Privacy Policy

This Privacy Policy explains how Mitr Companies Pty Ltd (ABN 96 689 165 240), trading as MITRAT ("we", "us", "our"), collects, uses, discloses, and protects personal information through the MITRAT platform (mitrat.com.au). We are committed to complying with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and applicable NDIS information-management requirements.

We may collect the following types of personal information:

• Identity information: full name, email address, phone number
• Business information (providers): business name, ABN, NDIS registration number, address, service categories, team member details
• Account information: login credentials, role (participant, provider, support coordinator, admin)
• Service information: inquiries, service requests, reviews, forum posts, messages
• Verification documents: ABN certificates, NDIS registration certificates, insurance documents, police checks
• Usage data: pages visited, search queries, provider views, device and browser information
• General search preferences: non-identifying service categories and broad location preferences

We collect personal information:

• Directly from you when you register, create a profile, submit forms, or contact us
• From publicly available sources (e.g., NDIS provider registers, ABN lookup) when populating provider directories
• Automatically through cookies and analytics when you use our platform
• From support coordinators and providers for business and account administration; participant-identifiable information must not be submitted

We use personal information to:

• Provide and improve the MITRAT provider-discovery platform
• Create and manage user accounts and provider profiles
• Help users browse and shortlist service providers using non-identifying criteria
• Process general business, technical, privacy and provider inquiries
• Send transactional emails (approvals, notifications, confirmations)
• Verify provider identity, ABN, and NDIS registration
• Moderate reviews, forum posts, and community content
• Generate anonymised analytics and platform statistics
• Comply with legal and regulatory obligations

We may share personal information with:

• Other platform users: Approved provider profiles and user-generated community content may be visible to other users. Participant-identifiable information must not be posted.
• Service providers: Base44 (platform infrastructure), email delivery services.
• Regulatory bodies: If required by law, court order, or to comply with NDIS Quality and Safeguards Commission requirements.

We do not sell personal information to third parties.

MITRAT is built on Base44. Base44 states that app data is stored in the United States by default. This MITRAT workspace does not currently provide an Australian data-storage region. Information submitted to MITRAT may therefore be stored or processed outside Australia, including in the United States and in other locations used by Base44 and its subprocessors.

Because Australian data residency is not currently available, MITRAT must not be used to collect or store participant-identifiable or sensitive information. A notice is displayed throughout the platform and at relevant collection points, and NDIS plan upload and analysis is disabled.

We use available security measures including:

• Encrypted data transmission (HTTPS/TLS)
• Role-based access controls (admin, provider, participant, SC)
• Row-level security on database records
• Restricted provider-document storage for business verification material

Overseas hosting does not remove our responsibilities under Australian privacy law. We assess overseas handling under APP 8 and take reasonable steps appropriate to the type and sensitivity of information involved. Before disclosing personal information overseas we take reasonable steps under APP 8.1 to ensure the recipient handles it consistently with the Australian Privacy Principles. This policy is a transparency measure and is not a substitute for those legal and security obligations.

If participant information is submitted accidentally, stop using the affected feature and contact hello@mitrat.com.au promptly so we can assess containment, deletion and any notification obligations.

We use essential cookies for authentication and session management. We may use analytics tools to understand platform usage patterns. No personal information is shared with advertising networks.

Under the Australian Privacy Principles, you have the right to:

• Access your personal information held by us
• Correct inaccurate or outdated information
• Request deletion of your account and associated data
• Withdraw consent for optional data processing
• Lodge a complaint if you believe we have breached the APPs

To exercise any of these rights, please contact us using the details below or via our Contact page.

We retain personal information only for as long as it is reasonably needed for the purpose for which it was collected or as required by law. Provider profiles may be retained in a de-identified form for historical directory purposes. We securely delete or de-identify information when it is no longer required. Requests for access, correction or deletion can be sent to the contact below.

MITRAT is for adults, NDIS participants and their authorised representatives. We do not knowingly collect personal information directly from anyone under 18 without the involvement of a parent, guardian or nominee.

If an eligible data breach occurs that is likely to result in serious harm, we will assess it promptly and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under Part IIIC of the Privacy Act 1988 (Cth).

We may update this policy from time to time. Material changes will be communicated via email or a notice on the platform. Continued use of MITRAT after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

To make a privacy complaint, email hello@mitrat.com.au. We will acknowledge your complaint within 5 business days and respond in writing within 30 days. If you are not satisfied, you may complain to the OAIC at www.oaic.gov.au or 1300 363 992.