IooI Privacy Policy
Draft of 1 November 2026.
1. Who we are, and what this policy covers
“We”, “us” and “IooI” mean IOOI PTY LTD, ABN 57 692 458 594. You can reach us at solutions@iooi.com.au.
We handle personal information under the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme. We handle it in three different ways, and this policy keeps them apart:
- This website (section 2). Very little, by design.
- Information we handle for ourselves (section 3): accounts, sign-ins, sign-ups and billing. We decide how this is handled.
- Records we hold for provider organisations (section 4): client and staff records that NDIS and Support at Home providers keep in IooI. The provider decides what is collected and why. We hold and process those records for the provider, as its service provider (often called a processor).
This policy covers this website and the IooI platform. Navigator H is a separate product on separate systems, and this policy does not yet describe its hosting. Contact us if you need those details.
2. This website
This website sets no cookies. It has no analytics, no advertising, no tracking pixels, and no fonts or scripts from anyone else. It has no forms, so you give us nothing by reading it. You can read it without telling us who you are.
The pages are static files delivered by Amazon CloudFront. Like any web service, CloudFront handles your IP address, browser details and the page you asked for in order to send you the page, and these may be kept in operational logs. We use them only to run and protect the site.
If you email us, we receive your address and what you write, and use them to reply. Our mailbox is hosted on Microsoft 365.
3. Information we handle for ourselves
| What | Includes | Why |
|---|---|---|
| Account | Name, work email, the organisations and apps you have access to. | To sign you in and show you the right organisation. |
| Sign-in and security | Sign-in times, IP address, browser and device details, second-factor status. Amazon Cognito holds passwords; we do not. | To protect accounts and investigate misuse. |
| Sign-up | Email address, organisation name, ABN, state, programs, staff numbers, and the version of the terms accepted, with the time and IP address. | To set up your organisation and keep a record that the terms were accepted. |
| Billing | Organisation and billing names, billing email, address, ABN, plan, and the number of active staff. Card and bank details are entered on Stripe’s pages; we do not hold them. | To charge the subscription and issue tax invoices. |
| Email delivery | Whether a message was delivered, and addresses that bounced or complained. | To stop sending to addresses that cannot or should not receive our email. |
| Support | What you tell us, and our record of what our staff did. | To help you, and to show afterwards what was done. |
4. Records we hold for providers
A provider organisation puts these records into IooI. Many of them are sensitive information, including health information.
- About clients: names and contact details, NDIS numbers or My Aged Care IDs, funding details, care plans, medical alerts, shift notes, incident reports, photos, signatures and documents.
- About staff: names and contact details, employment details, certificates and worker checks, leave, reviews, rosters, timesheets, location at clock-in and clock-out, and payroll details including bank, super and tax file numbers.
- About family and nominees: the email address a provider lists to receive a client’s schedule.
We use these records only to provide and support the service for that provider. We do not sell them and we do not use them for marketing. We do not use government identifiers, such as NDIS numbers or tax file numbers, as our own way of identifying people.
Providers are responsible for their own obligations to their clients and staff, including telling them what is collected and why. If you are a client or a worker, your provider’s privacy policy applies to your record, and your provider is the place to start with questions.
IooI staff can see a provider’s records only through a support session, which that provider controls. Each session has a stated reason, lasts at most 60 minutes, and is listed for the provider to see, down to each request. See how support sessions work.
5. Who else handles personal information
These services handle personal information for us. Each one receives only what it needs for the job in the table.
| Service | What it does | Where |
|---|---|---|
| Amazon Web Services | Hosts the apps, database, files and backups. | Sydney, with backup copies in Melbourne |
| Amazon Cognito | Handles sign-in: passwords, second factors, passkeys. | Sydney |
| Amazon SES | Sends our email. | Sydney |
| Amazon Location | Turns client and work addresses into map positions. | Sydney. Amazon may pass the query, with account details removed, to map data providers outside the region |
| AWS WAF | Web firewall. Logs blocked or flagged requests, without cookies, tokens or query strings. | Sydney. If AWS will not deliver the logs there, the United States (us-east-1) for 30 days |
| Stripe | Takes payments and issues invoices. Receives the billing details in section 3. | May be processed outside Australia |
| Google Firebase and Apple | Deliver notifications to staff phones. | May be processed outside Australia |
| Xero | Receives staff hours, only if a provider connects its own Xero account. | Under the provider’s agreement with Xero |
| Microsoft 365 | Hosts the mailbox for email sent to us. | May be processed outside Australia |
We also disclose personal information if the law requires it, such as under a court order or a regulator’s notice. If we export a provider’s records for that reason, the export goes in that provider’s audit log and its admins get an email when it starts.
6. Information that can leave Australia
Customer records are stored in Australia: in Sydney, with backups in Melbourne. We do not say that nothing ever leaves Australia, because a few things can:
- address lookups passed on by Amazon Location, with account details removed;
- web firewall logs, if AWS will not deliver them to Sydney;
- billing details handled by Stripe, and notifications delivered by Google and Apple;
- email you send to our Microsoft 365 mailbox;
- hours sent to Xero, if a provider connects it.
These are mostly recipients based in or operating from the United States, and each runs its service across several countries. Tell us if you need more detail for your own assessment under APP 8.
7. How we protect it
Providers’ records are kept apart by the database itself, access is limited by role, sign-in needs a second factor or a passkey, data is encrypted, and important actions go into an audit log. Our security page sets this out, along with what we have not done yet.
8. How long we keep it
| Information | How long |
|---|---|
| A provider’s records | While its subscription runs, then 90 days read-only, then deleted 30 days after that. Admins get an email when deletion is scheduled and 7 days before. An admin can ask for earlier deletion once the subscription has ended, confirmed by an emailed code and, where there is one, a second admin. A legal hold pauses deletion. |
| A provider’s data export | 30 days after it is ready. |
| Backups | Deleted data stays in backups until they expire: 35 days for daily backups and 12 months for monthly ones, in Sydney and Melbourne. Earlier versions of files are kept for 30 days. |
| Accounts | Deleted with the last organisation they belong to. An account that still works for another organisation stays. |
| Unfinished sign-ups | Removed within 30 days after they lapse. |
| Billing records | Stripe keeps customers and invoices as tax records. The ATO requires 5 years. |
| Application logs | Up to 12 months. |
| Email block list | Kept across the service after an organisation leaves, so we keep honouring bounces and complaints. |
| Deletion certificates | Kept as our proof of deletion. They hold counts and hashes, not personal information. |
| Email to us | As long as we need it to deal with what you asked and keep our business records. |
Providers usually have record-keeping duties of their own, generally 7 years for NDIS and aged care. They should export what they must keep before they leave.
9. Seeing or correcting your information
You can ask for access to the personal information we hold about you, and ask us to correct it.
- Your own account or an enquiry: email us. We will respond within a reasonable time, usually within 30 days, and tell you why if we cannot do what you ask.
- A provider’s record about you: ask the provider, since it decides what the record says and who can see it. If you ask us, we will pass your request to the provider and help it respond.
10. Data breaches
If we suspect a data breach, we contain it and assess it quickly, within 30 days at the outside. If it is likely to cause serious harm to someone, it is an eligible data breach under the Notifiable Data Breaches scheme. We then notify the Office of the Australian Information Commissioner (OAIC) and the people affected as soon as we practicably can.
If a breach involves records we hold for a provider, we tell that provider without delay and give it what it needs. The provider and IooI then work out who notifies whom, so the people affected hear once and clearly.
11. Marketing and cookies
We do not send marketing email. Our email is transactional: the full list is on our contact page.
This website sets no cookies. The IooI apps, once you sign in, use session cookies that keep you signed in and protect your account. They are not used for tracking or advertising.
12. Complaints
If you think we have mishandled your personal information, email solutions@iooi.com.au. We will look into it and aim to reply within 30 days.
If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13. Changes to this policy
We will change this policy when what we do changes, and when legal review is finished. The date at the top shows the current version. If a change matters to people using IooI, we will tell the provider’s admins before it takes effect.