Goal Evidence Engine
Privacy policy
Xavier Braithwaite, sole trader (ABN pending) runs Goal Evidence Engine. This policy explains what the app holds about people, why, where it goes and what you can do about it. It is written to be read, not to be survived.
Two organisations are involved in any record you find here, and it matters which is which.
Your disability service provider decides what is recorded about you, who may see it and how long it is kept. They are the ones you have a service agreement with. Goal Evidence Engine is the software they use to record it, and we hold the records on their behalf and under their instructions.
If you want something changed, corrected or explained, your provider is the fastest path, because they can act on it directly. You can also come to us and we will help them do it.
What is deliberately not asked for. There is no field anywhere in the app for a participant's surname, address, date of birth, NDIS number, Medicare number or contact details. None of them is ever asked for. A shift note is free text though, so a worker can type one into a note, and we do not pretend otherwise. Contact details are stripped out of the text before any of it is sent for report drafting, which is described further down. There is no third-party analytics, no advertising, no tracking of people across other websites.
Almost everything is collected from the support worker who was on shift, typed or spoken into their phone at the time. Goals come from the participant's own plan, entered by their coordinator. We rarely collect anything from a participant directly.
Records are held in a managed database in Sydney, Australia. Access needs a sign-in. Coordinators see the people in their own organisation and nobody else's. The security page explains how that boundary works and how it is tested.
A sign-in does not last forever. It ends after seven days whatever happens, and after 24 hours with nothing done. After that the person signs in again. That matters most on a shared work phone, where the last person to use it should not still be signed in.
A submitted shift note cannot be edited, by anyone, including us. That is deliberate. A care record that can be quietly rewritten later is not a record. Something written in error is corrected by adding a correction, so both the mistake and the fix stay visible.
Records are not sold, rented or used for advertising. They are not used to train any AI model, ours or anyone else's.
Yes. Shift note content is sent to the United States.
When a worker asks for a shift report, the text of their notes is sent to Anthropic, an artificial intelligence company in the United States, which drafts the report. That is the only place content leaves Australia, and it is a disclosure to an overseas recipient under Australian Privacy Principle 8.
What we do not say. We do not say the notes are anonymous by the time they get there. Using a first name or an alias reduces the risk. It does not make a shift note stop being information about a person, because the provider holds the key that connects the two and the note itself describes a real day in a real person's life.
Personal information is held by these providers on our behalf.
| Provider | What they do | Where |
|---|---|---|
| Supabase | The database, the sign-in service and the audit tables. Every note, report and goal is stored here. | Australia (Sydney, ap-southeast-2) |
| Vercel | Runs the application itself. Handles each request and renders each screen. | Australia (Sydney, syd1) for the application. Static files are served from a worldwide network. |
| Anthropic | Writes the draft narrative of a shift report from the worker's own recorded notes. | United States |
| Upstash | Counts requests, so that one account or one address cannot flood the app or burn the shared sign-in code budget. It holds counters and the identifier each counter is against: a user id, an organisation id, an email address on the sign-in path, and the network address a request came from. | The region this project's counter store was created in. |
Records are kept for at least seven years. That comes from the NDIS incident and complaints rules, and for a participant record the clock runs from the end of the service rather than the day the note was written. A provider can choose a longer window. Nobody can choose a shorter one, and the app refuses to shorten one that is already set.
A record can be restricted, which takes it off every screen and out of every export while keeping it for the period the rules require.
There is one deletion path and it is deliberate. A provider can ask for their whole workspace to be cleared, and an administrator can do that behind a second code. It removes everything for that provider at once. There is no way for anyone to delete a single note, and no ordinary account can do any of it.
You can ask for a copy of the personal information held about you, and you can ask for it to be corrected. There is no charge to ask.
Ask your provider first. They can produce a participant pack themselves, in the app, with the goals, the approved reports and the record of what was written. If that is not possible, write to us:
Privacy Officer, Xavier Braithwaite, sole trader (ABN pending)Email is the channel today. There is no published telephone number and no postal address, because there is no office and no phone line to answer one. Both go here when they exist.
We will respond within 30 days. If we cannot give you something, we will tell you why in writing.
If you think your privacy has been mishandled, tell the Privacy Officer at the address above. Say what happened and what you want done about it. We will acknowledge it in writing, look into it, and give you an answer within 30 days. If it will take longer, we will tell you before the 30 days are up and say why.
If you are not happy with our answer, or we do not answer, you can take it to the Office of the Australian Information Commissioner. The OAIC usually expects you to have complained to us first and given us about 30 days.
Office of the Australian Information CommissionerA complaint about the care itself, rather than about privacy, goes to the NDIS Quality and Safeguards Commission on 1800 035 544.
If this policy changes we will publish the new version here and change the date below. If a change affects how information is handled in a way that matters, we will tell providers directly rather than relying on anyone re-reading this page.