In each of these settings the organisation must answer the same question, repeatedly and quickly: which parts of this person's information may this particular requester see, right now, for this particular purpose, in this particular place?

• A personal-care worker needs mobility and daily-care information, not full diagnoses.
• A pharmacist needs medication information, not behavioural notes.
• A family member may receive a wellbeing update, not the clinical record.
• A paramedic may need critical allergies and medication within seconds.
• An analytics platform may need patterns, not identities.

Each participant may have a legitimate need for some information, but not necessarily the entire resident record. That is the precise operational problem addressed by CareBand's context-specific, attribute-level disclosure architecture.

1. 1

   A request is initiated by a device associated with a person at the point of care.

2. 2

   The individual is identified through a patient or resident identifier.

3. 3

   The requesting user's identity, role, licence or authority is established.

4. 4

   Purpose, relationship, location, facility and jurisdiction context is evaluated.

5. 5

   A determination engine calculates one or more relevant care categories.

6. 6

   Only the permitted information is selectively retrieved from the encrypted profile.

7. 7

   The minimum necessary information is released in real time.

8. 8

   The information is securely delivered to the authorised user or system.

9. 9

   The request, decision and disclosure are recorded.

The stated novelty is not ordinary role-based access alone. It is the combination of dynamically calculated care categories, attribute-level disclosure, role, authority, purpose, relationship, location and jurisdiction, together with selective retrieval from encrypted information profiles.

The CareBand material also expressly positions the architecture for aged care, rotating care teams, emergency services, disability support and multi-agency care environments — the exact environments Regis publicly describes operating in.

Australian Provisional Patent Application No. 2025905426. Descriptions on this page summarise the CareBand position for commercial discussion and are not a substitute for the patent specification or professional legal advice.

No rating on this page should be read as an assertion that Regis Healthcare uses the CareBand patented system or method.

Every statement in this review is classified into one of five categories:

• Every Regis-specific assertion is connected to an official Regis webpage, annual report, investor presentation or clearly identified official publication.
• Where public material does not reveal technical detail, the review displays: Technical implementation not publicly disclosed.
• No inference is made that the new clinical management system uses FHIR.
• No inference is made that Regis currently uses NFC, wearables or CareBand-like devices.
• No testimonials, quotes, financial figures or technical implementations are fabricated.

This review is not described as a claim chart or claim mapping. It is a Patent Positioning & Technology Alignment Review prepared for confidential commercial discussion. Regis Healthcare has not commissioned, reviewed, approved or endorsed it.

Regis' privacy policy confirms that information may be obtained from and disclosed to care recipients, health practitioners, other health providers or facilities, associated providers, family members, supporters, attorneys, ambulance services, hospitals and government organisations. Privacy and governance source

Each participant may have a legitimate need for some information, but not necessarily the entire resident record. That is the precise operational problem addressed by CareBand's context-specific, attribute-level disclosure architecture.

Each of these pillars increases the number of systems, users and services that may legitimately request resident information. Integration and scale generally expand the surface across which disclosure decisions must be made consistently.

• Integrated care models increase cross-system information exchange.
• Workflow redesign changes who requests information and for what purpose.
• Scalable systems require policy to be enforced by software rather than local practice.
• AI and smart technologies introduce non-human requesters of resident information.

The public strategy material does not describe the technical mechanism by which access or disclosure decisions are made. Technical implementation not publicly disclosed.

A clinical management system in residential aged care typically contains or supports: Investor disclosure

CareBand's relevance is not that it duplicates the entire clinical management system. It is that CareBand may sit:

Regis' investment in a new clinical management platform creates a strategic point of relevance for CareBand. The CareBand patent position addresses how a request for resident information may be evaluated against the requester's role, authority, location, purpose and relationship before selected information is retrieved and released. If a clinical management platform or its integration layer performs this broader sequence, it becomes an important area for confidential technical comparison.

No view is expressed on the vendor or product selected. This review does not speculate about system identity where no reliable source confirms it.

Regis' home-care material describes assessment, individual needs and goals, care plans, dedicated care partners, clinical care, assistive technology, home modifications, restorative care, end-of-life care, dementia support, disability support and in-home palliative support. Care-service source Care-service source

1. 1

   Worker attends the client's home.

2. 2

   Client identity is confirmed through an authorised token, application or wearable.

3. 3

   Worker credentials and assignment are validated.

4. 4

   Purpose is identified: personal care, medication assistance, mobility support, meal preparation, clinical care or emergency response.

5. 5

   CareBand determines the relevant care category.

6. 6

   Only the required information is released.

7. 7

   Access expires when the visit or purpose ends.

8. 8

   The event is recorded.

Illustrative CareBand workflow — not a representation of current Regis or AlayaCare behaviour. Technical implementation not publicly disclosed.

Regis' privacy policy states that Regis seeks to: Privacy and governance source

• protect personal and health information
• ensure use and disclosure occurs only for legally permitted purposes
• regulate access, correction and deletion
• maintain confidentiality through storage and security
• control access through access and identity-management systems
• protect information when using service providers
• control where information is stored and who has access
• use privacy-by-default settings where possible
• manage consent withdrawal

Regis already describes the legal and operational obligation. CareBand potentially provides a protected technical method for enforcing that obligation at the moment information is requested.

Regis participated in the Aged Care Data Compare Plus project with the University of Queensland, CSIRO, the Digital Health Cooperative Research Centre, Queensland Cyber Infrastructure Foundation and AutumnCare. Investor disclosure

CareBand may operate before data reaches an analytics dashboard, determining whether information should be identifiable, pseudonymised, aggregated, suppressed or released in a more limited form.

CareBand supports de-identified aggregate outputs for occupancy, staffing, patient flow, resource allocation and other analytics.

The commercially relevant question is not whether Regis analyses data. It is whether the decision about what data may enter the analytic pathway is made by an explicit, auditable policy layer.

The public material does not disclose how identifiability, suppression or de-identification decisions are made technically. Technical implementation not publicly disclosed.

• Reducing what is released reduces what can be exposed in a breach.
• Attribute-level release limits the blast radius of a compromised account.
• Time-bounded access reduces standing privilege across a large workforce.
• Jurisdiction-aware policy supports control over where information may travel.
• Decision records support post-incident reconstruction of what was actually disclosed.

1. 1

   Identification of the individual.

2. 2

   Identification of the requester.

3. 3

   Verification that the requester is at or associated with the point of care.

4. 4

   Evaluation of contextual information.

5. 5

   Retrieval of a permitted subset of the individual's profile.

The commercially relevant question is not merely whether Regis identifies residents. It is whether a resident-identification event is connected to a context-based decision that determines which categories or individual attributes are released to the particular user or system.

Whether Regis' current or planned systems perform the second sequence cannot be established from public material. Technical implementation not publicly disclosed.

The distinguishing question is not whether a system has roles. It is whether the disclosure decision is recomputed from live context each time information is requested.

• Minimum necessary release is a stated privacy obligation, not merely a preference.
• Attribute-level control reduces breach exposure across a large distributed workforce.
• Suppression decisions are recordable, which supports governance and regulatory review.
• De-identified or aggregate release enables analytics without exposing identifiable data.

Record-level access asks who may open the file. Attribute-level determination asks what this person, for this purpose, at this moment, actually needs to see.

Technical implementation not publicly disclosed.

• The individual may be unable to give or withhold consent at the moment of request.
• A family member may or may not hold legal decision-making authority.
• Authority may be partial: medical decisions but not financial, or the reverse.
• Authority may change over time and must be revocable.
• Multiple family members may make conflicting requests.

1. 1

   A resident deteriorates and an emergency is declared.

2. 2

   Ambulance is called; responders arrive without a Regis account.

3. 3

   Resident identity is confirmed at the point of care.

4. 4

   Emergency purpose is asserted and recorded.

5. 5

   CareBand releases the emergency attribute set: allergies, medications, diagnoses, mobility, emergency contacts and advance care directive.

6. 6

   Non-essential attributes such as billing and full notes remain suppressed.

7. 7

   Access expires automatically when the transfer concludes.

8. 8

   The entire disclosure event is recorded for later review.

9. 9

   On return from hospital, discharge context is matched back to the resident record.

Illustrative CareBand workflow — not a representation of current Regis behaviour.

Regis' privacy policy contemplates disclosure permitted by law, including circumstances involving serious threats to life, health or safety. Privacy and governance source

Illustrative CareBand escalation model — not a representation of current Regis behaviour.

Regis publicly described system integration and automated extraction from the clinical management system as part of the Aged Care Data Compare Plus project. Investor disclosure

Standards such as FHIR describe how information may be exchanged. They do not decide whether a particular requester should receive a particular attribute for a particular purpose.

• An AI service cannot be relied upon to forget data it should never have received.
• Placing the decision before the model makes it reviewable and recordable.
• The same policy layer can govern human and machine requesters consistently.
• Suppression and pseudonymisation decisions become part of the governance record.

The governance question is not whether an AI service is trustworthy. It is whether an explicit, auditable policy determined what that service was permitted to see.

Illustrative CareBand output model — not a representation of current Regis reporting.

• Reduces the volume of identifiable data leaving the clinical system.
• Makes de-identification an explicit, recorded decision.
• Supports benchmarking and external research participation with lower privacy exposure.

Illustrative CareBand record model — not a representation of current Regis logging.

Regis publishes corporate governance material describing oversight, risk and compliance structures, and its privacy policy commits to controlling access and protecting information handled by service providers. Official Regis source Privacy and governance source

• Supports incident investigation and complaint response with concrete evidence.
• Supports regulatory and accreditation review.
• Supports breach assessment by establishing what was actually exposed.
• Difficult and expensive to retrofit once a clinical platform is in production.

Evidence of appropriate disclosure is itself an asset in a regulated environment — and it is produced as a by-product of making the decision explicitly in the first place.

• A clinical management system rollout is the natural moment to define a disclosure policy layer.
• Home care is already live and can host a contained pilot without touching residential systems.
• Governance and analytics benefits accrue from the same instrumentation, not a separate build.

Alignment scores are indicative assessments based on public material and are intended to guide discussion, not to assert technical equivalence.

Answers would inform a joint technical assessment of where CareBand's architecture could add control, evidence or exposure reduction — and equally, where Regis' existing systems already address the requirement.

• Reduction in identifiable attributes released per task
• Proportion of disclosures with a recorded purpose and basis
• Time to revoke access across devices and integrations
• Completeness of evidence available for an incident review
• No measurable increase in time to complete care tasks

• No requirement to replace existing systems or vendors.
• Staged commitment: each step informs the next.
• Evidence-led: pilot outcomes govern any expansion.
• Commercially constructive, not adversarial.

Nothing in this document constitutes an offer, a legal opinion or an assertion regarding Regis' technology implementation.

Sources are classified as official Regis sources, investor disclosures, privacy and governance sources, care-service sources or public research initiatives. Classification indicates the nature of the record, not the strength of any inference drawn from it.

Technical implementation not publicly disclosed for any item classified as requiring verification.

• Regis operates at significant scale across residential and home care, with a large and distributed workforce.
• Regis is actively investing in digital transformation, including a new residential clinical management system and a deployed home-care platform.
• Regis publicly states privacy obligations that describe purpose-limited disclosure, access and identity management, consent withdrawal and de-identification.
• Regis has publicly participated in research involving automated extraction from clinical systems and real-time quality-indicator dashboards.
• Regis' operating environment involves many distinct requester roles, relationships, purposes and settings.

Regis already describes, as an organisational obligation, the decisions the CareBand architecture is designed to make technically at the moment information is requested. The commercial question is whether making those decisions explicit, enforced and recorded adds control, evidence and exposure reduction at Regis' scale.

Confidential. Prepared for Regis Healthcare Limited. Australian Provisional Patent Application No. 2025905426. Prepared from publicly available material only.

This document is a commercial patent-positioning and technology-alignment review based on publicly available material. It is not a legal opinion, infringement allegation, freedom-to-operate opinion or assertion that Regis Healthcare implements every element of any patent claim. Technical implementation details not disclosed publicly require verification through confidential discussions and appropriate legal and technical review.