Privacy and data use

The obligations this is built around

Aldra is built for work that is regulated. A registered NDIS provider carries duties under the National Disability Insurance Scheme Act 2013 (Cth) and the rules made under it, under the NDIS Practice Standards and Quality Indicators, and under the NDIS Code of Conduct. For the personal and health information it holds, it also carries duties under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. How Aldra handles information follows from those duties rather than from product convenience.

• NDIS Practice Standards, rights and responsibilities. The privacy and dignity outcome is that “each participant accesses supports that respect and protect their dignity and right to privacy”. In Aldra, access is held by a named person for a named participant and can be revoked for one Case without touching another.
• NDIS Practice Standards, information management. Each participant’s information has to be identifiable, accurately recorded, current and confidential, accessible to the participant, and used only by the workers who need it. Records in Aldra carry their author, their responsible practitioner, the provider accountable for them and their revision history.
• NDIS Code of Conduct. Workers must respect the privacy of people with disability. Aldra records who opened, changed, exported or shared what, in an append-only trail your organisation can read.
• Privacy Act 1988 and the Australian Privacy Principles. Health information is sensitive information. APP 6 limits use and disclosure to the purpose the information was collected for, APP 11 requires reasonable steps to protect it and to destroy or de-identify it once it is no longer needed, and APP 12 and APP 13 give a person rights of access and correction.
• The Notifiable Data Breaches scheme. An eligible data breach has to be assessed and, where the threshold is met, notified to the Office of the Australian Information Commissioner and to the people affected. Aldra’s incident response preserves evidence, establishes the tenant, participant and time scope, and treats uncertain scope as affected.
• Record-keeping. Registered providers must keep particular records for seven years, including reportable incidents under the NDIS (Incident Management and Reportable Incidents) Rules 2018, complaints under the NDIS (Complaints Management and Resolution) Rules 2018, and worker screening information. Deleting an Aldra account does not override that.

What this covers

Aldra is used to deliver, coordinate, document and administer disability and allied health services. This covers personal information, health information, NDIS information, billing information, documents, messages, files and system activity — anything entered, uploaded, imported, extracted, generated or recorded in Aldra. Some of it is sensitive. Only enter or open what is needed for the service, the administration, the compliance obligation or the support request in front of you.

Access is granted to named people, not inherited from an organisation

Everyone who opens a participant Case holds their own access to it. Access records who has it, which Case it covers, what they may do, the purpose and provider context, when it begins and ends, and who authorised it. It can be revoked for one Case without touching any other.

• Working for an organisation does not by itself give someone access to a participant.
• Owning or administering an organisation is not a shortcut to clinical information. Administrators manage people, subscription and settings.
• Access is enforced in the database on every path, not by hiding things in the interface.

What Aldra information may be used for

Information in Aldra may be used to provide services, coordinate a care team, prepare records, manage invoicing, meet compliance obligations, answer an authorised support request, and keep the platform safe and reliable. It must not be browsed, exported, copied or disclosed for anything outside your role, the participant’s support, your organisation’s lawful operations, or Aldra’s own support and security needs.

Consent and authority sit with your organisation

Your organisation is responsible for having the participant consent, nominee authority, service agreement, employment authority or other lawful basis it needs before information is collected, entered, shared or acted on in Aldra. If consent is withdrawn or an authority changes, update the records promptly and stop using or sharing the affected information unless another lawful basis applies. Aldra processes what your organisation enters in order to provide, secure, support and improve the service for it.

A Case stays centred on the participant

A Case is the stable workspace for one participant and survives a change of practitioner or provider. Participant-centred does not mean anyone owns the information as property. The participant is the person the information is about and has privacy rights, including rights of access and correction. A provider is accountable for the records it creates or controls. Aldra hosts and processes that information to provide the service.

AI, extraction and automation

Aldra can extract from documents, draft records and answer questions about a Case. Those requests go through Aldra’s own controls to an Australian sovereign AI gateway running in Australian data centres.

• Aldra can only read what the person asking already has access to, so it cannot surface a Case someone is not entitled to open.
• What it produces is a draft. An authorised person reviews it before it is relied on, sent, lodged or stored as a final record.
• Do not put information through extraction or automation unless you are authorised to handle it and it suits the participant, the organisation and the service.
• The actions that matter are recorded alongside the rest of the Case.

Records carry who made them

Where it applies, a record keeps the provider accountable for it, its author and responsible practitioner, whether it was created by a provider, supplied by the participant, imported or derived by the system, and its revision history. Invitations, access changes, edits, exports and revocations are written to an append-only audit trail.

Confidentiality is part of using the service

Keep your sign-in secure and use only your own account. Take care when exporting or sharing anything, because it leaves the controls Aldra can apply. Report a suspected unauthorised access, disclosure, loss of information or security incident as soon as you can. Aldra records system activity for security, support, compliance, troubleshooting and audit.

How the service is protected

No single control is treated as sufficient.

• Verified identity and short-lived authenticated sessions.
• Australian-hosted data and controlled subprocessors.
• Encryption in transit and appropriate protection at rest.
• Least-privilege roles, with suspended or revoked access taking effect immediately.
• Tested backup, recovery and incident response.
• Adversarial testing across the API, files, documents, chat, finance, search and the assistant.

The agreement is versioned, and a change needs fresh consent

The platform data use agreement is stored with a version and a content hash. Acceptance is recorded against that exact version and keeps only the organisation and the person, their verified email at the time, the version and hash, the channel, the timestamp and the identifier of the request that recorded it. It does not keep IP addresses, browser fingerprints or any participant information. If the agreement changes, the new version has to be accepted again rather than applying quietly. Signed-in users can read the current agreement and their own acceptance in Settings.

Retention, correction and deletion

Records are retained, corrected, archived or destroyed according to your organisation’s legal, contractual, NDIS, employment, tax and clinical record-keeping obligations. Removing something from a screen does not always remove it everywhere at once: backups, audit records and immutable logs, and anything Aldra has to keep for security, accounting, compliance or a dispute, are handled on their own schedule.

Ending access and leaving

Removing someone’s access takes effect promptly. The records they created stay in the Case with their author and provider intact, because the provider that created them still has record-keeping duties. Deleting an Aldra account removes that person’s identity and access; it is not authority to erase an organisation’s participant, clinical, financial, incident, complaint or audit records. Some records must be kept for a set period under NDIS and other Australian obligations, and those are held with least-privilege access until they can lawfully be destroyed or de-identified.

Sources

The instruments named above are published by the NDIS Quality and Safeguards Commission, the Office of the Australian Information Commissioner and the Federal Register of Legislation. Check the current wording there rather than relying on this summary.

• NDIS Practice Standards and Quality Indicators
• Privacy Act 1988 (Cth)
• Australian Privacy Principles guidelines

Questions and requests

For privacy questions, access and correction requests, account deletion or a concern about how information has been handled, write to us. If your question is about a specific participant record, your organisation is the first place to ask, because it is accountable for the records it holds.