Participant information protected as the health information it is
CareHub keeps the records an NDIS audit asks for as a side effect of normal work, and gives you the controls and tools your privacy duties need. Here is what is actually in place.
Two-factor sign-in, and a second check before sensitive actions
- Authenticator app codes with ten single-use recovery codes. A device can be remembered for 7 days.
- Always required for owners and admins, on every plan. An organisation can require it for everyone as well.
- Step-up: the password and a fresh code are asked again before creating API tokens, issuing reset links, changing role permissions, turning two-factor off, releasing a privacy export or scheduling a deletion.
- Passwords stored as salted PBKDF2-SHA256 hashes; common passwords refused; repeated failures pause sign-in for that email for 15 minutes.
- Reset links issued by the office, valid for 24 hours and usable once.
- One login per person across organisations; a switch between organisations is recorded in both, and neither learns about the other.
Access by role
- Built-in roles (owner, admin, coordinator, support worker, family), each seeing only what the job needs.
- Custom roles from permission keys per module and action: for example a team leader who sees the roster but not pay rates.
- Workers see only their own shifts and the participants they are rostered with.
- Families see only what the office allows for each participant.
- Each provider's data is isolated: another provider's records are simply not found.
Who did what, and when
Every change, sign-in, failed sign-in, approval, export and document download is recorded with the person and the time, and written in plain English.
- Filter and export the log.
- A History tab on each participant and staff member.
- Timesheet corrections are logged, so an adjusted visit is never a mystery.
- A settings history with old and new values, and a "rules in force" list.
- Every report download is recorded with its filters.
Worker checks
- NDIS Worker Screening, police check, Working With Children Check, first aid, CPR, licence, insurance and your own check types.
- A mandatory check that expires blocks rostering that worker until it's renewed.
- Suspensions and bars recorded; checks verified; nothing deleted.
- See Workforce.
Your duties under the Privacy Act, built in
Every plan includes the tools to answer requests, keep records for as long as the law asks, and destroy them afterwards with a record of what was destroyed.
Request register
Access, correction, deletion and complaint requests with a due date 30 days after receipt and a task for the person responsible. What was sighted to check identity is noted, never copied.
Participant export
One participant's record as a ZIP. A reviewer removes other people's names before release, which needs a step-up; the download link lasts 7 days and each download is logged.
Statements
A participant's own statement about a record they disagree with, shown on their profile and in printed summaries.
Retention
Records kept 7 years after the last support or until the participant turns 25, whichever is later; incidents, complaints, screening and invoices 7 years. You can lengthen these, never shorten them.
Deletion with a tombstone
Owner only, with step-up, and scheduled 7 days ahead so it can be cancelled. Invoices and registers stay, de-identified; a tombstone records what was removed. Nothing is destroyed automatically.
Breach register
When a possible breach was found, what happened, who is affected, the 30-day assessment date, and when the OAIC and the people were told.
How participant data is protected
Built by an infrastructure and data engineering team, with privacy designed in rather than bolted on.
- Hosting: database and documents created in Cloudflare's Oceania region.
- Sessions: secure, HttpOnly cookies that are never sent from other websites; changes from another site are refused; sessions end on password change.
- Documents: stored privately, downloadable only after a permission check, with a "restricted" flag for sensitive files.
- Phones: the worker app keeps only the worker's own visits for about a day, and clears them at sign-out.
- Calendar feeds: private, revocable links that never carry phone numbers, notes or health information; by default they show initials and the suburb, not names and addresses.
- Open API: tokens limited to scopes, expiring, stored only as hashes, rate limited, and acting with one person's permissions. No health, incident or note data.
- Web security: encrypted connections and a strict content security policy.
- No trackers: no advertising, analytics or AI services receive participant data, and server errors are recorded in CareHub's own database rather than a third-party error service.
Ready for your next audit
- Incidents with the NDIS Commission's notification and 5-day report deadlines, investigations and actions.
- Complaints, risk, continuous improvement and restrictive practices registers.
- Service agreements with the clauses each programme requires.
- Policies workers read and confirm, against the exact version.
What we don't claim
CareHub does not hold a security certification, and we don't describe it as compliant with any framework on your behalf. You remain responsible for your obligations; CareHub gives you the controls and records listed on this page. We're happy to go through them with your compliance lead.
Questions from your compliance lead?
We're happy to go through security, data handling and hosting in detail.