BellaAssist Privacy Policy
How we handle personal information, and what you can ask us to do with it.
Who this policy covers
This policy explains how BellaAssist handles personal information. It applies to BellaAssist Pty Ltd (ABN 91 694 975 865), which operates BellaAssist, and Bella Sláinte Pty Ltd (ABN 84 695 641 573), its parent company, when it handles information for BellaAssist. Each company is responsible for information it holds or controls.
BellaAssist helps NDIS participants and their authorised representatives prepare and manage submissions and supporting evidence. Questions about this policy may be sent to privacy@bellaassist.au.
- Version
- 1.0
- Issue date
- 26 August 2026
- Classification
- Public · Controlled
- Review cadence
- At least annually, and after a material change in data handling or law
- Privacy Officer
- David Haberlah, CTO and Chief Data / AI Officer
1. Information we collect
We may collect identity and contact details; account and authentication records; NDIS participant numbers, plans, goals, budgets and support information; disability and health information; uploaded documents; submission content and AI-assisted drafts; consent, delegation and representative records; communications; and device, browser, IP address, usage and audit-log information.
We do not sell personal information, use biometric identification or track people across unrelated websites.
2. How we collect and hold information
We collect information from you when you create or use an account, upload evidence, prepare a submission, grant delegated access or contact us. We may also receive it from a guardian, nominee or other person authorised to act for you. BellaAssist records actions taken under a delegation so the audit trail identifies who acted.
Operational information is collected automatically when you use BellaAssist. Account and application records are held on secure Australian servers. Participant documents use Australian dual-region storage across Sydney and Melbourne.
3. Why we use and disclose information
We use personal information to provide and secure BellaAssist; authenticate users; prepare and manage submissions; analyse documents and generate requested drafts; support delegated access; communicate with users; respond to requests and complaints; prevent misuse; keep required records; and meet legal obligations. We collect sensitive information only where it is reasonably necessary for BellaAssist’s functions or activities and we have valid consent, unless another exception under the Privacy Act 1988 (Cth) applies.
Optional research sharing requires express consent. We use participant-derived information for cross-participant analytics or predictive-model improvement only after it is de-identified and aggregated, and after the purpose, legal authority, notice, purpose-specific opt-in, privacy assessment and safeguards have been approved. We do not currently use customer or participant content to train AI model parameters.
4. AI-assisted processing
BellaAssist uses AI to analyse documents, draft submission content and assess readiness or completeness. It may use account details, participant profiles, plans, uploaded documents, instructions, corrections, service interactions and approved outcome information. Any statistical probability estimate requires separate approval before release.
AI outputs are advisory. Where the feature permits, a participant or authorised representative can review, edit or reject them. BellaAssist does not decide NDIS eligibility or funding, clinical treatment, access to services or legal rights.
5. Service providers and other recipients
BellaAssist uses service providers to process information on our behalf, and each receives only the information needed for its function. Google Cloud hosts BellaAssist’s application, database and documents in Australian regions. Approved AI requests are processed through AWS Bedrock and Google Vertex AI in Australian regions. Operational services receive information for specific functions rather than the full product dataset. Google Workspace and Jira may hold correspondence, case details and authorised diagnostics. Slack receives category, severity, an opaque thread identifier and a Jira reference for ordinary feedback; complaint and privacy content is excluded. Postmark receives recipient addresses and transactional message content needed to send account communications and may process that information in the United States.
We may disclose information to an authorised representative, professional adviser, regulator or another recipient where authorised or required by law. BellaAssist does not lodge material with the NDIA; you or an authorised person may copy, download or lodge material prepared in BellaAssist. We do not disclose personal information to advertisers or data brokers. Where personal information is likely to be disclosed overseas, we take the reasonable steps required by APP 8.
6. Security and retention
We use access controls, multi-factor authentication where required, encryption, audit logging, restricted service routes, incident response and security testing appropriate to the information and service.
We keep personal information only while needed for an authorised purpose or legal obligation. Retention varies by record type and lifecycle. Legal holds, privacy requests, account closure and backup lifecycles can affect deletion. When information is no longer required, we take reasonable steps to delete or de-identify it.
7. Your choices and requests
You may ask to access or correct personal information we hold about you. You may also request deletion, withdraw optional research-sharing consent, or revoke delegated access. Deletion requests are assessed against legal and operational retention duties. AI analysis is part of the current BellaAssist service; contact us if you want to close your account instead.
Send a request to privacy@bellaassist.au. We may verify your identity before acting and normally respond within 30 calendar days.
8. Children and representatives
BellaAssist may create an account for a participant under 18 when a parent, guardian or other authorised representative provides the required authority. We collect information from that adult and from the child when the child uses the account. The adult’s delegated access expires at the child’s 18th birthday, when authority must be reassessed. Contact the Privacy Officer if you believe a child’s information was collected without proper authority.
9. Complaints
Send privacy complaints to complaints@bellaassist.au. We aim to acknowledge a complaint within two business days, investigate it and provide a written outcome within 21 calendar days. If more time is needed, we will explain why and give a revised date.
If you are dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
10. Changes and contact
We review this policy at least annually and after a material change in data handling or law. We publish the current version free through BellaAssist and can provide another accessible format on request. We notify users when a change materially affects the service or their choices.
Privacy Officer: David Haberlah, CTO and Chief Data / AI Officer. Email privacy@bellaassist.au.
BellaAssist Pty Ltd (ABN 91 694 975 865) | Bella Sláinte Pty Ltd (ABN 84 695 641 573)
Questions about your privacy?
Bella Sláinte is actively engaging with prospective customers, partners, investors, and regulatory bodies across the Australian care sector. We respond to every thoughtful inbound message within five working days.
jessica@bellaassist.au · Jessica on LinkedIn
Sydney, New South Wales, Australia