Privacy Policy
Last updated: August 2026
Introduction
HubShift is operated by HubShift Pty Ltd (ABN forthcoming), an Australian company providing workforce management solutions for the National Disability Insurance Scheme (NDIS) sector. We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website at hubshift.com.au, our web application at hubshift.au, and our mobile application (collectively, the "Services").
Information we collect
Account information
When you register for a HubShift account, we collect your name, email address, phone number, date of birth, job title, and organisational affiliation. For support workers, we may also collect professional qualifications, certifications, and emergency contact details as part of onboarding.
Enquiries and demo requests
When you complete a form on our website — booking a demo, contacting us, asking about pricing, or subscribing to updates — we collect the details you provide, such as your name, email address, phone number, organisation name, team size, and any message or preferred appointment time you enter. We use this solely to respond to your enquiry, arrange the demo you asked for, and keep a record of the conversation. We do not sell this information, and we do not use it for automated decision-making.
Location data
Our mobile app may collect precise and approximate location data when you use shift, clock-in/out, travel, transport, or support delivery features. This may include your current location, travel start and end locations, route information, timestamps, and distance travelled.
We use location data to verify service delivery locations, support work-related travel tracking, calculate travel distance, support timesheets and travel claims, maintain service delivery records, and meet safety, audit, and NDIS compliance requirements.
Background location may be used only during an active shift or travel tracking session so that work-related travel can continue to be recorded when the app is not open. HubShift does not use background location to track support workers outside active work-related sessions.
Location tracking can be started and stopped through the app. You can also manage location permissions through your device settings.
Location and travel records may be visible to authorised organisation administrators, managers, coordinators, or service provider representatives according to role-based access permissions.
Camera and photos
The app may request access to your device camera and photo library to capture and upload shift evidence, incident documentation, and profile photos. Photos are only captured or accessed when you explicitly choose to take or select an image.
Microphone and speech recognition
The app uses your device microphone for voice-to-text input when composing progress notes and for our voice assistant feature. Audio is processed in real time for transcription and is not stored or recorded on our servers.
Push notifications
We use push notifications to alert you about upcoming shifts, shift changes, swap requests, messages, and other time-sensitive information. You can manage notification preferences in your device settings at any time.
Device and usage information
We automatically collect device information including your device type, operating system, app version, IP address, browser type, and usage analytics (pages viewed, features used, session duration). This helps us improve performance, diagnose issues, and enhance the user experience.
How we use your information
We use the personal information we collect to:
- Provide, operate, and maintain the HubShift platform and mobile app
- Manage shift rostering, clock-in/out verification, and timesheet processing
- Facilitate staff onboarding, training, and compliance management
- Process progress notes, incident reports, and shift documentation
- Send notifications about shifts, messages, and account activity
- Support NDIS compliance, audit trails, and regulatory obligations
- Improve our services through usage analytics and feedback
- Respond to support requests and communicate with you about your account
- Detect and prevent fraud, abuse, and security incidents
How we share your information
We do not sell your personal information. We may share your information with the following parties for legitimate business purposes:
- Your organisation — your employer or service provider organisation that manages your account on HubShift
- NDIS participants and guardians — limited information relevant to service delivery
- Cloud infrastructure providers — we use secure cloud hosting to store and process data
- Analytics services — to understand usage patterns and improve our platform
- Error monitoring — we may use error monitoring tools to detect crashes, diagnose issues, and maintain app stability
- Legal and regulatory bodies — where required by law, court order, or regulatory obligation
Third-party service providers
We may use trusted third-party service providers to operate and improve HubShift, including:
- Cloud infrastructure providers, such as Amazon Web Services, for secure hosting and data storage
- Google Maps and Google Places for maps, address lookup, route display, and travel-related features
- Xero, where enabled by an organisation, for accounting, invoices, payroll, or finance-related integrations
- Email and notification providers to send account, support, shift, and service-related communications
These providers may process personal information only as needed to provide their services to us and are subject to their own privacy practices.
Data storage and security
Your data is stored on secure servers with encryption in transit (TLS) and at rest. We implement industry-standard security measures including access controls, regular security assessments, and secure authentication mechanisms to protect your personal information.
While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.
Data retention
We retain your personal information for as long as your account is active or as needed to provide you with our services. We also retain information as necessary to comply with legal obligations, resolve disputes, enforce our agreements, and meet NDIS record-keeping requirements.
Location and travel records are retained for as long as reasonably necessary to support service delivery records, timesheets, travel claims, audit, compliance, dispute resolution, and legal or contractual obligations.
When data is no longer required, it is securely deleted or anonymised in accordance with our data retention policies.
Your rights
Under the Australian Privacy Act and applicable data protection laws, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Request deletion of your personal information, subject to legal and contractual obligations
- Withdraw consent for optional data collection (e.g. push notifications, location access)
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached
For users in the European Economic Area (EEA), you also have additional rights under the GDPR including the right to data portability and the right to restrict processing. To exercise any of these rights, please contact us at the details below.
Cookies and analytics
We use Google Analytics (GA4), provided by Google LLC, to understand which pages of this website people find useful. It records the pages you visit, roughly where in the world you are, and what kind of device and browser you used. It does not tell us who you are, and it is entirely separate from the Hubshift platform — no participant data, support notes, rosters or claims are involved.
Analytics only runs if you accept it. Until you choose, analytics cookies are switched off: we use Google Consent Mode to set analytics storage to "denied" before the Google tag loads, so no analytics cookie is written. We do not use advertising, remarketing or personalisation cookies at all, and those signals stay denied whatever you choose here.
Your choice is remembered in your browser's local storage, not in a cookie, and it is not sent to us. Declining costs you nothing — every part of this website works the same either way. You can change your mind at any time:
Clearing your browser storage for this site also resets the choice, and we will ask again. Separately, the strictly necessary cookies that keep the site working are not covered by this choice and cannot be turned off. Google's own handling of the data it receives is described in Google's privacy policy.
Children's privacy
Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately so we can delete it.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date above. We encourage you to review this policy periodically.
Contact us
If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint, please contact us:
- Email: support@hubshift.au
- Website: hubshift.com.au