Goodo Safeguarding and Incident Response Policy

Draft for legal review — not yet legal advice

Many people on Goodo are at higher risk of harm: abuse, neglect, exploitation, financial abuse, coercion and isolation. Safeguarding is not a feature we add on top. It shapes who can talk to whom, what staff can see, and how fast we respond.

This policy covers: the risks we plan for, how we detect them, how fast we respond, who we tell, what staff may and may not do, how we keep evidence, and where people can get help. It is read together with the Moderation Policy, Community Guidelines and Privacy Policy.

1. Principles

1. The person at risk comes first. Their safety matters more than our reputation or convenience.
2. Respect autonomy. We do not take over people's decisions. We act to stop harm, and we support people to make their own choices.
3. Say little, say it carefully. We share personal information about a person only as far as needed to protect them or others, and as the law allows.
4. Do not tip off an offender. If telling a person about an investigation could put someone at risk, we do not.
5. Plain language and accessible formats in every message we send during an incident.
6. Keep records of what we did and why.

2. What the product already does

These rules are built into the database, not left to policy alone.

• Participant-initiates messaging. Providers cannot start a conversation with a participant, nominee or carer. They can reply only after the participant has written, and only while the conversation is open. Either person can close a conversation. A participant can reopen it by writing again. Blocks stop both starting and replying.
• Conversations are created through one controlled function. Direct inserts are refused.
• Staff can read a conversation only when it has an open or triaged report (against the conversation or one of its messages) or contains a message flagged by our filter. Otherwise private messages are not browsable by staff.
• Providers can never discover participants through location search. Location is opt-in, postcode-only, shown only as distance bands.
• Only verified participants, nominees and carers can create groups. Providers can join open groups but cannot found them.
• Events belong to a group or community. Provider-hosted events are labelled. The exact address and online link are visible only to the host, staff, confirmed attendees and the support worker a confirmed attendee is bringing.
• Role-restricted spaces (for example the workers lounge) do not leak into the main feed.
• Report and block are reachable within two taps from any content.
• Captions are mandatory. Uploads without captions are not published.
• Credentials expire. Badges drop automatically when a credential lapses.

3. Risk register

The register is reviewed every 6 months, after every serious incident, and whenever a new feature is added.

4. Detection

We find out about risk in four ways.

1. Reports from users. Every report goes to the reports queue. Report reasons are: harassment, hate, self-harm, sexual content, violence, scam or inducement, misleading claim, privacy breach, impersonation, conflict of interest, and other. A report can target a video, profile, comment, message, conversation, group or event.
2. Message filter flags. Every direct message is checked by a rule-based filter. Messages that match patterns (phone numbers, bank details, phrases such as "pay me directly", sexual content markers) are flagged and enter the flagged-messages queue. A flagged message is not blocked. It is sent to a person for review. Flagging is a signal for a human to check, not a finding.
3. Automated scans of videos, captions and text. Videos that are flagged go to the video review queue and are not published until reviewed.
4. Staff observation during vetting, such as inconsistent documents, odd vouching, or reviews of provider content.

Where a report or flag suggests a person may be at risk of immediate harm, it is treated as urgent, whichever queue it is in.

5. Triage and response times

We measure time from when the report or flag is created to when a trained person first looks at it and takes a first step.

Priority is set by the reviewer, not only by the reason chosen. A report marked "other" that describes abuse is P2. Reviewers can raise priority at any time, and must when in doubt.

[Coverage: a 1 hour and 4 hour response at all hours needs an on-call roster. During the invite-only phase we will publish our actual cover hours in the app and say clearly that Goodo is not an emergency service. This commitment needs a decision from the founder.]

First steps for P1:

1. Look at the content and context. Show the person supportive messages and resources (section 9). Do not leave a person in crisis without a response because the content is "just a post".
2. If someone appears to be in immediate danger and we can reasonably identify them, we may contact emergency services (000). Privacy law allows this where it is necessary to lessen or prevent a serious threat to life, health or safety.
3. Contact the person with a caring, non-judgemental message and resources. We do not punish people for expressing distress.
4. Remove or limit content that shows methods or encourages others, but keep a copy for the record (section 8).
5. Record every step in the case file.

First steps for P2:

1. Preserve evidence first (section 8).
2. Limit risk: hide the content, restrict or suspend the account, close the conversation, or revoke the badge, as needed.
3. Decide on referral (section 6) and make it.
4. Contact the person at risk, if the safe way is available, with support and options.
5. Record every step in the case file.

6. Escalation and referrals

Which one is it? If unsure, escalate to the safeguarding lead, who decides. When in doubt, refer.

Consent and telling people.

• Where it is safe and practical, we tell the person at risk what we are doing and why, and ask what they want.
• A person's wish for privacy does not stop us acting where there is a risk of serious harm to them or to others, or where the law requires.
• We do not tell a person we are investigating, or tell a provider about a complaint, if that could put someone at risk or interfere with a police or Commission investigation.

7. Mandatory and voluntary reporting

[Counsel to confirm the points below. They are not final legal conclusions.]

• NDIS reportable incidents are a legal duty on registered NDIS providers, not on Goodo. Registered providers must notify the NDIS Commission of reportable incidents (such as the death or serious injury of a participant, abuse or neglect, unlawful sexual or physical contact, sexual misconduct, and unauthorised use of a restrictive practice) within the required timeframes. Goodo is not a registered provider. If we learn of a possible reportable incident, we treat reporting to the Commission as a voluntary step that we will normally take, and we encourage the reporter to contact the Commission too.
• Child abuse and sexual offences. State and territory laws differ on who must report suspected child abuse, and some laws require any adult who knows or reasonably believes a child has been sexually abused to report it to police. We treat any suspected child abuse or sexual offence against a child as reportable to police and, where applicable, the relevant child protection authority. [State-by-state mandatory reporting obligations, and whether Goodo or its staff are mandatory reporters, to be confirmed.]
• Child sexual abuse material. Commonwealth law requires internet content hosts and similar services that become aware of such material on their service to refer it to the Australian Federal Police within a reasonable time. We do that, report it to eSafety, remove it, and do not keep or share copies other than as the AFP direct. [Section references and reporting method to be confirmed.]
• Concealing offences. Several states have laws about failing to report serious offences. Our policy is to report suspected serious crime to police.
• Voluntary reporting. Where there is no legal duty, we will report if we reasonably believe it is needed to prevent or respond to serious harm, and privacy law permits it.
• eSafety notices. We comply with removal notices and information requests from eSafety.
• Records. We record each decision to report or not report, with reasons.

8. Evidence preservation

When a case may involve harm, crime or a legal claim:

1. Preserve before you remove or tell anyone. Capture the content (video file, caption file, message text, comment, profile, group or event record), the account identifiers, timestamps, report details and moderation scores.
2. Hash it. Record a SHA-256 hash of each item so integrity can be shown.
3. Store it in a restricted case file separate from live systems, in Australia, with access limited to the safeguarding lead and the people they name. Access is logged.
4. Keep a chain-of-custody note: who captured what, when, from where, and who has seen it.
5. A legal hold overrides normal deletion. If the person deletes their content or their account, or retention periods end, the held copy stays until the hold is lifted. Preserved information is used only for safeguarding, legal and regulatory purposes.
6. Child sexual abuse material is not copied or stored by us except as the AFP or the law directs. We do not move it to personal devices, email it or screenshot it.
7. Disclosure. We disclose preserved material to police, regulators or courts through a lawful request or where privacy law permits. Another referral to a different authority is made only by the safeguarding lead.
8. End of hold. The safeguarding lead documents when a hold ends and the material is deleted.

[A legal-hold export function and a case file system are still to be built. Until then, preservation is done manually under this procedure.]

9. Staff access to private messages

1. Only when reported or flagged. Staff may open a conversation only when it has an open or triaged report that targets the conversation or one of its messages, or contains a message flagged by the filter. The database enforces this. Staff cannot search or browse private messages.
2. Need to know, and only what you need. Read only what is needed to decide the case. Do not read unrelated parts of a conversation. Do not copy messages except into the case file.
3. Write down why. Each time staff open a conversation, they record the case, the reason, and what they looked at. The system records who and when.
4. Conflicts. Staff must not review conversations involving people they know, or have worked or lived with. They hand the case to another person.
5. Close the loop. Once a flag or report has been dealt with, the reviewer marks it resolved so access ends. A conversation is not left open to staff without a live reason.
6. No discussion outside the case. Staff do not discuss message content except with people who need to know.
7. Misuse. Unauthorised access is a serious breach, may be an eligible data breach, and may lead to dismissal, notification to the OAIC and referral to police.
8. Participant protections. If staff are reading a conversation because a participant reported it, they take extra care to protect the participant's privacy and wishes.

10. Supporting the person

We give anyone affected clear information about where they can get help.

[All numbers and services are to be checked before each release.]

These details appear in the app wherever a person reports self-harm, is shown a crisis message, or has a conversation flagged for safety. They are available in Easy Read.

11. After an incident

• A review within 5 business days for any P1 or P2 incident: what happened, what worked, what did not, what to change.
• Update the risk register and, where needed, this policy.
• If personal information was involved in a breach, follow the Notifiable Data Breaches process in the Privacy Policy.
• Staff debrief and wellbeing support (see the Moderation Policy).
• Count it in the transparency report.

12. Roles

All staff and contractors who handle reports are trained on first joining and every year after. They are checked, including a National Police Check and [NDIS Worker Screening Check — to be confirmed whether roles need it], and bound by confidentiality.