How Clearline supports NDIS compliance.

The tooling we ship, in plain language.

Inside the vendor scope, here's what the platform actually does today. Every bullet is in production now across the four products (Aura OS, Pilot, Compass, Scrive). We build Clearline to help providers meet their obligations under the NDIS Practice Standards — the Standards apply to providers, not to software vendors, but the workflows we build are shaped around them.

• Append-only audit log on every state-changing action across the platform. Roughly 22 distinct event types live today. No UPDATE or DELETE paths exist in the API; rows are written once and stay.
• Tamper-evident audit exports. NDIA-format audit exports for a participant ship as PDF, CSV, or JSON with a SHA-256 hash on the export package so a recipient can verify the bundle wasn't altered after generation.
• Consent capture and revocation flows wired into the Connect identity layer. Families approve who joins their participant's care team across all four products. Revocation propagates across products within seconds; the audit log records who accessed what, and when.
• NDIS numbers stored as SHA-256 hash with a server-side pepper. Never as plaintext, anywhere in the database. Match-by-hash works for cross-product participant discovery without putting plaintext NDIS numbers on the wire.
• Shift note and report structures shaped around NDIS Practice Standards documentation expectations. Aura OS shift notes, Scrive reports (5 NDIS report types), and Pilot reports (Progress, Implementation, Plan Review) carry the fields and structure NDIS auditors look for.
• Cross-product participant identity continuity (Connect graph). A participant's identity stays consistent as providers, support coordinators, and OTs change around them — reducing duplicate records and the gap between what a family says and what each provider has on file.
• Data export available on request. Human-readable (PDF) and machine-readable (CSV, JSON) formats. Per-participant exports for NDIA compliance audits; per-organisation exports for the provider's own records.
• Per-product role-based access. Workers, coordinators, OTs, family members, and admins each see only what their role permits. Workers don't see business administration; family members don't see other families.

What we keep, for how long, and how it's protected.

Records, service-agreement dates, shift notes, incident reports, and clinical reports are retained per the canonical retention table in our Privacy Policy. NDIS compliance records carry the 7-year regulatory minimum; cancelled-account data is purged within 90 days except where retention is required by law.

• Full retention table at Privacy Policy § 5.4 — covers active account data, compliance records, participant records, cancelled accounts, and analytics
• Audit log entries are append-only — no UPDATE or DELETE paths in the API
• Audit exports ship in PDF, CSV, or JSON with a SHA-256 tamper-evident hash on the export package
• Behaviour Support Plan content (Aura OS) is retained for 7 years per NDIS requirements, with role-based access restricted to behaviour_support_lead, manager, and owner roles
• Encryption at rest and TLS 1.2+ in transit on every endpoint — see Trust & security for the full posture

Where to direct what.

Participants and their nominees can revoke consent at any time. Revocation propagates across all four products via the Connect identity layer (see the architecture diagram above) — the provider sees the change in their app, further reads of the revoked scope return 403, and the audit log records the action.

• Consent revocation works from any account that holds the consent role — family member, nominee, or self-consenting adult participant
• Data export on request — we aim to provide exports within 30 days from the email request landing at support@clearlinehealth.com.au, in line with the Privacy Act (APP 12) standard for access requests
• Data deletion follows the retention table: cancelled-account data within 90 days; NDIS compliance records retained 7 years per regulatory requirement

One person to email.

Compliance, privacy, and platform-handling questions go to a single mailbox monitored by the founder. No legal@ or compliance@ alias, no triage tier. Faster for everyone.

Internal pages and external NDIS resources.

On the Clearline platform side: our Trust & security page covers data handling, encryption, backups, and the broader security posture. Pricing Download is published in AUD with no contact-us-for-pricing.