Goodo Privacy Policy

Draft for legal review — not yet legal advice

Goodo ("we", "us") is operated by [Legal entity name TBC] (ABN [TBC]). We treat ourselves as bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) whether or not a particular exemption might apply to a business of our size. This policy explains how we collect, use, store and share personal information, and how you can access it, correct it, delete it, or complain.

An Easy Read version of this policy is published alongside it and kept in step with it.

The short version

• We collect as little as we can.
• We never store your ID document or your date of birth.
• Your evidence files are deleted after we review them.
• Your location is off unless you turn it on, and even then it is only a postcode. Other people only ever see a distance band such as "2–5 km".
• Your data is stored in Sydney.
• We do not sell your information and we do not show ads.
• Staff cannot browse your private messages. They can read a conversation only if it has been reported or our system has flagged a message.

Where to find each Australian Privacy Principle in this policy

1. Sensitive information and your consent (APP 3)

Being an NDIS participant, nominee or carer reveals information about a person's disability and health. This is sensitive information under the Privacy Act. Content you post in videos, comments and messages may also reveal health, racial or ethnic origin, religious, sexual or other sensitive information.

We collect sensitive information only with your consent, and only what we need to run Goodo. When you sign up, we ask for your consent separately for:

1. creating an account in a participant-side role, including showing a role badge on your profile
2. identity and role verification
3. the optional features you turn on, such as location and notifications

What other people can see. Your handle, display name, bio, avatar, state, role and badges are visible to other signed-in users. A participant, nominee or carer badge tells people you are connected to the NDIS. You can use a pseudonym as your display name and handle, and we encourage you to think about this before posting. Do not put your legal name or other identifying details in your bio unless you want them seen. [Whether participants can hide their role badge from the public is a product decision still to be made.]

You can withdraw consent at any time by changing your settings or deleting your account. Withdrawing consent may mean we can no longer provide some features (for example, you cannot hold a participant badge without verification).

2. What we collect, by feature

We do not collect precise GPS location. We do not collect your contacts. We do not use your camera or microphone except when you record or upload a video.

Unsolicited information (APP 4). If you send us information we did not ask for, we decide whether we could have collected it. If not, we delete or de-identify it unless the law requires us to keep it.

3. How we use and share information (APP 6)

We use personal information for the purposes for which we collected it, as described above, and for related purposes you would reasonably expect, including:

• providing and improving the service
• verifying identity and roles, and re-verifying when credentials expire
• keeping the community safe: handling reports, filtering messages for known risks, moderating videos, enforcing our rules
• responding to your questions, access requests and complaints
• meeting legal obligations
• producing aggregate, de-identified statistics for transparency reports

We may disclose information:

• to our service providers who help us operate (section 6)
• to the NDIS Quality and Safeguards Commission, police, the eSafety Commissioner, AHPRA or another authority if we reasonably believe it is necessary to prevent or respond to serious harm, or a possible offence, or where required or authorised by law
• to a court or tribunal, or under a lawful request
• with your consent

We do not sell personal information. We do not share personal information with advertisers. We do not give providers any list of participants, and providers cannot find participants through location search.

How automated systems are used. We use automated systems to: check IDs (via our vendor), match ABNs, Provider Register and AHPRA lookups, expire credentials on their dates, generate captions, scan videos for harmful content, hold videos for human review, and flag messages that match risk patterns (for example, phone numbers, bank details, requests to be paid directly, or sexual content markers). Automated systems can place a video into review or flag a message for a person to look at. Badges lapse automatically when a credential expires. We do not suspend or ban an account, or remove a badge for misconduct, based only on an automated result: a trained person makes those decisions and you can appeal them. [Wording for the December 2026 automated-decision transparency requirements to be confirmed by counsel.]

4. Direct messages and staff access

• Messages are private between the people in the conversation.
• Staff can read a conversation only when it has an open report, or a message in it has been flagged by our system. Staff cannot browse messages otherwise.
• Every time staff open a conversation, we record who, when and why.
• If you report a message or conversation, you are letting us read that conversation to look into it.
• Messages are not end-to-end encrypted. [Confirm in the Privacy Impact Assessment.]
• Participants write first: providers cannot start a conversation with a participant, nominee or carer.

5. Location (APP 3 and 5)

• Location is off by default.
• If you turn it on you enter a postcode. That is all.
• We store the approximate centre of the postcode, not your address. This is kept in a separate table readable only by you and authorised staff.
• When you search for people, groups or events near you, other people appear in distance bands ("under 2 km", "2–5 km", "5–10 km", "10–25 km", "25–50 km"), never exact distances. Results in each band are shuffled so repeated searches cannot be used to pin down where someone is.
• Searches reach out to a maximum of 50 km.
• Providers can never search for participants by location. Participants and carers can find peers and verified workers. Workers can find other workers.
• Only active accounts with a live badge appear in people search, and people you have blocked (or who have blocked you) never appear.
• You can turn location off at any time. When you do, you stop appearing in people search. We delete the stored postcode from our profile location table [timing in the Data Retention Schedule].

Groups and events show a suburb and postcode set by the person who created them. The exact address of an event is shown only to the host, confirmed attendees, the support worker an attendee is bringing, and staff.

6. Third parties we use (APP 6 and 8)

We use trusted service providers. They may only use personal information to provide services to us. [Vendors below are not final; the list will be completed before launch.]

Overseas disclosure (APP 8). Some providers, such as push notification services and some vendors, may handle information outside Australia. Before we give personal information to an overseas recipient we take reasonable steps to make sure it handles the information consistently with the APPs, usually by contract. We keep a list of countries and will publish it. [To be completed once vendors are chosen.] We will not use a vendor that cannot keep the content of videos or messages in Australia without first telling you and getting your consent where required.

We do not send sensitive information, message content or evidence to third-party analytics.

7. Direct marketing (APP 7) and spam

We use your email and mobile number to run your account: sign-in codes, safety notices, verification updates and changes to our policies. We send newsletters or promotions only if you opt in, and every message includes an unsubscribe option (Spam Act 2003). Providers on Goodo cannot use our systems to send you marketing.

8. Keeping information secure and deleting it (APP 11)

• Data is encrypted in transit and at rest.
• Access to evidence and private messages is limited to authorised staff on a need-to-know basis, protected by multi-factor authentication, and logged.
• Evidence files are opened only through short-lived links and are never shown from a public address.
• Identity documents and dates of birth are never stored by us.
• Personal information is kept out of application logs and analytics.
• We run security testing before launch and regularly after.
• When we no longer need information we delete or de-identify it. Our periods are in the Data Retention Schedule.

Summary of retention (the schedule has the detail):

9. Notifiable Data Breaches

If we have reasonable grounds to believe an eligible data breach has happened (unauthorised access, disclosure or loss that is likely to result in serious harm) we will:

1. contain it and investigate immediately
2. assess whether it is an eligible data breach within 30 days at most, and aim to do so within 72 hours
3. notify the Office of the Australian Information Commissioner (OAIC) and affected people as soon as practicable, with what happened, what information was involved, what we are doing, and what you can do
4. tell you directly (by email, in the app or both), not just on our website
5. record what we learned and fix the cause

Because most of our users are people with disability, our notifications are written in plain language and offered in accessible formats. Our response plan is tested at least once a year.

10. Your rights

Access (APP 12). You can ask for a copy of the personal information we hold about you. We will respond within 30 days. We give access in the format that suits you, including accessible formats. We can refuse in limited cases (for example, where giving access would unreasonably affect another person's privacy or put someone's safety at risk) and will tell you why.

Correction (APP 13). If information is wrong, out of date or misleading, tell us and we will correct it, or tell you why not. You can edit most profile details yourself in the app.

Deletion. You can delete your account in the app at any time (or ask us to). We will hide your profile immediately and permanently delete or de-identify your personal information within 30 days, except where we must keep information to meet legal obligations, handle a safety or legal matter (see section 11), or maintain a minimal record of bans. Backups roll off within 30 days. Messages you have sent are deleted with your account.

Anonymity and pseudonymity (APP 2). You can use a pseudonym as your public display name and handle. We need your real identity to verify you, but other users do not see it.

Government related identifiers (APP 9). Your NDIS number may be visible on plan evidence you give us. We use it only to check that evidence. We do not use it to identify you in our systems and we do not disclose it except as required by law.

Quality (APP 10). We take reasonable steps to keep information accurate and up to date, including re-verifying credentials when they expire.

11. Safety, legal obligations and holds

We may keep information that would otherwise be deleted where:

• there is an open report, investigation, appeal or complaint
• we have a reason to believe it relates to serious harm, exploitation, abuse or a criminal offence
• police or a regulator has asked us to preserve it, or the law requires it

Preserved information is stored separately, accessed by a small group of staff, and deleted when the hold ends.

12. Under-18s

Accounts are for people aged 16 and over. People aged 16 and 17 have the same protections as everyone else, and some features may work differently for them. We will follow the Children's Online Privacy Code when it comes into force. [Counsel to advise on consent capacity for 16 and 17 year olds, and on the Code.]

13. How this policy is managed (APP 1)

• We have a named privacy contact.
• We carry out a Privacy Impact Assessment before launch and when we make major changes.
• Staff with access to personal information are trained and bound by confidentiality.
• We review this policy at least once a year, and when features change. If we make a significant change we will tell you in the app before it starts.
• Version history is kept.

14. Complaints

If you think we have breached the Privacy Act or this policy:

1. Contact our privacy contact (below). We will acknowledge within 3 business days and aim to resolve within 30 days.
2. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, phone 1300 363 992.

You may bring a support person or an advocate to help you at any stage.

15. Contact

Privacy contact: [Name or role TBC] Email: [privacy email TBC] Post: [postal address TBC]