Privacy Policy

1. Scope of this Policy

This Policy applies to:

• NDIS Providers using the HuGo platform
• Support Workers and staff whose information is entered into HuGo
• Participant information uploaded by Providers
• Visitors to our website

HuGo is purpose built for NDIS Providers, where participant confidentiality and secure record keeping are essential.

2. Personal Information We Collect

We may collect personal information including:

• Provider contact and business details
• Support Worker details
• Participant information entered by Providers
• Rostering, shift and documentation data
• System usage and activity logs
• Technical, browser and device information
• Website enquiry information

Providers are responsible for ensuring they have appropriate authority and consent to upload participant information into HuGo.

3. How We Use Personal Information

We use your information to:

• Provide access to the HuGo platform
• Enable rostering, reporting, documentation and communication features
• Maintain system functionality and performance
• Protect platform security and integrity
• Respond to support requests and enquiries
• Meet legal and regulatory obligations

We do not sell personal information.
We do not use Provider or participant data for marketing purposes without consent.

4. Disclosure of Personal Information

We may disclose personal information:

• To authorised personnel within the relevant Provider organisation
• To Amazon Web Services (AWS) for secure cloud hosting
• To professional advisers where required
• To regulators or authorities where required by law

Personal information is not disclosed overseas except as part of secure cloud hosting arrangements, where applicable.

5. Hosting & Data Storage

HuGo is hosted on secure Australian cloud infrastructure via Amazon Web Services (AWS).

AWS maintains internationally recognised security certifications including ISO 27001 and SOC frameworks. Ability Tech does not represent itself as independently certified under these standards; however, our infrastructure is built upon AWS’s secure and certified environment.

Data is stored within Australia unless otherwise agreed in writing.

6. Security Controls

We implement layered technical and organisational controls designed to protect personal information from unauthorised access, misuse, loss or disclosure. These include:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest using AWS-managed encryption
• Secure user authentication
• Structured role-based access controls
• Controlled access for authorised Ability Tech support personnel
• System monitoring and audit logging

Access to participant information is restricted based on user roles within each Provider organisation.

7. Two-Factor Authentication

HuGo incorporates secure login protocols, including optional two-factor authentication (2FA), to enhance account security.

8. Data Ownership

All Provider data entered into HuGo remains the property of the Provider.

Ability Tech does not claim ownership over Provider or participant data.

9. Backup & Business Continuity

Automated backups are conducted within the AWS environment to support data integrity and availability.

Ability Tech maintains business continuity and disaster recovery procedures designed to minimise disruption in the event of a system outage or security incident.

10. Security Incident Response

Ability Tech maintains a defined incident response process covering identification, escalation, investigation, containment and remediation.

In the event of a confirmed security incident:

• Investigation commences promptly
• Impacted Providers are notified as required
• Containment and remediation measures are implemented
• Regulatory obligations are followed where applicable