Kind Compliance Platform
This Privacy Policy is provided for legal review before publication. It does not constitute legal advice. Kind Compliance recommends consulting a qualified legal professional before finalising.
This Privacy Policy is published at https://kindcompliance.com.au/privacy-policy and forms part of the Kind Compliance Terms & Conditions, incorporated by reference.
Kind Compliance is a compliance management and business support platform designed to assist NDIS providers in managing their compliance systems, documentation, and operational workflows. Kind Compliance Pty Ltd ("Kind Compliance", "we", "us", or "our") is committed to protecting the privacy of individuals whose personal information is collected, stored, and processed through our Platform. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy applies to all users of the Kind Compliance Platform, including NDIS providers, workers, consultants, auditors, and any other individuals accessing the Platform.
"Platform" means Kind Compliance, including all features, tools, AI-generated content, and services. "Personal Information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. "Sensitive Information" includes health information, biometric information, criminal records, and other information defined as sensitive under the Privacy Act 1988 (Cth). "Participant" means an NDIS participant whose information may be entered into the Platform by a provider. "Provider" means the NDIS provider organisation using the Platform. "User" means any individual accessing the Platform, including providers, workers, consultants, and auditors. "Third-Party Service Provider" means external services integrated with the Platform, including payment processors, AI providers, and cloud storage services.
We collect the following types of information through the Platform: a) Account Information: • Full name • Email address • Password (encrypted) • Role within the organisation (e.g., administrator, manager, worker, consultant, auditor) • Organisation details (business name, ABN, NDIS registration number) b) Provider Organisation Information: • Business name and trading names • Australian Business Number (ABN) • NDIS registration number and registration groups • Services provided • Provider contact details (address, phone, email) • Key personnel and organisational structure c) Participant Information (entered by the provider): • Name and date of birth • Address, phone number, and email • NDIS number • Emergency contact details (name, phone, relationship) • Support plan dates and details • Risk assessment information • Behaviour support plan status • Restrictive practices information • Communication profile and preferences • Support requirements and observations • Intake and discharge dates • Notes and handover logs relating to support provided d) Worker Information (entered by the provider): • Name and contact details • Position and employment type • Emergency contact details • Worker screening number and expiry • Blue card / Yellow card number and expiry • Police check details and expiry • First aid and CPR qualifications and expiry • Driver's licence details • Professional registrations • Training records and qualifications • Compliance status e) Compliance and Operational Data: • Uploaded documents (policies, procedures, forms, evidence) • Audit findings and corrective actions • Risk assessments and risk registers • Incident reports and complaint records • Continuous improvement records • Meeting minutes and governance documents • Service agreements and signed documents • Progress notes and handover logs • Activity logs (user actions, timestamps) f) Billing and Subscription Information: • Subscription plan and status • Billing cycle and payment history • Stripe customer identifier (payment card details are handled by Stripe and are not stored on our servers) g) Legal Acknowledgement Data: • Acknowledgement text and version • Date and time of acceptance • Internet protocol (IP) address • Device information and user agent h) Technical and Usage Data: • Browser type and version • Device type and operating system • Access times and duration • Pages visited and features used • Error logs and diagnostic data
We collect personal information through the following methods: a) Direct Collection: Information you provide when registering for an account, completing onboarding, entering participant or worker records, uploading documents, using forms, or communicating with us. b) Automated Collection: Technical and usage data collected automatically through cookies, logs, and analytics when you access the Platform. c) Third-Party Collection: Information collected through third-party integrations such as Google OAuth (for login), Stripe (for payments), and AI service providers (for content generation). d) Indirect Collection: Information entered by your organisation's administrators or colleagues, such as when a team member is invited to the Platform or when participant and worker records are created by authorised users.
We use personal information for the following purposes: a) Providing the Platform: • Creating and managing user accounts • Operating compliance management features • Generating compliance documents, policies, and recommendations using AI • Storing and organising documents, evidence, and records • Managing participant and worker records • Facilitating progress notes, handover logs, and incident reporting • Managing service agreements and signature workflows • Providing audit readiness tools and evidence tracking • Generating reports and analytics b) Communication: • Sending notifications about compliance deadlines, document reviews, and expiring credentials • Sending subscription and billing communications • Providing customer support and responding to enquiries • Sending regulatory updates and compliance alerts c) Billing and Subscriptions: • Processing subscription payments through Stripe • Managing subscription plans, trials, and renewals • Maintaining billing records and transaction history d) Security and Fraud Prevention: • Authenticating users and managing access • Detecting and preventing unauthorised access or fraudulent activity • Maintaining audit trails and activity logs • Monitoring Platform usage for security purposes e) Improvement and Development: • Analysing usage patterns to improve Platform features • Developing new features and functionality • Conducting quality assurance and testing • Improving AI-generated content quality and accuracy f) Legal Compliance: • Meeting legal and regulatory obligations • Responding to legal requests where required • Maintaining records as required by law • Enforcing our Terms and Conditions
We process personal information on the following legal bases: a) Consent: Where you have consented to the collection and processing of your personal information, such as during registration and onboarding. b) Contractual Necessity: Where processing is necessary to provide the Platform services under our Terms and Conditions and your subscription agreement. c) Legal Obligation: Where processing is required to comply with legal or regulatory obligations, including NDIS Practice Standards and record-keeping requirements. d) Legitimate Interests: Where processing is necessary for our legitimate business operations, including security, fraud prevention, and service improvement. e) Vital Interests: Where processing is necessary to protect the health, safety, or wellbeing of individuals, including in the context of incident management and safeguarding.
The Platform may collect and store sensitive information, including: • Health information relating to participants • Behaviour support plan details and restrictive practices information • Criminal history information (worker screening, police checks) • Biometric information (if biometric authentication is used) • Information about an individual's racial or ethnic origin, disability, or religious beliefs (where relevant to NDIS service delivery) We collect sensitive information only with your consent or where required by law. Sensitive information is handled with additional safeguards, including: • Restricted access based on role and permissions • Encryption in transit and at rest • Multi-tenant data isolation (organisation-level separation) • Audit logging of access to sensitive records You may withdraw consent for the collection of sensitive information at any time, however this may affect the ability of your organisation to use certain Platform features.
We may share personal information with the following parties: a) Third-Party Service Providers: • Stripe — payment processing and subscription management • AI Service Providers — for generating documents, recommendations, and reports • Cloud Infrastructure Providers — for hosting, storage, and database services • Email Service Providers — for transactional and notification emails Third-party providers are engaged under contractual arrangements that require them to handle personal information in accordance with applicable privacy laws and this Privacy Policy. They are only permitted to use personal information for the purpose of providing their services to us. b) Your Organisation: • Information entered by one user may be visible to other users within the same organisation, depending on their role and permissions • Organisation administrators can manage user access and data visibility c) Auditors and Consultants: • Where a provider grants access to an auditor or consultant through the Platform's access management features • Access is read-only unless specifically configured otherwise • Auditor access is time-limited and can be revoked at any time d) Legal and Regulatory Authorities: • Where required by law, court order, or lawful request from a government or regulatory authority • Where necessary to report incidents as required by NDIS Commission obligations • Where necessary to protect the rights, property, or safety of Kind Compliance, our users, or others e) Business Transfers: • In the event of a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to applicable privacy laws We do not sell personal information to third parties.
Kind Compliance is an Australian-based platform. However, some of our third-party service providers may store or process data outside of Australia, including: • Cloud infrastructure providers that may use data centres in other countries • AI service providers that may process data in international locations Where personal information is disclosed to overseas recipients, we take reasonable steps to ensure that the recipient handles the information in accordance with the Australian Privacy Principles. This may include contractual arrangements and assessing the privacy laws of the recipient's jurisdiction. Australian Privacy Principle 8 (APP 8) — Cross-Border Disclosure of Personal Information: Because personal information is stored and processed on servers located outside Australia, this constitutes a cross-border disclosure of personal information under APP 8 of the Privacy Act 1988 (Cth). This applies regardless of which overseas region our hosting provider uses (including the European Union, the United States, or any other jurisdiction), and regardless of that region's own data protection standards. Before such disclosure occurs, we take reasonable steps to ensure that overseas recipients do not breach the Australian Privacy Principles in relation to the information, consistent with our obligations under APP 8.1, unless an exception under APP 8.2 applies. By using the Platform, you acknowledge and consent to this cross-border disclosure and processing of your personal information outside of Australia, subject to the safeguards described in this section.
We take reasonable measures to protect personal information from unauthorised access, modification, disclosure, or loss, including: a) Technical Safeguards: • Encryption of data in transit using TLS/SSL • Encryption of data at rest • Secure authentication with token-based session management • Role-based access control with organisation-level data isolation • Regular security assessments and updates b) Operational Safeguards: • Restricted internal access to personal information on a need-to-know basis • Staff training on privacy and data protection • Audit logging of user activity and system access • Incident response procedures c) Infrastructure Safeguards: • Cloud hosting with reputable providers • Regular data backups • Network security controls While we take reasonable steps to protect personal information, no system is completely secure. We cannot guarantee the absolute security of information transmitted to or stored on the Platform.
This section is a truthful, good-faith disclosure of where the Platform's data is hosted and processed. It is not legal advice and does not constitute a guarantee that the Platform meets any particular legal or regulatory obligation. We are having this disclosure reviewed by a qualified privacy lawyer to ensure it meets our obligations under Australian privacy law, and it may be updated as that review progresses. Providers should not rely on this section alone to assess their own legal compliance — we encourage you to seek independent advice if your organisation has specific data residency or privacy obligations. The Kind Compliance Platform is built on Base44, a cloud platform-as-a-service provider. This means we don't run our own servers or data centres — the Platform's application, database, file storage, and authentication are all hosted and managed by Base44's cloud infrastructure. Base44, in turn, relies on third-party subprocessors to deliver its infrastructure. This means your data may be processed or stored by companies other than Kind Compliance, including: • Cloud infrastructure providers — hosting the servers, databases, and file storage that run the Platform • AI/LLM providers (including OpenAI, Google, and Anthropic) — processing text and documents when you use AI features like document generation, compliance reviews, or writing assistance • Stripe — processing payments and subscriptions (Stripe handles all card details directly; we don't store them) • Google — providing the "Sign in with Google" option, if you use it What this means for you: • Your data is stored in the cloud, not on servers we own or control. By default, all data hosted by Base44 — including database records and uploaded files — is stored in data centres located in the United States. We cannot guarantee that your data will remain within Australia. • Participant and provider data may be processed by service providers located outside Australia, including the United States. This includes cloud hosting providers, AI/LLM providers, payment processors, and authentication providers used to deliver the Platform's features. • When you use AI features, the content you submit is sent to AI providers for processing. We don't knowingly use your data to train AI models. • Payment card details never touch our servers — they go directly to Stripe, which processes them according to its own security standards. • Each organisation's data is kept separate from other organisations on the Platform through role-based access controls and organisation-level data isolation. • We are responsible for the Platform's security configuration, access controls, and data isolation rules. Our providers are responsible for the security of the underlying infrastructure. As an Australian NDIS platform, storing personal information on servers located outside Australia — whether in the European Union, the United States, or any other overseas region — constitutes a cross-border disclosure of personal information under Australian Privacy Principle 8 (APP 8) of the Privacy Act 1988 (Cth), regardless of which overseas region is used. See section 9 (Cross-Border Disclosure) for details of our obligations and the steps we take in relation to this disclosure. If your organisation has specific requirements about where data can be stored (for example, it must remain within Australia), please contact us before using the Platform — currently, the Platform's data is hosted in the United States by default, and we are unable to guarantee Australian-only data residency. We are working toward more localised, Australian-based data hosting as the platform grows and will update this policy if and when Australian data residency becomes available.
We retain personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with legal and regulatory requirements. a) Active Accounts: Information is retained for the duration of your subscription and while your account is active. b) Deactivated Accounts: If you deactivate your account, your data is retained for 90 days to allow for reactivation. During this period, your account is disabled and access is suspended. c) Permanently Deleted Accounts: If you permanently delete your account, data not subject to legal retention obligations is permanently removed. However, certain records—including participant records, worker records, incident reports, compliance evidence, policies, registers, and audit documentation—must be retained for a minimum of 7 years (or until a minor turns 25, where applicable) in accordance with NDIS and other legal record-keeping requirements. These records are retained in a secure, access-restricted archive and are permanently destroyed only after the applicable retention period expires. This action cannot be undone. d) Legal and Regulatory Requirements: Certain information may be retained for longer periods where required by law, including NDIS record-keeping requirements, audit evidence retention, and legal hold obligations. e) Subscriptions: Billing and transaction records may be retained for the period required by taxation and financial regulations.
Under the Australian Privacy Principles, you have the following rights regarding your personal information: a) Access: You may request access to the personal information we hold about you. You can access much of your information directly through the Platform, or you may submit a formal access request. b) Correction: You may request correction of inaccurate or outdated personal information. Most information can be updated directly through the Platform's profile and settings features. c) Deletion: You may request deletion of your personal information. Account deletion is available through the Platform's Settings → Danger Zone. Data not subject to legal retention obligations is permanently removed; certain records—including participant and worker records, incident reports, and compliance evidence—are retained for a minimum of 7 years (or until a minor turns 25, where applicable) as required by NDIS and other legal record-keeping requirements. d) Withdrawal of Consent: Where we rely on your consent to process personal information, you may withdraw that consent at any time. Withdrawal of consent may affect your ability to use certain Platform features. e) Complaint: If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC). To exercise any of these rights, please contact Kind Compliance support through the Platform's help centre.
The Platform uses cookies and similar technologies to: • Authenticate and maintain user sessions • Remember preferences and settings • Analyse usage patterns and Platform performance • Detect and prevent fraud Cookies are small data files stored on your device. You can control cookies through your browser settings, however disabling cookies may affect the functionality of the Platform. We do not use cookies for advertising or cross-site tracking purposes.
The Platform uses artificial intelligence (AI) to generate documents, recommendations, reports, and other content. When using AI features: a) Data Processing: Information you enter into AI-powered features (such as document generation or compliance recommendations) is processed by our AI service providers to generate responses. b) Data Minimisation: We aim to send only the information necessary for the AI to generate the requested content. c) Human Review: All AI-generated content must be reviewed and approved by an authorised representative of your organisation before implementation. The Platform does not make automated decisions that significantly affect you without human oversight. d) No Training on Your Data: We do not knowingly use your personal information or uploaded documents to train AI models for general use. AI service providers are engaged under contractual terms that restrict the use of your data for model training. e) Quality and Accuracy: AI-generated content may contain errors or inaccuracies. We continuously work to improve quality but cannot guarantee the correctness or completeness of AI-generated outputs.
The Platform is designed for use by NDIS providers and their workforce. We do not knowingly collect personal information directly from children under 16 years of age. Participant information entered into the Platform may include information about children (e.g., NDIS participants under 18). This information is entered and managed by the provider organisation, which is responsible for obtaining appropriate consents from parents or guardians. If you believe we have collected personal information from a child in a manner that is not appropriate, please contact us so we can investigate and take appropriate action.
As a Platform used by NDIS providers, we acknowledge the specific privacy obligations that apply to NDIS service delivery, including: a) NDIS Practice Standards: The Platform supports providers in meeting the NDIS Practice Standards, including those relating to privacy and dignity. b) NDIS Code of Conduct: We recognise the importance of respecting the privacy of people with disability and handle participant information accordingly. c) NDIS Quality and Safeguards Commission: Providers may be required to report certain incidents to the NDIS Commission. The Platform supports incident management and reporting workflows but does not itself report to the Commission on behalf of providers. d) Participant Consent: Providers are responsible for obtaining appropriate consent from participants (or their representatives) before entering participant information into the Platform, consistent with NDIS requirements. e) Information Sharing: Providers remain responsible for ensuring that information sharing through the Platform complies with applicable NDIS rules and guidelines.
The Platform operates on a multi-tenant architecture with organisation-level data isolation. This means: • Each provider organisation's data is logically separated from other organisations • Users can only access data belonging to their own organisation • Data access is controlled through role-based permissions • Organisation administrators manage user access within their organisation This ensures that your organisation's data is not accessible by other organisations using the Platform.
Users have control over their account through the Platform's account management features: a) Deactivation: You may deactivate your account at any time through Settings → Danger Zone. Deactivation: • Disables your ability to log in • Cancels your subscription at the end of the current billing period • Pauses compliance reminders and notifications • Retains all data for 90 days (recoverable within this period) b) Permanent Deletion: You may permanently delete your account at any time through Settings → Danger Zone. Permanent deletion: • Removes data not subject to legal retention obligations, including provider profile settings, user preferences, and active subscription configuration • Retains participant records, worker records, incident reports, compliance evidence, policies, registers, and audit documentation for a minimum of 7 years (or until a minor turns 25, where applicable) as required by NDIS and other legal record-keeping obligations • Is irreversible for data that is permanently removed; retained records are destroyed only after the applicable retention period expires • If you re-register with the same email, no previous data will be available, except for records retained under legal retention obligations c) Organisation Transfer: Account owners may transfer ownership of the organisation to another user before deletion, ensuring continuity of access for the organisation.
In the event of a data breach that is likely to result in serious harm to any individuals, we will: • Take immediate steps to contain and assess the breach • Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) • Provide information about the breach, the data involved, and steps individuals can take to protect themselves • Take corrective action to prevent similar breaches in the future
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. • Material changes will be notified through the Platform or via email • The effective date will be updated at the top of this policy • Continued use of the Platform after changes constitutes acceptance of the updated policy • We encourage you to review this Privacy Policy periodically The current version and effective date are displayed at the top of this page.
The Platform may contain links to third-party websites or services, including: • NDIS Commission website • Regulatory resources and guidance • Third-party integrations We are not responsible for the privacy practices of these external websites. We encourage you to review the privacy policies of any third-party websites you visit.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact: Kind Compliance Pty Ltd Email: support@kindcompliance.com.au Website: https://kindcompliance.com.au If you are not satisfied with our response to a privacy concern, you may contact: Office of the Australian Information Commissioner (OAIC) Phone: 1300 363 992 Website: www.oaic.gov.au Effective Date: 15 August 2026 Version: 1.1