Privacy Policy
Version: 1.0 · Effective date: 29 July 2026
1. Who we are and what this policy covers
James Stephen Maximos (ABN 16 961 953 494) trading as OpsFlow (we, us, our) provides a software platform used by NDIS and disability service providers to manage referrals, participants, workers, compliance records, tasks and communications.
This policy explains how we handle personal information. It applies to:
- our website at opsflow.net.au;
- the OpsFlow web and mobile applications; and
- our dealings with customers, prospective customers, and people who contact us.
We handle all personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), and we do so as a binding commitment to our customers, regardless of whether an exemption might otherwise be available to us.
2. Two different roles — please read this first
It matters which of these two situations applies to you.
2.1 Information we hold for our own purposes
When you visit our website, sign up for an account, contact us, or use OpsFlow as a staff member, we handle your personal information for our own purposes — to run the platform, bill for it, support it and secure it. This policy governs that information, and we are accountable for it.
2.2 Information we hold on behalf of a provider
Most information inside OpsFlow — participant records, referral details, support worker records, documents, notes, call recordings and messages — is entered by a provider (our customer) and held on their behalf and on their instructions.
For that information:
- the provider decides what is collected, why, who can see it, and how long it is kept;
- the provider’s own privacy policy applies to how they use it;
- we hold and protect it, and only use it to provide the platform to that provider.
If you are a participant, family member, support worker or referrer and you want to access, correct or complain about information a provider holds about you in OpsFlow, contact that provider directly. If you contact us, we will refer your request to them and tell you we have done so. We cannot give you access to a provider’s records without their authority.
3. What personal information we collect
3.1 From customers and their staff (our own purposes)
| Category | Examples |
|---|---|
| Identity and contact | Name, work email, work phone, job title, organisation, role |
| Account | Login credentials (passwords are hashed — we never see them), authentication tokens, MFA settings |
| Organisation | Business name, ABN, NDIS registration details, addresses, billing contact |
| Billing | Subscription plan, invoices, payment history. Card details go directly to Stripe — we do not collect or store full card numbers |
| Usage and technical | Pages viewed, features used, IP address, browser and device type, timestamps, error and diagnostic logs |
| Communications with us | Support requests, emails, meeting notes, feedback |
| Marketing | If you enquire or subscribe: name, email, and your interactions with our emails |
3.2 Held on behalf of providers
Depending on how a provider configures OpsFlow, the platform may hold:
- Participant information — name, contact details, date of birth, NDIS number, plan details, supports, notes, and correspondence;
- Health information — which is sensitive information under the Privacy Act, and may include diagnoses, support needs, behaviour support material, incident records and clinical notes;
- Worker information — name, contact details, employment details, worker screening clearances, qualifications, certificates and expiry dates;
- Referral information — details of the person being referred, and the referrer’s details;
- Documents — uploaded files, signed agreements and e-signature records;
- Communications — SMS content, email content, call metadata, and call recordings where the provider has enabled recording.
We do not decide what goes into these records. Providers do.
3.3 Information we do not want
Please do not send us sensitive information (including health information) through support channels unless we ask for it. If you do, we will handle it under this policy, but the right place for participant information is inside the platform.
4. How we collect personal information
- Directly from you — when you sign up, subscribe, contact us, or use the platform.
- From your organisation — when an administrator creates an account for you or invites you.
- Automatically — through logs, cookies and similar technologies when you use the website and platform.
- From third parties — from Stripe (billing status), from our carriers (call and message delivery status), and from a service you choose to connect (such as Microsoft 365 or Google Workspace, where you authorise access to send email or create calendar events on your behalf).
- From a public referral form — where a provider publishes an OpsFlow referral form, information submitted through that form is collected by us on behalf of that provider.
5. Why we use personal information
We use personal information we hold for our own purposes to:
- create and administer accounts and authenticate users;
- provide, operate, maintain and improve the platform;
- provide support and respond to enquiries;
- bill for the service and manage payments and collections;
- monitor security, detect and prevent fraud, abuse and misuse, and investigate incidents;
- produce aggregated, de-identified statistics about platform usage — never derived from participant health information, documents, message content or call recordings;
- send service communications (outages, security notices, changes to terms, renewal notices) — you cannot opt out of these while you hold an account;
- send marketing about our products, where permitted — you can opt out at any time using the unsubscribe link or by emailing us; and
- comply with our legal obligations.
We do not sell personal information. We do not use personal information for advertising. We do not use customer data to train artificial intelligence or machine learning models.
6. Who we disclose personal information to
6.1 Service providers (sub-processors)
We use third parties to run the platform. Each is bound to protect the information and to use it only to provide services to us. A current, detailed list — including what each one handles and where — is published at opsflow.net.au/subprocessors and in our Data Processing Agreement.
In summary:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage, application backend | Australia — AWS Sydney (ap-southeast-2) |
| Vercel | Web application hosting and delivery | Global edge network; may process request metadata outside Australia |
| Twilio | Voice calling, call recording, SMS | Voice and recordings: Australia (Twilio AU1, Sydney). SMS: processed outside Australia — see 6.3 |
| Resend | Transactional and notification email | Outside Australia (United States) |
| Stripe | Payment processing and subscription billing | Outside Australia |
| Annature | Electronic signature | Australia |
| Sentry | Error and performance monitoring (optional, payloads scrubbed) | Outside Australia |
| Microsoft / Google | Where you connect a mailbox or calendar, to send on your behalf | Determined by your own tenant settings |
| Apple / Google push services | Mobile push notifications — content-free, no personal information in the payload | Outside Australia |
6.2 Others
We may also disclose personal information:
- to your organisation — if you are a staff member, your organisation’s administrators can see your account and activity in the platform;
- to professional advisers (lawyers, accountants, auditors) under confidentiality;
- to a purchaser of our business, where they agree to handle it consistently with this policy;
- where required or authorised by law, or to a court, regulator or law enforcement agency; and
- where you consent.
6.3 Overseas disclosure ⚠️
Some of our sub-processors are located outside Australia, principally in the United States, and some operate global infrastructure where the specific country of processing may vary.
We are accountable for how those recipients handle personal information. Before disclosing, we take reasonable steps to ensure they handle it consistently with the APPs, including by putting contractual protections in place and by choosing Australian processing regions where they are offered.
We deliberately host the core platform — the database, documents and file storage — in Australia (Sydney), because the information we hold on behalf of NDIS providers is sensitive.
⚠️ Where offshore processing is unavoidable, we tell you. The two you should be aware of are:
- SMS message content is processed through Twilio infrastructure outside Australia. Voice calls and call recordings remain in Australia.
- Email delivery is processed by Resend outside Australia.
If offshore processing of message content is unacceptable for your organisation, those features can be left disabled.
7. How we protect personal information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification and disclosure, including:
- encryption in transit (TLS) and at rest;
- row-level security in the database enforcing separation between provider tenants;
- role-based access control within each provider account;
- multi-factor authentication support;
- least-privilege access for our personnel, with access logged;
- server-side audit logging of significant actions;
- an immutable attestation ledger for records where a provider enables it;
- automated backups, and a documented and tested rebuild procedure;
- monitoring and alerting for errors and anomalous activity; and
- confidentiality obligations on all personnel and contractors.
No system is perfectly secure. If a breach occurs, we act under our Data Breach Response Plan and under the Notifiable Data Breaches scheme.
8. Data breaches
If we suspect a data breach, we will assess it promptly — and in any event we take all reasonable steps to complete the assessment within 30 days, as required by the Privacy Act.
If it is an eligible data breach likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.
Where the breach affects information we hold on behalf of a provider, we will notify that provider without undue delay and in any event within 48 hours of becoming aware, and give them the information they need to meet their own notification obligations. Where the provider is the entity required to notify, they will lead the notification and we will support them.
9. How long we keep information
| Information | Retention |
|---|---|
| Provider data held on their behalf | For the life of the subscription, then available for export for 90 days after termination, then deleted from active systems within 30 days and purged from backups within 7 days |
| Account and billing records | 7 years, to meet tax and corporate record-keeping obligations |
| Support correspondence | 2 years |
| Security and audit logs | 12 months |
| Marketing contacts | Until you unsubscribe, then a suppression record only |
⚠️ Providers: NDIS record-keeping obligations generally require participant records to be kept for at least 7 years, and for a child, until they turn 25. Deleting your OpsFlow account does not satisfy those obligations. Export your records before you close your account.
10. Cookies and analytics
We use cookies and similar technologies for:
- strictly necessary purposes — keeping you logged in, security, load balancing. These cannot be turned off;
- functional purposes — remembering preferences such as theme;
- analytics — we do not currently use analytics cookies. If that changes, we will update this policy and ask for your consent first where required.
We do not use advertising or cross-site tracking cookies.
You can block or delete cookies in your browser. If you block strictly necessary cookies, the platform will not work.
11. Accessing and correcting your information
If you are a customer or staff member of a customer: you can view and update much of your information directly in the platform. For anything else, email privacy@opsflow.net.au.
If a provider holds information about you in OpsFlow (as a participant, family member, worker or referrer): contact that provider. They control those records. We will refer any request we receive to them.
We will respond to an access or correction request within 30 days. We do not charge for making a request. If we refuse access or correction, we will tell you in writing why, and how to complain.
We may need to verify your identity before acting on a request.
12. Complaints
If you think we have breached the Australian Privacy Principles:
Step 1. Email privacy@opsflow.net.au with the details. We will acknowledge within 5 business days and respond substantively within 30 days.
Step 2. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner:
- Online: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
You may also have rights under State or Territory health privacy legislation. We are based in Victoria, and the Health Records Act 2001 (Vic) and its Health Privacy Principles apply to health information we hold. Equivalent legislation may apply where you or your provider are located — for example the Health Records and Information Privacy Act 2002 (NSW). Complaints under Victorian health privacy law can be made to the Health Complaints Commissioner (Vic) at hcc.vic.gov.au.
You may also have rights under the statutory tort for serious invasions of privacy that commenced on 10 June 2025.
13. Anonymity
You may deal with us anonymously or under a pseudonym for general enquiries. This is not practicable where we need to identify you — for example, to create an account, provide support on an account, or process payment.
14. Children
The platform is a business tool for provider staff and is not intended for use by children. However, records held in the platform on behalf of providers may relate to children who are NDIS participants. Those records are handled under section 2.2 above, and under the provider’s own policies and consent arrangements.
15. Changes to this policy
We may update this policy. The current version is always published at opsflow.net.au/privacy with its version number and effective date. If we make a change that materially affects how we handle your personal information, we will notify customers by email at least 30 days before it takes effect.
16. Contact us
| Privacy enquiries | privacy@opsflow.net.au |
| Postal | Berwick, VIC 3805 |
| Entity | James Stephen Maximos trading as OpsFlow, ABN 16 961 953 494 |