aggregated information may be made publicly available, for example through publication in the media, social media or academic journals. Aggregated information may also be presented at conferences or as part as educational activities.
We may provide academic partners access to data which includes personal information (e.g., workplace location, age) you have provided. This allows our academic partners to evaluate and analyse the data. All academic research is approved by a relevant ethics committee. Your personal details are not published. Our academic partners are committed to ensuring your data is protected.
We do not plan to share your personal information with anyone else. If, for some unanticipated reason, we are required to share your personal information we will contact you to discuss the situation. We will also advise you if your personal information is compromised through a data breach.
We keep your email address and any other personal information you have provided to support operational processes, such as completed assessments and tracking changes over time. Information is stored temporarily before submission to allow you to return and complete your assessment later. Data from different assessments may also be combined to understand trends and track changes over time. Our data collection is reviewed annually to identify any personal information that is no longer required. Data is deleted if no longer needed.
Assessment responses and results are kept so that results can be compared between assessment rounds and for collated analysis across different regions. We retain your email address and organisational details to support matching of assessment results. The contracting organisation may ask us to delete data.
You can ask us to delete the personal information we hold about you by emailing notifications@kaleidoscope.care. We will verify the request and complete it within 60 days, and tell you if a copy remains in an encrypted backup until that backup expires.
Kaleidoscope operates two separate platforms, both hosted on Amazon Web Services. Information collected on our Australian platform (www.kaleidoscope.care) is stored in Australia. Information collected on our European platform (eu.kaleidoscope.care) is stored in Germany. Our Australian team may access information on either platform to provide support. Access to the European platform from Australia is limited to named staff using individual accounts with multi-factor authentication over encrypted connections, and is covered by the European Commission's standard contractual clauses (see “If you are in the European Union or the United Kingdom”).
Encrypted backups are kept in the same region as each platform. Backups are used only to restore the service if required, and backed up data is deleted within 150 days.
We are contracted by third parties to perform services. These contracts generally include provisions around protecting any personal information provided to us.
We also seek your consent to collect and share any additional personal information you provide to us.
Apart from the circumstances detailed below, data in the Australian platform is processed in Australia and data in the European platform is processed in the European Union.
Support is provided by Semantic Consulting employees from Australia. In limited circumstances, assessment results from the Australian platform may be manually processed by Semantic Consulting employees in Australia using desktop software. This does not include any personal information such as email addresses.
We may use the name of health services, combined with other publicly available data, to plot the location of your health service using Google Maps. The geolocation service responsible for this processing is based in the United States.
When we verify an email address, we use ZeroBounce, an email verification service based in the United States that processes data on servers in the European Union. Only the email address is sent; names, assessment responses and IP addresses are not. We keep only the result of the check (for example, valid or invalid).
We use OpenAI, based in the United States, to analyse assessment responses. Assessment responses may be sent to OpenAI for summarisation, thematic analysis, or to explore assessment data on an adhoc basis. The relevant assessment responses are shared with OpenAI to generate answers. Only assessment responses are shared, email or IP addresses are not shared.
The organisation that commissioned the assessment is the controller of your assessment data and Semantic Consulting processes it on that organisation's instructions, either directly or as a sub-processor of a partner organisation, under written agreements that meet Article 28 of the GDPR. Your data and its backups are stored in the European Union. It is transferred outside the European Union only when our staff in Australia access it to support the service, and when assessment responses are sent to OpenAI in the United States for analysis (see “Processing of data”). Australia does not have an adequacy decision under the GDPR, so access from Australia is made under the European Commission's standard contractual clauses in our agreement with the commissioning organisation or partner, and is limited to named staff using individual accounts with multi-factor authentication over encrypted connections. Transfers to OpenAI are made under OpenAI's data processing addendum, which includes the standard contractual clauses. To access your personal data, have it corrected or erased or to restrict its processing, email notifications@kaleidoscope.care. You also have the right to lodge a complaint with the data protection authority in your country, or with the UK Information Commissioner's Office.
We do not change assessment responses once the assessment is complete. If you believe there is an error which requires correction, please contact us on notifications@kaleidoscope.care.
If you have any questions, need to let us know about an issue or have a complaint please email notifications@kaleidoscope.care.
If you feel that we have not addressed your concern in a satisfactory manner, you may contact the party which contracted us, this information is available in the assessment. You can also contact the Office of the Australian Information Commissioner or the relevant authority in your jurisdiction.