Last updated: July 2026
NDIS Flow ("we", "us") respects your privacy. This policy explains how we handle personal and health-adjacent information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
We collect account information (name, email), provider organisation details, and the records you choose to enter about your participants, workers, incidents, rosters and compliance. Participant records may include personal and health-related information you input — you are responsible for collecting and handling that information under your own privacy obligations as a registered provider.
To provide and operate the NDIS Flow platform, maintain data isolation between provider organisations, provide support, and improve the service. We do not sell your data.
Each provider organisation can access only its own records. Other providers cannot see your data. Platform administrators may access records in a read-only capacity for support purposes only and cannot edit or delete your data.
Data is stored on secure cloud infrastructure with access controls and encryption in transit. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access.
You may request access to, or correction of, your personal information. You can export or delete your data at any time by contacting us. Participant data you enter remains your responsibility to manage in accordance with the Privacy Act 1988 and NDIS Practice Standards.
For privacy enquiries, contact Base44 support.