Privacy Policy

1. Introduction

Imagination 2 Reality LLC ("I2R", "we", "us", "our") operates the CareVyx NDIS care management platform ("Platform"). This Privacy Policy describes how we collect, use, store, disclose, and protect personal information and health information in connection with the Platform.

We are committed to complying with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the NDIS Act 2013, and the requirements of the NDIS Quality and Safeguards Commission. Where we process personal data of individuals in the European Union, we also comply with the General Data Protection Regulation (GDPR).

2. Information We Collect

2.1. Participant Information

• Full name, date of birth, NDIS participant number
• Contact details (address, phone, email)
• NDIS plan details (plan dates, funding categories, budgets)
• Health and medical information (diagnoses, medications, allergies, medical history)
• Care records (shift notes, incident reports, medication administration records)
• Goals, support plans, risk assessments
• Restrictive practices records
• Complaints and feedback
• Consent records
• Family and guardian contact details

2.2. Provider and Staff Information

• Provider organisation details (ABN, NDIS registration, contact information)
• Staff names, contact details, roles, employment type
• Qualifications, certifications, and expiry dates
• NDIS Worker Screening Check status
• Availability, leave records, shift history
• GPS location data (clock-in/out, travel tracking — with consent)
• Timesheet and payroll-related data

2.3. Technical Information

• IP addresses, browser type, device information
• Usage data (pages visited, features used, session duration)
• API access logs
• Authentication and session data

3. How We Use Information

We use personal information solely for the following purposes:

• Care delivery: Managing participant care records, shift notes, medication administration, incident reporting, and compliance documentation
• NDIS compliance: Meeting NDIS Practice Standards, Quality and Safeguards Commission requirements, and mandatory reporting obligations
• Operational management: Rostering, scheduling, time and attendance, payroll processing, and invoicing
• NDIS claims: Generating and submitting PRODA claims, invoicing plan managers, and tracking funding utilisation
• Platform improvement: Analysing usage patterns to improve Platform features and performance (using aggregated, de-identified data only)
• Communication: Sending notifications, alerts, and service-related communications
• Legal compliance: Responding to legal obligations, audits, and regulatory requirements

We do not sell, rent, or trade personal information to third parties for marketing purposes.

4. Legal Basis for Processing

• Consent: Where participants or their authorised representatives have provided consent for data collection and use
• Contractual necessity: Processing required to deliver services under the subscription agreement
• Legal obligation: Processing required to comply with NDIS Act 2013, Privacy Act 1988, and related regulations
• Legitimate interests: Platform security, fraud prevention, and service improvement (using de-identified data)

5. Data Storage and Security

5.1. All data is stored on secure, encrypted servers. Database access is restricted to authorised personnel and systems only.

5.2. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Role-based access controls with row-level security (RLS)
• HMAC-based session authentication
• Immutable audit logging of all data access and modifications
• Rate limiting on all API endpoints
• Regular security audits and penetration testing
• Automated backup and disaster recovery

5.3. While we take all reasonable steps to protect personal information, no system is completely secure. We cannot guarantee absolute security of data transmitted to or stored on the Platform.

6. Data Retention

6.1. Participant care records, shift notes, incident reports, medication records, and compliance documentation are retained for a minimum of seven (7) years from the date of creation, in accordance with NDIS Practice Standards.

6.2. Where a participant was a child when the record was created, records are retained until the person turns twenty-five (25) years of age, or seven years from creation, whichever is later.

6.3. Account and billing records are retained for seven (7) years in accordance with Australian tax and business record requirements.

6.4. Technical logs (IP addresses, session data) are retained for twelve (12) months and then deleted.

7. Data Sharing and Disclosure

We may share personal information only in the following circumstances:

• With the participant's provider(s): To deliver care and manage operations as authorised by the participant's service agreement
• With family/guardians: As configured in the participant's consent and access settings
• With NDIS bodies: NDIA, NDIS Quality and Safeguards Commission, and plan managers for claims processing, compliance reporting, and audit purposes
• With accounting systems: Provider-authorised payroll and accounting integrations (Xero, MYOB, KeyPay, QuickBooks) — only provider staff and financial data, never participant health records
• Legal requirements: Where required by law, court order, or regulatory direction
• Emergency situations: Where necessary to prevent or lessen a serious threat to the life, health, or safety of any individual

We do not share participant health information with accounting integrations. Accounting bridges receive only staff timesheet, pay rate, and invoice data.

8. Data Sovereignty and Cross-Border Disclosure

8.1. All customer data — including participant records, staff records, care documentation, and provider information — is stored exclusively in Australian data centres located in the Sydney (ap-southeast-2) region. No customer data is transferred to, processed in, or stored in any jurisdiction outside of Australia.

8.2. I2R is a US-based company (Wyoming LLC). Our development, maintenance, and support operations are conducted from the United States. Authorised I2R personnel may access Australian-hosted data remotely for the purposes of technical support, system maintenance, security monitoring, and platform operation. This access is conducted via encrypted connections and is subject to the same data protection obligations outlined in this Privacy Policy.

8.3. In accordance with Australian Privacy Principle 8 (APP 8), we take reasonable steps to ensure that any overseas access to personal information is subject to protections substantially similar to the APPs. I2R maintains contractual, technical, and organisational safeguards to protect data during any remote access, including:

• Encrypted connections (TLS 1.3) for all remote access
• Role-based access controls limiting access to authorised personnel only
• Immutable audit logging of all data access
• Contractual obligations on all personnel to comply with the Australian Privacy Act 1988

8.4. Our hosting providers maintain data centres with appropriate security certifications (SOC 2 Type II, ISO 27001) and are contractually bound to maintain data within Australian territory.

8.5. We will not transfer customer data outside of Australia without the express written consent of the affected provider and, where applicable, the affected participants.

9. Your Rights

Under the Australian Privacy Principles and applicable law, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate, incomplete, or out-of-date personal information
• Complaint: Lodge a complaint about our handling of personal information
• Withdraw consent: Withdraw consent for specific uses of your information (where consent is the legal basis)
• Data portability: Request your data in a machine-readable format (where technically feasible)
• Deletion: Request deletion of personal information, subject to our legal retention obligations under NDIS rules

To exercise any of these rights, contact us at legal@i2rapps.com. We will respond within thirty (30) days.

10. Cookies and Tracking

10.1. The Platform uses essential cookies for authentication, session management, and security. These are strictly necessary for the Platform to function and cannot be disabled.

10.2. We do not use third-party advertising cookies or tracking pixels on the Platform.

10.3. The landing page and marketing site may use analytics cookies to understand visitor behaviour. These are anonymous and do not collect personal health information.

11. Children's Privacy

The Platform may store information about NDIS participants who are children (under 18). This information is collected and managed by the participant's provider and/or guardian and is handled with additional protections, including extended data retention periods as required by NDIS Practice Standards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Users will be notified of material changes via email or in-platform notification. The "Last updated" date at the top of this policy reflects the most recent revision.

13. Complaints

If you are not satisfied with our response to a privacy concern, you may lodge a complaint with:

• Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au
• NDIS Quality and Safeguards Commission: www.ndiscommission.gov.au

14. Contact

For questions about this Privacy Policy or to exercise your rights, contact:

Imagination 2 Reality LLC
Email: legal@i2rapps.com
Web: i2rapps.com