PRIVACY POLICY

1. INTRODUCTION

This privacy policy explains how Support For Everyone Pty Ltd (ABN 50 686 098 448) (we, us or our) collects, holds, uses and discloses personal information.

We are a provider registered under the National Disability Insurance Scheme (NDIS). We provide disability supports to NDIS participants through our own employees. We also own and operate the Support For Everyone App, including its website and mobile application (Platform), through which supports are requested, booked, recorded and paid for.

This policy applies to participants and their representatives, support coordinators, plan managers, our support workers, people who apply to work with us, and anyone else who deals with us or uses the Platform.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) it contains. We also handle participants’ information in line with the NDIS Practice Standards and the NDIS Code of Conduct.

If you would like this policy in Easy Read or another format, or would like it explained, please contact us using the details in clause 17.

We may update this policy from time to time by publishing a new version on the Platform. This version was last updated on 26 October 2026.

2. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you deal with us, and may include the following.

Participants and their representatives

(a)name, address, phone number, email address, date of birth and preferred way of being contacted;

(b)NDIS number, plan details, how the plan is managed, funding information and goals;

(c)health and disability information, including support needs, medical conditions, medications, allergies, risk assessments and behaviour support plans;

(d)records of the supports we provide, including bookings, shift notes, progress notes and incident reports;

(e)cultural background, religious beliefs, language and communication needs, where you share them to help us provide culturally safe and accessible supports;

(f)details of representatives, emergency contacts, support coordinators, plan managers and health professionals;

(g)payment information, although our payment processor handles card details and we do not store full card numbers; and

(h)photographs and recordings, but only with consent.

Support workers and job applicants

(i)name, contact details, emergency contacts, date of birth, identity documents and information about your right to work in Australia;

(j)qualifications, training, work history, references, interview notes and the recordings, transcripts and scores of any AI video interview;

(k)NDIS worker screening clearance details, and any other screening outcome needed for the role, which may include criminal record information;

(l)tax file number, superannuation fund, bank account details and pay records;

(m)the location recorded by the Platform when you check in to and out of a booking; and

(n)health information relevant to your work, such as an injury or a condition that affects how you can work safely, where you provide it or the law requires it.

Everyone

(o)messages, reviews and other material you submit through the Platform;

(p)information about your device and how you use the Platform, including IP address, device type, browser and app data; and

(q)any other information you give us, or that we need to provide our services or to meet our legal obligations.

3. CHILDREN AND PEOPLE WHO NEED SUPPORT TO DECIDE

Some participants are under 18, and some adults need support to make decisions about their personal information. We assess a person’s capacity to consent case by case, in line with the APP guidelines published by the Office of the Australian Information Commissioner (OAIC). Where it is not practicable to assess capacity individually, we generally treat a person aged 15 or over as able to consent, unless there are reasonable grounds to think otherwise.

Where a person cannot consent, we seek consent from someone with legal authority to act for them, such as a parent, guardian or other representative. We still involve the participant as much as possible and respect their will and preferences.

4. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information lawfully and fairly and, wherever possible, directly from you. This includes when you register for or use the Platform, request or manage a booking, sign a service agreement or consent form, apply for a job (including through an AI video interview), communicate with us, or visit our website.

We also collect information from other people where you have consented or the law allows it. Examples include a participant’s representative, support coordinator or plan manager, the National Disability Insurance Agency (NDIA), health professionals and other providers, referees, worker screening units and our payment processor.

The Platform collects some information automatically, such as device information and the location recorded when a support worker checks in to or out of a booking. The Platform may use cookies so that it works properly, for example to keep you signed in. You can disable cookies in your browser, although some features may then not work.

If you give us personal information about someone else, you must have their consent or other lawful authority to do so. Representatives, support coordinators and plan managers should only give us information within the scope of their authority.

5. WHY WE USE PERSONAL INFORMATION

We use personal information to:

(a)assess, plan, deliver, record and review supports;

(b)operate the Platform, including matching participants with suitable support workers and managing bookings;

(c)claim payment from the NDIA, invoice plan managers and participants, and process payments;

(d)keep participants and workers safe, including through risk assessments, incident management and reporting, and complaints management;

(e)recruit, screen, engage, roster, supervise and pay our support workers, and check and display on the Platform each support worker’s screening clearance, whether a banning order is in force against them, and their credentials and qualifications;

(f)communicate with you, including service messages and reminders;

(g)meet our legal obligations, including under NDIS, work health and safety, tax and employment laws, and take part in audits by NDIS approved quality auditors; and

(h)improve our services and the Platform.

We may also use personal information for a related purpose you would reasonably expect, to lessen or prevent a serious threat to a person’s life, health or safety, or where you consent or the law requires or allows it.

6. AUTOMATED DECISIONS

The Platform uses computer programs to make, or to help us make, some decisions that could significantly affect a person’s access to supports or to work. The kinds of decisions are:

(a)matching, where the Platform lists and ranks support workers for a participant using the participant’s support needs, interests, preferred languages, gender preference, location and past feedback, and the worker’s services, experience, interests, languages, gender, location and ratings. Matching does not hide any support worker who is able to take bookings, and the participant or their representative always chooses the worker;

(b)booking rules, where the Platform automatically refuses a booking, or stops a support worker accepting or starting one, if the worker’s screening clearance, blue card, police check, first aid, CPR or other required training or credential is not current or not verified, if the booking would breach limits on hours, rest breaks between shifts or minimum shift length, if the support cannot be provided at that time, if the price would be above the NDIS price limit or the booking falls after the participant’s plan ends, or if the booking would take the participant’s spending above 90% of the funding available in their plan. The Platform also cancels a booking request that the support worker has not answered within 48 hours, or close to its start time, and tells the participant;

(c)interview assessment, where an AI tool scores an applicant’s recorded interview answers against the requirements of the role. An applicant who scores 70 or more passes the interview step automatically, unless the assessment flags a concern. If a score is within 5 points of 50 or 70, the answers are scored a second time, and a member of our staff reviews the interview if the two results differ. A member of our staff reviews the interview if the score is between 50 and 69 or the assessment flags a concern. An applicant who scores under 50 is declined only after a member of our staff confirms that decision;

(d)worker checks, where the Platform checks the NDIS Commission’s register of banning orders against each support worker every day and records a clear result automatically, and an AI tool reads a support worker’s national police certificate and marks it as verified if the name matches, it shows no disclosable outcomes and it was issued in the last 3 years. A possible match on the register, and any police certificate that does not meet those conditions, goes to a member of our staff, and these checks never reject anyone on their own; and

(e)going live, where the Platform makes a support worker’s account live automatically once every required step is complete and the worker has passed the interview step. Before that can happen, a member of our staff verifies each worker’s screening clearance, blue card, first aid, CPR and orientation certificates and checks them on the official registers, and a member of our staff decides personally if the Platform flags anything, such as a possible banning order match or an interview that needs review.

The Platform makes booking rule decisions, and records worker check results, on its own. It also decides on its own that an applicant who scores 70 or more, with no concern flagged, has passed the interview step, and that a support worker whose checks a member of our staff has verified can go live. Matching helps a participant to choose a worker, and a member of our staff makes every other decision about an applicant.

The personal information these programs use includes participants’ support needs, interests, preferences, location, plan funding and spending, and feedback on support workers; workers’ skills, qualifications, screening status, police certificates, banning register results, availability, location, hours worked and ratings; and applicants’ interview responses.

You can ask us to have a person review any decision made or assisted by the Platform by contacting us using the details in clause 17.

7. AI VIDEO INTERVIEWS

We may invite job applicants to complete a recorded video interview. Your spoken answers are converted into text by the speech recognition built into your web browser (in Google Chrome, Google provides this service), or you can type your answers. Claude, an AI tool provided by Anthropic, then scores the answers against the requirements of the role, as clause 6 explains. The AI tools never reject an application on their own, and a member of our staff verifies every support worker’s checks before they can take bookings.

We will ask for your consent before the interview starts. The AI tools do not use facial analysis or analyse your tone of voice, and we do not use the recording to identify you by your face or voice. Your browser’s speech recognition only converts your spoken answers into text, and we do not send your recording to any speech-to-text service. We delete interview recordings 90 days after we decide the application.

You may ask for an alternative to the AI video interview, such as an interview with a member of our staff, or for an adjustment to suit your needs. Asking for an alternative will not count against your application.

8. WHO WE DISCLOSE PERSONAL INFORMATION TO

We disclose personal information only as needed for the purposes in clause 5, or as the law requires or allows. Depending on the circumstances, we may disclose it to:

(a)our support workers who deliver a participant’s supports, limited to what they need to deliver them safely;

(b)a participant’s representatives, and, with consent, their support coordinator, plan manager, health professionals and other providers;

(c)the NDIA, for claims and, with consent, for plan reviews;

(d)the NDIS Quality and Safeguards Commission, including for reportable incidents, complaints, worker screening and compliance;

(e)NDIS approved quality auditors conducting audits of our services;

(f)service providers who help us run our business and the Platform, such as hosting providers and software developers, our payment processor, communications and payroll providers, and our AI interview providers;

(g)our professional advisers, auditors and insurers;

(h)government agencies such as the Australian Taxation Office, and superannuation funds, for our workers; and

(i)anyone else where you consent, in an emergency, or as the law requires or allows, for example under a court order or to report suspected criminal activity.

On the Platform, participants, representatives, support coordinators and plan managers can see support worker profiles, which may include a worker’s name, photograph, skills, languages and screening and credential status. Support workers can see the information about a participant that they need for a booking.

We do not sell personal information. If our business is sold or restructured, we may transfer personal information to the new owner, who must handle it in line with the Privacy Act.

9. STORAGE, RETENTION AND OVERSEAS DISCLOSURE

We store personal information electronically on the Platform and in our other systems, which service providers host for us. The Platform’s database and file storage are hosted in Sydney, Australia, and the servers that run the Platform are in the United States.

Some of our service providers store or access personal information outside Australia, in the United States. They include our hosting providers, our payment processor (Stripe), our email provider (Resend) and our AI interview provider (Anthropic). If you use Google Chrome for an AI video interview, Chrome sends your spoken answers to Google to convert them into text. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs.

We keep personal information for as long as we need it and as the law requires, including under NDIS, employment and tax record keeping laws. We then destroy it or de-identify it.

10. SENSITIVE INFORMATION

Some of the information we collect is sensitive information under the Privacy Act. This includes health and disability information, criminal record information from worker screening, and information about racial or ethnic origin or religious beliefs where you share it to help us provide culturally safe supports.

We collect sensitive information only with consent, unless the law allows otherwise. We use and disclose it only for the purpose for which it was collected, or for a directly related purpose you would reasonably expect, or as the law allows.

Participants and their representatives record their consents in our participant consent form, which we review with them at least every 12 months and when their plan or supports change. You can change or withdraw a consent at any time by contacting us. If you withdraw a consent that we need to deliver supports safely, we will explain how that affects the supports we can provide.

11. MARKETING

We may send you information about our services. We do this in line with the Spam Act 2003 (Cth), and we do not use sensitive information, including health information, for marketing. You can opt out at any time by using the unsubscribe link in our messages or by contacting us.

12. SECURITY AND DATA BREACHES

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include access controls on the Platform, so that each person sees only the information they need, and confidentiality obligations for our staff and service providers.

If a data breach is likely to result in serious harm to anyone, we will notify the people affected and the OAIC as the Privacy Act requires.

13. DE-IDENTIFIED INFORMATION

We may use de-identified information, from which no one can reasonably be identified, to understand and improve our services. We will not try to re-identify it.

14. ACCESS AND CORRECTION

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us. We may need to verify your identity first. We will respond within a reasonable time, usually within 30 days.

There is no charge for making a request or for correcting your information. If we refuse a request, we will tell you why in writing and how you can complain.

15. EMPLOYEE RECORDS

Some records about our current and former employees are exempt from the Privacy Act. We still handle employee information carefully and in line with this policy where practicable. We handle tax file numbers in line with the Privacy (Tax File Number) Rule 2015.

16. COMPLAINTS

If you have a concern about how we have handled your personal information, please contact us using the details in clause 17. We will acknowledge your complaint, investigate it and respond within 30 days.

If you are not satisfied with our response, you can complain to the OAIC (phone 1300 363 992 or www.oaic.gov.au). You can also raise concerns about the quality or safety of NDIS supports with the NDIS Quality and Safeguards Commission (phone 1800 035 544 or www.ndiscommission.gov.au).

17. CONTACT US

For questions about this policy, or to access or correct your information or make a complaint, please contact our Privacy Officer by email at admin@supportforeveryone.com.au or by phone on 0409 029 922.