Privacy Policy

Alevora is a business name of INDESIGN MEDIA GROUP PTY LTD (ABN 99 609 102 374).

This applies to the Alevora Care app (iOS and Android) and the Alevora website.

Trading as Alevora · ABN 99 609 102 374. Contact: hello [at] alevora.com.au

Alevora is software used by NDIS providers. We handle participant information on behalf of the providers who use Alevora. The provider decides what information is entered and is responsible for telling participants about it.

For information about your own account on the Alevora website, or the people who use Alevora to run their business, we are responsible for handling it under the Privacy Act 1988 and the Australian Privacy Principles (APPs).

• Account details: name, email address and contact details, role and organisation.
• Participant care information: entered by the provider, including health and disability information (which is sensitive information), NDIS numbers, plans and budgets, goals, progress notes and incident reports.
• Worker information: credentials, screening checks, availability, timesheets and pay estimates.
• Location at clock in and clock out: collected only when a worker taps Clock in or Clock out, and while that shift’s screen is open, to check they are at the participant’s address. We do not collect location in the background.
• Photos and documents: files that users upload or attach, such as credentials, agreements and incident evidence.
• In-app messages: messages sent using Alevora’s in-app messaging.
• Crash reports: technical details sent when the app or website fails. They are scrubbed of names, NDIS numbers and contact details.
• Website enquiries: the name, email address, organisation, phone number, role and message you send through our contact and demo forms.
• Billing: Stripe holds payment card details. We never see full card numbers.

• Directly from you, when you sign up, use Alevora or contact us.
• From the NDIS provider you work for or receive services from, who enters participant and worker information.
• From a worker’s phone, when they clock in or out (location) or attach a photo or document.
• Automatically, when a crash occurs (crash reports).
• From Xero, only if the provider connects it.

• To provide Alevora: rosters, timesheets, pay estimates, invoices, NDIS claims, case notes and messages.
• To check that workers attend the participant’s address when they clock in or out.
• To send notifications and emails about shifts, sign-in and account activity.
• To keep Alevora secure, fix faults and prevent misuse.
• To bill subscriptions and answer enquiries and support requests.
• To meet our legal obligations.

We do not use usage analytics, advertising or tracking. The only automatic reporting is crash reports.

• DigitalOcean (hosting, database and files): Sydney, Australia.
• Sentry (crash reports): USA.
• Resend (email delivery): USA.
• Stripe (subscription payments).
• Expo push service, with Apple and Google (notifications to phones).
• Google Maps (address lookups): the address text only, never names or health details.
• Xero: only if the provider connects it.

Overseas disclosure. Most information is stored in Australia. Crash reports go to Sentry and email is delivered through Resend, and both operate in the USA, so that information is disclosed to recipients in the USA. Stripe, Expo, Apple, Google and Xero are global services and may handle limited information outside Australia. We take reasonable steps to make sure these services handle information in a way that is consistent with the APPs.

We may also disclose information where the law requires it.

• Information is encrypted in transit (HTTPS) and at rest.
• Access is controlled by role, so people only see what their role allows.
• Two-step sign-in is supported for user accounts.

• You can ask us to delete your account at any time (see Account Deletion). We complete account deletion within 30 days.
• Deleted files can be recovered for 30 days, then they are removed.
• Database backups rotate, and deleted information drops out of them as they do.
• Providers may have to keep records, usually for 7 years, under NDIS rules. Those records stay with the provider even if an individual account is deleted.
• Website enquiries and demo requests are kept for 24 months and then automatically deleted.

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing hello [at] alevora.com.au. Participant information belongs to the provider who entered it, so we may ask the provider to help with your request.

If you have a privacy complaint, email hello [at] alevora.com.au. We will reply within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We follow the Notifiable Data Breaches scheme. If we suspect a breach that is likely to cause serious harm, we will assess it quickly, tell affected providers so they can meet their own obligations, and notify affected individuals and the OAIC where required.

Alevora is not directed at people under 18. Information about children is entered by their provider or family, not by the child.

We use only essential cookies and similar storage, for sign-in and your preferences. We do not use tracking or advertising cookies.

We may update this policy. When we do, we will publish the new version on this page and change the “Last updated” date.