SupportDuo Privacy Policy
Last updated 1 October 2026
The short version
- SupportDuo helps NDIS participants and independent support workers find each other and work together. To do that we need some personal information, including information about disability and support needs.
- We only collect what the app needs, we never sell it, we show no ads, and we use no advertising, analytics or AI services.
- Other people only see what they need: your exact location, gender, interests list, NDIS number and safety details are never shown to people you are not connected with.
- Your information is stored with our hosting provider in Singapore. Some service providers (for notifications and app store billing) are in the United States.
- You can see and change most of your information in the app, and delete your account at any time in the app or by emailing contactsupportduo@gmail.com.
- Questions or complaints: email contactsupportduo@gmail.com. You can also contact the Office of the Australian Information Commissioner.
1. About this policy
The SupportDuo app is run by SupportDuo (ABN 18 527 561 017), a registered Australian business ("we", "us"). This policy explains how we collect, hold, use and share personal information when you use the SupportDuo app or contact us. It is our privacy policy under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which we follow. Because SupportDuo is used to arrange care and support for people with disability, we treat the information in it as health information and also follow state and territory health records laws where they apply.
Support workers who use SupportDuo are independent businesses, not our employees. Each worker is also responsible, under privacy law and the NDIS Code of Conduct, for the participant information they hold, such as their own notes, invoices and service agreements.
This policy is free. You can read it in the app (Privacy) or at https://help.supportduo.com.au/privacy/. If you'd like it in another format, such as large print, Easy Read, plain text or read aloud, email contactsupportduo@gmail.com. The app can also read any screen aloud.
2. Who SupportDuo is for, and people acting for someone else
SupportDuo accounts are for adults (18 and over). A participant who is under 18, or who wants or needs help to manage their supports, can have a parent, guardian, NDIS plan nominee or other authorised person set up and run the account for them. That person gives the participant’s information on their behalf and agrees to this policy for them.
If you act for someone else, please involve them in decisions as much as they are able, respect their wishes, and only share what is needed. If you need help to make decisions, you can use a supporter, advocate or nominee.
If we learn that someone under 18 has opened an account without a parent or guardian, we will contact them and may close the account. Contact contactsupportduo@gmail.com if you are concerned.
3. What we collect
We collect the following, mostly directly from you when you use the app. Some features are optional; the table says which are needed.
| Information | Examples | Needed? |
|---|---|---|
| Account | Email address (used to sign in with an emailed link), whether you are a participant or a support worker, the name you choose to show | Yes |
| Profile | Profile photo, “About me” text, interests, what support you need or offer, a worker’s experience and the qualifications they say they have | Photo, About me and interests are optional |
| Location | Your suburb, postcode and state, a rounded map point for your area (about 1 km), and how far you’re willing to travel | Yes, to find people near you |
| Gender | A support worker’s gender (or “prefer not to say”); a participant’s comfort choice about workers’ gender | An answer is needed, but “prefer not to say” and “no preference” are options |
| Disability and support information (participants) | The kinds of support you need, such as personal care or community access | Yes, for matching |
| NDIS details (participants) | NDIS number, how your plan is managed, plan manager name and email, an email for invoices | Optional |
| Safety details (participants) | Allergies, and an emergency contact’s name, relationship and phone number | Optional |
| Connections and messages | Connection requests, blocks, messages, meetings and activity choices, service agreements and signatures | Only if you use these features |
| Support worker records | Shift notes, incident reports, invoices, payments, expenses and receipts, tax-estimate settings, ABN, business name and contact details, bank account or PayID for invoices | Only if you use these features |
| Subscriptions | Which plan you have and when it renews, from Google Play or the App Store (never your card details) | Only if you subscribe |
| Device | A notification token for your phone, and whether it is Android or iPhone | Only if you allow notifications |
| Safety reports | Reports you make about another member, and reports others make about you | Only if a report is made |
Our hosting provider also keeps standard technical logs when the app talks to our servers (such as times, and the IP address and device type making the request), which we use to keep the service secure and working.
We also receive some information from others: the Australian Business Register tells us whether a support worker’s ABN is active and the name it is registered to; Google Play and the App Store tell us about subscriptions; and other members may give us information about you (see “Information about other people”).
4. Sensitive information and your consent
Some of what SupportDuo holds is sensitive information under the Privacy Act: disability and support needs, allergies, health details a worker records in shift notes or incident reports, gender identity, interests that may show religious beliefs, and qualifications such as worker screening checks.
We only collect sensitive information with your consent (or the consent of the person acting for you) and only because the app needs it: to match participants with suitable workers, to keep people safe, and to run the support relationship. We never use it for advertising or for anything unrelated.
You can change or remove most of it in the app at any time, and stop sharing your NDIS or safety details with a worker whenever you like. If you remove information the app needs, some features may stop working well; for example, matching is less accurate without support needs.
5. Information about other people
SupportDuo sometimes holds information about people who gave it to us through someone else:
- emergency contacts, plan managers and nominees a participant enters;
- shift notes and incident reports a support worker writes about a participant (the participant does not see these in the app);
- people named in a safety report or incident report; and
- a participant’s details entered by a parent, guardian or nominee.
If you give us someone else’s information, please make sure they know and are happy for you to share it. That person can contact us to see or correct it.
6. How we use your information
- to create and secure your account and sign you in;
- to show participants suitable support workers nearby, and workers suitable participants, and to work out shared interests and a match score;
- to run connection requests, messages, meetings, service agreements and notifications;
- to give support workers tools for shift notes, NDIS invoices, income, expenses and tax estimates;
- to check that a support worker’s ABN is active;
- to keep people safe: safety details, blocking, safety reports and incident records;
- to manage subscriptions and what each plan includes;
- to answer your questions, support and privacy requests; and
- to meet our legal obligations and protect the service from misuse.
7. Who can see your information
The app shows other members only what they need. Our database enforces these rules.
| Information | Who can see it |
|---|---|
| Your name and profile photo, “About me”, the support a worker offers and their experience | Signed-in members on the other side (workers see participants’ and participants see workers’). A support worker who is taking new participants can be seen by any signed-in member. |
| A participant’s support needs | Support workers whose area overlaps with yours, and workers you have a request or connection with |
| Your location | Only you. Others see a rounded distance in whole kilometres, never your suburb or map point. |
| Your interests | Only you. Others see only the interests you have in common and a percentage. |
| Gender and gender comfort choice | Only you. They are used to decide who is shown, but never shown to anyone. |
| Messages, meetings, service agreements | Only the two people in the connection |
| NDIS details and safety details | Only you, and each worker you choose to share them with, while you are connected |
| Shift notes, incident reports, invoices, expenses, tax settings, bank details | Only the support worker who made them (and the people they choose to send invoices or PDFs to) |
| Your email address | Never shown to other members |
When a worker sends an invoice or service agreement, it includes what those documents need: names, the participant’s NDIS number, the plan manager’s details, and the worker’s ABN, contact and bank details. NDIS numbers, bank details and financial records are never shown publicly or in search results.
A small number of authorised SupportDuo staff can see profiles, connections, service agreements and reports so they can look into safety reports and fix problems. They do not read messages, safety details, NDIS details or workers’ financial records as part of that role. Our technical administrators can access the database only when needed to run, secure or repair the service, or when the law requires it.
8. Service providers and overseas storage
We use these service providers to run SupportDuo. They may only use your information to provide their service to us, and must protect it to the same standard as this policy.
| Provider | What they do | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | Hosts our database, files and sign-in, and sends sign-in emails | Singapore |
| Expo | Delivers push notifications. Receives your notification token and the notification text (such as “Sam sent you a message”), never message contents. | United States |
| Google (Firebase Cloud Messaging, Google Play) | Delivers notifications to Android phones; handles Google Play subscriptions and payments | United States and other countries |
| Apple (Push Notification service, App Store) | Delivers notifications to iPhones; handles App Store subscriptions and payments | United States and other countries |
| Australian Business Register | Checks a support worker’s ABN | Australia |
| Your phone’s map service (Google on Android, Apple on iPhone) | Turns the suburb you type, or your phone’s location when you tap “Use my location”, into an area | Various |
This means your personal information is stored in Singapore and some of it is handled in the United States and other countries. Before using an overseas provider we take reasonable steps, through their contracts and security commitments, to make sure they handle it in line with the Australian Privacy Principles.
We may also disclose information when the law requires or allows it (see “When we may share information without asking”).
9. Automated matching and decisions
SupportDuo uses computer rules, with no person reviewing each result, to decide who appears in your search results and in what order. These decisions affect who you can find and connect with.
These are decided automatically:
- who is shown: only people on the other side, within each other’s travel distance, who haven’t blocked each other and don’t already have a request open;
- a participant’s gender comfort choice: in “only show” mode, workers outside that choice are not shown and can’t send that participant a request;
- whether a support worker is taking new participants;
- if switched on, whether a support worker’s ABN is active, and whether a member has a current plan or has reached their plan’s limit, which decide whether they are shown and can make new connections; and
- whether a support worker can use the Invoices & Income tools (Premium plan).
These help people decide, but don’t decide for them: the order of search results and the match score, which is 60% how many of a participant’s support needs a worker offers and 40% shared interests, then distance. Interests never stop anyone being shown.
The personal information used is: your area and travel distance, support needs or supports offered, interests, gender and gender comfort choice, blocks, ABN status and plan status. If you think an automated result is wrong or unfair, email contactsupportduo@gmail.com and a person will look into it.
10. Your phone: permissions and what stays on it
| Permission | What it’s used for |
|---|---|
| Location (only while using the app) | To find your suburb when you tap “Use my location”. Your exact position is not stored; only your area is. You can type your suburb instead. The app never uses location in the background. |
| Camera and photos | Only when you choose a profile photo or photograph a receipt. Profile photos have their location data removed before upload. |
| Notifications | To tell you about new messages, requests and meetings. Optional. |
| Calendar | Only when you choose to add a meeting; your phone shows its own “add event” screen. The app never reads your calendar. |
| Face ID, fingerprint or passcode | To unlock the app if app lock is on. Your phone checks it; SupportDuo never receives fingerprint or face data. |
Some things are kept only on your phone: your sign-in session (in the phone’s secure storage), your app lock PIN (stored only as a scrambled code), accessibility settings, and PDFs or spreadsheets you make until your phone clears them. Read aloud uses your phone’s own speech engine.
11. How we keep it safe
- All information travels over encrypted connections (HTTPS), and our hosting provider encrypts stored data.
- Database rules let each person see only the records they are allowed to, as described above.
- Files such as photos and invoices are private and opened through short-lived links.
- Sign-in uses emailed one-time links rather than passwords, and the app can be locked with Face ID, fingerprint, passcode or PIN.
- Only a few authorised people can access the systems, and only when needed.
If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and explain what you can do.
12. How long we keep information
We keep your information while your account is open, and delete or de-identify information we no longer need. When you delete your account:
- your profile, photo, answers, location, preferences, safety and NDIS details, subscription records and notification tokens are deleted straight away;
- your connections are deleted, which also deletes the messages, meetings and service agreements you had with each person, for both of you, so save a PDF of any agreement you want to keep first;
- a support worker’s own records (shift notes, incident reports, invoices, expenses, receipts and tax settings) are deleted, so workers should export anything they must keep for tax or NDIS purposes first.
Some information is kept after an account is deleted:
- Safety reports: a report you made is kept without your name; a report about you is kept with your name and email, so reports of harm can’t be erased. We keep these for as long as needed for safety and legal reasons, up to 7 years.
- A support worker’s business records about a participant (shift notes, incident reports and invoices with the participant’s name, NDIS number and plan manager details) stay with that worker if the participant deletes their account, because the worker may be legally required to keep them.
- Security and purchase records (account and subscription identifiers, and records of account deletion and subscription changes) are kept for up to 7 years for fraud prevention, tax and legal reasons.
- Copies in our hosting provider’s backups are removed as those backups expire.
- Anything already sent outside the app, such as an emailed invoice or a saved PDF, isn’t affected.
Deleting your account doesn’t cancel a Google Play or App Store subscription; cancel it in your phone’s subscription settings first.
13. Delete your account
In the app: open Home, scroll down and tap “Delete my account”, then confirm. Your account is deleted straight away.
Without the app: email contactsupportduo@gmail.com from the email address you sign in with, with the subject “Delete my SupportDuo account”. We will confirm it’s you, delete the account within 30 days (usually much sooner), and email you when it’s done. More details are at https://help.supportduo.com.au/delete-account/.
You can also delete some information without closing your account: remove your photo or About me, change your answers, clear your NDIS or safety details, stop sharing them with a worker, or remove bank details from Invoices & Income.
14. Your choices
- Change or remove profile information, answers and preferences in the app at any time.
- Choose which workers can see your NDIS and safety details, and stop sharing at any time.
- Type your suburb instead of using your phone’s location.
- Turn notifications, location, camera and photo access on or off in your phone’s settings; the app still works without them.
- Block someone so they can no longer see or contact you.
15. Seeing and correcting your information
You can see and update most of your information in the app. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing contactsupportduo@gmail.com. There is no fee. We may need to confirm who you are, and we will respond within 30 days. If we can’t do what you ask, we will explain why in writing and tell you how to complain. If we don’t agree to correct something, you can ask us to attach a note with your view.
16. When we may share information without asking
We may use or share personal information without asking first only where the law requires or allows it, including:
- to lessen or prevent a serious threat to someone’s life, health or safety;
- to report suspected abuse, neglect, exploitation, violence or sexual misconduct to the NDIS Quality and Safeguards Commission, police or child protection authorities;
- to comply with a court order, subpoena or a request from a regulator such as the NDIS Commission; and
- to help police investigate unlawful activity.
17. No selling, advertising, tracking or AI
- We do not sell or rent personal information.
- We show no ads and do not share information with advertisers or data brokers.
- We do not track you across other companies’ apps or websites, and use no analytics or advertising tools.
- No artificial intelligence (AI) service receives your information or messages.
- We send service messages (such as sign-in links, notifications and important account notices) but no marketing. If we ever start, we will ask first and every message will have a way to opt out.
18. Questions and complaints
If you have a question or a complaint about how we handle personal information, email contactsupportduo@gmail.com. We will acknowledge it within 7 days, look into it, and give you a written answer within 30 days. You can have an advocate or someone you trust help you.
If you aren’t happy with our answer, you can contact:
- the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992, GPO Box 5288 Sydney NSW 2001;
- for concerns about the safety or quality of NDIS supports, or a worker’s conduct: the NDIS Quality and Safeguards Commission, 1800 035 544, www.ndiscommission.gov.au;
- for health information in Victoria: the Health Complaints Commissioner, www.hcc.vic.gov.au; in New South Wales: the Information and Privacy Commission, www.ipc.nsw.gov.au.
19. Changes to this policy
We review this policy regularly and whenever the app changes how it handles personal information. The date at the top shows when it last changed. If we make an important change, we will tell you in the app before it applies.
20. Contact us
SupportDuo (ABN 18 527 561 017). Privacy contact: contactsupportduo@gmail.com. Website: https://help.supportduo.com.au.