Last updated: 27 September 2026
Accessia is run by IIRONIIC Media, based in Canberra. This policy explains what personal information we collect, why, who we share it with, and what you can ask us to do with it. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1. What we collect
Everyone with an account
- Name, email address and state or territory.
- Your password, which we never see. It is stored in a form that cannot be read back.
- Your notification settings.
Providers
- Business name, ABN, NDIS registration number, phone number, team size, service categories and service areas.
- What you add to your listing, such as a description, website and availability.
- Documents you upload to claim a listing, such as an ABN extract, NDIS registration certificate and certificate of currency.
Individuals
- How the NDIS plan is managed, and the kinds of support you are looking for.
- If you choose to verify your identity: a drivers licence, a proof of identity document and a Working with Vulnerable People check.
The supports someone is looking for can say something about their health or disability. That is sensitive information under the Privacy Act, so we only collect it with your consent, which you give by entering it, and only use it to run Accessia.
What you send through Accessia
- Requests you post on the request board.
- Responses and private messages between you and other users.
- Anything you send us through the contact or removal forms.
Payments
Card details go straight to Stripe. We never see or store your card number. We keep a record of your plan and billing period.
What we do not collect
We do not run analytics or advertising trackers, and we do not build profiles of what you browse.
2. How we use it
- To create your account and check it is genuine before it goes live.
- To verify that a provider claiming a listing runs that business.
- To show provider listings in the directory. This includes the business contact details a provider chooses to publish.
- To deliver requests, responses and messages between users.
- To send account emails: confirmation links, approvals, password resets, receipts and the notifications you have switched on.
- To take payment for paid plans.
- To answer your questions and deal with complaints or misuse.
- To meet our legal obligations, such as tax record keeping.
We do not sell personal information, and we do not use it for advertising.
3. Who can see what
- The public sees provider listings: business name, category, location, and any contact details the provider publishes.
- Other members see your name on requests you post and messages you send.
- Our team sees account details and uploaded documents so we can review accounts and claims.
- Nobody else sees identity documents. Providers and other members never see them.
4. Service providers we use
We use a small number of companies to run Accessia. They handle personal information for us and only for that purpose:
- Our hosting provider runs the secure cloud infrastructure that stores your account, messages and uploaded documents, and handles sign-in.
- Our hosting platform serves the website.
- Stripe processes payments and billing.
- Our email delivery service sends account and notification emails.
- Our contact form service delivers messages from the contact and listing removal forms to our inbox.
- OpenStreetMap: supplies the map tiles on directory and profile pages. Your browser requests the tiles directly, so OpenStreetMap receives your IP address when a map loads.
5. Where your information is stored
Your information is stored on secure servers in data centres in the Asia-Pacific region, outside Australia. Some of the services above, including Stripe, may also process information in the United States and other countries. We only use services that protect personal information to a standard comparable with the Australian Privacy Principles.
6. Cookies
We only use cookies and browser storage that the site needs to work, such as keeping you signed in. We do not use advertising or tracking cookies.
7. How long we keep it
- While your account is open, we keep your details so Accessia can work for you.
- When you delete your account, your profile, requests, responses, messages and uploaded documents are deleted straight away. If you had claimed a listing, the listing goes back to an unclaimed register entry.
- Some records stay longer where the law requires it. Stripe keeps payment and invoice records for tax purposes. Emails we have already sent, and contact form messages, stay in the relevant inbox and service logs until they are deleted there.
- Backups are kept for a short period and are overwritten on a rolling basis.
8. Public register data
Unclaimed listings come from the NDIS Quality and Safeguards Commission's public provider register, used under the CC BY 4.0 licence. They stay in the directory whether or not the business has an account. If a listing is yours and you want it changed or removed, use the removal request form or claim it.
9. Your rights
You can ask us to:
- Access the personal information we hold about you.
- Correct it. Most details can be changed from your account page.
- Delete it. You can delete your account yourself from your account settings, or ask us to.
Email contact@accessia.care. We may need to confirm who you are first. We will respond within 30 days and will not charge you for making a request.
You can deal with us anonymously or under a pseudonym when browsing the directory or asking a general question. An account needs your real name and email so providers know who they are talking to.
10. Security
We take reasonable steps to protect your information from misuse, loss and unauthorised access. Uploaded documents are private and only our team can open them. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
11. Children
Accounts are for people aged 18 and over. A parent, carer or coordinator can use Accessia on behalf of a younger participant. If you think a child has given us personal information directly, contact us and we will delete it.
12. Complaints
If you think we have mishandled your personal information, email contact@accessia.care and tell us what happened. We will respond within 30 days. If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
13. Changes to this policy
We will update this policy when the way we handle information changes. If a change matters, we will email account holders or post a notice on the site. The date at the top shows when it last changed.
14. Contact
Privacy questions and requests go to IIRONIIC Media, Canberra ACT, at contact@accessia.care or through our contact form.