Privacy Policy

Last updated: 9 October 2026

1. Who we are

Support Work (supportwork.app) is run by NDM Co Pty Ltd ("we", "us").

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains what we collect, why we collect it, who can see it, where it is stored, and how you can change or delete it. It is part of our Terms.

Questions? Email us at .

2. The short version

We only collect what the app needs to work.
We do not sell or rent your information.
Participants choose who they connect with. They can remove people at any time.
A participant's phone location is only taken when they hold the Help button.
A worker's GPS is only recorded while they are clocked in.
You can delete your account at any time.

3. Who uses Support Work

Workers: support workers, sole traders, agency staff, subcontractors and volunteers.
Businesses: business owners, agencies and plan managers who run a team.
Participants: people who receive support. A family member or plan manager may set up the account for them.

4. What we collect

### Everyone

Your name, email, mobile number and password (or Google sign-in).
Device and network details, like your IP address and browser type, and basic app logs. We use these to keep the app working and secure.
Messages you send us.

### Workers and businesses

Shift times, breaks, support notes, incident notes, photos and receipts.
GPS location at clock-in, at clock-out, and about every minute while you are clocked in.
Participant details you enter, like names, addresses, NDIS numbers and plan manager details.
Rates, invoices, business details and emergency contacts.
Voice recordings, if you use dictation (see section 9).
Billing details. Stripe handles card payments. We never see or store your full card number.

### Participants

Your name, mobile, address, date of birth and NDIS number.
Your support needs, mobility and access needs, care notes and emergency contacts.
Files that you or your helpers upload, like your NDIS plan or care plan.
The people you connect with, and who is on your on-call list.
Your emergency alerts, including your location at the time of each alert.

5. Sensitive information and consent

Health and disability information is "sensitive information" under the Privacy Act. This includes NDIS plans, support needs, care notes, incident notes and similar records.

We only collect sensitive information with your consent, or where the law allows it.

Participants give consent when they tick the consent box during setup.
If a family member or plan manager sets up the account, they confirm that the participant agrees, or that they are allowed to agree for them.

You can withdraw consent at any time by deleting the information or your account (see section 11). Some parts of the app will not work without it.

6. Location

### Workers

GPS is only recorded while you are clocked in: at clock-in, at clock-out, and about every minute during the shift. In the phone app this includes when the screen is locked.
It stops when you clock out.
While you are clocked in, your latest location is also used to check if you are near a participant who needs help (see section 7).
Your business owner can see your location while you are on shift, and the location trail of your shifts.

### Participants

We only take your phone's location when you hold the Help button.
We do not track you at any other time.
If you enter your home address, we store it and may look up its map position, so your helpers can find you.

7. Emergency alerts

When a participant holds the Help button, we send an alert straight away. The alert shows:

your name,
your mobile number,
your location when you pressed the button, with the time and how accurate it is (if your phone could find it).

The alert goes to:

your on-call list,
the workers and plan managers you are connected with who get alerts,
if you allow it, Support Work workers who are on shift within about 10 km. They may not know you, but they may be able to help fast.

Nearby alerts are on unless you turn them off. You can turn them off at any time in Settings.

If your location cannot be found, the alert still goes out and says the location is unavailable.

Workers can also send a help alert during a shift. It goes to their team with their name, the participant's name and their location.

Support Work is not an emergency service. In an emergency, call 000.

8. Who can see your information

You can always see your own information.
Participants: the workers and plan managers you connect with can see your profile details and your files. A plan manager who sets up your account can also be an admin. An admin can change your details, manage your people and on-call list, and add or delete files. You can remove any connection at any time.
Workers: your business owner (and their admins) can see the shifts, notes, locations and invoices you record for them. Your emergency contact is shown to your business owner only while you are clocked in on a shift for them.
Participants and plan managers see the invoices you choose to send them.
Service providers who help us run the app (see section 9).
Others, only if you ask us to, or if the law requires or allows it (for example, a court order, or to prevent a serious threat to someone's life, health or safety).

We do not sell or rent your information.

9. Service providers and where your data is stored

We use these providers to run Support Work:

Database and file storage: Supabase, hosted on Amazon Web Services in Mumbai, India. This is where your account, records, files and alerts are stored.
App hosting and network: Lovable and Cloudflare. Their servers are in many countries, including the USA.
Payments: Stripe (USA and other countries).
Push notifications: Google Firebase (USA), Apple, and your web browser's notification service.
Voice dictation: your recording is sent through Lovable's AI service to Google (Gemini) to turn it into text. We do not keep the recording.
Maps and address lookup: OpenStreetMap (UK and Europe). When you see a map, your device loads map images from OpenStreetMap, which can see your IP address. Addresses are looked up using OpenStreetMap's search service.
Google sign-in, if you use it (Google, USA).
Email: Zoho (Australia) for our help inbox.

This means your information may be stored or handled outside Australia, mainly in India and the USA. We take reasonable steps to make sure these providers protect it in line with the Australian Privacy Principles.

10. Keeping your information safe

Information is sent over encrypted connections (HTTPS).
Access rules in our database stop people from seeing information that isn't theirs.
Files are kept in private storage.
No system is perfectly safe. If a data breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), as the law requires.

11. Your choices

Change your details: in the app, under Profile, Settings or My info.
Remove a helper: participants go to My people and tap Remove. That person loses access straight away.
Turn off nearby alerts: participants go to Settings and turn off "Alert nearby workers".
Delete a file: open the file and tap Delete. It is removed for everyone.
Delete your account: in the app (Settings or Profile, then Delete my account), or follow the steps at supportwork.app/delete-account.
Marketing: we only send marketing if you opt in. You can opt out at any time.
See or correct your information: email us. We will reply within 30 days.

12. How long we keep information

Shift, GPS, support note, incident, audit and invoice records (Compliance Records) are kept for seven (7) years from when they were made. This includes after a subscription ends or an account is deleted. NDIS and tax rules can require businesses to keep these records.
When an account is deleted, we remove personal identifiers from kept Compliance Records where we can.
When a participant deletes their account, their profile, connections and files are deleted. Emergency alert records are kept as part of the safety record, with the participant's name and phone number removed.
Other information is deleted or made anonymous when we no longer need it.

13. Cookies and local storage

We use cookies and your device's storage to keep you signed in, remember your settings and save your work while you are offline. We do not use advertising cookies.

14. Complaints

If you are unhappy with how we handled your information, email us first at . We will reply within 30 days.

If you are still not happy, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or call 1300 363 992.

15. Changes to this policy

We may update this policy. We will change the date at the top. If the change is big, we will also tell you in the app.

16. Contact us

NDM Co Pty Ltd, trading as Support Work (supportwork.app)

Email: