Privacy Policy

Our commitment to privacy

Able Digital Wellness Pty Ltd (trading as Able Wellness) builds and operates a digital platform for the Australian disability support sector (NDIS). The people the platform serves are participants with disability and their families. We treat their information with the care that duty demands.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable to our role, by the NDIS Act 2013, the NDIS Practice Standards and the NDIS Code of Conduct. This policy explains how we handle personal information, consistent with APP 1 (open and transparent management of personal information).

What personal information we collect

Depending on how you interact with Able Wellness, we may collect:

• Participant information: name and contact details, information about supports, goals and activities, and, where relevant to delivering a service, health or support needs. Health information and information about disability are sensitive information under the Privacy Act and receive a higher standard of protection.
• Family, guardian and support-network information: contact details and the nature of the relationship to a participant.
• Workforce and provider information: the details of support workers, clinicians and provider administrators who use the platform, including identity and access information.
• Technical information: account identifiers, device and log information generated when the platform is used.
• Website enquiries and sign-up: when you use a form on our website, such as the launch invitation, Contact us or the organisation enquiry, we collect what you enter: usually your name, email address, your message, and whether you are asking for yourself, someone you support or an organisation. To protect the forms from misuse, we also keep a one-way code derived from your internet address. We cannot turn that code back into the address, and we do not keep the address itself with your enquiry. If you try to sign in on our website with an email address that has no Able account, we don't send a code or create an account; we record the attempt, and the Able team may see it.

We collect only the information reasonably necessary for our functions and activities (APP 3).

How we collect it

We collect personal information directly from the individual wherever practicable, and by lawful and fair means (APP 3). Where a provider (such as an NDIS organisation) supplies participant information to the platform on the participant's behalf, we rely on that provider having the authority and consent to do so, and we handle that information under this policy and our agreement with the provider. We take reasonable steps to notify individuals of the matters in APP 5 at or before the time of collection.

Our website does not use advertising or tracking cookies. It stores your appearance choice (for example, high contrast) in your own browser so the website remembers it. That choice stays on your device and is not sent to us.

Why we collect and how we use it

We use personal information to:

• Deliver and operate the platform and its services.
• Personalise supports, content and activities for participants.
• Communicate with users about the service.
• Maintain the security, integrity and quality of the platform.
• Meet our legal and regulatory obligations.
• Reply to your enquiry, and, if you asked for one, send your launch invitation.
• Answer your questions in Ask Able, if you have chosen to use it (see below).
• Look into feedback and reports you send from the app (see below).

We use and disclose personal information only for the purpose for which it was collected, for a directly related purpose the individual would reasonably expect, or where otherwise permitted or required by law (APP 6). We do not sell personal information. We send news and offers only if you have ticked the box that asks for them, and every message includes a way to stop them (APP 7). The launch invitation you ask for is not marketing, and you receive it whether or not you ticked that box.

Consent

Consent is central to how the platform operates. Where we rely on consent to collect, use or disclose personal information, we seek consent that is informed, specific and freely given, and we provide clear ways to review and withdraw it. For participants who may need support to make decisions, we work with providers, families and guardians in a way that respects the participant's dignity and, so far as possible, their own voice in decisions about their information.

Ask Able

Ask Able is an optional assistant in the Able app for adults using Able for themselves. It helps you find activities and meal ideas, and answers questions about using Able. You choose whether to join, and before you do, we explain how your conversations are handled and kept and ask you to agree.

• How it works: what you type is processed by an artificial intelligence model run through Amazon Web Services in Australia. It is not sent overseas, and it is not used to train the model.
• What we keep: we keep parts of your conversations, and records of how Ask Able answered, for the periods shown to you when you join. Then we delete them.
• People who may read it: to keep Ask Able safe and accurate, a small number of trained Able staff may read a conversation that was flagged, or a sample of conversations.
• Its limits: Ask Able does not give medical advice, and it does not decide what is safe for your health.
• Stopping: you can stop using Ask Able at any time. Deleting your account deletes your Ask Able conversations as well.

Disclosure

We may disclose personal information to:

• The provider organisation responsible for a participant's supports.
• Service providers who help us operate the platform (for example, cloud hosting and identity providers), under contracts that require them to protect the information and use it only for the purposes we specify.
• Stripe, which processes membership payments. You enter your card details with Stripe, and we never see or store your full card number.
• Others where the individual consents, or where we are permitted or required to disclose by law.

Data location and cross-border disclosure

Personal information held by the platform is stored in Australia (Amazon Web Services, Sydney region). We do not routinely transfer personal information overseas. Videos in the Able app are played through Vimeo, a video service whose servers may be outside Australia: when you play a video, your device connects to Vimeo as any web browser would, and we do not send Vimeo your name, email address or account details. Membership payments are processed by Stripe, which may handle payment information outside Australia under its own privacy commitments. Before any other arrangement that would involve disclosing personal information to an overseas recipient, we assess it under APP 8 (cross-border disclosure) and take the steps that principle requires.

How we protect it

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11). These steps include:

• Encryption of personal information in transit and at rest.
• Access controlled on a least-privilege basis, with authenticated, federated identity for workforce users and a separate identity path for participants and families.
• Hosting on managed, access-controlled cloud infrastructure with no public network access to data stores.
• Backups and recovery arrangements proportionate to the sensitivity of the data.
• Personnel obligations including confidentiality, screening appropriate to the role, and privacy awareness.

Keeping information accurate

We take reasonable steps to ensure the personal information we hold is accurate, up to date and complete, having regard to the purpose for which it is used (APP 10). We rely in part on individuals and providers to keep us informed of changes.

Access and correction

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 12 and APP 13). Contact us using the details below. We will respond within a reasonable period and will explain our reasons if we are unable to provide access or make a correction.

Feedback and reports

You can tell us about a problem or an idea from inside the Able app, and you can report a moment or a comment in a care circle that worries you.

• What you send: what you write and the kind of feedback it is. You can add a picture of the screen; we only take it if you choose to send it. If you report a moment or a comment, we receive which one it is and the reason you chose.
• What the app adds: details that help us find the problem: the app's version, the kind of device and its system version, the screen you were on, whether it was upright or sideways, the colour theme, and whether you were online. We also know which account or device sent it.
• Who sees it: people at Able who look after feedback and safety. We use it to fix problems, improve Able and keep care circles safe.
• How long we keep it: we keep feedback and reports for 24 months, then delete them. We treat every picture of the screen as personal information: we delete it 30 days after we finish with your report, and after 90 days whatever happens. The person reviewing it can delete it sooner, never later.

Deleting your account

You can delete your account in the app: open Profile (or the family page), then Your account, then Delete my account. You are signed out straight away. If you no longer have the app, ask us to delete your account. Use the email address you sign in with, so we can find your account. We will confirm by email before anything is deleted.

What we delete: your account, your sign-in, your answers, your activity, your notes and comments, your picture and your settings. We finish within 30 days of confirming.

What we keep: if a disability or aged care provider supports you, the law requires them to keep some care records. Those stay with the provider. We keep a record that you asked for deletion and when we completed it, without your name or email address.

Data breaches

We maintain processes to detect, assess and respond to data breaches. Where a breach is likely to result in serious harm and is not adequately remediated, we comply with the Notifiable Data Breaches (NDB) scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC).

Retention and disposal

We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law (including any applicable NDIS record-keeping obligations). When it is no longer required, we take reasonable steps to destroy or de-identify it securely. We keep website enquiries for as long as we need them to respond and to keep a record of the conversation, and then delete them.

Complaints

If you have a concern about how we have handled your personal information, please contact us using the details below. We will acknowledge your complaint and work to resolve it. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

How to contact us

For any privacy question, or to access or correct your information, contact our privacy team:

Changes to this policy

We may update this policy from time to time. The current version is identified by the version number and effective date at the top of this page. Material changes will be communicated through the platform or directly to affected users.