1. What this product does

MagMindLab is a preparation tool for people involved in the NDIS process. It has two tools.

• Evidence Alignment helps you upload existing reports and clinical documents and see what they appear to show about disability, functional impact, treatment history, permanence and evidence gaps.
• Support Needs Evidence helps you prepare for an I-CAN or support needs assessment by extracting relevant information from your reports and organising it into a structured support needs summary.

This tool helps you organise and interpret your existing evidence. It does not provide clinical advice, legal advice, or any guarantee of an NDIS outcome. Reports generated by this tool should be self reviewed, or by a qualified advocate, support coordinator or disability professional before external use.

2. What information we collect

When you use MagMindLab, we may collect and store the following:

• Account information: the email address you use to create your account.
• Profile information: the reference name you give to a profile, the date of birth of the person the profile relates to (where you choose to provide it), and the disability/disabilities you nominate to include in your evidence check.
• Text from uploaded documents: when you upload a document (PDF or Word), we extract the text from it. The original file is not stored, only the extracted text.
• A masked version of that text: before your document text is reviewed by our AI, we automatically deidentify and mask personal details such as names, contact details and reference numbers, and the names of clinicians, schools and clinics. This masked version is what our AI actually reads. 
• Evidence review findings: the findings generated from your uploaded documents, including functional impact summaries, gap analysis and report sections.
• Consent records: when you accept our privacy notice, we record the consent version, the time of acceptance, and your browser type.
• System audit log: a record of actions taken in your account (for example, files uploaded, files removed, reports generated). These records do not contain the content of your documents.

3. Why we collect it

We collect this information solely to provide the MagMindLab service. Specifically:

• Your email address is used to create and secure your account.
• Profile information lets you organise your evidence preparation across multiple sessions.
• Date of birth, where provided, is used to tailor AI-generated findings to age-appropriate expectations, for example benchmarking a child’s functional capacity against typical development for their age, or using adult functional framing for adults.
• Text from uploaded documents is the primary input for the AI-powered evidence review. We mask personal details in that text before it reaches the AI, as explained in section 6.
• Evidence review findings are saved to your account so you can access them after closing the browser.

We do not collect information for marketing, advertising or profiling purposes.

4. Who can use the product

MagMindLab is intended for:

• NDIS participants preparing for an access request, plan review or reassessment.
• Family members, carers and informal supporters helping a participant prepare their evidence.
• Disability advocates and support coordinators preparing evidence on behalf of a participant.

If you are entering information about another person, you confirm that you have their authority (or the authority of their legal guardian or representative) to do so. If you are providing information about a person under 18, you confirm you are that person’s parent, guardian or authorised representative.

5. Consent and representative consent

Before you can use the tool, you will be asked to read our privacy notice and confirm that you accept it.

By accepting, you confirm:

• You have read and understood how your information will be used.
• You have the authority to act for the NDIS participant whose information you are entering.
• You have obtained or will obtain the consent of the participant to use their information in this tool.
• If the participant is under 18, you are their parent, guardian or authorised representative.

We keep a record of your acceptance, including which version of the privacy notice you accepted and when. If we make material changes to this privacy notice, you will be asked to review and accept the updated version before continuing to use the tool.

6. How uploaded documents are used

When you upload a document:

• The text is extracted from the file in memory during the upload request. The original file itself is never saved to our systems.
• Before storage, we automatically check the extracted text for structural identifiers such as Medicare numbers, payment card numbers, hospital record numbers and mobile phone numbers, and replace them with a redaction marker.
• We then run an automated identity-masking step, hosted in Sydney, Australia, that finds names and identifying details, including the participant’s own name and the names of clinicians, support workers, schools and practices, and replaces them with placeholder tokens before the text is stored or sent anywhere else, including to our AI.
• This masked text, not your original document wording, is what is stored in your account and what is later reviewed by our AI. When you view your own reports inside the app, real names are shown back to you; the masking applies only to what leaves your account for AI review.
• No automated system catches every identifying detail with complete certainty. We reduce this risk with several overlapping detection layers, and if a document cannot be processed with confidence, its text is not stored at all, rather than risking an unmasked upload. Even in the unlikely event a detail is missed, it stays inside your own locked account: it is never shown to anyone else, never used to train AI systems, and never leaves Australia.
• If you remove a document from your case, it is removed from your view. The extracted text may remain in the database until it is deleted under the retention rules in section 11, or until you request full deletion under section 12.
• Documents are limited to 20 MB per file. Very long documents may be partially processed.

We do not share or sell the content of your uploaded documents.

7. How AI processing is used

When you run an evidence review or generate a preparation report, the masked version of your document text (see section 6) is sent to an AI system for analysis.

The AI system we use runs on secure, Australian-hosted infrastructure in the Sydney region. Your document text does not leave Australia for this step.

The AI reads the masked text and identifies findings related to disability, functional capacity, support needs and assessment domains. It does not diagnose conditions, predict NDIS decisions, or replace the role of a clinical professional.

Under our infrastructure provider’s published terms, content processed for this step is not used to develop or improve their own services, and stays within the region where it was processed.

A record of the AI’s response is stored in our database so we can check its quality and investigate errors. It is not shown to you directly in raw form; your reports are the plain-language, checked version of that output.

8. Where information is stored

• Database: your account data, profile information, extracted document text and evidence review findings are stored using a secure, managed database service hosted in the Sydney, Australia region.
• AI processing: document text is processed by AI infrastructure hosted in the Sydney, Australia region during an evidence review. This data is not retained beyond the processing request.
• Payments: purchases are made through the WooCommerce checkout on our website. We do not receive or store your payment card details; the payment gateway configured in that checkout handles this directly.
• Email: account emails, for example setting your password, a feedback follow-up, or a reminder before your data is deleted, are sent through a transactional email delivery service. These emails contain links and account details only, never the content of your documents.

All database and AI processing described above is located in Australia.

9. Who can access information

Your information is accessible only to you through your account.

MagMindLab staff may access account data for the purposes of operating and supporting the service, including processing deletion requests and investigating technical issues. Staff do not have routine access to your document text; any access for support purposes is limited to what is needed and recorded.

We do not sell, rent or share your information with third parties, except:

• Our AI processing provider, for AI processing as described above.
• Our email delivery provider, for account and reminder emails.
• Our payment provider, for processing purchases.
• As required by Australian law.

10. What is not done with your information

We do not:

• Sell or rent your information to any third party.
• Use your data for advertising or marketing profiling.
• Share your information with the NDIA or any government body except as required by law.
• Use your documents, extracted text, or evidence review outputs to train AI models.
• Display the content of your uploaded documents to anyone other than you.

11. Retention period

Your extracted document text and evidence review findings are automatically deleted 90 days after your first document upload, or 12 months after purchase, whichever happens first. When this happens, your document text is permanently removed and your reports are cleared; your account and purchase record remain so you can see that a purchase was made.

You can also request deletion earlier at any time (see section 12).

System audit log entries record actions taken in your account. These entries are a security and integrity record of the service and cannot be deleted, even on request. They do not contain the content of your uploaded documents.

Consent records (your acceptance of this privacy notice) are retained for the duration of your account as part of our compliance records.

12. How to request deletion

You can request deletion of your account data, profiles, extracted document text and evidence review findings at any time, without waiting for the automatic deletion described in section 11.

To request deletion, email contact@magmindlab.com with the subject line “Deletion request” and the email address associated with your account.

We will process your request within 30 days and confirm when it has been completed.

Please note: system audit log entries cannot be deleted, as they form part of the security and integrity record of the service. These records do not contain the content of your uploaded documents.

Under the Australian Privacy Act 1988, you also have the right to access and correct personal information we hold about you. Contact us at the email address above to exercise these rights.

13. Limits of the tool

MagMindLab is a preparation and organisation tool. It has important limitations you should understand before relying on it:

• It does not predict or guarantee any NDIS outcome.
• It does not assess eligibility for NDIS access.
• It does not provide clinical advice, legal advice or financial advice.
• Evidence review findings are based on what our automated tools can identify in your document text. The quality of findings depends on the quality and completeness of the documents you upload.
• Automated systems, including AI, can make errors or miss things. All findings should be reviewed by a qualified person before external use.
• The tool is not affiliated with the NDIS or the NDIA.

14. Contact and complaints

For questions about this privacy notice, to request access to or deletion of your information, or to raise a concern about how your information has been handled, contact us at:

Email: contact@magmindlab.com

Operator: Magcare Pty Ltd, trading as MagMindLab. ABN: 85668557613.

If you believe we have not handled your information in accordance with the Australian Privacy Act 1988, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.