Effective 27 October 2026
Who we are
Oriah is the trading name of Maxx Care Disability Pty Ltd (ABN 88 677 721 961), a registered NDIS provider operating in New South Wales and Queensland. In this policy, "Oriah", "we" and "us" mean Maxx Care Disability Pty Ltd.
We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the NDIS Practice Standards and the NDIS Code of Conduct. Where we hold health information, we also follow the health privacy laws of the state we operate in.
This policy covers three things: the supports we deliver, our website at oriah.au, and the Oriah staff app that our support workers use on their phones.
What we collect
Participants and the people who support them
To deliver NDIS supports safely we collect and hold information such as your name, date of birth, contact details, NDIS number and plan details, your goals and support needs, health and disability information, medication and behaviour support details, emergency contacts, and the names of family members, guardians, nominees and other providers involved in your care. During supports, our workers write progress notes and may record incidents, hazards, complaints and feedback. Photos are only taken where you or your decision-maker have given consent.
Support workers and job applicants
For people who work with us or apply to, we collect identity and contact details, home address, right-to-work and worker screening information, qualifications and certifications, availability, rosters, timesheets and pay details, and records of training, supervision and performance. Applicants who use our careers page send us a résumé and any documents they choose to attach.
Website visitors
If you use our contact, careers or feedback forms, we collect what you type into them. The feedback form can be submitted anonymously. Our web server records technical information such as IP address, browser type and pages requested, which we use to keep the site running and secure. We do not run advertising trackers or sell visitor data.
The Oriah staff app
The Oriah app is used only by our own support workers and administrators, who sign in with a work account issued by Oriah. It is not available to the public and does not create accounts on its own. The app asks for phone permissions only when a feature needs them, and you can refuse any of them in your phone's settings.
| Permission | What it is used for | What we keep |
|---|---|---|
| Location | Suggesting the nearest participant when you clock in to a shift, and recording where an incident or hazard report was made. Location is read only while you are using the app, never in the background. | A single position at clock-in or when a report is saved, plus the kilometres you choose to record for travel claims. |
| Camera and photos | Attaching a photo to a progress note, incident report or hazard report, where the participant's consent allows. | The photos you choose to attach. They are stored with the record they belong to. |
| Microphone | Dictating a note or report instead of typing it. Only when you tap the microphone. | The text. Audio is converted to text and the recording is not kept. |
| Phone number | Sending shift reminders and urgent incident alerts by SMS. | The work mobile number you give us. |
The app also records who created or changed a record and when. This audit trail is required by the NDIS Practice Standards and cannot be switched off. The app contains no advertising and no third-party analytics or tracking kits.
How we use information
- Planning, delivering and reviewing your supports, and keeping you safe.
- Rostering workers, recording the time they work, and paying them.
- Claiming payment from the NDIA or your plan manager for supports delivered.
- Meeting our obligations to the NDIS Quality and Safeguards Commission, including incident reporting, restrictive practice reporting and worker screening.
- Responding to your enquiries, complaints and feedback.
- Recruiting and onboarding workers.
- Keeping our systems secure and improving how they work.
We do not use your information for marketing without asking you first, and we never sell it.
Who we share it with
We share personal information only where it is needed to deliver your supports, where you have asked us to, or where the law requires it. That can include:
- The NDIA, your plan manager or support coordinator, for planning and payment.
- The NDIS Quality and Safeguards Commission, for reportable incidents, restrictive practice reporting and audits.
- Health professionals, allied health providers and other providers involved in your care, with your consent.
- Your nominated family members, guardians or nominees, in line with your wishes and any legal authority.
- Emergency services, where someone's safety is at risk.
- Our payroll, accounting and worker screening providers, for information about workers.
How we protect it
Records are stored in encrypted systems hosted in Australia, with access restricted to the workers and administrators who need it for their role. Workers can only see the participants they are rostered to support. Every view and change of a participant file is logged. Staff accounts use multi-factor authentication, and access is removed when a worker leaves. We review our security controls regularly and will notify you and the Office of the Australian Information Commissioner if a data breach is likely to cause you serious harm.
How long we keep it
The NDIS Practice Standards require us to keep participant records for at least 7 years after the last support was delivered. Records relating to children are kept until the person turns 25. Worker and payroll records are kept for at least 7 years after employment ends. Website form submissions are kept for as long as we need them to respond to you, and job applications are kept for 12 months unless you ask us to delete them sooner. When a record is no longer needed we delete it or de-identify it securely.
Your choices
Access and correction
You can ask to see the personal information we hold about you and ask us to correct anything that is wrong. We will respond within 30 days. There is no charge for a reasonable request.
Deleting your information
You can ask us to delete your information at any time. We will delete everything we are not legally required to keep and tell you what we have to retain and for how long. Workers who leave Oriah have their app access removed on their last day; their account is closed and only the records the law requires us to keep are retained.
Phone permissions
Workers can withdraw location, camera or microphone permission in their phone's settings at any time. The app will keep working, with those features switched off.
Questions and complaints
If you have a question about this policy, want to access or correct your information, or think we have mishandled it, contact us. We take privacy complaints seriously and will acknowledge yours within 3 business days.
Privacy Officer, Oriah
Email: hello@oriah.au
Phone: 1800 388 562
Post: Maxx Care Disability Pty Ltd, 479 Rocky Point Road, Sans Souci NSW 2219
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Participants can also contact the NDIS Quality and Safeguards Commission on 1800 035 544.
Changes to this policy
We review this policy at least once a year and whenever our services change. The current version is always at oriah.au/privacy, with the effective date at the top.