Housing Match

Your Information. Your Control.

Housing Match is designed to help participants maintain control over what information is shared and who can access it. Your privacy and security are our top priority.

Secure User Accounts

Multi-layer authentication with encrypted passwords and secure session management.

Role-Based Permissions

Participants only see their data. Providers see only applications relevant to their properties. Admins have controlled access.

Secure Document Storage

Uploaded participant documents are stored in AWS in the Sydney region (ap-southeast-2) and remain in Australia — encrypted at rest (SSE-S3) and accessed only through short-lived presigned links. Participants control who sees their documents.

Participant Controlled Sharing

You decide who sees your information. Grant or revoke consent to providers, coordinators, and family at any time.

Secure Messaging

Encrypted messages between participants and providers. Full audit trail for compliance.

Admin Access Controls

Administrative access is restricted, monitored, and logged. Admins cannot access sensitive data without authorization.

Test & Demo Data Separation

Production data is completely separated from demonstration data. Demo accounts are clearly marked.

Audit & Activity Logging

All data access, changes, and sensitive operations are logged for security review and compliance.

How We Protect Your Data

Encryption

All data in transit uses HTTPS/TLS encryption. Uploaded participant documents are encrypted at rest using AWS server-side encryption (SSE-S3) in the Sydney region (ap-southeast-2). Documents are uploaded and downloaded directly to secure AWS storage using short-lived presigned links that expire after approximately five minutes — documents never use public URLs.

Access Control

Every user has role-based access. Participants can only see their own information. Staff access is limited to necessary functions and is fully audited.

Security Reviews

We conduct regular security reviews and vulnerability assessments. Independent penetration testing has not yet been completed and is listed as an external dependency in our Assurance Register.

Incident Response

We have a comprehensive incident response plan. Any security incidents are investigated and handled promptly.

Your Privacy Rights

You control your information. Manage consent settings, document sharing, and communication preferences at any time.

You can request data. Ask us what information we hold about you and receive it in a portable format.

You can request corrections. If information is inaccurate, we'll correct it promptly.

You can request deletion. Subject to legal requirements, you can request deletion of your information.

You have recourse. If you believe your privacy has been breached, contact us or file a complaint with the Office of the Australian Information Commissioner (OAIC).

Alignment with Standards

Housing Match is designed in alignment with the following frameworks. We have not been independently certified or audited against these standards:

  • Australian Privacy Principles (APP) — design alignment, not certified
  • Privacy Act 1988 (Cth) — design alignment, not independently assessed
  • Disability Discrimination Act 1992 — design alignment
  • NDIS Quality and Safeguarding Commission standards — Housing Match is a technology platform, not a registered NDIS provider
  • Industry best practices for data security — adopted where feasible; ISO 27001 and IRAP certification are future roadmap items, not current certifications

What About Test & Demo Data?

Housing Match uses test and demo environments for development and testing. These are completely separate from production:

  • Demo accounts are clearly marked with a "DEMO" badge
  • Demo data is never mixed with real participant data
  • Non-production systems use synthetic, non-real personal information
  • Demo data is regularly deleted and refreshed

AI & Automated Processing

Housing Match uses advanced technologies to improve service delivery:

  • Matching algorithms — to suggest suitable housing matches based on preferences and requirements
  • Automated technologies — to process applications and assess compatibility
  • Artificial intelligence tools — to generate referral recommendations and compatibility assessments, and to extract profile information from uploaded documents

Overseas AI Processing

Important disclosure: AI document processing (extracting profile information from clinical documents) is performed by third-party AI providers located outside Australia. When you upload clinical documents for AI extraction:

  • The raw, identifiable document is transmitted overseas — this is NOT de-identified
  • The AI provider may be located in the United States or other countries
  • Compatibility assessment prompts are de-identified (names and contact details removed), but document extraction sends the raw document
  • NDIS participant numbers are excluded from AI extraction for data minimisation

You can choose not to use AI document processing and enter information manually instead. Consent for overseas AI processing is recorded in your consent history and can be withdrawn at any time.

Important: AI-generated matches and compatibility assessments are decision-support tools only. They do not replace professional judgment, clinical assessment, or decision-making by you, your support coordinator, provider, or healthcare team. All final placement and service decisions remain with the relevant organisation or individual. AI outputs may contain errors and must be reviewed by a qualified human before any decision is made.

Third-Party Technology Providers

Housing Match uses trusted third-party providers to deliver secure, reliable services:

  • Cloud hosting and infrastructure services
  • Security monitoring and threat detection
  • Data storage and backup services
  • Artificial intelligence and processing services
  • Communication and notification services

All third-party providers are contractually required to maintain appropriate privacy and security standards consistent with Australian privacy legislation. We do not sell or commercially share your information with third parties.

Security Governance

Housing Match maintains comprehensive security controls to protect sensitive participant information:

  • Access Controls — Role-based permissions ensure users only access data necessary for their function
  • Audit Logging — All data access and modifications are logged for compliance and investigation
  • Role-Based Permissions — Participants, providers, coordinators, and staff have defined access levels
  • Security Monitoring — Continuous monitoring for suspicious activity and potential threats
  • Incident Response Procedures — Documented procedures for detecting, responding to, and remediating security incidents
  • Regular Training — Staff receive ongoing security and privacy training

Data Breach Response

Housing Match maintains comprehensive procedures for responding to suspected or confirmed data breaches:

  • Prompt detection and investigation of suspected breaches
  • Immediate containment to prevent further unauthorised access
  • Assessment of affected individuals and information types
  • Notification to affected users where required under Australian privacy legislation
  • Cooperation with relevant authorities and regulators

Where a notifiable data breach occurs, Housing Match will comply with the Privacy Act 1988 (Cth) Notifiable Data Breaches scheme and notify affected individuals as soon as practicable with details of the breach, recommended actions, and contact information for further assistance.

Legal Alignment & Limitations

Housing Match is designed in alignment with the following frameworks. The following items are NOT certified or independently verified:

  • Privacy Act 1988 (Cth) — design alignment; no independent Privacy Impact Assessment completed
  • Australian Privacy Principles (APPs) — design alignment; not certified
  • Notifiable Data Breaches Scheme — breach response procedures are documented but not externally tested
  • Disability Discrimination Act 1992 (Cth) — design alignment
  • NDIS Act 2013 (Cth) — Housing Match is a technology platform, not a registered NDIS provider
  • ISO 27001 / IRAP / SOC 2 — NOT certified. These are future roadmap items, not current certifications
  • Penetration testing — NOT yet completed. Listed as a required external activity in our Assurance Register

We are committed to working towards these standards but do not claim compliance that has not been independently verified.

Questions About Security & Privacy?

If you have concerns about how we protect your data, wish to report a security issue, request access to your information, withdraw consent, or have questions about privacy, please contact us at:

hello@housingmatch.com.au

We take all security reports and privacy inquiries seriously and will investigate and respond promptly. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.