Privacy and collection notice.

What we collect

• Scorecard request or question. Your provider type, your state or territory if you give it, your email address and what you need sorted first. If you reached us from an ad, the form also sends the campaign and click identifiers described under Why we collect it.
• Full scorecard intake. Your business and contact details, your answers about your service, and any documents or links you send.
• Email. What you write to us and what we write back.

Remove identifying details first

Do not send participant names, NDIS numbers, diagnoses, clinical notes, incident narratives or worker personal details. Send samples with those details taken out. If identifying information reaches us anyway, we delete or redact it and tell you.

Why we collect it

To work out whether we can help, to produce the free scorecard, to do the work you engage us for, and to reply. Client material is never used for marketing, and never for anything outside the engagement.

On clearharbour.com.au and www.clearharbour.com.au we may use Google Ads conversion measurement for the scorecard request and the full intake. It reads only these campaign and click identifiers from the address of the page you land on: UTM values, GCLID, GBRAID and WBRAID. It stores that attribution in this browser for the session as you move between pages.

The conversion event holds no form answers, documents or contact details. It reports a successful submission and nothing more. We read and qualify each intake ourselves. This is not Google Analytics, enhanced conversions, remarketing or ad personalisation.

Who handles it

• Netlify hosts this site. It receives the enquiry and intake forms, including any file you upload, and sends us the notification email.
• ForwardEmail forwards incoming email to our Google mailbox.
• Google holds the destination mailbox.
• Stripe handles billing for paid work.
• AI assisted drafting tools help us produce our documents. They receive redacted working material only. They never receive participant or worker identifying information. Under the plans we use, that material is not used to train their models.

Some of these providers process data in the United States. Our subprocessor register lists each one and is available on request.

How long we keep it

We delete scorecard intake material, including uploads, 90 days after we send your scorecard. If you engage us, the engagement letter sets how long we keep it. We keep enquiries and correspondence as business records.

Security

Access is limited to the principal. Working copies for paid work are kept in a controlled workspace, not on this site.

Access, correction and complaints

Email us to see or correct what we hold about you. Email us to complain about how it was handled. The principal replies in writing within five business days. If that does not resolve it, contact the Office of the Australian Information Commissioner.

Notice updated 24 September 2026.