How ProvidHQ collects, uses, stores and protects your personal information — written in plain English, compliant with Australian law.
The short version: We only collect what we need to run the service. Your data is stored in Australia. We never sell it. We never share it without your permission unless required by law. You can access, correct or delete your data at any time. We are bound by the Privacy Act 1988 (Cth) and all 13 Australian Privacy Principles (APPs).
ProvidHQ is operated as a sole trader business registered in Victoria, Australia. We are the data controller for all personal information collected through this website and the ProvidHQ application.
Privacy contact: privacy@providhq.com.au
Response time: Within 5 business days for all privacy-related requests
Regulator: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
Note: We voluntarily comply with all 13 Australian Privacy Principles regardless of turnover threshold, because we handle sensitive health-adjacent data (NDIS participant records).
When you create an account or contact us, we may collect:
To deliver the ProvidHQ service, we store data you input, including:
You remain the data controller for all service data. We act as a data processor on your behalf. You are responsible for ensuring you have the appropriate consent and legal authority to enter participant information into ProvidHQ.
We automatically collect limited technical data when you use our service:
We collect and use personal information only for these stated purposes:
We will not use your personal information for any secondary purpose without notifying you and, where required, obtaining your consent.
When you generate a progress note, relevant session observations are sent to a third-party AI API provider to generate the note text. The AI does not receive participant NDIS numbers, dates of birth or any sensitive identifying information beyond what you type into the observations field.
Our current AI providers are:
Cross-border disclosure notice (APP 8): Under APP 8 of the Privacy Act 1988, we remain responsible for how overseas recipients handle your data even after transfer. While we use contractual measures with AI providers, you should be aware that AI processing occurs on servers outside Australia. We minimise the personal information sent to these providers and do not send full participant profiles. If you have strict data sovereignty requirements, contact us at hello@providhq.com.au to discuss options.
All ProvidHQ account data, participant records, notes, invoices and compliance records are stored on Australian servers (AWS Sydney region, ap-southeast-2). We take the following security measures:
No system is 100% secure. In the event of a data breach likely to cause serious harm, we will notify affected users and the OAIC as required under the Notifiable Data Breaches (NDB) scheme under the Privacy Act. We will notify you within 30 days of becoming aware of an eligible breach, or sooner where practicable.
We do not sell your personal information. We share it only with:
We do not share your data with advertisers, data brokers, analytics platforms or any party not listed above.
Under the Privacy Act 1988 and Australian Privacy Principles, you have the right to:
To exercise any of these rights, email privacy@providhq.com.au. We will respond within 5 business days and action your request within 30 days.
We use cookies and similar technologies on our website and application. While Australian law does not explicitly mandate cookie banners, under the Australian Privacy Principles we must inform individuals about how their data is collected and used — including via cookies and tracking technologies.
We do not use advertising cookies, cross-site tracking pixels, social media tracking or any third-party marketing cookies.
You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using the service. See our Cookie Policy for full details.
ProvidHQ uses AI to generate progress notes, invoices and compliance suggestions. These are assistive outputs only — no automated system makes decisions that legally or significantly affect you or your participants without human review.
You always review, edit and approve AI-generated content before it is used. The AI is a writing assistant, not a decision-maker.
From 10 December 2026, the Privacy and Other Legislation Amendment Act 2024 introduces new transparency requirements for automated decision-making in privacy policies. We will update this section before that date to ensure full compliance.
We will only send you marketing communications if you have expressly consented (e.g. by signing up to our waitlist or opting in during registration). Every marketing email includes an unsubscribe link. We will action unsubscribe requests within 5 business days.
We comply with the Spam Act 2003 (Cth), which requires that all commercial electronic messages sent from Australia must have your consent, identify the sender and include an unsubscribe mechanism.
ProvidHQ is not directed at children under 16. We do not knowingly collect personal information from children. NDIS participants whose information is entered into ProvidHQ by providers may include children — in these cases, the provider (our customer) is responsible for ensuring they have appropriate consent and authority from parents or guardians to enter that information.
A Children's Online Privacy Code framework was introduced by the Privacy and Other Legislation Amendment Act 2024. When the Code is finalised by the OAIC, we will update our practices to comply. We will publish any updates to this policy on this page.
We retain personal information for as long as necessary to provide the service and comply with legal obligations:
Some of our service providers are located outside Australia, including the United States. Under APP 8, before disclosing personal information to overseas recipients, we take reasonable steps to ensure they handle it in a manner consistent with the Australian Privacy Principles.
Countries to which we may disclose personal information: United States of America (Anthropic, Google, Stripe).
Measures we rely on include contractual data processing agreements, provider privacy commitments and our practice of minimising the personal information sent to overseas providers.
We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. If we experience a data breach that is likely to result in serious harm to any individual, we will:
We may update this policy as our service evolves or as Australian privacy law changes. We will notify you of material changes by email at least 14 days before they take effect. The updated policy will be published on this page with a new "Last updated" date.
Continued use of ProvidHQ after changes take effect constitutes acceptance of the updated policy.
If you believe we have mishandled your personal information, please contact us first at privacy@providhq.com.au. We will investigate and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
From 10 June 2025, individuals also have the right to bring a statutory tort action for serious invasions of privacy under the Privacy and Other Legislation Amendment Act 2024.