Data Processing Agreement

This Data Processing Agreement (DPA) sets out the terms on which Housing Match processes personal and sensitive information on behalf of Australian provider organisations that use the Housing Match Platform. It is written for procurement teams, privacy officers and legal advisers, and is suitable for Australian solicitor review.

This DPA aligns with the Australian Privacy Principles (APPs) and uses the terms "Controller" and "Processor" — familiar to enterprise procurement — to describe the roles of the Customer and Housing Match respectively. Both parties remain APP entities under the Privacy Act 1988 (Cth).

This DPA applies to:

• All personal and sensitive information the Customer uploads to, or creates within, the Platform, including participant profiles, resident profiles, documents, applications, messages and property data.
• All processing Housing Match performs on that information to provide the Platform, including AI processing, matching, audit logging and reporting.
• The sub-processors Housing Match engages to deliver the Platform.

This DPA forms part of the Terms of Use and is read together with the Privacy Policy, the Consent & Information Sharing Framework, and any subscription, Pilot or Founding Partner agreement between the Customer and Housing Match. In the event of inconsistency, the specific agreement prevails to the extent of the inconsistency; in relation to personal information, the Privacy Policy prevails over the Terms of Use.

The parties to this DPA are:

The following terms have the meanings set out below. Definitions shared across the Housing Match governance suite appear in the Master Glossary and are used consistently here.

Housing Match and the Customer each hold responsibilities under the Privacy Act. Roles are allocated based on who decides why data is processed and who operates the processing:

Housing Match processes the following categories of personal information, verified against the database schema:

Housing Match processes the following categories of sensitive information, only where the Customer or a participant voluntarily provides it or an authorised representative provides it with authority:

• Disability type, diagnoses and support needs.
• Clinical reports — Occupational Therapy reports, Functional Capacity Assessments, Behaviour Support Plans, medical and hospital reports.
• Hospital discharge summaries and risk assessments.
• NDIS plan details and funding information.

Housing Match performs the following processing activities on the Customer's data, each implemented and verified:

Housing Match uses AI for the following purposes that involve the Customer's data. Most functions use de-identified data — no names, NDIS numbers, contact details or dates of birth leave Australia for these functions. Only document extraction, an optional opt-in feature, processes the original identifiable document, and only when the participant has given separate, explicit consent. Participants and their support coordinators can also enter profile information manually instead of using AI document extraction.

Consent is central to how Housing Match processes participant data. The Platform records consent as an event in a permanent, append-only Consent Ledger. The Customer is responsible for ensuring that appropriate consent or legal authority exists before uploading or sharing participant data.

• Each consent action — grant, update, reconfirm, withdraw, expire, provider access granted or revoked — creates a new permanent record.
• Consent is recorded with the actor, their role and organisation, the authority basis (self, guardian, nominee, administrator, parent of a minor, support coordinator as agent, other), the consent basis (written, verbal, guardian/substitute decision maker, digital acceptance), the legal document version, and the IP address.
• Consent can be withdrawn at any time. Withdrawal is recorded in the same ledger as the original grant, and the relevant sharing or processing stops.
• Overseas AI document extraction requires separate, explicit consent that can be withdrawn at any time.

Housing Match protects personal data using a defence-in-depth approach. The following controls are implemented and verified:

• Secure login — every account requires email and password; every page is access-controlled.
• Role-based permissions — enforced on the server, with admin actions re-checked server-side.
• Organisation data separation — each provider can access only its own data, enforced through provider data scoping.
• Private document storage — clinical documents are never stored as permanent public links.
• Authorised document access — every document view is checked for identity, permission and consent before a time-limited signed link is issued.
• De-identification for AI compatibility processing — prohibited identifiers are removed before AI prompts are built; the call is blocked if any remain.
• Consent-gated overseas processing for AI document extraction.
• Immutable audit logging and an immutable consent ledger.
• Encryption in transit — all data between the user's browser and the Platform is encrypted using HTTPS/TLS.
• Immutable, version-locked agreement acceptance.

Every sensitive action is recorded in an immutable, append-only Audit Log written exclusively by the recordAuditEvent backend function. No application code path updates or deletes audit rows.

• Recorded events include document access, AI processing, consent changes, profile updates, application status changes, messages, information sharing, legal agreement acceptance, permission changes, admin actions, data exports and security events.
• Each record captures the actor, their role and organisation, the action type, the target, the stated purpose, whether AI data was de-identified, the IP address, and the timestamp.
• Audit records contain no sensitive health information — only pseudonyms, timestamps, field-name references and the stated purpose.
• The Customer may request an audit extract relevant to its data through the contact details in Section 19.

Housing Match treats all personal data processed under this DPA as confidential. Access is restricted to authorised personnel who require access to operate and secure the Platform, and to the sub-processors identified in Section 14. Housing Match does not sell personal data.

Housing Match engages the following sub-processors to provide the Platform. Only verified, in-use providers are listed:

Housing Match engages sub-processors under agreements that require them to protect personal data to a standard consistent with the APPs. Formal vendor risk assessment is on our security roadmap. Housing Match will notify the Customer of new or replacement sub-processors that materially affect the processing, giving the Customer the opportunity to raise concerns.

Some processing occurs outside Australia, consistent with APP 8 and our Privacy Policy. Not every AI function transmits identifiable information overseas — routine compatibility and match processing use de-identified data; only the optional, consent-gated document extraction feature transmits an identifiable document:

• AI compatibility assessment and match explanation — de-identified data sent to overseas AI providers.
• AI document extraction — raw clinical documents sent overseas, only with the participant's separate, explicit consent.
• Google Analytics 4 — pseudonymous usage data sent overseas, with IP addresses anonymised.
• Resend — transactional emails to registered users sent overseas.
• Google sign-in and the optional Outlook connector — authentication and calendar data sent overseas when used.

The Platform's primary application, database, clinical document storage and backups are hosted on the Base44 managed cloud platform. Where information is sent overseas, Housing Match takes reasonable steps to ensure the overseas recipient handles it in accordance with the APPs.

Data residency is consistent with our Privacy Policy. The Platform's primary application, database, clinical document storage and backups are hosted on the Base44 managed cloud platform. Overseas processing is limited to the sub-processors and purposes identified in Sections 14 and 15. A dedicated Data Residency Statement provides further detail (planned).

The Customer is responsible for:

• Ensuring it has a lawful basis and appropriate consent or legal authority before uploading or sharing any participant data, including sensitive information.
• Ensuring any representative acting on a participant's behalf has the legal authority to do so.
• The accuracy and completeness of the data it uploads, and updating it promptly when it changes.
• Managing consent for the participants whose data it uploads, including responding to withdrawal requests and removing data where consent is withdrawn.
• Compliance with the Privacy Act 1988 (Cth), the NDIS Act 2013 (Cth), the NDIS Code of Conduct and NDIS Practice Standards where they apply to the Customer.
• Ensuring only authorised staff are invited to the Customer's account and that each is assigned the correct role.
• Using the Platform only for its intended purposes and in accordance with the Terms of Use.

Housing Match is responsible for:

• Processing the Customer's data only to provide and secure the Platform, and in accordance with the Customer's instructions through Platform features.
• Implementing and maintaining the security controls described in Section 11.
• Maintaining the Audit Log and Consent Ledger described in Sections 10 and 12.
• Engaging sub-processors under appropriate agreements and notifying the Customer of material changes.
• De-identifying data for AI compatibility and match processing, and consent-gating overseas document extraction.
• Notifying the Customer of a Data Breach affecting the Customer's data in accordance with Section 20.
• Supporting the Customer's access and correction obligations by providing audit extracts and enabling data export and deletion as described in Sections 21 and 22.

Housing Match maintains the Audit Log and access controls described in this DPA to detect and investigate security events. When a Security Incident is identified, Housing Match will assess, contain and investigate it, and determine whether it meets the threshold for a Data Breach under the Notifiable Data Breaches scheme.

Housing Match complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If Housing Match experiences a Data Breach that is likely to result in serious harm to one or more individuals, including the Customer's participants, Housing Match will:

1. Assess the breach using the Audit Log to identify affected records and individuals.
2. Contain the breach and take steps to limit its impact.
3. Notify affected individuals as soon as practicable where required, with information about the breach, the steps taken, and what individuals can do.
4. Notify the Office of the Australian Information Commissioner (OAIC) where required by the NDB scheme.
5. Notify the Customer without undue delay where the breach affects the Customer's data, so the Customer can meet its own obligations.

Further detail is set out in our Data Breach Response Plan (planned). Formal incident response tabletop testing is on our security roadmap.

Housing Match retains the Customer's data for as long as necessary to provide the Platform, maintain the Audit Log and Consent Ledger, resolve disputes, and comply with legal obligations. A formal data retention and destruction schedule is being developed (planned).

In the interim, the following applies:

• Active account data is retained while the Customer's account is active.
• Clinical documents are retained in private storage for the duration of the active account plus a reasonable period for audit and compliance purposes.
• Immutable Audit Log entries and Consent Ledger records are retained as a permanent legal record. They contain no sensitive health information — only pseudonyms, timestamps, field-name references and the stated purpose.
• Housing Match may retain minimal information (such as an email address) where required to comply with legal obligations or to prevent fraud.

When the Customer, or a participant on whose data the Customer has uploaded, requests deletion:

• Clinical documents in private storage are deleted and signed access links are revoked immediately.
• Profile information is removed or de-identified.
• Immutable Audit Log and Consent Ledger records are retained as a permanent legal record (no sensitive health information).
• Backups are managed by the Base44 hosting platform and are overwritten on the platform's backup cycle.

On termination of the Customer's account or this DPA, the Customer's right to access the Platform ceases. Housing Match will, on the Customer's request, export the Customer's data in a structured format, and then delete the Customer's data in accordance with Section 22, subject to the retention of the permanent Audit Log and Consent Ledger records and any data required to comply with legal obligations.

For any matter arising under this DPA, including data requests, audit extracts, sub-processor concerns or breach notification, please contact:

This DPA is governed by the laws of New South Wales, Australia, consistent with the Terms of Use.

This Data Processing Agreement forms part of the Housing Match Customer Assurance Package. The register below is the master index for the suite. It is maintained centrally and embedded in every governance document so that versions, verification status and review dates are tracked in one place.