Data Processing Addendum

Version 0.2 · for the GapCheck portal and worker app

Draft 0.2, 6 October 2026. Written to match what the software does today. Not yet reviewed by a lawyer. Version 0.2 · 6 October 2026

Forms part of the Terms of Service. This is the document your compliance person will ask for.

1. Roles

You decide what information about your staff, workers and participants is entered and why. We hold and process it only to provide the service to you, and only on your instructions. You remain accountable to your workers and participants for it.

Australian privacy law does not use the controller/processor split, so nothing here imports GDPR meanings. The practical position is what matters: it is your data, held by us on your behalf.

2. Scope

In — your staff: name, email, role, password hash, settings, sign-in times.

In — your workers: names, the identifiers you choose, roles, work emails, training assignments, due dates, assessment responses and scores, competency sign-offs with the assessor's name, credentials and their numbers and expiry dates, documents you upload against a worker, availability, time off and its kind (including sick leave), shifts, offers, clock-in and clock-out times, the phone's location at clock-in and clock-out where you switch it on, pay rates and approved hours, and announcement read receipts. While a CSV of workers or participants is being imported, the parsed rows are held for up to 30 minutes.

In — your participants: the identifiers and labels you choose, NDIS numbers, plan dates, plan management type and plan funding, plan manager name and email, shifts and support items, travel recorded against shifts, agreed support hours, the regular team, progress notes, chart entries, medicine lists and medicine records (where we switch that feature on for you), the bowel flag setting, and incident records including internal ones.

Health information in that list: progress notes, chart entries, medicine lists and records, incident records, and sick-leave markers. You are the party that decides to collect them and owes notice to the people concerned.

Out: participants' full names beyond the label you choose, dates of birth, addresses, care plans, behaviour support plans and restrictive-practice authorisation documents. There is no field for them and the service refuses documents against a participant. (An incident record can say a restrictive practice was used.) Do not put them in notes. If we notice them, we will tell you and ask you to supersede the note.

3. Our undertakings

We will:

• process the information only to provide the service to you and not for our own purposes, except that we may build de-identified, aggregated datasets from training and assessment use (direct identifiers and free-text answers removed; never notes, charts, medicine records, incidents, locations or pay) to improve our courses and product, as the Privacy Policy describes;
• not sell personal information, and not use it for advertising or to profile individuals;
• not attempt to re-identify any de-identified dataset we create;
• keep it in Australia (clause 5);
• limit our own access to support and maintenance, with a reason;
• apply the security measures in clause 4;
• help you respond to a worker's or participant's request about their own record;
• return or delete it as described in clause 7;
• switch on features that widen the data held (medicine records today) only when you ask us to, and record that you asked.

4. Security

• Passwords hashed with scrypt; we cannot read them.
• Session cookies and device keys stored as digests, so a stolen copy of the database cannot be used to sign in.
• TLS in transit, with HSTS.
• Sign-in throttling by account and by network address.
• Every query scoped to one provider; two customers cannot collide.
• Signed notes, chart entries, incident records and clock events are append-only; nothing is rewritten or deleted. A note is corrected by a superseding note; the others by a correction recorded alongside.
• The audit log cannot be altered while the account is open (database triggers); network addresses on it, and in the web server's access log, are removed after 90 days.
• A nightly copy of the database, taken through SQLite's online backup and checked whole before it is kept, pulled to a machine we control in Australia and kept 30 days; the host's own two-day server snapshots in Sydney. The copy was opened and read on 5 September 2026; a full restore from the host's snapshot has not yet been rehearsed.
• The app keeps its device key in the phone's secure store and the Android app is excluded from cloud backup; signing out removes the local copy.

5. Sub-processors

Not sub-processors but worth knowing: the nightly database copy goes to a machine we control ourselves in Australia, not to a third party; Apple and Google distribute the app and receive no service data; Google Maps is opened in a staff member's own browser only if they click "Map" on a clock-in position; the NDIA and plan managers receive only what you download and send yourself.

We will give you [NUMBER] days' notice before adding a sub-processor, and you may terminate without penalty if you object.

6. Breach notification

If we become aware of unauthorised access to, disclosure of, or loss of your information, we will:

• tell you without undue delay and in any case within [NUMBER] hours of becoming aware;
• tell you what we know: what happened, what data, how many people, what we are doing;
• help you meet your own obligations, including under the Notifiable Data Breaches scheme and, for incidents involving participants, your NDIS obligations; you are the one who can identify and reach the people concerned, and where the scheme lets one notification cover us both we will rely on yours;
• not make a public statement identifying you without your agreement, unless the law requires it.

7. Return and deletion

On termination, or on your written request at any time, we will give you a machine-readable export (CSV files plus the documents you uploaded) and delete the data from live systems within [NUMBER] days and from backups within a further [NUMBER] days as backups age out.

We will not delete data during a billing dispute in a way that costs you evidence you are required to hold.

8. Audit

On reasonable notice, no more than once a year, we will answer a reasonable written security questionnaire and provide what documentation we have. We are a small supplier: expect honest answers about what exists, not certifications we do not hold.

9. Your responsibilities

• Have a basis to enter your workers' details, pay rates and credentials, and tell them what the service records about them, including location at clock-in if you switch it on.
• Give participants the privacy notice your own obligations require before your workers write notes, charts, medicine records or incidents about them.
• Keep account access under control, and remove people who leave.
• Decide your own retention periods. Incident and complaint records carry a seven-year retention under the NDIS (Incident Management and Reportable Incidents) Rules 2018 and the NDIS (Complaints Management and Resolution) Rules 2018, as our courses on them cite; that is your obligation, not a GapCheck setting.
• Do not enter the excluded participant information in clause 2.
• Where you download exports, claim files, invoices or notes packs, you are responsible for them from that point.

Contact: Gap Check, Shop 2/290 Boundary Street, Spring Hill QLD 4000, hello@gapcheck.net