Data Processing Agreement

1. Parties and Scope

This Data Processing Agreement ("DPA") forms part of the Provider Subscription Agreement between Imagination 2 Reality LLC ("I2R", "Processor") and the subscribing NDIS provider organisation ("Provider", "Controller") for the CareVyx platform ("Platform").

This DPA governs the processing of personal information and health information by I2R on behalf of the Provider in connection with the Platform. It supplements and is incorporated into the Terms of Service and Privacy Policy.

2. Definitions

• "Personal Information" has the meaning given in the Privacy Act 1988 (Cth) and includes any information or opinion about an identified individual, or an individual who is reasonably identifiable.
• "Health Information" has the meaning given in the Privacy Act 1988 (Cth) and includes information about a participant's health, disability, care needs, medications, incidents, and related records.
• "Processing" means any operation performed on Personal Information, including collection, storage, use, modification, retrieval, disclosure, transfer, and deletion.
• "Data Breach" means unauthorised access to, disclosure of, loss of, or modification of Personal Information that is likely to result in serious harm to any affected individual.
• "Sub-processor" means any third party engaged by I2R to process Personal Information on behalf of the Provider.

3. Roles and Responsibilities

3.1. Provider (Controller): The Provider determines the purposes and means of processing Personal Information. The Provider is responsible for:

• Obtaining all necessary consents from participants, staff, and other data subjects
• Ensuring that data entered into the Platform is accurate and lawfully collected
• Complying with NDIS Practice Standards regarding record-keeping and participant rights
• Configuring access controls, role assignments, and module permissions within the Platform

3.2. I2R (Processor): I2R processes Personal Information solely on behalf of and under the documented instructions of the Provider. I2R is responsible for:

• Processing data only for the purposes described in this DPA and the Terms of Service
• Implementing appropriate technical and organisational security measures
• Notifying the Provider of any Data Breach in accordance with Section 8
• Assisting the Provider in meeting its obligations under the Privacy Act 1988
• Not processing data for any independent purpose, including marketing, profiling, or sale

4. Categories of Data Processed

I2R processes the following categories of Personal Information on behalf of the Provider:

4.1. Participant Data

• Identity data (name, date of birth, NDIS number, contact details)
• Health and clinical data (diagnoses, medications, allergies, medical history)
• Care records (shift notes, incident reports, medication administration records)
• Support plans, goals, risk assessments, and restrictive practices
• NDIS funding information (plan dates, budgets, claims history)
• Family and guardian contact information
• Consent and agreement records

4.2. Staff Data

• Identity and contact data (name, email, phone, role)
• Employment data (qualifications, certifications, screening check status)
• Operational data (shift history, timesheets, availability)
• Location data (clock-in/out coordinates, where consent is provided)

4.3. Provider Data

• Organisation details (ABN, NDIS registration, facility addresses)
• Billing and subscription records
• Compliance and audit records

5. Data Sovereignty

5.1. All Personal Information processed through the Platform is stored exclusively in Australian data centres located in the Sydney (ap-southeast-2) region. No customer data is stored outside of Australia.

5.2. I2R personnel located in the United States may access Australian-hosted data remotely for the purposes of technical support, system maintenance, security monitoring, and platform operation. This remote access is conducted via encrypted connections and is subject to the safeguards described in the Privacy Policy (Section 8).

5.3. I2R will not transfer, migrate, or replicate customer data to any data centre or server located outside of Australia without the Provider's prior written consent.

5.4. Backups and disaster recovery replicas are maintained within Australian data centres only.

6. Security Measures

I2R implements the following technical and organisational measures to protect Personal Information:

6.1. Technical Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Row-level security (RLS) ensuring provider data isolation at the database level
• HMAC-based session authentication with 24-hour expiry and 5-minute role revalidation
• Rate limiting on all API endpoints
• Immutable audit logging of all data access, modifications, and deletions
• Automated backup with point-in-time recovery
• Network isolation between provider tenants

6.2. Organisational Measures

• Access to production systems limited to authorised I2R personnel on a need-to-know basis
• All I2R personnel with data access are bound by confidentiality obligations
• Regular security audits and vulnerability assessments
• Incident response procedures with defined escalation paths
• Staff security awareness training

7. Sub-processors

7.1. I2R uses the following sub-processors to deliver the Platform:

7.2. I2R will notify the Provider at least thirty (30) days before engaging any new sub-processor that will have access to Personal Information. The Provider may object to a new sub-processor in writing within fourteen (14) days of notification.

7.3. I2R ensures that all sub-processors are bound by data processing obligations no less protective than those in this DPA.

8. Data Breach Notification

8.1. I2R will notify the Provider of any confirmed or suspected Data Breach without undue delay and in any event within twenty-four (24) hours of becoming aware of the breach.

8.2. The notification will include:

• Description of the nature of the breach, including categories and approximate number of affected individuals
• The likely consequences of the breach
• Measures taken or proposed to address the breach, including mitigation steps
• Contact details for the I2R representative handling the incident

8.3. I2R will cooperate with the Provider in assessing whether the breach triggers notification obligations under the Notifiable Data Breaches (NDB) scheme of the Privacy Act 1988. The Provider, as Controller, retains responsibility for notifying affected individuals and the OAIC where required.

8.4. I2R will take immediate steps to contain and remediate any Data Breach and will provide the Provider with regular updates until the breach is resolved.

9. Data Subject Rights

9.1. I2R will assist the Provider in responding to requests from individuals exercising their rights under the Privacy Act 1988, including rights of access, correction, and deletion.

9.2. If I2R receives a request directly from a data subject (participant, staff member, or other individual), I2R will promptly redirect the request to the Provider and will not respond directly unless instructed by the Provider.

9.3. I2R will provide reasonable technical assistance to enable the Provider to fulfil access and correction requests within the thirty (30) day timeframe required by the APPs.

10. Data Retention and Deletion

10.1. I2R will retain Personal Information for the duration of the Provider's subscription and for a post-termination period as described below.

10.2. Upon termination of the subscription:

• I2R will provide the Provider with a complete export of all their data in a standard machine-readable format (CSV or JSON) within thirty (30) days of the termination date, at no additional charge.
• Care records, shift notes, incident reports, medication records, and compliance documentation will be retained for the minimum period required by NDIS Practice Standards (seven years from creation, or until a child participant turns twenty-five, whichever is later).
• After the mandatory retention period, all Personal Information will be securely deleted using industry-standard methods. The Provider will be notified before deletion occurs.

10.3. The Provider may request early deletion of specific data, subject to mandatory NDIS retention requirements. I2R will not delete data where doing so would cause the Provider to breach NDIS record-keeping obligations.

11. Audits and Inspections

11.1. I2R will make available to the Provider, upon reasonable request, information necessary to demonstrate compliance with this DPA.

11.2. The Provider (or a qualified third-party auditor appointed by the Provider) may conduct an audit of I2R's data processing activities no more than once per twelve (12) month period, with at least thirty (30) days' prior written notice.

11.3. Audits will be conducted during normal business hours and in a manner that minimises disruption to I2R's operations. The Provider will bear the costs of any audit.

11.4. I2R will cooperate with any investigation or audit by the OAIC or the NDIS Quality and Safeguards Commission that relates to data processed through the Platform.

12. NDIS-Specific Obligations

I2R acknowledges the following NDIS-specific data handling requirements and will support the Provider in meeting them:

• Practice Standard 1 (Rights and Responsibilities): The Platform supports participant consent management and access controls that enable participants to view their own records.
• Practice Standard 3 (Provision of Supports): Care records, shift notes, and support plans are maintained with immutable audit trails.
• Practice Standard 5 (Service Environment): Emergency plans and drill records are maintained per facility.
• Practice Standard 6 (Feedback and Complaints): Complaint records and continuous improvement registers are maintained.
• Practice Standard 8 (Governance and Operational Management): Internal audit records, risk registers, and compliance documentation are maintained with full version history.
• Reportable incidents: The Platform maintains incident records with severity classification and supports the Provider's obligations to report to the NDIS Commission within required timeframes.
• Restrictive practices: Records of authorised and unauthorised restrictive practices are maintained with complete audit trails as required by the NDIS (Restrictive Practices and Behaviour Support) Rules.

13. Liability and Indemnification

13.1. I2R will indemnify the Provider against any direct losses arising from I2R's breach of this DPA or the Privacy Act 1988 to the extent caused by I2R's negligence or wilful misconduct.

13.2. The Provider will indemnify I2R against any claims arising from the Provider's breach of its obligations under this DPA, including failure to obtain necessary consents or entering inaccurate data.

13.3. Liability under this DPA is subject to the limitations set forth in Section 11 of the Terms of Service.

14. Term and Termination

14.1. This DPA takes effect upon the Provider's acceptance of the Terms of Service and remains in effect for the duration of the subscription.

14.2. Sections 5 (Data Sovereignty), 8 (Data Breach Notification), 10 (Data Retention and Deletion), and 11 (Audits and Inspections) survive termination of this DPA.

15. Governing Law

This DPA is governed by the laws of the Commonwealth of Australia, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles. To the extent there is any conflict between this DPA and the Terms of Service regarding the handling of Personal Information, this DPA prevails.

16. Contact

For questions about this Data Processing Agreement, contact:

Imagination 2 Reality LLC
Email: legal@i2rapps.com
Web: i2rapps.com