Inclusify Privacy Policy

1. Who we are

We are Inclusify Software, based in Australia. We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Notifiable Data Breaches (NDB) scheme under Part IIIC of that Act.

We operate the Service within Australia. The Service and the data processed through it are hosted and handled in Australia, and in some cases outside Australia, as described in section 8 of this policy.

2. This policy applies to you

This policy applies to:

• providers and prospective providers that use the Service, including their personnel;
• individuals who are invited into a provider's tenant as authorised personnel (for example administrators, service managers, team leaders, support workers, roster coordinators, finance officers, quality and clinical managers, and auditors);
• individuals whose personal information is entered or uploaded into the Platform by a provider (for example participants, staff, carers, families, and contacts) (Recorded Individuals).

For Recorded Individuals, the provider that controls the data is responsible for the data and for the consent or other lawful basis. Inclusify processes that data as a service provider and processor on the provider's instructions. Providers are required to enter only data they are lawfully authorised to enter.

3. What we collect

3.1 Account and identity information: name (first and last), work email address, role or position, membership, role, duty pack, scope, delegation, and expiry data, password authentication handled through a third-party identity provider, security keys or one-time codes, and any information you choose to provide to support.

3.2 Provider setup and onboarding information: legal name, trading name, provider type, NDIS registration status or intent, ABN or ACN where you provide it, business contact details, default timezone, commercial arrangement (trial or subscription), and plan (Core, Pro, Enterprise, or free).

3.3 Authorised-personnel and workforce information: information entered into provider staff, workforce, roster, compliance, and payroll-related records where a provider enters it, including qualifications, training, duty, and compliance records.

3.4 Participant and service delivery information: participant records, service details, plans and entitlements, service agreements, shifts, timesheets, invoices, claims, incidents, complaints, quality and safeguarding, clinical governance, risk, and documents, in each case only where a provider enters or uploads it.

3.5 Usage and device information: automatically collected information such as browser type, operating system, device identifiers, IP address, pages and functions accessed, session and engagement data, error logs, and performance metrics, for security, integrity, and improvement.

3.6 Communications: correspondence with support, survey responses where you choose to provide them, and notification and interaction logs (including in-app notifications) generated as part of the Service.

3.7 Payment information: in most cases payments are processed through a secure payment provider. We may collect the last four digits, expiry, a tokenised reference, and billing history for invoicing, re-crediting, and handling disputed payments. We do not store full card numbers on our servers.

3.8 Sensitive information: we do not intentionally collect sensitive information other than where it is needed to provide the Service as requested by a provider (for example disability-related, health, incident, or safety data entered into provider workflows).

4. Sensitive information

4.1 Where a provider enters or uploads sensitive information (including health information, disability information, photos, or information about a participant), that information will be handled only under the provider's authority and only for the purposes for which the provider provided it, and for the security of the Service.

4.2 We rely on the provider to have the relevant consent or lawful basis for that sensitive information, and we will not use it for unrelated marketing or profiling.

5. How we collect information

We collect personal information:

• directly from the provider or user (in the app, on forms, through onboarding);
• automatically as you use the Service (logs and analytics);
• from third parties, including the identity provider and providers of cloud infrastructure, to deliver and secure the Service;
• where you or your provider chooses to connect or share information with us.

If we identify that information has been collected without a lawful basis, we will notify the relevant provider and co-operate with its removal or return.

6. How we use information

We use personal information to:

• operate, deliver, secure, and maintain the Service;
• authenticate users and manage identity and authority;
• manage accounts, memberships, entitlements (for example trial and subscription states), and plan configurations;
• produce audit, outbox, and evidence records that support platform data flowing in the workflow;
• provide support and respond to inquiries and incidents;
• prevent, detect, and respond to fraud, security, and unauthorised access;
• manage billing, payment, and compliance with our legal obligations;
• send essential service and notification messages (for example trial expiry and security events), and, where we have consent, optional product updates;
• comply with our legal and regulatory obligations, including record-keeping and, where applicable, the NDB scheme;
• improve and develop features and analytics, by using aggregated or de-identified information where possible.

We do not sell your personal information. We do not use participant records for any purpose other than providing, securing, and improving the Service, except where required by law.

7. Legal bases

We process personal information under Australian law, including:

• our contract with the provider, including onboarding and subscription requirements;
• the provider's consent and lawful authority where you enter or upload data;
• our legal obligations (for example under the NDIS Act 2013 (Cth), the NDIS (Quality and Safeguards) legislation, workplace health and safety laws, records and corporate law);
• our legitimate interests in providing a secure, reliable, and commercial platform, where your rights do not otherwise override those interests.

8. Storage and disclosure

8.1 We do not sell, rent, or trade personal information.

8.2 We may disclose personal information to:

• sub-processors and trusted service providers that support the Service, including cloud hosting and infrastructure (the platform runs on infrastructure in the Australia region, ap-southeast-2), and the identity provider used for authentication. These providers are bound by confidentiality and security obligations;
• professional advisers (legal, financial, audit) and insurers, on a confidential basis;
• regulators and other parties with lawful authority, in response to lawful requests, including the NDIS Quality and Safeguards Commission and the Office of the Australian Information Commissioner (OAIC);
• a prospective purchaser or merged entity in connection with a sale, merger, or restructure, subject to confidentiality obligations consistent with this policy;
• other parties where you request or authorise us to.

8.3 Cross-border disclosure: some of our sub-processors process data from, or provide services from, locations outside Australia. Where we disclose personal information to an overseas recipient, we take reasonable steps to comply with APP 8, including requiring the recipient to protect the information to standards not less than those required by the Act and to handle it only for the permitted purposes.

9. Cookies and similar technologies

9.1 We use session cookies, local storage, and similar technologies essential to sign-in, security, and the Service. We do not use advertising cookies.

9.2 We use analytics tools to improve the Service. Where possible, analytics data is aggregated or de-identified.

9.3 Essential cookies are required for the Service to operate. You can configure your browser, but the Service may require essential cookies to work.

10. Security

10.1 We take reasonable steps to protect personal information, including:

• identity and access management with multi-factor authentication where required;
• encryption in transit (TLS) and at rest;
• least-privilege database and worker access controls using row-level security;
• tenant isolation enforced at the trusted API;
• audit logging of protected state changes;
• transport and system monitoring, and incident response;
• access control reviews and least-privilege grants.

10.2 You are responsible for keeping your login details, devices, and authorised access current, and for security practices for the devices and accounts used to reach the Service.

10.3 No security system is perfect. Where we detect an eligible data breach we will notify the OAIC and affected individuals as required under the NDB scheme.

11. Data retention

11.1 We retain personal information only for as long as we need it to provide the Service, to satisfy our record-keeping obligations, to support workflow evidence and audit, and to comply with law and any legal hold. Provider and participant records are subject to the provider's document and record-keeping obligations and to applicable retention requirements.

11.2 When an account closes, we will delete or anonymise data in line with the Privacy Policy and our retention schedule, subject to contractual, legal and audit obligations, and after providing a reasonable opportunity to export data through the Service.

12. Access, correction, deletion and export

12.1 Under the APPs you may, in appropriate circumstances:

• access (APP 12) and seek correction (APP 13) of your personal information;
• request an explanation of what we hold;
• request deletion of data where there is no lawful basis to keep it (and where the law otherwise requires);
• request a copy of the data provided by you or the provider, through export functions in the Service, subject to legitimate retention and legal obligations.

12.2 We will respond within the time required by law (including 30 calendar days, generally). We take reasonable steps to verify your identity before responding.

12.3 For Recorded Individuals whose data was entered by a provider: requests should first be made to the provider, who controls the data. If we receive a request, we will forward it to the relevant provider and co-operate on a reasonable basis.

12.4 We may charge a reasonable fee for a disproportionate or repeated request, where permitted by law.

13. Automated decision-making

We do not make decisions that have a significant legal or similar effect based solely on automated processing, except:

• where it is necessary to enter into or perform the contract (for example access state controls, full, continuity, read-only, none) that follow directly from the subscription and trial state of the account; and
• where the rules are deterministic, understandable, documented, and reviewable, and where a human review is available on request.

14. Direct marketing

We do not send marketing communications except where we have a lawful basis or consent, and every marketing message includes a simple opt-out. You can opt out at any time.

15. Complaints and your rights

15.1 To exercise your rights, or to make a privacy complaint, contact our Privacy Officer at privacy@inclusify.au. We will acknowledge within 7 days and respond substantively within a reasonable time, generally 30 days.

15.2 If you are not satisfied with our response, you may complain to the OAIC (oaic.gov.au) or to your state or territory privacy commissioner or ombudsman, as applicable.

16. Notifiable data breaches

We comply with the Notifiable Data Breaches scheme. Where there are reasonable grounds to believe a breach is likely to result in serious harm, we notify the OAIC and affected individuals as required, and take reasonable steps to reduce the risk of harm.

17. Changes to this policy

We may update this policy from time to time. The current version is published on the Platform with an effective date. We will notify you of material changes through the Platform or by email in advance of the effective date. Continued use after the effective date constitutes acceptance.

18. Contact

Questions about this policy should be directed to privacy@inclusify.au or to the platform's support channel. If you are a provider, please also review the Inclusify Terms and Conditions.