Privacy Policy

Information about a person's disability, health, accessibility needs, NDIS plan, and support requirements is sensitive information (and may also be health information) under the Privacy Act 1988 (Cth). These categories attract stricter protections under the Australian Privacy Principles.

We only collect sensitive and health information:

• with your explicit consent (provided when you complete your profile or book services); and
• because it is directly necessary to provide you with support-matching services on the Platform.

We do not use your disability or health information for advertising, analytics profiling, or any purpose other than operating the Platform and complying with our legal obligations.

If you are setting up a profile on behalf of a child, you represent that you have the authority to provide that information and consent on the child's behalf. We do not knowingly collect personal information from children under 18 without appropriate parental or guardian consent.

If you are a Participant who links your account to a Support Coordinator, that Coordinator will be able to view the following data about you through the Platform:

• Your appointment history and upcoming bookings
• Invoices raised against your account
• NDIS budget summaries (where you have entered budget information)
• Session reports shared by you with providers
• Your goals and progress notes

Coordinator access is granted only with your explicit consent when you accept a coordinator's invitation. You can revoke access at any time from your account settings.

Support Coordinators are bound by the Coordinator Agreement, which requires them to maintain confidentiality and comply with the Australian Privacy Principles in relation to your data.

FindMySupport is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). Given that we hold sensitive health and disability information, we take data breach prevention and response seriously.

What constitutes a notifiable breach: An eligible data breach occurs when personal information is accessed, disclosed, or lost in circumstances where it is likely to result in serious harm to the individuals affected — and we cannot prevent the likely harm through remedial action.

What we will do:

• Assess suspected breaches within 30 days.
• If a breach is determined to be "eligible", we will notify the OAIC and affected individuals as soon as practicable.
• Notifications will include: what happened, what information was involved, what we are doing in response, and what steps you can take to protect yourself.

Reporting a breach to us: If you suspect your account has been compromised, contact us immediately at [email protected].

As a platform operating within the NDIS ecosystem, we may be required to disclose information to the NDIS Quality and Safeguards Commission in the following circumstances:

• When responding to a Commission investigation or audit of a registered provider;
• When a mandatory report of a reportable incident is required under the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018;
• When otherwise required by the National Disability Insurance Scheme Act 2013 (Cth) or associated rules.

Such disclosures are made under legal compulsion. We will notify affected users where we are legally permitted to do so.

FindMySupport is not an NDIS registered provider and does not submit participant data to the NDIA. Participants manage their own NDIS plans independently.