Privacy Policy
Effective: 19 April 2026 · Governing law: Victoria, Australia · Privacy Officer: hello@billa.app
Important Notice to NDIS Participants
Billa does not provide services directly to NDIS participants. Information about you may be held by Billa if your NDIS provider uses our platform. You have rights to access and correct that information. If you are an NDIS participant with a privacy question or access request, please contact us at hello@billa.app and we will direct you to the appropriate process described in this Policy.
1. Who We Are and How to Contact Us
Billa is a software-as-a-service platform (“Billa”, “we”, “us”, “our”) operated as an Australian business providing NDIS service delivery documentation tools, including AI-assisted progress note drafting, live budget tracking, approval workflows, claim export, and accounting integration.
We are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in respect of personal information we hold. To the extent we hold health information about individuals who are residents of Victoria, we are also subject to the Health Records Act 2001 (Vic) (HRA) and the Health Privacy Principles (HPPs) set out therein. Equivalent health privacy legislation applies in other Australian states and territories as applicable.
2. Scope of This Policy and the Subscriber / Participant Distinction
This Policy applies to all personal information and health information that Billa collects, holds, uses, or discloses in the course of operating the platform. It covers:
- Subscriber information — information about individuals and organisations that hold Billa accounts (NDIS providers, sole traders, and their staff);
- NDIS participant information — information about NDIS participants that is entered into the platform by Subscribers; and
- Website visitor information — information collected when individuals visit billa.app.
The subscriber / participant distinction is fundamental to this Policy. Billa's direct relationship is with Subscribers (NDIS providers), not with NDIS participants. Subscribers are the data controllers primarily responsible for participant information. Billa is a data processor that handles participant information on behalf of Subscribers solely for the purposes of providing the Service. Subscribers bear primary responsibility for:
- Ensuring participants have been notified, in accordance with APP 5 and HPP 2, that their information will be processed through third-party software platforms including Billa;
- Obtaining any consent required from participants for the collection and use of their sensitive health information; and
- Complying with their own obligations under the Privacy Act 1988 (Cth), the NDIS Act 2013 (Cth), the NDIS Practice Standards, and applicable state health privacy legislation.
Billa's collection and processing of participant information is incidental to, and reasonably necessary for, the delivery of NDIS-funded supports that Subscribers are authorised to provide under the NDIS Act 2013 (Cth).
3. Definitions
In this Policy, the following terms have the following meanings:
- Personal information has the meaning given to it by s.6 of the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true, and whether or not it is recorded in a material form.
- Sensitive information has the meaning given to it by s.6 of the Privacy Act 1988 (Cth), and includes health information, information about a disability, and information about an individual's racial or ethnic origin.
- Health information has the meaning given in s.6 of the Privacy Act 1988 (Cth) and s.3 of the Health Records Act 2001 (Vic), and includes information or an opinion about the health or disability of an individual or about a health service provided or to be provided to an individual.
- NDIS participant means an individual who has been accepted as a participant in the National Disability Insurance Scheme under the NDIS Act 2013 (Cth).
- Protected NDIS information has the meaning given in s.3 of the NDIS Act 2013 (Cth), and includes information obtained in the course of the NDIS that relates to an identifiable NDIS participant.
- Subscriber means an individual or organisation that holds a Billa account and uses the Service in the capacity of an NDIS service provider.
- Worker means an individual who accesses the Service under a Subscriber's account.
- Overseas recipient has the meaning given in APP 8 of the Privacy Act 1988 (Cth): a person who is not in Australia or an external territory and who is not the individual to whom the information relates.
- AI-Generated Content means any text, data, or documentation produced by Billa's artificial intelligence functionality using inputs provided by a Subscriber.
- Eligible data breach has the meaning given in Part IIIC of the Privacy Act 1988 (Cth): unauthorised access to, or disclosure of, personal information held by an entity, or loss of personal information, that is likely to result in serious harm to any of the individuals to whom the information relates.
4. Anonymity and Pseudonymity (APP 2)
APP 2 requires us to offer individuals the option to interact with us on an anonymity or pseudonymity basis, where it is lawful and practicable to do so.
It is not lawful or practicable for Subscribers to use the platform anonymously or pseudonymously, as the platform's functions require accurate identification of the Subscriber, their organisation, and the participants to whom services are delivered, in order to produce compliant NDIS documentation and accurate claim exports.
Individuals visiting our website (billa.app) may browse without identifying themselves, subject to the cookies and analytics practices described in clause 22 of this Policy.
5. What Personal Information We Collect (APP 3, APP 5)
5.1 Subscriber Information
We collect the following categories of personal information from or about Subscribers and Workers:
- Full name, email address, phone number, and business name;
- Australian Business Number (ABN) or other business registration details;
- Subscription plan, billing history, and payment method details (processed via Stripe; we do not store full card numbers);
- Account credentials (hashed passwords and authentication tokens);
- Professional registration details (e.g. NDIS provider registration number); and
- Communications with us including support requests, feedback, and correspondence.
5.2 NDIS Participant Information (Collected via Subscribers)
We collect the following categories of personal information and sensitive information about NDIS participants, entered into the platform by Subscribers:
- Full name and contact information;
- NDIS participant number (a government-related identifier — see clause 8);
- NDIS plan details including plan budgets, support categories, funding allocations, and plan dates;
- Service delivery records including dates, duration, support workers involved, and services rendered;
- Progress notes, incident reports, goal tracking data, and other clinical or care documentation (which may constitute health information);
- Information about a participant's disability, support needs, functional capacity, or health status, to the extent entered by the Subscriber; and
- Invoice and financial claim data submitted to the NDIA or plan managers.
5.3 Usage and Technical Data
We automatically collect the following usage and technical data when Subscribers and Workers use the platform:
- IP address, browser type, operating system, and device type;
- Session identifiers, login timestamps, and authentication event logs;
- Feature interaction data and navigation paths within the platform; and
- Error logs and crash reports.
5.4 Website Visitor Information
When you visit billa.app, we may collect IP addresses, referral sources, browser metadata, and page interaction data through cookies and analytics tools, as described in clause 22.
6. Sensitive Information (APP 3.3)
Health information and disability-related information about NDIS participants is sensitive information under s.6 of the Privacy Act 1988 (Cth) and health information for the purposes of the Health Records Act 2001 (Vic).
We collect this sensitive information from Subscribers (not directly from participants). The lawful basis for this collection is:
- Authorisation by Australian law (APP 3.3(b)): The NDIS Act 2013 (Cth) authorises registered NDIS providers to collect, hold, and use participant health and disability information in connection with the delivery of NDIS-funded supports. Billa's collection of this information is incidental to, and reasonably necessary for, the provision of documentation and claims management services to those authorised providers.
- Subscriber consent (APP 3.3(a), supplementary basis): Subscribers, by accepting our Terms of Service, acknowledge that they are responsible for obtaining participant consent for the processing of participant information through third-party software platforms, and represent that they have done so.
We treat sensitive information with heightened care. We do not collect, use, or disclose sensitive information except:
- Where reasonably necessary for the primary purpose of providing the Service (clause 10);
- For a directly related secondary purpose that the Subscriber would reasonably expect;
- As required or authorised by law; or
- With express consent.
7. Health Information — Health Records Act 2001 (Vic)
To the extent we hold health information about individuals who are residents of Victoria (and equivalent health information legislation in other states), we comply with the applicable Health Privacy Principles (HPPs).
7.1 HPP 1 — Indirect Collection of Health Information
HPP 1.1 requires that health information be collected directly from the individual unless it is not reasonable or practicable to do so. Billa collects participant health information indirectly, via Subscribers. This is justified on the following bases:
- It is not reasonable or practicable for Billa to collect health information directly from NDIS participants, because: (i) NDIS participants are not Billa's customers and do not have accounts or a contractual relationship with Billa; (ii) requiring participants to interact directly with Billa to enter their own service delivery information would be operationally and clinically impracticable and contrary to the NDIS service model; and (iii) the information is entered by qualified support workers or providers with a professional relationship with the participant.
- Indirect collection from providers is authorised under the NDIS Act 2013 (Cth) and NDIS Practice Standards as a function of lawful NDIS service delivery (HPP 1.3(b)).
7.2 HPP 4 — Use and Disclosure of Health Information
We use participant health information only for the primary purpose for which it was collected: the provision of NDIS documentation, claims management, and audit-support services to Subscribers. We do not use participant health information for any secondary purpose, including product development, feature analytics, or AI model training, without compliance with the consent requirements applicable to sensitive information under both the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic).
Internal platform analytics that involve participant-linked records are conducted only on de-identified or aggregated data that cannot reasonably be linked to identifiable individuals.
8. Government-Related Identifiers: NDIS Participant Numbers (APP 9)
The NDIS participant number issued to each NDIS participant by the National Disability Insurance Agency (NDIA) is a government-related identifier for the purposes of APP 9 of the Privacy Act 1988 (Cth).
APP 9.2 prohibits us from adopting, using, or disclosing a government-related identifier as our own identifier of an individual. We comply with this prohibition: NDIS participant numbers are not used as Billa's own internal identifiers. We maintain separate internal identifiers for platform records.
We collect, hold, use, and disclose NDIS participant numbers only to the extent reasonably necessary to identify the participant to whom a service delivery record, note, or claim relates, and for no other purpose. Specifically:
- We use NDIS participant numbers to associate service delivery records with the correct participant plan within the platform (APP 9.3(a): identity verification in connection with service delivery);
- We include NDIS participant numbers in claim export files submitted to the NDIA or plan managers on behalf of Subscribers, where this is required by the NDIA's Pricing Arrangements and Payment Terms (APP 9.3(c): authorised by Australian law); and
- We display NDIS participant numbers to authorised Subscriber users within the platform to facilitate accurate record management.
We do not use NDIS participant numbers for analytics, marketing, product development, or any purpose other than the above. NDIS participant numbers are not disclosed to any third party other than as described in clause 13 of this Policy.
9. Protected NDIS Information and the NDIS Act 2013 (Cth)
We recognise that personal information about NDIS participants, including service delivery records, progress notes, plan details, and financial data, may constitute “protected NDIS information” within the meaning of s.3 of the NDIS Act 2013 (Cth). Section 67 of the NDIS Act creates criminal liability for the unauthorised use or disclosure of protected NDIS information.
We maintain the following authorisation framework to ensure compliance with s.67:
- Access to participant information within the platform is restricted to: (i) the Subscriber's authorised Workers, as determined by the Subscriber's own role-based access configuration; (ii) Billa's technical and support staff, solely to the extent necessary to provide platform services and under binding confidentiality obligations; and (iii) our subprocessors, solely to the extent necessary to operate the infrastructure on which the platform runs, and under contractual data processing obligations described in clause 13.
- We do not disclose protected NDIS information to any person or entity other than as expressly permitted by the NDIS Act 2013 (Cth), as required by law, or as authorised in writing by the relevant Subscriber.
- All Billa staff and contractors with any access to participant data are bound by written confidentiality obligations that extend to protected NDIS information.
- Access events involving participant records are logged and subject to regular access review.
10. Why We Collect Personal Information (APP 5, APP 6)
We collect personal information for the following primary purposes:
- To provide, operate, maintain, and improve the platform and its features;
- To enable the creation, storage, review, and export of NDIS service delivery documentation;
- To generate AI-assisted draft progress notes and documentation using inputs provided by Subscribers;
- To track NDIS participant plan budgets and support category utilisation;
- To create and export NDIS claim files and draft invoices for Subscribers;
- To process payments and manage Subscriber billing and account administration;
- To provide technical support and respond to Subscriber enquiries;
- To detect, prevent, and investigate security incidents, fraud, and unauthorised access;
- To comply with our legal obligations, including under the Privacy Act, Health Records Act, NDIS Act, and tax law; and
- To communicate with Subscribers about the Service, including material changes to the platform or these policies.
Where we use personal information for a secondary purpose, we will only do so where:
- The secondary purpose is directly related to the primary purpose and the individual would reasonably expect us to use the information in that way;
- We have obtained the individual's consent; or
- We are required or authorised by law to do so.
We will never use participant health information for secondary purposes including marketing, product development analytics involving identifiable data, or AI model training, without first satisfying the consent requirements applicable to sensitive information under the Privacy Act and, where applicable, the Health Records Act.
11. Use of Artificial Intelligence and Automated Processing (APP 6, HPP 4)
11.1 How AI Processes Your Information
Billa uses artificial intelligence to assist in generating draft progress notes and other documentation from inputs provided by Subscribers. When a Subscriber uses the AI note-generation feature, the inputs provided (which may include participant information and health information) are transmitted to a third-party AI model provider for processing. The AI model provider returns a draft text response which is displayed to the Subscriber for review.
Our current AI model provider is Anthropic, PBC, a company incorporated in the United States. When you use the AI note-generation feature, inputs are transmitted to Anthropic's API infrastructure, which may be located in the United States or other jurisdictions. This constitutes a cross-border disclosure under APP 8.1, subject to the safeguards described in clause 12.1 of this Policy.
AI-Generated Content is a drafting tool only. It is not a clinical record, professional advice, or a verified account of service delivery. Subscribers are solely responsible for reviewing, verifying, and approving all AI-Generated Content before it is used or submitted.
11.2 Prohibition on AI Training Using Participant Health Information
This prohibition applies regardless of whether the data has been anonymised, unless the anonymisation is demonstrably irreversible and the data cannot reasonably be used to re-identify any individual.
Where we conduct AI model development or improvement activities, we use only:
- Synthetic data generated for that purpose without reference to real participant information;
- Genuinely de-identified and aggregated data that cannot reasonably be re-identified; or
- Data from individuals who have provided express, informed, and specific consent for their information to be used for AI training purposes.
Our contractual arrangements with AI model providers expressly prohibit those providers from using data we transmit to them (including participant information in Subscriber inputs) to train, improve, or develop their own AI models.
11.3 Automated Decision-Making
The platform does not make automated decisions about NDIS participants that produce legal or similarly significant effects on those participants. All outputs of the AI functionality are subject to mandatory human review and approval by a qualified Subscriber staff member before use. Billa does not submit any AI-Generated Content to the NDIA or any other body on behalf of participants without Subscriber authorisation.
12. Overseas Disclosure of Personal Information (APP 8)
We disclose personal information to overseas recipients in two circumstances: in connection with AI note generation (clause 12.1) and in connection with the Xero integration (clause 12.2). Both disclosures are subject to the obligations in this clause.
12.1 AI Model Providers
When a Subscriber uses the AI note-generation feature, inputs entered by the Subscriber (which may include participant information and health information) are transmitted to a third-party AI model provider. That provider may be located outside Australia. This constitutes a cross-border disclosure of personal information under APP 8.1.
Before making this disclosure, we take the following reasonable steps to ensure the overseas recipient does not breach the APPs with respect to the information:
- We enter into a binding data processing agreement (DPA) with each AI model provider, which expressly prohibits the provider from using transmitted data for model training or any purpose other than returning the requested output;
- We assess each AI model provider's privacy and security certifications, data handling practices, and contractual commitments before engagement;
- We require that AI model providers implement technical and organisational security measures at least equivalent to those we apply to the information ourselves; and
- We review these arrangements periodically and upon any material change to the provider's terms or data practices.
In addition, Subscribers consent to this overseas disclosure by using the AI note-generation feature, as notified in our Terms of Service (APP 8.2(b)).
12.2 Xero Limited
If a Subscriber enables the Xero integration, financial and billing information (including participant identifiers embedded in invoice data) will be transmitted to Xero Limited, a company incorporated in New Zealand with data infrastructure that may be located in multiple jurisdictions including New Zealand, the United States, and other countries.
We take reasonable steps to ensure that Xero Limited handles personal information in a manner consistent with the APPs, including by relying on Xero's published Data Processing Agreement. New Zealand is a jurisdiction that the Australian Attorney-General has recognised as providing comparable privacy protections to those available in Australia.
Use of the Xero integration constitutes Subscriber consent to this overseas disclosure under APP 8.2(b). Billa is not responsible for Xero Limited's handling of information after it has been transmitted to Xero's systems, beyond the reasonable steps described above.
13. Domestic Third-Party Disclosure (APP 6)
We may disclose personal information to the following categories of domestic third parties:
Subprocessors and Infrastructure Providers
We engage Australian and international cloud infrastructure, database, payment processing, and authentication service providers to operate the platform. Each subprocessor is bound by contractual data processing obligations that prohibit use of personal information for any purpose other than providing services to Billa, and require security measures consistent with those described in clause 16.
Payment Processors
Payment information is processed by Stripe, Inc. We do not retain full credit card numbers on our servers. Stripe's handling of payment data is subject to its own privacy policy and PCI-DSS compliance obligations.
Email Delivery (Resend)
We use Resend, Inc. to deliver transactional emails, including team invitations. Recipient email addresses are transmitted to Resend solely for the purpose of delivering the requested email. Resend does not retain email content beyond delivery and is bound by a data processing agreement consistent with applicable privacy law.
Error Monitoring (Sentry)
We use Sentry, Inc. to capture and log application errors for debugging and platform stability. Sentry is configured to minimise personal data capture. Error reports may incidentally include request metadata (such as IP address and browser type) but are not used to identify individual users or participants. Sentry's data handling is subject to its own Data Processing Agreement.
Professional Advisers
We may disclose personal information to our legal, accounting, or insurance advisers where reasonably necessary and subject to confidentiality obligations.
Regulatory and Law Enforcement Bodies
We will disclose personal information where required or authorised by law, including to the NDIA, the NDIS Quality and Safeguards Commission, the Office of the Australian Information Commissioner (OAIC), the Victorian Privacy Commissioner (where applicable), the Australian Taxation Office, or any court or tribunal of competent jurisdiction.
Business Transfers
In the event of a merger, acquisition, asset sale, or restructure involving Billa, personal information may be disclosed to the acquiring or successor entity, subject to that entity agreeing to be bound by privacy obligations at least equivalent to those in this Policy. We will notify affected Subscribers of any such transfer.
We do not sell, rent, trade, or otherwise commercially exploit personal information to third parties for marketing, profiling, advertising, or any commercial purpose.
14. Direct Marketing (APP 7)
We may use Subscriber contact information (name, email address) to send communications about the Service, including feature updates, pricing changes, and relevant product news. We will not use participant information for any direct marketing purpose.
Subscribers may opt out of non-essential marketing communications at any time by:
- Clicking the unsubscribe link in any marketing email; or
- Contacting us at hello@billa.app with a request to opt out.
We will not use sensitive information for direct marketing purposes. We will not disclose personal information to third parties for the purpose of those third parties directing marketing at individuals.
15. Data Quality (APP 10)
We take reasonable steps to ensure that the personal information we collect, use, and disclose is accurate, up to date, and complete. In particular:
- Subscribers are responsible for the accuracy of information they enter about themselves and about participants. We provide mechanisms for Subscribers to update and correct Subscriber account information.
- We encourage Subscribers to review and correct participant information held within the platform, and we provide export and correction tools for this purpose.
- We do not independently verify the accuracy of participant information entered by Subscribers.
- AI-Generated Content is a drafting aid only. Accuracy of AI-Generated Content as a reflection of actual service delivery is the sole responsibility of the reviewing Subscriber.
16. Data Security (APP 11.1)
We implement reasonable technical and organisational measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include, without limitation:
- Transport Layer Security (TLS 1.2 or higher) for all data in transit between users and our platform;
- Encryption of sensitive data at rest;
- Row-level database security ensuring that each Subscriber's data is logically isolated from other Subscribers' data;
- Role-based access controls restricting staff and Worker access to data on a need-to-know basis;
- Audit logging of note lifecycle events (submission, approval, and rejection), with logs retained for accountability and dispute resolution purposes;
- Periodic review of access permissions as part of our internal security practices; and
- Binding confidentiality and security obligations on all staff and subprocessors with access to personal information.
No method of electronic transmission or storage is completely secure. Subscribers are responsible for maintaining the security of their own account credentials. Shared passwords are not permitted. Subscribers must notify us immediately at hello@billa.app upon becoming aware of any suspected unauthorised access to their account.
17. Data Breach Notification (Privacy Act 1988 (Cth), Part IIIC)
We maintain a Data Breach Response Plan that governs our response to suspected data security incidents. Our process is as follows:
- Detection and containment: Upon becoming aware of a potential data security incident, we will take immediate steps to contain the incident, preserve evidence, and assess the scope of any potential unauthorised access or disclosure.
- Assessment (30-day period): Within 30 days of becoming aware of a potential eligible data breach, we will complete a reasonable and expeditious assessment of whether the incident constitutes an “eligible data breach” within the meaning of Part IIIC of the Privacy Act 1988 (Cth).
- Notification to OAIC: If we determine that an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable using the OAIC's prescribed notification form.
- Notification to affected individuals: We will notify affected individuals (or, in the case of participant data, the relevant Subscriber who will in turn notify affected participants) as soon as practicable after notifying the OAIC, unless the OAIC directs us otherwise.
- Notification to Subscribers: Regardless of whether a breach meets the NDB threshold, we will notify affected Subscribers promptly of any security incident that has or may have resulted in unauthorised access to their data within 72 hours of confirming the incident.
The 30-day assessment period is a statutory maximum, not a target. Where we are able to complete our assessment sooner, we will do so and will notify affected parties without unnecessary delay.
18. Retention and Destruction of Personal Information (APP 11.2)
We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. Our retention periods are set out below.
| Data Category | Retention Period | Basis |
|---|---|---|
| Subscriber account and contact information | Duration of subscription + 7 years post-termination | General legal obligations |
| NDIS participant clinical notes and service records | 7 years from creation, or as required by applicable law (whichever is longer) | NDIS record-keeping requirements; Health Records Act 2001 (Vic) |
| Financial, billing, and invoice records | 7 years | Corporations Act 2001 (Cth); Tax law |
| AI processing inputs and outputs (where retained) | 90 days, then permanently deleted or de-identified | Operational necessity; minimisation obligation |
| Usage analytics and technical logs | 2 years | Platform improvement; security monitoring |
| Correspondence and support records | 3 years after resolution | Dispute resolution |
Legal retention obligation overrides account closure: Where the deletion of personal information upon account closure would conflict with a mandatory legal retention obligation (including NDIS record-keeping requirements and obligations under the Corporations Act 2001 (Cth)), the legal obligation prevails. We will retain the relevant information only for the minimum period required by law and will apply appropriate access restrictions during that period.
Upon expiry of the applicable retention period, we will take reasonable steps to destroy or permanently de-identify personal information in a manner that renders re-identification not reasonably practicable, in accordance with APP 11.2.
19. Right of Access to Personal Information (APP 12)
You have the right to request access to the personal information we hold about you.
Subscriber Access
Subscribers and Workers may request access to personal information we hold about them by contacting our Privacy Officer at hello@billa.app. We will respond within 30 days. In most cases, Subscribers can also access and export their own data directly through the platform.
NDIS Participant Access
NDIS participants do not have a direct account with Billa. Participant information is held by Billa on behalf of, and under the control of, the relevant Subscriber. Accordingly:
- Participants wishing to access their personal information held within Billa should direct their request in the first instance to the relevant NDIS provider (Subscriber), who is the primary data controller with respect to participant information;
- Where a participant contacts Billa directly with an access request, we will: (i) acknowledge the request within 5 business days; (ii) notify the relevant Subscriber of the request; and (iii) assist the Subscriber in responding to the participant's request to the extent that we are able to do so without compromising the security of other Subscribers' data; and
- Where Billa holds personal information about a participant that cannot be accessed through the relevant Subscriber (for example, because the Subscriber's account has been closed), we will deal with the participant's access request directly, subject to identity verification and to any applicable legal restrictions on disclosure.
We may decline to provide access to personal information in limited circumstances, including where access would unreasonably affect the privacy of other individuals, reveal our confidential commercial information, or be contrary to a law of the Commonwealth or a State. Where we decline access, we will provide written reasons and information about how to complain.
20. Right to Correct Personal Information (APP 13)
You have the right to request correction of personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading. Correction requests should be directed to hello@billa.app.
We will respond to correction requests within 30 days. Where we make the requested correction, we will take reasonable steps to notify third parties to whom we have disclosed the information of the correction, where requested and reasonably practicable.
Where we decline to make a requested correction, we will provide written reasons and will, if requested, attach a statement from the individual to the relevant record noting the disputed correction.
21. Privacy Complaints (APP 1.4(e))
Step 1 — Contact our Privacy Officer
If you believe we have interfered with your privacy or breached the APPs, the HRA HPPs, or any other applicable privacy obligation, please contact our Privacy Officer at hello@billa.app. We will:
- Acknowledge your complaint within 5 business days;
- Investigate the complaint thoroughly and impartially;
- Provide a substantive written response within 30 days; and
- Where a breach is confirmed, take corrective action and notify you of the steps taken.
Step 2 — Escalation to the OAIC
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
Step 3 — Victorian Privacy Commissioner (Health Information)
If your complaint relates to health information held by Billa and you are a Victorian resident (or the information relates to a Victorian participant), you may also lodge a complaint with the Health Complaints Commissioner at www.hcc.vic.gov.au.
Step 4 — NDIS Quality and Safeguards Commission
Complaints relating to the handling of participant information by an NDIS provider may be directed to the NDIS Quality and Safeguards Commission at www.ndiscommission.gov.au.
23. Children and Vulnerable Participants
NDIS participants include individuals under the age of 18 (minors) and individuals with cognitive, intellectual, or communication disabilities who may have reduced capacity to make decisions about their personal information.
Billa does not interact directly with NDIS participants, including minors or individuals with reduced decision-making capacity. Information about minor participants or participants with reduced capacity is entered into the platform by Subscribers acting in their professional capacity as NDIS providers. Subscribers are responsible for:
- Ensuring that consent for the collection and processing of information about minor participants is obtained from a parent, guardian, or other legally authorised decision-maker;
- Ensuring that consent for participants with reduced decision-making capacity is obtained from a nominee, guardian, or other authorised representative consistent with applicable guardianship and administration law; and
- Applying appropriate safeguards to information about vulnerable participants within the platform, including restricting access to authorised Workers only.
We apply heightened care to participant information that appears, from context, to relate to minor participants or individuals with significant vulnerabilities, including restricting AI processing outputs to the minimum necessary for the documented service.
24. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. The version date at the top of this Policy indicates when it was last updated.
Where we make a material change to this Policy — including any change that expands the categories of information we collect, the purposes for which we use it, or the parties to whom we disclose it — we will:
- Notify active Subscribers by email at least 14 days before the change takes effect; and
- Display a prominent notice on the platform for at least 14 days before the change takes effect.
Non-material changes (such as clarifications of existing practices or typographical corrections) may take effect immediately on publication. Continued use of the Service after the effective date of a material change constitutes acceptance of the updated Policy.
Previous versions of this Policy are available on request from hello@billa.app.
Billa is not affiliated with, endorsed by, or connected to the National Disability Insurance Agency (NDIA), the NDIS Quality and Safeguards Commission, or the Australian Government. NDIS® is a registered trademark of the National Disability Insurance Agency.
This Privacy Policy was last updated on 19 April 2026. Previous versions are available on request from hello@billa.app.