Privacy Policy for Ausvanta Platform Effective Date: 2 July 2026 Last Updated: 1 October 2026
Introduction Neural Networks Group Pty Ltd (ACN 691 933 632, ABN 53 691 933 632), which provides Ausvanta ("Ausvanta", "we", "us", "our") is committed to protecting the privacy and security of personal information entrusted to us. This Privacy Statement explains how we collect, use, disclose, and manage personal information in connection with the Ausvanta NDIS Provider Management Platform ("the Platform"). Ausvanta is a software provider, delivering the Platform to NDIS registered providers and disability support organisations across Australia. We recognise that the personal information we handle includes sensitive data relating to NDIS participants, support workers, and organisational staff. This Privacy Statement is designed to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. We are also committed to meeting the privacy requirements under the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act) and the NDIS Practice Standards.
Types of Personal Information We Collect 2.1 Information We Collect From Organisation Administrators and Staff When organisations register to use the Platform and their staff use our services, we collect: Identity and Contact Information: ⦁ Full name ⦁ Email address ⦁ Phone number ⦁ Position/title ⦁ Business address Employment and Professional Information: ⦁ Employment status and role ⦁ Qualifications and certifications ⦁ NDIS Worker Screening Clearance number and expiry date ⦁ Police check details and expiry date ⦁ First aid certificate details ⦁ Working with Children Check details (where applicable) Account Information: ⦁ Username and encrypted password ⦁ Login timestamps and session data ⦁ IP addresses and device information ⦁ User preferences and settings 2.2 Information We Collect About NDIS Participants Organisations using the Platform may enter information about NDIS participants receiving support services. This includes: Personal Details: ⦁ Full name ⦁ Date of birth ⦁ NDIS Number ⦁ Residential address and service locations ⦁ Gender ⦁ Cultural and linguistic background (optional) Support Information: ⦁ NDIS Support Plan details and documents ⦁ Care plans and goals ⦁ Service agreements ⦁ Funding management type (self-managed, plan-managed, NDIA-managed) Health and Disability Information (Sensitive Information): ⦁ Disability type and support needs ⦁ Health conditions and medical information ⦁ Medication details ⦁ Behavioural support requirements ⦁ Restrictive practices information (where applicable) Emergency and Contact Information: ⦁ Emergency contact names and phone numbers ⦁ Family member/carer contact details ⦁ Nominee or guardian details Service Delivery Records: ⦁ Shift records and attendance ⦁ Progress notes and observations ⦁ Incident reports ⦁ Photos and evidence of service delivery 2.3 Sensitive Information We collect sensitive information only with consent and where it is reasonably necessary for our functions or activities. Sensitive information may include: ⦁ Health information about participants and workers ⦁ Disability information ⦁ Criminal history (Worker Screening Checks, Police Checks) ⦁ Location information (GPS coordinates captured at clock-in and clock-out to evidence shift attendance) ⦁ Racial or ethnic origin (for cultural support planning) 2.4 Information We Collect Automatically When you use the Platform, we automatically collect: ⦁ Device and browser information ⦁ IP address and geolocation data ⦁ Access logs and timestamps ⦁ Pages viewed and features used ⦁ Session duration and activity patterns
How We Collect Personal Information 3.1 Direct Collection We collect personal information directly from: ⦁ Organisation administrators during registration and onboarding ⦁ Staff members when they create their profiles ⦁ Support Workers when they clock in/out and complete shift activities ⦁ Participants (or their representatives) through service delivery processes ⦁ Users who contact us for support or enquiries 3.2 Indirect Collection We may receive personal information from: ⦁ Authorised representatives or nominees acting on behalf of participants ⦁ Other organisations when a user transfers between providers ⦁ Third-party integrations (Xero, MYOB) when authorised ⦁ Publicly available sources (where permitted) ⦁ Law enforcement or regulatory bodies when required by law 3.3 Collection Notices At or before the time of collection, we will take reasonable steps to provide a collection notice that explains: ⦁ Our identity and contact details ⦁ The purposes of collection ⦁ How the information will be used and disclosed ⦁ Whether disclosure is required or authorised by law ⦁ How to access and correct the information
Purposes of Collection and Use We collect and use personal information for the following purposes: 4.1 Platform Service Delivery ⦁ Creating and managing user accounts ⦁ Enabling access to Platform features ⦁ Processing time tracking and shift management ⦁ Generating billing and payroll exports ⦁ Providing technical support and training 4.2 Compliance and Regulatory Requirements ⦁ Verifying NDIS Worker Screening Clearances ⦁ Maintaining certification expiry tracking ⦁ Recording and reporting incidents to the NDIS Commission ⦁ Generating compliance reports and audit trails ⦁ Responding to regulatory enquiries and audits 4.3 Service Delivery to NDIS Participants ⦁ Managing participant profiles and care plans ⦁ Scheduling and coordinating support services ⦁ Recording service delivery and progress ⦁ Managing emergency contacts and safety information ⦁ Supporting quality and safeguarding activities 4.4 Communication ⦁ Sending service-related notifications ⦁ Communicating about Platform updates and changes ⦁ Responding to enquiries and support requests ⦁ Sending marketing communications (with consent) 4.5 Security and Fraud Prevention ⦁ Authenticating users and preventing unauthorised access ⦁ Detecting and investigating suspicious activity ⦁ Maintaining audit logs for security purposes ⦁ Responding to data breaches and incidents 4.6 Business Improvement ⦁ Analysing Platform usage and performance ⦁ Developing new features and improvements ⦁ Conducting research and reporting (de-identified data only) ⦁ Training and quality assurance activities
Disclosure of Personal Information We may disclose personal information to: 5.1 Authorised Recipients Within Your Organisation ⦁ Staff members with appropriate role-based access ⦁ Managers and coordinators responsible for service delivery ⦁ Compliance officers for audit and reporting purposes ⦁ Finance staff for billing and payroll processing 5.2 Third-Party Service Providers We engage third-party service providers to assist with our operations, including: ⦁ Cloud hosting and infrastructure providers ⦁ Payment processing services ⦁ Accounting software providers (Xero, MYOB) when you authorise integration ⦁ Email and communication services ⦁ Analytics and monitoring tools These providers are bound by contractual obligations to protect personal information and use it only for the purposes we specify. 5.3 Regulatory Bodies and Law Enforcement We may disclose personal information when: ⦁ Required or authorised by law ⦁ Requested by the NDIS Quality and Safeguards Commission ⦁ Responding to valid legal processes (subpoenas, court orders) ⦁ Reporting notifiable data breaches to the OAIC ⦁ Preventing or investigating fraud or criminal activity 5.4 Related to Business Transactions In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to confidentiality obligations. 5.5 With Your Consent We may disclose personal information for other purposes with your express consent.
Cross-Border Disclosure Platform and customer data: the Ausvanta Platform, and the personal information our customers enter into it (including participant, worker and service delivery records), is hosted only in Australia, on Amazon Web Services in the Sydney region (ap-southeast-2). The Platform's AI-assisted features (section 13) run in Australia on our own infrastructure: Platform data is not sent to third-party AI providers and is not processed by AI services outside Australia. Apart from email delivery, described below, we do not store or process Platform data outside Australia. Our public website, ausvanta.com.au, is also hosted on Amazon Web Services. Email: emails sent by the Platform and by our public website (such as enquiry and demo-request notifications) are delivered through SMTP2GO, an email delivery service. SMTP2GO handles the email addresses and the content of those messages, and may process them outside Australia. Website services: some services we use for our public website are provided by companies that store or process information outside Australia. They handle website usage data, not Platform or customer data: ⦁ Google (Google Analytics and the Google tag, loaded through Google Site Kit) — website usage data; may be processed in the United States ⦁ Microsoft (Microsoft Clarity) — website session recordings and usage data; may be processed in the United States ⦁ AddToAny — the social sharing buttons on our website; may be processed in the United States Before disclosing personal information to an overseas recipient, we will: ⦁ Obtain your consent where required by APP 8 ⦁ Ensure the overseas recipient is bound by equivalent privacy protections ⦁ Take reasonable steps to ensure the overseas recipient complies with the APPs We do not disclose sensitive participant information to overseas recipients without explicit consent.
Data Security and Retention 7.1 Security Measures We implement robust security measures to protect personal information, including: Technical Security: ⦁ Encryption of data in transit (TLS 1.3) and at rest (AES-256) ⦁ Secure httpOnly session cookies for authentication ⦁ Role-based access control and principle of least privilege ⦁ Regular security assessments and penetration testing ⦁ Intrusion detection and monitoring systems Organisational Security: ⦁ Staff training on privacy and security obligations ⦁ Background checks for staff with access to personal information ⦁ Confidentiality agreements with all staff and contractors ⦁ Documented security policies and procedures Physical Security: ⦁ Secure access controls for physical facilities ⦁ Secure destruction of physical records 7.2 Data Retention We retain personal information for as long as necessary to: ⦁ Provide the Platform services ⦁ Meet legal and regulatory obligations (including NDIS requirements) ⦁ Respond to complaints or legal claims ⦁ Maintain audit trails required for compliance Specific Retention Periods: ⦁ Participant records: Retained for 7 years after last service or as required by NDIS ⦁ Staff records: Retained for 7 years after employment ends ⦁ Incident reports: Retained for 7 years minimum ⦁ Audit logs: Retained for 7 years ⦁ Financial records: Retained for 7 years per tax law requirements When information is no longer required, we securely destroy or de-identify it. 7.3 Data Deletion Upon Request When you request deletion of your data, we will: ⦁ Delete or anonymise your personal information within 30 days ⦁ Retain only information required by law (archived with restricted access) ⦁ Notify third parties who may hold your information on our behalf
Access and Correction 8.1 Your Right to Access Under the Privacy Act, you have the right to request access to personal information we hold about you. To make an access request:
Submit a written request to our Privacy Officer (details below)
Provide sufficient identification information
Specify the information you are seeking We will respond to your request within 30 days. 8.2 Fees We do not charge you for making a request for access or correction. Where we give you access, we may charge a reasonable fee that is not excessive, to cover: ⦁ Staff time required to locate and compile the information ⦁ Costs of copying or reproducing records We will advise you of any applicable fees before processing your request. 8.3 Correction of Information You may request correction of personal information that is inaccurate, outdated, incomplete, irrelevant, or misleading. We will: ⦁ Assess your request within 30 days ⦁ Make corrections where appropriate ⦁ Notify you of the outcome ⦁ Add a statement to the record if we decline to make a correction 8.4 Access Through Platform Users can access and update certain personal information directly through the Platform: ⦁ Staff can view and edit their own profile information ⦁ Participants (or their representatives) can request access through their provider organisation ⦁ Administrators can manage organisational data within their tenant
Anonymity and Pseudonymity Where it is lawful and practicable, individuals may deal with us anonymously or under a pseudonym. However, we may not be able to provide certain services without identifying information, such as: ⦁ Creating a user account ⦁ Processing NDIS claims ⦁ Verifying worker clearances We will inform you if anonymity or pseudonymity is not possible for a particular transaction.
Notifiable Data Breaches 10.1 Our Commitment Ausvanta is committed to preventing data breaches and responding swiftly if they occur. We have robust systems and processes in place to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. 10.2 Data Breach Response If we suspect a data breach has occurred, we will:
Contain the breach – Take immediate steps to limit the spread and impact
Assess the breach – Conduct an assessment within 30 days to determine severity
Notify affected parties – If the breach is eligible for notification under the NDB scheme: ⦁ Notify the Office of the Australian Information Commissioner (OAIC) ⦁ Notify affected individuals with recommendations for protective action
Review and improve – Conduct a post-incident review to prevent future breaches 10.3 Notifiable Data Breach Scheme Under the NDB scheme, we are required to notify individuals and the OAIC when: ⦁ There is unauthorised access to, or disclosure of, personal information ⦁ This is likely to result in serious harm to affected individuals ⦁ We cannot prevent the serious harm through remedial action
Direct Marketing We may use your personal information for direct marketing purposes only when: ⦁ We have your consent to do so ⦁ The marketing relates to services similar to those you have previously requested ⦁ You have not opted out of receiving marketing communications 11.1 Opt-Out Rights You can opt out of marketing communications at any time by: ⦁ Clicking the "unsubscribe" link in marketing emails ⦁ Contacting us at hello@ausvanta.com.au ⦁ Updating your communication preferences in your account settings We will process opt-out requests within 5 business days.
Cookies and Tracking Technologies 12.1 Cookies We Use We use cookies and similar technologies to: ⦁ Maintain your session and authenticate your login ⦁ Remember your preferences and settings ⦁ Analyse Platform usage and performance ⦁ Improve security and detect fraud 12.2 Types of Cookies Cookie Type Purpose Duration Essential Session management, authentication Session Functional Preferences, settings Up to 12 months Analytics Usage analysis, performance monitoring Up to 24 months Security Fraud prevention, bot detection Session
12.3 Third-Party Tools We Use The following third-party services run on our public website and set cookies or similar identifiers: ⦁ Google Analytics — measures site usage and traffic sources, such as pages viewed, approximate location derived from your IP address, and device and browser type. It is added to the site by Google Site Kit, using the Google tag (gtag.js) served from Google Tag Manager. ⦁ Microsoft Clarity — session recording and heatmaps: records how visitors interact with pages, including clicks, scrolling and page interactions, to help us improve them ⦁ AddToAny — provides the social sharing buttons Google and Microsoft may process this information outside Australia, including in the United States (see section 6). These tools are used on our public website. They are separate from the Ausvanta Platform itself. 12.4 Cookie Notice and Your Choices Every visitor can accept or reject non-essential analytics at any time with the "Cookie choices" button at the bottom of every page. If your browser is set to a European or UK time zone, our cookie notice asks you first, and Google Analytics and Microsoft Clarity stay off until you choose Accept. For all other visitors they load shortly after the page opens and keep running until you choose Reject. Choosing Reject stops Google Analytics and Microsoft Clarity and clears the cookies they set on this site. Your choice is stored on your device in a first-party cookie named nng_consent (and in your browser's local storage) for 180 days. 12.5 Managing Cookies You can also manage cookies through your browser settings, or install Google's Analytics opt-out browser add-on. Note that disabling essential cookies may affect Platform functionality. The tools we use are listed in section 12.3.
Artificial Intelligence (AI) Transparency Ausvanta may use AI-assisted features to enhance Platform capabilities, including: ⦁ AI-powered search and information retrieval (RAG with citations) ⦁ Note drafting assistance (optional feature) ⦁ Compliance form completion assistance ⦁ Risk signal detection for missing evidence or anomalies 13.1 AI Data Handling When AI features are used: ⦁ They run in Australia on our own infrastructure, using AI models hosted on our own hardware. Your data is not sent to third-party AI providers and is not processed by AI services outside Australia ⦁ Your data is processed securely and not used to train third-party AI models without consent ⦁ AI outputs are clearly identified and may be reviewed before finalisation ⦁ You can opt out of AI-assisted features in your organisation settings 13.2 Human Oversight AI features are designed to assist, not replace, human decision-making. All AI-generated outputs should be reviewed by authorised staff before use.
Children's Privacy The Ausvanta Platform is not designed for use by children under 18 years of age. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information. Where participants under 18 receive NDIS supports, information about them is managed by their parent, guardian, or authorised representative in accordance with this Privacy Statement.
Changes to This Privacy Statement We may update this Privacy Statement from time to time to reflect: ⦁ Changes in our information handling practices ⦁ New features or services ⦁ Changes in legal or regulatory requirements ⦁ Industry best practices When we make material changes, we will: ⦁ Publish the updated Privacy Statement on our website ⦁ Notify registered users by email ⦁ Update the "Last Updated" date at the top of this document We encourage you to review this Privacy Statement periodically.
Complaints and Enquiries 16.1 Contacting Us If you have questions, concerns, or complaints about our privacy practices, please contact our Privacy Officer: Neural Networks Group Pty Ltd (ACN 691 933 632, ABN 53 691 933 632) Attention: Privacy Officer ⦁ Email: hello@ausvanta.com.au ⦁ Phone: 0468 167 862 ⦁ Post:Suite 17, 89-97 Jones Street, Ultimo, NSW 2007 16.2 Complaints Process We take privacy complaints seriously and will:
Acknowledge your complaint within 5 business days
Investigate and respond within 30 days
Provide a written response explaining our findings and any remedial actions 16.3 External Review If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC): ⦁ Website: www.oaic.gov.au ⦁ Phone: 1300 363 992 ⦁ Post: GPO Box 5218, Sydney NSW 2001
Definitions Term Definition APP Australian Privacy Principle Collection Gathering, acquiring, or obtaining personal information Consent Express or implied agreement to the collection, use, or disclosure of personal information Data Breach Unauthorised access to, disclosure of, or loss of personal information NDIS National Disability Insurance Scheme NDB Scheme Notifiable Data Breaches scheme under Part IIIC of the Privacy Act Personal Information Information or an opinion about an identified individual, or an individual who is reasonably identifiable Sensitive Information Personal information including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and biometric information Tenant An organisation's isolated environment within the Ausvanta Platform Use Access, consultation, processing, or handling of personal information
Contact Information Neural Networks Group Pty Ltd (provider of Ausvanta) ACN 691 933 632 ABN 53 691 933 632 Business address: Suite 17, 89-97 Jones Street, Ultimo, NSW 2007 Privacy Officer: Email: hello@ausvanta.com.au Phone: 0468 167 862 Data Protection Enquiries: Email: hello@ausvanta.com.au
Related Policies This Privacy Statement should be read in conjunction with: ⦁ Ausvanta Terms and Conditions ⦁ Ausvanta Acceptable Use Policy Information about cookies is in section 12 of this Statement. Our data-protection obligations to customers, and our service levels, are set out in the Terms and Conditions. We do not currently publish a separate Cookie Policy, Data Processing Agreement or Service Level Agreement; a data processing agreement can be provided to customers on request. ──────────────────────────────────────────────────────────────────────────────── Document Control Version Date Author Changes 1.0 2 July 2026 Ausvanta Legal & Compliance Initial release
──────────────────────────────────────────────────────────────────────────────── This Privacy Statement has been prepared having regard to the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
We use cookies for analytics: Google Analytics, and Microsoft Clarity, which records how visitors use our pages (clicks, scrolling and page interactions). They only run if you accept.They run unless you reject them. You can change your choice at any time with “Cookie choices” at the bottom of the page. Privacy policy