Privacy policy

Privacy matters to us, and we know it matters to you. This page explains, in plain English, what information this website collects, what we do with it, and the choices you have. No legal maze, no buried surprises.

The short version

• Our analytics set no cookies and never identify you, so there is no banner to click.
• If you use the contact form, we only use your details to reply to you.
• The one place we ask for participant or health information is our intake form, and only with your consent.

Analytics, without the tracking

We use Plausible, a privacy-friendly analytics tool, to understand how people use this site: which pages are read, the general area people visit from (country or region, never your address), the kind of device and browser used, and how people found us. That helps us make the site more useful.

Plausible sets no cookies and does not collect or store any personal information. It does not follow you across sites or build a profile of you, so there is no banner to click and nothing to consent to. The statistics are anonymous and counted in aggregate, processed by Plausible on servers in the European Union; because none of it identifies you, nothing personal leaves your device. You can read more in Plausible’s privacy policy.

The contact form

When you share your story through our contact form, we receive your name, email address and message. We use them to reply to you, and that is it. We do not add you to mailing lists and we never sell your information. Form submissions are processed by Netlify, the US company that hosts this website, so your name, email and message may be stored on servers in the United States and are handled under Netlify’s privacy policy rather than Australian privacy law. If you would rather keep your details onshore, email us directly instead.

The participant intake form

When you join us as a participant, we invite you to fill in an intake form so we can set up your supports well. Unlike the contact form, this one does ask for participant and health information: your NDIS details, how you like to communicate, sensory supports, and any medical or safety information a support worker should know. We only collect it with your consent, you can skip anything you are unsure of, and you can ask us to fill it in with you by phone or in Easy Read instead. The form is not linked from our menu; we share the link with you directly.

Your intake information is stored in our secure participant systems, HubSpot (a US company) and ShiftCare, and shared only with your support team and, where relevant, your plan manager, support coordinator, and other services you have told us about. Because HubSpot stores data on servers in the United States, some of your information is held outside Australia. We have a data protection agreement in place and take reasonable steps to protect it to a standard consistent with the Australian Privacy Act 1988. You can access, correct, or withdraw your consent at any time, and it will not affect your supports.

We also hold some information about the people around you: family members, nominees, guardians, and others in your support network. That is usually a name, how they are connected to you, and contact details. It reaches us because you gave it to us, or because it came up while we were supporting you. We use it only to provide your supports and to stay in touch with the people you want involved. Those people often have not given it to us themselves, so if you are one of them, the rights further down this page are yours too: you can ask us what we hold about you, ask us to correct it, or ask us to stop using it.

Signing documents with us

Separately from this website, when you become a participant we prepare and send documents such as your service agreement for you, or your representative, to sign electronically. We use a secure document platform called PandaDoc for this. Your information in that platform is stored on encrypted servers in the United States, so some of your personal information is held outside Australia. We have a data protection agreement with the provider and take reasonable steps to protect your information when it is held overseas, and we handle it under the Australian Privacy Act 1988. You can always ask to sign on paper instead, and it will not affect your supports.

AI-assisted administration

To run our service efficiently, Soul Support uses AI-assisted tools for administrative tasks such as drafting notes, preparing reports, and organising documents. Before any AI tool is used, text goes through a step that replaces identifying details such as a participant’s name and NDIS number with an anonymous code. Administrative tasks that involve participant information are processed on servers in Australia, including Microsoft Azure under Microsoft’s enterprise data protection terms, and that data is not used to train AI models. Some of our tools also need to send text to a service outside Australia, for example to build the search index that helps us find a document again later. That substitution step reliably catches full names and NDIS numbers. A first name mentioned in passing can still slip through, so we keep checking and improving it. We take reasonable steps to protect information handled overseas and we handle it under the Australian Privacy Act 1988. These tools assist with administration only and do not make decisions about a person’s support or care, and you can ask us to prepare documents without AI assistance at any time.

There is one exception, and it only involves billing. Once a fortnight we prepare invoices from our rostering system. During that task a name can be visible to the AI tool as it reads the screen, because each invoice has to be matched to the right person. That task runs only while a staff member is there and has started it, it is never scheduled or left to run on its own, and the invoice is prepared as a draft for a person to check before anything is sent. Any notes or summaries it produces use a code rather than a name. The tool for this task is provided by Anthropic, whose servers are in the United States, under a data protection agreement. If you would rather your invoices were prepared without it, just tell us and we will do them by hand.

Keeping our enquiry forms simple

Some of the information in our day-to-day support work is deeply personal. Our general enquiry and contact forms never ask for it: no participant records, NDIS plans, or health information flow through them. That kind of detail is only ever collected through our participant intake form, described above, and only with your consent. If you choose to share personal details in a contact form message, we treat them with the same care: we use them only to respond to you, and we delete them if you ask. Our broader privacy practices for participants and their families are also set out in our service agreements and participant information materials.

Your rights

Under the Australian Privacy Act, you can ask us:

• what personal information we hold about you
• to correct it if it is wrong
• to delete contact form details we hold, and we will, unless we have a genuine reason to keep them (like an ongoing conversation)

To make a request, email us at hello@soulsupport.co. We will respond within 30 days.

If you ever feel we have not handled your information well, please tell us first so we can put it right. You can also contact the Office of the Australian Information Commissioner at oaic.gov.au.

Who we are

Soul Support Disability Services is operated by National Support Agency Pty Ltd (ABN 91 674 721 281), supporting people 17+ across the Gold Coast to Byron Bay.

Talk to us

Questions about privacy, or about anything on this page? Email us at hello@soulsupport.co and a real person will get back to you.