Skip to main content
DundalooToolkit

Before you publish this

This is a working draft, not legal advice. Because this service can hold health and disability information, and information about participants who are not the account holder (including potentially children), have it reviewed by a privacy lawyer against the Privacy Act 1988 (Cth), the Australian Privacy Principles, and any NDIS Practice Standards or state-based disability service requirements that apply before it goes live.

Privacy Policy

Last updated: [add date before publishing]

1. Who this policy covers

This policy explains how [Organisation legal name] ("we", "us") handles personal information collected through this website ("the Service"). It applies to:

  • People who create an individual or family account.
  • Organisations (such as NDIS providers, schools or clinics) and their staff who create an account.
  • Participants - the people receiving support - whose profiles are created and managed by an individual or an organisation account on their behalf. A participant is not required to have their own login.
  • Anyone using a free tool, like the Communication Board, that doesn't require an account.

2. Tools that don't need an account

Most tools on this site - including the Visual Communication Board - work entirely on your own device. Favourites, custom pictures and settings are stored locally in your browser, never sent to our servers, and we have no way to see or recover them.

3. Information we collect for accounts

For account holders (individuals, families, and organisation staff), we collect:

  • Name and email address.
  • Account type (individual/family or organisation) and, for organisations, the organisation's name and ABN.
  • A securely hashed password (we never store or can see your actual password).

For participant profiles created by an account holder, we collect only what is entered into the tool: typically a name, and optionally a date of birth and notes. Some tools (for example behaviour tracking or social stories) will store further information specific to that tool, tied to the participant profile it was entered under.

Some of this information - health, disability, and behavioural information - is "sensitive information" under the Privacy Act 1988 and is handled with extra care, as described below.

4. Who can see participant information

Access is restricted at the database level, not just in the app, so it cannot be bypassed by a bug in a single tool:

  • A participant profile created by an individual/family account is visible only to that account holder.
  • A participant profile created by an organisation is visible only to staff who belong to that organisation.
  • Organisations cannot see another organisation's participants or staff.

5. Consent for participant profiles

Anyone creating a profile for another person confirms, at sign-up, that they are authorised to do so - for example as a parent, guardian, or support coordinator, or under an organisation's existing service agreement or consent process with the participant. Organisations are responsible for obtaining and recording any consent required by their own obligations (including NDIS Practice Standards) before entering a participant's information.

6. Where information is stored and how it's protected

  • Account and participant data is stored with Supabase, our database provider, using industry-standard encryption in transit and at rest.
  • Every table enforces row-level security so a query can only ever return the rows a signed-in user is actually authorised to see.
  • We do not sell personal information, and we do not use participant information for advertising.
  • We do not use participant or account data to train third-party AI models.

7. Data retention and deletion

We keep account and participant information for as long as the account is active. You can request deletion of an account, organisation, or participant profile at any time by contacting us - see below. [Add your specific retention periods here, especially any minimum periods required by NDIS record-keeping obligations, before publishing.]

8. Your rights

Under the Australian Privacy Principles, you can generally request access to, and correction of, personal information we hold about you or a participant you manage. Contact us using the details below to make a request.

9. Cookies and local storage

We use essential cookies to keep you signed in securely. Accessibility preferences (text size, contrast, font) and no-account tool data (like communication board favourites) are stored only in your browser's local storage, on your own device.

10. Contact us

For any privacy question, or to request access to, correction of, or deletion of your information: [add contact email/postal address before publishing]. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

← Back home · Terms of Use