CareReady Acceptable Use Policy

Drafted 10 August 2026. Do not publish as final until a lawyer has reviewed it.

Last updated: 11 August 2026

This is the short list of what CareReady may and may not be used for. It forms part of the Terms of Service.

It is short on purpose. There is one rule underneath all of it: CareReady holds health information about people with disability, and everything in here follows from taking that seriously.

1. Use it for support work you actually do

CareReady is for running your own NDIS support business — the participants you support, the shifts you work, the invoices you raise, the records you are required to keep.

Do not use it as a general-purpose database, a place to keep records for someone else's business, or a store for information that has nothing to do with the support you provide.

2. Do not put other people's participants in it

This is the one that matters most.

Only enter information about a participant you personally support, or are engaged to support, and who has agreed to it — or whose nominee, guardian or other substitute decision-maker has agreed on their behalf.

That means, plainly:

• Not a participant you have heard about, been told about, or used to support and no longer do.
• Not a colleague's caseload, an agency's client list, or records copied out of another provider's system.
• Not a list you were given by someone who did not have the right to give it to you.
• Not a person who has said no, or who has withdrawn their consent.

Only enter what you need for the support you provide. The optional fields — dietary needs, triggers, communication needs, whether someone is Aboriginal or Torres Strait Islander — are optional because a participant may agree to some of it and not the rest. Leaving a field blank is a valid answer.

If you stop supporting someone, stop adding to their record. What you keep after that is a record-keeping question, covered in the Privacy Policy.

3. Look after the account

• One account, one person. Do not share your login with anyone, including a colleague covering your shifts.
• Use a password you do not use anywhere else.
• Lock your phone. The app is on it, and so are the records.
• If you think someone has got into your account, tell us straight away.

Anything done under your account is treated as done by you.

4. Do not use it to harm anyone

Do not use CareReady to harass, threaten, defame or stalk a person — a participant, a family member, another worker, or anyone else. Do not use the location record from a check-in to keep track of a person for any purpose other than your own record of your own shift.

Do not use it for anything unlawful, and do not use it in a way that breaches the NDIS Code of Conduct.

5. Do not attack the software

Do not try to reach another worker's account or another worker's participant records. Do not probe, scan or test the security of the system without our written permission. Do not scrape it, resell access to it, or run it as a service for other people.

If you find a security flaw, tell us instead of using it. We will not come after someone who reports a genuine problem in good faith and gives us a chance to fix it before telling anyone else.

6. Keep your public listing honest

If you publish a profile on CareReady Connect, it is read by participants and their families deciding who to let into their home.

Say what is true. Do not claim a qualification, a screening clearance, an insurance policy or an experience you do not have. Credential badges are computed from the documents you upload, so do not upload someone else's, an expired one, or one that has been altered.

7. What happens if this is breached

It depends on what happened.

• Something careless or a misunderstanding. We will tell you what the problem is and ask you to fix it, and give you a reasonable time to do it.
• Something serious, or repeated after we have raised it. We may suspend or close the account under clause 17 of the Terms of Service.
• Something that puts other people's data or safety at risk. We may suspend the account immediately, without notice, and tell you why afterwards. That is the only case where we act first and explain second.
• Something that has to be reported. Where the law requires it, or where we reasonably believe someone is at risk of harm, we may report a matter to the NDIS Quality and Safeguards Commission, the police, or another regulator.

Where an account is closed, you get a reasonable period to export your records first, unless giving you that time would itself put other people's data at risk.

8. Telling us about a problem

If you see something in CareReady that should not be there — a record that looks like it belongs to someone else's participant, a profile making claims that are not true, or an account being misused — tell us.

privacy@careready.com.au, monitored by the founding directors, handles this and security reports both, until we have grown enough to split them out. Our contact form works too, and always will, even while that inbox is being set up.

Source of record: docs/legal/ACCEPTABLE-USE.md in the CareReady repository. Questions about anything on this page can go through our contact form.