Privacy policy

Information we collect and why

We collect information you give us through registration, accounts, forms, uploaded files and enquiries. Providers and their authorised staff or representatives may also enter information about other people. Relevant records can include:

• Business and account details: names, contact information, ABN, intended services, registration evidence, assistance enquiries, account identifiers and correspondence. These support registration preparation and access to the workspace.
• Staff information: identity and contact details, service assignments, screening, licences, qualifications, training, competence and supporting documents. Providers use these to manage their workforce and review eligibility.
• Participant information: contact and identification details, NDIS number where supplied, service assignments, communication needs, consents, representative authority, plans and agreements. Support delivery, medication, behaviour, accommodation, incident and complaint records may contain health, disability and other sensitive information.
• Learning information: your SD Property course progress, module versions, saved lesson steps, scenario choices, questionnaire answers, scores, attempts and completion dates. We use these to save your place, provide feedback and let SD Property Super Admin review course use and training needs across providers. Your learning centre shows your own progress. Provider administrators can see attempt and completion summaries in audit history; detailed choices and answers are available only in SD Property Super Admin course reporting. A completion records product learning, not professional or clinical competence.
• Operational information: changes and document access recorded in audit history, support enquiries, and authentication/security information handled by our infrastructure providers, such as IP addresses and browser/device information. These support security, troubleshooting and service operation.

We use relevant information to operate SD Property, help prepare registration applications, organise evidence and review tasks, support authorised service records and audit sharing, and investigate problems. No field is described as legally required solely because it appears in a form.

Only provide information needed for the task. Before adding another person’s information, confirm the purpose, your authority, and consent where required, including any representative’s authority. We may ask for clarification or restrict access where the basis for handling information is unclear.

You may make a general enquiry without identifying yourself, where practical. Account access, registration assistance and managing an individual’s records usually need sufficient identifying information. If needed information is not supplied, we may be unable to provide that function; your provider should explain any effect on its services.

Who can access or receive information

• Provider administrators manage their organisation’s records. Staff access depends on their role, assignments and the records permitted for their work. Participants can see their own available records and information explicitly shared with them.
• SD Property Super Admin users can review provider registration material and download documents uploaded into provider workspaces, including staff and participant documents. Authorised technical operators may access information needed to operate, support or secure SD Property. Upload only evidence needed for the stated purpose.
• Invited auditors can access selected documents after identity checks, while their invitation remains valid. Revoking access does not recall copies already downloaded.
• When SD Property Super Admin explicitly enables learning API access for a verified BMS Pro Trade business connection, that business can retrieve its provider-admin and staff learning catalogue, progress and activity summaries. This API excludes participant learning, scenario choices and individual questionnaire answers. Permission can be revoked for future requests; revocation does not recall records already received by the connected business.
• Google/Firebase and Vercel, and their service providers, process information to supply authentication, databases, private document storage, hosting and related infrastructure.
• We may disclose information where required or authorised by law, or to respond to a properly assessed security or legal matter. The relevant circumstances and authority must be considered.

SD Property does not automatically submit records to the NDIS Commission, grant registration or start BMS transfers when an account is created. A separately authorised BMS learning connection can retrieve the summaries described above. Billing arrangements handled outside SD Property have their own information-handling arrangements.

Storage, overseas processing and protection

SD Property uses Google/Firebase and Vercel. The main database and document storage are in Sydney, and application functions are configured for Sydney. Other service processing can occur overseas: Firebase Authentication processes account information in the United States, and Vercel and its providers operate internationally, including the United States.

These settings do not provide an Australia-only processing guarantee. The vendors publish more detail about their processing locations and service providers: Firebase privacy and security, Firebase subprocessors, Vercel privacy notice and Vercel subprocessors and security information. Processing countries can differ by service and may change; contact us for help understanding the arrangements relevant to your use.

We use authenticated access, organisation and role restrictions, private document storage, upload checks, audit history, backups and monitoring. No online service can guarantee absolute security. Reports of suspected unauthorised access should be sent promptly to our privacy contact, with minimal identifying detail initially.

Our response process is to contain and investigate a suspected breach, preserve relevant evidence, assess the effects and applicable notification duties, and coordinate recovery with affected providers and service vendors. SD Property does not automatically lodge a privacy-breach notification.

Retention, correction and disposal

Records are retained to provide the service and meet applicable recordkeeping, dispute and legal-hold needs. The appropriate period depends on the record and the provider’s obligations; there is no single automatic expiry for all compliance records. We review requests to close accounts or dispose of information with the relevant provider and against those requirements.

Signing out, removing a service or closing a workflow does not erase its history. Corrections to signed operating records generally retain the original facts and add an attributed correction. Backups and recoverable deleted files can persist for their configured recovery periods. A disposal request may therefore require controlled removal from several systems; it is not instant self-service deletion.

Contact us to request access, correction, deletion or de-identification. We will assess the request and explain the outcome and any lawful reason for retaining information. Files already downloaded by an authorised recipient are outside the platform’s ability to recall.

Your choices, access and correction

Contact info@bmspros.com.au or write to our address above. Tell us what you need and, if relevant, which provider holds the record. You do not need to use a special form. You may ask for this policy or assistance in another accessible format.

We may need to confirm your identity and any authority to act for another person. Do not send passwords or full identity or health documents in an initial email. We will arrange an appropriate way to provide information if it is needed and coordinate with the provider where it is responsible for the record.

We will investigate and respond within the applicable period, explain any refusal or restriction, and explain available complaint options. Ask your provider about changes to its service consent; withdrawing consent can affect the support it can deliver and does not automatically remove records that must be retained.

Sign-in and browser storage

Authentication can remain active after a browser is closed. Sign out on shared devices. Registration drafts are temporarily kept in the browser session so you can resume a form; drafts older than 24 hours are not restored and a successful registration submission clears the draft. The 24-hour limit is not a guarantee of physical erasure at that instant. The reviewed application does not include advertising analytics; infrastructure services maintain operational and security information.

Automated checks

SD Property checks entered dates, evidence status, permissions, assignments and recorded requirements to display reminders or block invalid actions. These checks support human review. SD Property does not decide NDIS access or registration, prescribe treatment or grant clinical or restrictive-practice authority. Contact your provider or us if a check appears incorrect; do not enter false information to bypass it.

Privacy complaints

Send your concern to the SD Property privacy contact at info@bmspros.com.au or by post. We will record it, review the circumstances, coordinate with the relevant provider where needed, and explain our response and next steps. Let us know if you need assistance making a complaint.

If you are dissatisfied with our response, or have not received a response within a reasonable time, you can contact the Office of the Australian Information Commissioner. Its guidance explains the complaint process, including approaching the organisation first and generally allowing 30 days for a response. Service complaints may also have a separate provider or NDIS Commission pathway.