Governance & Data Protection | Steady Guide

Privacy Policy

Last updated: 9 September 2026 | Managed in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. At a Glance: How Your Data is Handled & Protected

Steady Guide operates with strict system segregation to ensure your sensitive NDIS records are completely isolated from marketing tools and retail platforms:

Website & Analytics Hosting: Hosted by Panthur on enterprise-grade servers in Sydney, NSW. Traffic monitoring is managed via Plausible Analytics, delivering 100% non-identifying website usage data.
Strict System Segregation: Sensitive NDIS participant files (Astalty & Microsoft 365) and marketing/e-commerce tools (FluentCRM, Facebook, Stripe) run on completely separate accounts and infrastructure. Participant data is never exposed to marketing platforms.
Secure NDIS Participant Records: Stored securely in Astalty (Australian-hosted, encrypted at rest and in transit) and linked to a dedicated, encrypted Microsoft 365 participant inbox (Sydney/Melbourne data centres).
Safe Payment Processing: Payments for support coordination are managed through NDIS plan managers. Self-managed payments are managed through bank transfers.
Data Sovereignty: All core data is stored securely within Australia under Australian Privacy Principles.

2. Website Traffic & Analytics Monitoring

Our WordPress website utilises Plausible Analytics to measure website traffic and improve user experience. Plausible operates without invasive tracking cookies and collects only non-identifying aggregate data:

Visitor browser types, operating systems, and device types.
Referring website pages, pages visited, bounce rates, and visit duration.
Geographic locations (city/region level).

💡 Privacy Protection: No identifying information is collected through website analytics. NDIS participant intake forms (Astalty) are never embedded on public pages—form submissions route directly into Astalty’s encrypted database.

3. Appointment Bookings & Form Submissions

Microsoft Bookings: Scheduling a private consultation collects your name, email address, physical address, and contact details. Communications are handled through our encrypted participant services Microsoft account (hosted in Sydney/Melbourne data centres).
Steady Steps Newsletter: Subscribing to our newsletter stores your email address within WordPress on Panthur servers. Emails are delivered via SMTP2GO’s secure Australian infrastructure.
Astalty Service Forms: Official NDIS participant intake and referral details are transmitted directly to Astalty’s database with end-to-end encryption.

4. Payment Processing & NDIS Invoicing

NDIS Support Coordination: Participant NDIS numbers, plan dates, and Plan Manager details are stored exclusively in Astalty. Official claim invoices are issued directly from Astalty.
Bank Transfers: Direct bank transfers are available for self-managed clients.

5. NDIS Participant Records & AI Protections

All NDIS participant case notes, phone logs, and service agreements are stored within the Astalty database. We enforce strict data protection controls:

🔒 Data Sovereignty

All participant records are encrypted at rest and in transit on Australian servers under the Australian Privacy Principles.

🛡️ Artificial Intelligence Ethics

Participant data inside Microsoft 365 and Astalty is strictly excluded from Copilot/AI model training. AI is never used for NDIS report writing or funding decisions.

Sensitive Information Handling: Health, disability, and clinical diagnostic details are collected strictly with explicit participant consent and used exclusively to support your individual NDIS plan goals.

6. Your Legal Rights: Access, Correction & Deletion

Under APPs 12 and 13, you have clear, enforceable rights regarding the personal information we hold:

Access: You may request a complete copy of the personal records we keep about you.
Correction: You may request updates or corrections to inaccurate or out-of-date records.
Deletion: You may request the secure destruction of your records where lawful and appropriate under NDIS regulations.

⏱️ We respond to all formal privacy requests within 30 calendar days.

7–14. Additional Privacy Principles & Data Governance

7. Anonymity & Pseudonymity

While support coordination requires verified identity details under NDIS rules, you are welcome to browse our site or contact us anonymously for general inquiries.

8. Unsolicited Information

If we receive unrequested personal data (e.g. accidental referral attachments), we evaluate its necessity and securely destroy or de-identify it immediately if not required.

9. Direct Marketing Transparency

We do not use cold direct messaging or invasive SMS text campaigns. Newsletter subscribers can opt out at any time with a single click. Meta Pixels are limited exclusively to commercial pages.

10. Government Identifiers

NDIS numbers are collected strictly for NDIS verification and claims processing. They are never adopted as internal customer IDs or shared with external parties.

11–12. Data Quality & Cross-Border Disclosure

We maintain accurate data through routine reviews. While primary servers are hosted in Australia, enterprise vendors (like Microsoft) operate under strict contractual data protection agreements matching Australian law.

13. 7-Year NDIS Record Retention

In compliance with NDIS record-keeping rules, participant records are retained for 7 years following the conclusion of services, after which they are securely destroyed.