Account & Data Deletion

How to request account deletion

Whether you are a support worker, an NDIS participant, or a family contact / nominee, you can ask for your Alevora account and personal data to be deleted in either of two ways:

• Email us directly: Send an email to hello [at] alevora.com.au from the email address linked to your Alevora account, stating that you would like your account deleted.
• Ask your organisation’s admin: Contact the administrator or coordinator at your NDIS provider organisation and ask them to revoke and delete your user account on your behalf.

What gets deleted

Once your request is verified, we permanently remove your login and profile credentials:

• Your login credentials, password hash, two-step verification settings, and active sessions.
• Registered mobile push notification tokens and remembered device tokens.
• Your personal login profile (email address, phone number, and portal access links).
• Any draft items stored locally on your device when you sign out or uninstall the mobile app.

What your provider may have to keep by law

Alevora provides software to NDIS care providers, who are the data controllers for service delivery records. Under Australian law — including NDIS Quality and Safeguards Commission record-keeping rules, the NDIS Act, Fair Work payroll rules, and Australian taxation law — your care provider may be legally required to retain certain operational records for a minimum statutory period (commonly 7 years):

• Completed shift records, timesheets, pay summaries, and NDIS claim / invoice histories.
• Progress notes, case notes, incident reports, and service agreements created during care delivery.
• Worker screening and statutory audit trail entries required for NDIS Commission audits.

Where records must be retained by your provider for legal record-keeping, your login access is immediately deactivated and your personal contact details are removed from active marketing or notification lists.

How long it takes

We acknowledge all account deletion requests within 2 business days. Once your identity is confirmed (and, where applicable, coordinated with your organisation’s administrator), account deactivation and personal data deletion are completed within 30 days. Encrypted database backups are automatically rotated and overwritten within 30 days.