Privacy Policy

NDIS Next Steps understands that NDIS documents can contain sensitive personal, health and disability information. This policy explains what information is processed when you use NDIS Next Steps, why it is needed and how it is handled.

Information you provide

Depending on how you use NDIS Next Steps, you may provide information about an NDIS situation, NDIS letters, plans, reports, supporting documents, images, pasted text and other information relevant to the review you request.

This information may include personal information and sensitive information, including health or disability-related information. If you provide information about another person, you should only do so where you are authorised to provide that information.

How your information is used

Information you provide through the review tool is used to generate the service you request, such as a plain-English summary, professional review, Action Pack, action plan, evidence suggestions, templates or draft documents.

NDIS Next Steps does not sell uploaded documents or personal information.

Uploaded documents

NDIS Next Steps does not keep copies of uploaded NDIS documents in a participant account or document database. Uploaded documents are processed to generate the review you request.

For PDF documents, text may be extracted from the document for processing. Uploaded images may be processed as images. This information is sent to the artificial intelligence service used to generate your requested review.

Artificial intelligence processing

NDIS Next Steps uses OpenAI's API to assist with generating summaries, reviews and Action Packs.

OpenAI states that information submitted through its API is not used to train its models by default. NDIS Next Steps also requests that responses are not stored as application state by the OpenAI Responses API.

OpenAI may retain limited API data for a period of time for purposes such as abuse monitoring, security and service operation in accordance with its own data retention practices.

Generated reviews and your browser

Your generated review may be stored locally in your web browser so that you can return to it. Browser storage is located on the device and browser you use and is not a participant document account maintained by NDIS Next Steps.

You can clear locally stored information by clearing the relevant website data in your browser.

Information we ask you not to provide

Please remove or redact information that is not needed for your review, particularly Medicare numbers, Tax File Numbers, bank account details and payment card numbers.

NDIS Next Steps uses safeguards intended to reduce the accidental submission of some high-risk identifiers in pasted text and readable PDF documents. These safeguards may not identify every instance, particularly information contained in images, so you should check your documents before uploading them.

Third-party service providers

NDIS Next Steps uses third-party technology providers to operate the service. These may include providers for artificial intelligence processing, website hosting, payment processing and database services.

Personal information may be processed outside Australia, including in the United States, by technology providers used to operate NDIS Next Steps. In particular, information provided for an NDIS review is transmitted to OpenAI for artificial intelligence processing.

Payments

Payments are processed by Stripe. NDIS Next Steps does not directly store your full payment card details.

Payment and transaction information may be retained where necessary to administer purchases, provide customer support, maintain transaction records and meet legal or financial obligations.

Professional Access Codes

If you purchase or use Professional Review credits, information relating to the Professional Access Code may be stored to manage review balances, record transactions and assist with customer support.

Data security

NDIS Next Steps takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

No online service can guarantee absolute security. Users should avoid providing information that is not necessary for the review they are requesting.

Retention

Uploaded NDIS documents are processed for the purpose of generating the requested review and are not intentionally retained by NDIS Next Steps in a participant document database.

Third-party service providers may retain information for limited periods in accordance with their service, security and legal requirements.

Other information that NDIS Next Steps needs to retain, such as payment records, Professional Access Code transactions or support correspondence, may be retained for as long as reasonably necessary for those purposes or to meet legal obligations.

Access, correction and deletion

You may contact NDIS Next Steps to ask whether personal information about you is held by us and to request access to or correction of that information, subject to applicable legal requirements.

You may also request deletion of personal information held by NDIS Next Steps where it is no longer required to be retained for legal or operational purposes.

Privacy concerns or complaints

If you have a question or concern about how your personal information has been handled, please contact NDIS Next Steps using the contact details published on this website.

We will review privacy concerns and complaints and respond within a reasonable period. If you are not satisfied with the response, you may also be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).

Changes to this policy

This Privacy Policy may be updated when the service, technology providers or privacy practices change. The current version and last updated date will be published on this page.

Contact

Privacy enquiries, access or correction requests and privacy complaints can be made using the contact details published on the NDIS Next Steps website.