Privacy Policy

How NDISNotes collects, uses, and protects your information

Last updated: March 2026

1. Overview

NDISNotes ("we", "us", "our") (ABN 23 711 017 200) is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the NDIS Act 2013, and the NDIS Practice Standards relating to information management and participant confidentiality. This policy explains how we handle your personal information.

2. Australian Data Residency (NDIS Compliance)

All participant data — including profiles, progress notes, incident reports, and uploaded photos — is stored exclusively on Australian-based servers in Sydney (AWS ap-southeast-2 region). Participant data never leaves Australia. This complies with NDIS Practice Standards for the secure storage of participant information and supports providers' obligations under the NDIS Code of Conduct. Database backups and file storage remain within the Sydney region. Encrypted backups are retained in the same Australian region.

3. AI Processing & No Training on Your Data

AI-assisted note drafting is performed by Anthropic's Claude API. Note text is sent transiently for generation and is NOT used to train, fine-tune, or improve any AI model. We have explicitly disabled all AI data training and data-sharing toggles for this project. Anthropic does not retain prompts or completions for model training under their zero-data-retention commitments to API customers. We strongly recommend you do NOT enter participant identifying information (full names, NDIS numbers, addresses) into AI-assisted fields — use initials or participant codes instead.

4. What We Collect

• Account information: name, email address, organisation name, ABN
• Support documentation: progress notes, incident reports, photos attached to reports
• Participant information: name, NDIS number, date of birth, disability information
• Usage data: login timestamps, features used, report counts (no content is accessed)
• Payment information: handled entirely by Stripe. NDISNotes never stores credit card details.

5. How We Use Your Information

• To provide the NDISNotes documentation service
• To generate AI-assisted notes via the Anthropic Claude API (note content is processed transiently and never used for AI training)
• To send transactional emails via Resend
• To process payments via Stripe
• To generate PDF documents client-side in your browser

6. Third-Party Services

7. Data Controller and Processor

NDISNotes stores participant data on behalf of the support worker or registered NDIS provider (the data controller). NDISNotes acts as a data processor under the Australian Privacy Act 1988 (Cth). Users are responsible for ensuring they have a lawful basis for collecting and storing participant information, and for complying with their own obligations under the NDIS Act 2013 and NDIS Practice Standards regarding the retention of participant records.

8. Account Deletion and User Responsibilities

• Users may initiate account deletion from Settings → Account at any time
• Upon deletion request, account access is immediately restricted and all data is permanently removed after 30 days
• Users are responsible for downloading or exporting any reports they need before deleting their account
• Account deletion does not absolve users of their NDIS record-keeping obligations — users must retain participant records for the required 7-year period independently of NDISNotes
• This action cannot be undone once confirmed

9. Data Retention

• Progress notes and incident reports: retained for a minimum of 7 years from the date of creation (NDIS record-keeping requirement)
• Participant profiles: retained for 7 years from last active date
• Account data: retained for 3 years after account closure or as required by law
• Uploaded photos: retained for the same period as the associated report

10. Your Rights

Under the Privacy Act 1988 you have the right to: access your personal information, correct inaccurate information, request deletion (subject to NDIS 7-year retention obligations), and complain to the Office of the Australian Information Commissioner (OAIC).

11. Contact

Privacy enquiries: info@ndisnotes.com.au General enquiries: info@ndisnotes.com.au Office of the Australian Information Commissioner: www.oaic.gov.au