NDIS Service Terms

Last updated: 14 October 2026

These terms apply to the services Fivefold AI offers to NDIS providers on 5foldstrategy.com/ndis: the Tech Health Check, Fix & Harden projects, and Managed IT & Compliance. They sit alongside our general Terms of Service. Where the two differ for an NDIS service, these terms apply. The contracting entity and ABN are shown on your quote and invoice.

1. The Tech Health Check

The Health Check is a fixed-price, remote review of the systems listed in your quote. It covers six areas: identity and access, Microsoft 365 or Google Workspace security, devices, backup and recovery, privacy and breach readiness, and software spend.

You receive a written report within five business days of the kickoff call, provided you give us the access and information we ask for by the end of the first business day. The report contains a red, amber and green scorecard, findings mapped to the relevant NDIS Practice Standards outcomes, a list of software savings with estimated annual values, and a prioritised 30-day fix plan. A 45-minute walkthrough call is included.

2. What the Health Check is not

• It is not an NDIS registration audit. Only an NDIS Commission approved quality auditor can assess conformity with the Practice Standards.
• It is not penetration testing, an on-site inspection or legal advice.
• It does not guarantee an audit outcome or that your systems are free of vulnerabilities.

Each finding is labelled as Verified (we checked the setting or record directly), Sampled (we checked a sample) or Reported by you (based on what you told us). Findings reflect your systems at the time of the review.

3. The Health Check guarantee

You do not pay the Health Check fee if the report identifies neither of the following:

• software savings with a combined estimated annual value of at least the Health Check fee you were quoted; nor
• at least one material gap in how participant information is protected.

If the report identifies either one, the fee is payable. "Material gap" has the meaning we agree with you in writing at kickoff. If nothing is agreed, it means a red-rated finding in the report. Savings are estimates based on your prices and usage at the time of review. The guarantee covers savings identified, whether or not you choose to act on them. The guarantee does not apply if we could not complete the review because access or information was not provided.

4. Fix & Harden projects

Fix & Harden work is quoted as a fixed price against a written scope after your Health Check. We make changes to your systems only as described in that scope and with your approval. We confirm completion of each item with you, and you sign off the project when the scoped items are done.

5. Managed IT & Compliance

The users, devices, systems, support hours, after-hours arrangements and response targets covered by your plan are those written in your quote or service agreement. Anything not listed there is out of scope and quoted separately. Plans run month-to-month and either party can cancel with 30 days' written notice.

6. Access and how we handle your data

We ask for the least access needed to do the work. For the Health Check this is read-only. We do not copy participant records out of your systems. Full detail is on our Data handling page, which forms part of these terms.

7. Confidentiality

We keep confidential everything we learn about your organisation, your systems and your participants, and use it only to deliver the service. Your report describes security weaknesses, so we share it only with the people you nominate. We will sign your confidentiality agreement on request. These obligations continue after the engagement ends.

8. Security incidents and data breaches

If we become aware of unauthorised access to, or loss of, your information that is connected to our work, we will tell your nominated contact without undue delay and no later than two business days after we become aware. We will give you the information we have to help you assess and meet your own obligations. You remain responsible for your notifications to the Office of the Australian Information Commissioner, the NDIS Commission and affected people.

9. Your responsibilities

• Give us timely access, a nominated contact and accurate information.
• Make sure you are authorised to give us access to the systems in scope.
• Decide which recommendations to act on. You remain responsible for your compliance with the NDIS Practice Standards, the NDIS Code of Conduct and privacy law.

10. Fees

Fees are in Australian dollars and exclude GST. The Health Check is invoiced when the report is delivered and is payable within 7 days, subject to the guarantee in section 3. Fix & Harden projects are invoiced as set out in the quote. Managed IT & Compliance is billed monthly in advance.

11. Liability

To the extent permitted by law, Fivefold AI's total liability arising from an NDIS service engagement is limited to the fees you paid for that engagement in the 12 months before the claim. Fivefold AI is not liable for indirect or consequential losses. Nothing in these terms excludes any right or remedy you have under the Australian Consumer Law that cannot lawfully be excluded.

12. Independence

Fivefold AI is an independent technology services business. It is not affiliated with the NDIA or the NDIS Quality and Safeguards Commission. We do not take commissions from the software vendors we review.

13. Governing law and changes

These terms are governed by the laws of New South Wales, Australia. We may update them from time to time. The terms that apply to your engagement are those in force when you accepted your quote.