First pilot testing is starting now. Pilot places are limited, join the waitlist

Privacy Policy

Last updated: 31 October 2026

Parkway is operating software for NDIS support providers. It is operated by Parkways Software Pty Ltd (ACN 697 911 890, ABN 54 697 911 890) (“we”, “us”). This policy explains how we collect, use, disclose and hold personal information through the website at parkways.com.au, the worker, family and coordinator apps, and related services (the “Service”).

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in Schedule 1. Disability support is a health service for the Act (ss 6FA, 6FB), so APP duties apply to health and participant information held in the Service.

Parcare Support Service Pty Ltd (ABN 94 666 356 430, NDIS 4050161227), trading as Parcare Lifestyle, is a related NDIS provider and a customer of the Service. Parcare remains responsible for its own participant, worker and NDIS records. Parkways Software processes that information to run the platform (APP 6). The two companies are not the same legal person.

1. What we collect

1.1 From provider organisations + admin staff

  • Name, email, phone, role, employer organisation
  • Authentication credentials (hashed; we never see your password)
  • Audit log of actions taken in the platform (super-admin viewable only)

1.2 From support workers

  • Identity, contact, and emergency contact
  • Compliance documents (Blue Card, NDIS Worker Screening, First Aid, CPR, driver's licence, insurance)
  • Tax File Number, super fund details, bank account details (payroll)
  • Self-declared skills, cultural background (optional), availability
  • Geo-location at clock-in/clock-out (Electronic Visit Verification)
  • Photo for Worker ID badge (optional)

1.3 From NDIS participants (entered by your provider)

  • Identity, contact, NDIS number, plan funding, supports + goals
  • Care plan, behaviour support plan, risk assessment
  • Medications and clinical observations
  • Shift completion notes
  • Incidents and feedback

1.4 Automatic technical data

  • Browser/device user agent, IP address (request logs only)
  • App crash reports and performance metrics
  • Web Push subscription endpoints (so we can notify your device)
  • How you found us (added 6 November 2026), when you join the waitlist or apply to the community directory: the site that sent you, the page you first landed on and any campaign tag. A small record in your browser holds this until you submit the form, for up to 90 days.

2. How we use it

  • To run your provider organisation's operations (rostering, billing, compliance, payroll)
  • To deliver notifications you've opted into (shift invites, credential reminders)
  • To produce audit-ready records for the NDIS Quality and Safeguards Commission
  • To improve the Service (aggregated, de-identified usage analytics)
  • From 23 October 2026, to train and test our own AI model (section 5.1), using de-identified records from provider organisations that have agreed in writing

We do not sell personal information. We do not use participant or worker data for advertising.

3. Where it's stored and overseas disclosure (APP 8)

Personal information is stored in databases hosted in Sydney, Australia (Supabase, region ap-southeast-2). Files (photos, certificates, signed PDFs) are stored in the same region.

Some sub-processors process information outside Australia (APP 1.4 / APP 8): Anthropic in the United States (AI features, only as a standby when Claude on Amazon Bedrock in Australia cannot answer), Twilio in the United States (video meetings, the notetaker's phone calls into outside meetings, and their recordings), ElevenLabs in the United States (Talk's voice, only with separate consent; from 7 November 2026 also dictation and meeting transcripts, only under zero retention, so ElevenLabs keeps nothing), DocuSeal in the United States (e-sign), Resend in the European Union (email). We share only what the feature needs. You consent to that disclosure by using those features.

Talk, the voice assistant in the Parkway Connect app, writes its replies with Claude on Amazon Bedrock in Australia. When you have given a separate consent it can hear and speak with ElevenLabs in the United States; from 7 November 2026 that is Talk's usual voice for anyone with that consent (your provider can switch it off for your link). Without that consent it uses Deepgram's Australian region. From 7 November 2026, dictated notes, dictated messages and meeting recordings are transcribed by ElevenLabs only under its zero-retention mode, where ElevenLabs keeps neither the audio nor the words once it has answered; when that mode is not available, and before that date, they are transcribed by Deepgram in its Australian region.

4. Sub-processors we use

  • Supabase: primary database + authentication + storage (AU)
  • Vercel: application hosting. Server functions run in Sydney (AU); two stateless edge routes, the health check and browser security reports, run at the nearest edge location and handle no participant or worker records
  • Amazon Web Services: Claude on Amazon Bedrock writes every AI feature's output (notes, chat, drafts, forms, reports and Talk), processed in Sydney and Melbourne only (AU). Inputs and outputs are not used to train models.
  • Anthropic: the direct Claude API, standby only since 23 October 2026, used when the Australian service cannot answer (US). Inputs and outputs are not used to train models.
  • ElevenLabs: speech recognition and voice. Talk's voice when you have given separate consent; from 7 November 2026 also transcribes dictated notes, messages and meeting recordings, under zero retention only (nothing kept after it answers) (US)
  • Deepgram: speech recognition and the spoken voice for Talk without that consent, and transcription of dictated notes, messages and meeting recordings when ElevenLabs' zero retention is not available (AU region). Opted out of Deepgram's model training.
  • Amazon Web Services (own model): from 23 October 2026, also stores the training data and trains and runs our own AI model in Sydney (AU)
  • Sentry: application error and performance monitoring
  • Xero: accounting sync when a provider connects their Xero organisation
  • Stripe: card billing for Parkway subscriptions
  • Resend: transactional email delivery (EU)
  • DocuSeal: eSignature for contracts and consent forms (US)
  • Twilio: SMS delivery for shift invites (AU numbers), video meetings (the call, its recordings and the combined meeting video), and the notetaker's phone calls into outside meetings, whose recordings are deleted from Twilio once Parkways stores them in Australia (US)

5. AI features

When you use AI-augmented features (note clean-up, goal-alignment scan, worker chatbot), the relevant data is sent to Claude on Amazon Bedrock in Australia for processing, with Anthropic's direct Claude API in the United States as a standby. Neither trains its models on the data sent through the API. Our own model is different (section 5.1). We do not send AI providers data unrelated to the feature you're using (e.g. the chatbot only sees your own profile + the policy library + your own next shift, not other workers' data).

5.1 Training our own AI model

From 23 October 2026, we also train and test our own AI model for disability support, rostering and voice work. It learns from records held in the Service by provider organisations that have agreed to it in writing (today, Parcare Lifestyle), and from transcripts of calls to their phone lines where the line's recorded message tells callers about it. Before anything is used, names, phone numbers, addresses, NDIS numbers and other details that could identify a person are removed. The training data is stored encrypted and the model is trained and run on Amazon Web Services in Sydney. The model is private: we do not sell it or the data it learns from.

  • A recording of someone's voice is used to train the model only if that person agrees separately.
  • The model suggests and drafts. People decide, and it sends nothing on its own.
  • To keep your information out of future training, tell your provider or email hello@parkways.com.au.

6. Worker app permissions

The worker app may request these device permissions:

  • Location: only at clock-in / clock-out, to confirm you arrived at the participant's address. Location is not tracked between shifts.
  • Notifications: to alert you about shift invites, credential renewals, and on-call updates.
  • Microphone: when you dictate a note, and when you join a video meeting. Dictated audio is transcribed by Deepgram in Australia, and from 7 November 2026 by ElevenLabs under zero retention when that is available; Parkway stores the transcript with the note and does not keep the recording. Video meetings are recorded and transcribed, and the meeting page asks for your consent before you join.
  • Camera + Photos: when you upload an ID photo or credential scan, and when you join a video meeting.

You can revoke any of these in your device settings at any time.

7. Push notifications

We send push notifications via the Web Push standard (or Apple Push Notification service when using the iOS app). You can disable these by revoking notification permission in your browser or device settings.

8. Eligible data breaches (Privacy Act Part IIIC)

If we suspect an eligible data breach, we assess it as soon as practicable and in any case within 30 days (s 26WH). If we have reasonable grounds to believe an eligible data breach has occurred, we prepare a statement for the Australian Information Commissioner (s 26WK) and notify individuals at risk (s 26WL) as soon as practicable. Remedial action that prevents serious harm can take an incident outside the NDB scheme (s 26WF).

NDIS reportable incidents (NDIS Act s 73Z) are a separate duty of the registered provider. A platform security incident is not automatically a Commission reportable. Practice Standards information management (s 12) still applies to how records are kept.

9. How long we keep it

  • Active worker + participant records: kept for the duration of engagement + 7 years after (NDIS audit retention requirement)
  • Shift notes + clinical records: 7 years (NDIS standard)
  • Audit logs: 7 years
  • Web Push subscriptions: deleted when you unsubscribe or after 90 days of inactivity

10. Your rights

You can ask us to:

  • Access the personal information we hold about you
  • Correct anything that's inaccurate
  • Delete your data, except where NDIS law requires us to keep it
  • Receive a copy of your data

Requests go to hello@parkways.com.au. We respond within 30 days. You can also make an anonymous complaint or speak-up report at /speak-up without giving your name.

11. Security (APP 11)

  • All data in transit is TLS-encrypted
  • Data at rest is encrypted by Supabase (AES-256)
  • Row-level security restricts every query to the requesting org
  • Service-role keys are scoped to specific server-side functions only
  • Two-factor authentication (TOTP) is optional for most sign-in. A fresh authenticator check is required before money movement (for example bank transfers).

12. Children

The platform is for adult workers and NDIS providers. Information about NDIS participants who are minors is entered by their support provider under their professional and legal duty of care.

13. Automated decisions

From 10 December 2026, APP 1 requires disclosure of kinds of personal information used in substantially automated decisions that have a legal or similarly significant effect. Parkway AI features (form prefill, note quality, incident classification suggestions) assist staff. They do not by themselves make a legally significant decision. This section will be updated if that changes.

14. Changes to this policy

We'll post material changes here with a new “Last updated” date and email registered users at least 7 days before they take effect.

15. Contact

Parkways Software Pty Ltd
ACN 697 911 890, ABN 54 697 911 890
Unit 5/5-7 Cairns Street, Loganholme QLD 4129
Email: hello@parkways.com.au

If you're not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. For NDIS supports, you can also use /speak-up or complain to the NDIS Quality and Safeguards Commission.