1. About this policy
This policy explains the proposed handling of personal information when you contact Metamorph Supports, use our website or receive support. It also explains how to request access or corrections and raise a privacy concern.
It covers enquiries, referrals and service records. Worker and contractor information may also need a separate collection notice relevant to their role.
2. Information we collect
The website enquiry form collects contact details, a short message and contact preferences. The current website enquiry privacy notice explains that process.
For future services, information may include contact and emergency details, communication preferences, support needs, goals, relevant health information, consent records, service agreements, shift records, progress notes, feedback and billing details. The final collection will depend on the support being arranged and what is reasonably necessary.
Please do not send health information, participant documents or other sensitive details through this website.
3. How information is collected and used
Information may come directly from you or, with appropriate authority, from a nominee, family member, support coordinator or another person involved in your support.
The proposed purposes are to respond to enquiries, assess whether suitable support is available, agree on support arrangements, provide and coordinate support, maintain service and billing records, and manage feedback, safety concerns and legal obligations.
Collection of sensitive information requires an appropriate lawful basis, which may include your consent. A privacy policy does not replace consent where it is required. Collection notices will explain the particular information being requested and why.
5. Storage and protection
The proposed safeguards include access restrictions, individual accounts, secure connections, appropriate worker confidentiality obligations and procedures for responding to suspected privacy incidents.
These safeguards and their operation must be verified before real participant records are introduced. No online system can be guaranteed completely secure.
General-purpose AI development and maintenance tools are not intended to have unrestricted access to participant records. The maintenance protocol prioritises code, technical metadata and synthetic test data; enforceable access boundaries remain a verification item. This draft does not claim that AI access is already technically impossible.
6. Technology providers and overseas handling
The website preview is hosted on Vercel, and the application includes Supabase for authentication and data services. Provider arrangements, subprocessors, support access, backups and relevant processing locations still need to be verified.
Before launch, this section must explain any likely overseas disclosures and identify the countries where practicable. We are not claiming that all information remains in Australia.
7. How long information is kept
The proposed approach is to keep information only for as long as it is needed for its lawful purpose or a record-keeping obligation. Where it is no longer needed and no retention obligation applies, reasonable steps should be taken to securely destroy or de-identify it.
The retention schedule for enquiries, participant records, financial records, complaints and backups must be confirmed before launch. This draft does not promise immediate deletion of records that must lawfully be retained.
8. Website information and tracking
Hosting and authentication services may process technical information needed to deliver and secure the website, such as network details and session information. Portal sign-in may retain authentication information in your browser.
The final policy must describe the actual cookies, browser storage, logs and any analytics or advertising tools in use. A complete tracking inventory has not yet been verified; this draft makes no claim that the website is free of tracking.
9. Access, corrections and privacy concerns
You may request access to personal information held about you, ask for inaccurate information to be corrected, or raise a concern about its handling. Requests may require identity or authority checks, and lawful exceptions can apply.
A designated privacy contact and accessible request process must be confirmed before real information is collected. The contact page will show online enquiry availability. You can use the contact form to request a privacy follow-up.
You can find information about privacy rights and external complaints through the Office of the Australian Information Commissioner. Service-related concerns may also be raised with the NDIS Quality and Safeguards Commission.
10. Policy updates
The approved policy will display its effective date and be updated when information-handling practices change. This version is a review draft dated 19 October 2026 and has no approved operational effective date.