How we handle your data

Last updated: 14 October 2026

NDIS providers hold some of the most sensitive information in Australia. This page explains what we access when we work with you, what we do with it and what we never do. It applies to our NDIS services and forms part of our NDIS Service Terms. Our website Privacy Policy covers enquiry forms.

What we access

• Settings and configuration in Microsoft 365 or Google Workspace: security settings, sharing settings and sign-in policies.
• Account and device lists: staff account names, roles, last sign-in dates, licence assignments and device records.
• Care platform user lists and roles (for example ShiftCare or Lumary), by read-only access or a screen share with your administrator.
• Business records you give us: your staff list, software invoices or statements, and your existing policies.

What we don't access or keep

• We do not open participant files, case notes, plans or health records. If we need to confirm that a file is shared publicly, we check the sharing setting, not the content.
• We do not copy, download or export participant records out of your systems.
• We do not put participant names, NDIS numbers or case notes in our reports.
• We do not sell or share your information, and we do not use it to train AI models.

How access works

• Least access: the Health Check uses read-only roles. Fix & Harden and managed services use the lowest admin role the scoped work needs.
• Named account: you create a named account for us in your own system, so everything we do appears in your audit logs under that name.
• Multi-factor login is required on every account we use.
• You stay in control: you can disable our account at any time. For a Health Check, we ask you to remove it when the walkthrough call is done.
• No changes without sign-off: during a Health Check we change nothing. In other engagements we change only what is in the agreed scope.

Who does the work, and where

Work is carried out from Australia by Fivefold AI's founder, a CISSP-certified security professional. If we ever need another person or a subcontractor to access your systems, we will tell you who and why, and get your written approval first.

What we store and for how long

• Working evidence (screenshots of settings, exported account and licence lists, your staff list) is stored in an encrypted business cloud account protected by multi-factor login.
• We delete working evidence 90 days after your report is delivered, unless you ask us to delete it sooner or you become an ongoing client.
• We keep your report and invoices for our business records. You can ask us to delete your report at any time.

Tools we use

We use mainstream business software for email, documents, video calls and invoicing. We use AI tools to help analyse configuration data and draft reports. We do not enter participant personal information into AI tools. On request we will give you a current list of the tools used in your engagement.

If something goes wrong

If we become aware of unauthorised access to, or loss of, your information connected to our work, we will tell your nominated contact without undue delay and no later than two business days after we become aware, and help you assess what happened. Your obligations under the Notifiable Data Breaches scheme and to the NDIS Commission remain yours, and we will give you the information you need to meet them.

Your requests

You can ask us at any time what information we hold about your organisation, to correct it or to delete it. Email hello@5foldstrategy.com.