Privacy and security
Privacy and your data
What we store, what we recommend you never upload, and the control you keep.
You are preparing to be trusted with other people's most personal information. It would be strange if we were careless with yours.
What we hold
- Your business details, profile answers and the documents generated from them
- Your roadmap, training records, evidence records and audit preparation
- Records about workers and participants that you choose to enter
- Files you choose to upload
Participants are recorded by identifier
We ask for an identifier — initials or a preferred short name — rather than full names. You do not need to enter a participant's full identity to prepare well, and less identifying information means less risk.
What we recommend you never upload
- Identity documents such as passports, driver licences and Medicare cards
- Behaviour support plans
- Clinical or health information
- Complete participant files
For all of these, record that you hold the document and where it is kept. Auditors sight originals in your own systems anyway, so uploading a copy adds risk without adding benefit. The product marks these items as sensitive and recommends the record-only option.
Security and access
Uploaded files are stored encrypted, and access to files is logged. Only people you invite to your organisation can see your information. Our staff access customer information only where it is needed to provide a service you have asked for, such as an expert review you requested.
Your control
- You can delete files you have uploaded
- You can export your data
- You can close your account and ask for your data to be deleted, subject to any records we are required to keep
Who we are not
Easy Compliance is independent of the NDIS Quality and Safeguards Commission. Nothing you enter here is sent to the Commission or to an auditor unless you send it yourself. We do not lodge your application, and we cannot see your Commission portal.
If you have a privacy concern about how we handle your information, contact us — and if you are not satisfied, you can raise it with the relevant privacy regulator.
