What we do with your information, in plain words

Sensitive fields are encrypted in the database with AES-256-GCM, using a key kept separate from the application key. They include NDIS numbers, dates of birth, medication and MAR details, progress note text and corrections, incident narratives and reviews, and complaint text. Exact NDIS number searches use a keyed index, so the number itself isn't stored in plain text.

Not every field is covered yet: form record contents, email addresses and log entries aren't field-encrypted. Stored files are private, and download links are signed and expire, by default after 60 minutes. Scheduled reports with personal details are sent as a link for each recipient that expires after 7 days or 10 downloads.

No. Each organisation has activity and sign-in logs, and the database refuses any change or deletion of audit rows, apart from the 7-year purge described below. Activity logs are hash-chained for each organisation, so a changed or missing row breaks the chain, and the chain is checked every day. Document records log every view and export, and signed documents keep a content hash and a certificate page. You can export the logs.

Two-step sign-in uses an authenticator app with recovery codes. Your organisation chooses whether it is off, optional (the default), required for admins or required for everyone, and an admin can reset it for a staff member. Staff can also sign in with Microsoft Entra ID or Google Workspace, required for admins or for all staff, while owners keep a separate password and two-step sign-in in case single sign-on fails. Single sign-on isn't available in the mobile app or for families, and SAML isn't supported.

Access is controlled by roles built from fine-grained permissions, and you can create your own roles. Each request is tied to one provider organisation, taken from the sign-in itself. Support workers see care information only, not plans or funding, and families see only what you allow for each contact.

Audit rows are kept for at least 7 years. Only a purge of rows older than that can remove them, and the 7-year cut-off is set in the database, so the app can't shorten it. Document Centre templates can't set a retention period under 7 years, and records destroyed at the end of retention are logged. Declined referrals are deleted after 90 days.

Location is read only at these moments:

• once at clock-in and once at clock-out, when the organisation uses geofencing
• once when a worker checks in or answers "Are you OK?", if they allow it
• while a help request is open, for up to 30 minutes, only while the app is open, and the worker can stop it
• when a worker taps "use my location" for an expense trip

There is no background or continuous tracking. The microphone is used only when a worker taps dictation, through the phone's own speech recognition; Autonomy Care doesn't record or keep audio, but Apple or Google may process it depending on the phone. Photos and files are read only when a worker chooses to attach them. Notifications on the lock screen don't show participant names.

No. The website uses no tracking cookies. Analytics, when switched on, is cookieless. Forms send what you type straight to our application, and the website itself stores nothing. We don't put personal details in web addresses. Read the cookie notice and privacy policy for the detail.

Registers, the participant list, reports and many records export as CSV or PDF, and a participant's Document Centre file can be exported. An admin can also export everything held about one participant or staff member in a single download, to answer a request for access to personal information.

If your subscription ends, you keep read-only access for 30 days so you can export what you need, and if you ask during that time we'll send you a copy of your data in common formats, such as CSV and PDF. We then delete your organisation's data within 90 days, unless the law requires us to keep something longer. There's no fee to leave or to take your data with you.

You stay responsible for keeping your own NDIS records for as long as the rules require, such as 7 years for incident and complaint records, so export them before you go. Our terms of use summarise these terms, and your customer agreement with us governs.

Not unless you turn it on. The note coach, Signals, worker matching, incident triage, medication checks and the claim pre-check are rule-based. They follow written rules and use no AI model.

There is one optional add-on, AI note summaries. It is off in three ways: it isn't in the default modules, a platform switch keeps it off, and an organisation admin must also turn it on, which is written to the activity log. If all three allow it, a staff member can press "Summarise" on a progress note. The note's text is then sent to OpenAI, processed outside Australia, and a suggested summary comes back for the worker to check. Autonomy Care doesn't store the text sent, families can't use it, and each person can ask for 20 summaries an hour.

We build the website and the product to WCAG 2.2 level AA. We don't claim certification or an independent audit. Here is how we test:

• the website's colour pairs are checked automatically on every build
• the mobile app's colours are tested against WCAG 2.2 AA contrast, and its screens are tested at 200% text size
• touch targets in the app are at least 48dp, and the app follows the phone's dark mode and reduce motion settings
• app controls have screen-reader labels, including a "Send a silent alert" action
• the Family portal has larger text sizes and Easy Read with illustrations

On 13/10/2026 we checked the web app's main screens with automated accessibility tests (axe, against WCAG 2.1 A and AA) at four screen widths, from phone to desktop, and worked through the six core lists using only a keyboard. We fixed what those checks found, such as pickers that needed a mouse and focus that was lost after closing a panel. A full run with screen readers (NVDA, VoiceOver and TalkBack) is still to be done.

Tell us through the accessibility statement or the contact page. It helps to say which page or screen, what you were trying to do, and any assistive technology you use.

Some things aren't in place yet, and we won't claim them until they are:

• Hosting provider and region.
• Backups. The design is encrypted nightly backups kept daily for 35 days, monthly for 13 months and yearly for 7 years, but none are running until hosting is in place.
• Sign-in time-outs. Idle sign-out times for the web app haven't been set yet.
• Data breach response.
• Sub-processors.
• Certifications. We don't hold security certifications such as ISO 27001 or SOC 2.