Privacy Policy

This Privacy Policy explains how Notion Tech Pty Ltd (ACN 698 318 124) (“Notion Tech Pty Ltd”, “we”, “us”, “our”), the provider of the Rosteryplatform (“Rostery”, the “Service”), handles personal information. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable, State and Territory health-records legislation.

1. Our role — controller vs processor

Rosteryis business-to-business software used by registered NDIS and disability service providers (each, a “Provider”) to run their operations. Where a Provider uploads or generates information about its workers, participants, clients, or their families through the Service, the Provider is the entity responsible for that information (the data custodian) and Notion Tech Pty Ltdacts as its service provider, processing that information on the Provider’s behalf and on its instructions. The Provider’s own privacy policy governs how it collects and uses that information. This Policy governs information for which Notion Tech Pty Ltd is responsible (for example, account holders, website visitors, and our direct customers).

2. Information we collect

• Account & contact information — name, email, phone, organisation, role, and login credentials.
• Billing information — plan, billing contact, and payment-related details (card data is handled by our payment processor, not stored by us).
• Operational data entered by Providers — staff records, rosters and shifts, participant/client records, care plans and goals, progress notes, medication records (eMAR), incidents, and invoices.
• Sensitive information — including health information about participants, recorded by Providers in the course of delivering supports.
• Location data — GPS location captured for electronic visit verification (EVV) clock-in/out, where enabled.
• Media — photos and voice recordings attached to notes, where the user chooses to add them.
• Usage & device data — log data, IP address, device/browser information, and analytics about how the Service is used.

3. How we use information

• To provide, operate, secure, support and improve the Service.
• To process billing and administer accounts.
• To send service, security and (where permitted) product communications.
• To detect, prevent and respond to fraud, abuse and security incidents.
• To comply with our legal obligations and to establish, exercise or defend legal claims.

4. Artificial intelligence features

Certain features (for example, note transcription, drafting assistance, summaries and risk indicators) use artificial-intelligence services. To deliver these features, relevant content may be processed by trusted third-party AI providers, which may be located outside Australia (including in the United States). We take reasonable steps to ensure such providers protect the information and use it only to provide the feature. AI outputs are assistive only, may contain errors, and must be reviewed by a qualified person before being relied upon (see our Disclaimer).

5. Disclosure

We do not sell personal information. We disclose it only to: (a) service providers who help us run the Service (such as cloud hosting, email/SMS delivery, payment processing and AI providers), under confidentiality obligations; (b) a Provider and its authorised users, in respect of that Provider’s data; and (c) others where required or authorised by law.

6. Cross-border disclosure

The Service is primarily hosted in Australia. Some service providers (including AI and communications providers) may store or process information overseas, including in the United States. Where we disclose information overseas we take reasonable steps to ensure it is handled consistently with the APPs.

7. Data security

We use encryption in transit and at rest, role-based access controls, tenant isolation, audit logging and regular backups, and we restrict access to authorised personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data breaches

We maintain procedures to assess and respond to data breaches and will comply with the Notifiable Data Breaches scheme under the Privacy Act. Where Notion Tech Pty Ltdacts as a Provider’s service provider, we will notify the Provider without undue delay so that it can meet its own notification obligations.

9. Retention

We retain information for as long as needed to provide the Service and as directed by the relevant Provider, and thereafter as required to meet legal, regulatory, NDIS record-keeping and accounting obligations (records may be required to be kept for up to seven years or longer). When no longer required, information is deleted or de-identified.

10. Your rights

You may request access to, or correction of, personal information we hold about you. If your information was provided to the Service by a Provider, we may direct your request to that Provider as the responsible entity. To make a request or raise a concern, contact us at info@rostery.com.au.

11. Account deletion

App users can request deletion of their account from within the Rosteryapp (Profile → Delete Account) or by contacting us. On request we deactivate the account and delete or de-identify associated personal information, except where we are required to retain certain records for legal, regulatory or NDIS compliance purposes.

12. Cookies & analytics

Our website and Service use essential cookies to operate and may use analytics cookies to understand usage. You can control cookies through your browser settings; disabling essential cookies may affect functionality.

13. Complaints

If you have a privacy complaint, contact us at info@rostery.com.au and we will respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted on this page with a revised date.

15. Contact us

Notion Tech Pty Ltd (ACN 698 318 124)
Email: info@rostery.com.au