Privacy Policy & Code of Engagement: Steady Guide Private Chat

💡 At a Glance & Governance Overview

⏱️ Estimated Read Time: 5 minutes

Central Takeaway: The Steady Guide Private Chat platform provides a secure, confidential environment for NDIS support coordination communications governed by the Australian Privacy Principles (APPs) and NDIS Practice Standards.

• Strict Statutory Compliance: Governed by APPs 1, 3, 5, 6, 11, 12, and 13 to ensure transparent, lawful, and secure handling of participant information.
• Third-Party Sharing Protocol: Prior written consent is strictly mandatory via Form Ref: SG-PRIV-FRM-2026-v10 before sharing any chat transcripts or data.
• AI Ethics & Data Sovereignty: Chat data is strictly excluded from external AI model training and retained within secure Australian data centres.
• Member Governance Rights: Guaranteed 30-day maximum response for data access (APP 12) and zero-cost correction rights (APP 13).

1. Purpose and Scope

The primary objective of the Steady Guide Private Chat platform is to provide a secure and confidential environment for the exchange of information related to NDIS support and service coordination. This document mandates all interactions, data handling processes, and professional conduct for stakeholders engaging within the private chat environment. All activities conducted through this platform are governed by the Australian Privacy Principles (APPs) and the NDIS Practice Standards to ensure the absolute protection of participant privacy and the integrity of personal information. Authorised users must harmonise their communication practices with these standards.

Steady Guide establishes this framework to ensure that all personal information is handled in an open and transparent manner. This policy dictates how information is collected, used, disclosed, and protected, requiring all internal and external organisations to adhere to the highest standards of professional conduct and statutory compliance.

2. Collection and Use Framework (APP 3, 5, & 6)

Steady Guide mandates a strict framework for the collection and use of personal information. Data gathering is limited to what is strictly necessary for service delivery and identity verification.

In accordance with APP 3.6, Steady Guide mandates the collection of personal information directly from the individual unless it is considered unreasonable or impracticable to do so.

3. Third-Party Data Sharing and Confidentiality

Steady Guide maintains a strict prohibition on the unauthorised sharing, disclosure, or exportation of chat transcripts to external parties. This protocol is an essential requirement under NDIS Practice Standards Outcome 1.3, which establishes the right of participants to privacy and confidentiality.

Under APP 11, Steady Guide is required to take reasonable steps to protect all personal information from unauthorised access, modification, or disclosure.

Requirement for Prior Written Consent: No personal information or chat transcripts may be shared with third parties, including other service providers, family members, or external agencies, without the express prior written signature of the individual or their authorised representative.

4. Protocol: Steady Guide Third-Party Data Sharing Consent Request Form

All requests for data sharing must be processed using Form Ref: SG-PRIV-FRM-2026-v10. This form includes a mandatory header block citing compliance with APPs 1, 3, 5, 6, 11, 12, and 13.

The mandatory protocol for the use of this form includes the completion of the following six sections:

• Applicant/Manager Information: Legal details of the entity or person initiating the request.
• Participant/Client Details: Full identification and NDIS number of the individual whose data is subject to disclosure.
• Nominated Recipients: Clear identification of specific third parties authorised to receive the information.
• Scope/Disclosure Box: A defined area specifying the temporal or topical range of the data being shared.
• Statutory/AI Terms: Affirmation of compliance with the Privacy Act and the exclusion of data from training models.
• Dual Approvals: Mandatory signature blocks for both the Requesting Party and the authorised Steady Guide Privacy Officer.

The Primary Purpose for Disclosure box is a clean, unlined open box with expanded writing clearance. It must be used to provide a definitive justification for the disclosure.

5. AI Ethics and Data Sovereignty

Steady Guide adopts a “technology neutral” approach to personal information handling. This means our privacy obligations remain unchanged whether the chat is human-to-human or facilitated by internal administrative AI. Our AI Ethics framework is built upon three pillars:

• Exclusion: Chat data is strictly excluded from use in external AI training or third-party machine learning models to prevent data leakage.
• Sovereignty: Steady Guide maintains exclusive control over its data assets, ensuring they remain within authorised Australian jurisdictions.
• Integrity: AI tools are restricted to administrative efficiency and are never used as a substitute for human professional judgment in privacy determinations.

6. Respectful Engagement and Code of Conduct

All participants in the Steady Guide Private Chat must adhere to the following Code of Conduct. Engagement must align with the “Fair Means” concept defined in APP 3.62.

7. Incident and Breach Reporting (NDB Scheme)

Steady Guide complies with the Notifiable Data Breaches (NDB) scheme. A data breach occurs when personal information is lost or subjected to unauthorised access or disclosure (e.g., a hacked database or a misdirected transcript). If a breach is likely to result in serious harm, Steady Guide mandates notification to the Office of the Australian Information Commissioner (OAIC) and the affected individuals.

Immediate Actions in Event of a Potential Breach:

1. Containment: Immediately isolate and contain the breach to prevent further unauthorised access or disclosure.
2. Assessment: Conduct an expedited risk assessment to determine whether the breach is likely to result in serious harm to any individual.
3. Notification: If serious harm is likely, notify the OAIC and all affected individuals promptly with detailed guidance and protective recommendations.
4. Review & Remediation: Review internal security protocols, identify system vulnerabilities, and implement corrective measures to prevent future occurrences.

8. Member Governance Rights and Retention

Steady Guide recognises the statutory rights of members regarding the management of their data.

• Access (APP 12): Individuals have the right to access the personal information held about them. While APP 12 refers to a “reasonable period,” Steady Guide establishes a maximum limit of 30 days for responding to access requests to ensure administrative accountability.
• Correction (APP 13): Steady Guide is obligated to correct inaccurate, out-of-date, or misleading information. Under APP 13.4, no fee will ever be charged for making a correction request or processing the correction. Furthermore, in accordance with APP 13.2, if an individual requests it, Steady Guide must take reasonable steps to notify third parties (to whom the data was previously disclosed) of the correction to ensure data integrity across the NDIS ecosystem.