Families see exactly what was consented to, and nothing else
Notes, shifts, documents and care-team credential expiry are each granted separately. There is no blanket switch, and the boundary is enforced in the database rather than in the interface.
Request early accessA family member's access record. Four separate consent switches, two shared and two not.
Four switches, not one
Blanket family access is the easy build and the wrong one. Each data type is granted on its own, recorded against a consent record.
- Granted separately · Notes, shifts, documents and credential expiry are four decisions.
- Recorded, not assumed · Each grant has a consent record behind it.
- Enforced below the UI · The rule lives in row-level security, not a React condition.
Consent records for one participant, including a delegated grant with an expiry date.
Pause or revoke, and the next query returns nothing
Access that takes a support ticket to remove is not access control. Have your team pause it for a set window (30 days by default) or revoke it outright, and it takes effect on the next read.
- Instant effect · The very next query returns nothing.
- Pause, not just revoke · An admin can suspend access for a set window without tearing down the record.
- On the record · Each change is stored against a consent record.
A paused delegated grant. Scope is capped at the delegator's own, with its own expiry.
Access can be shared, but never widened
Your team can record a delegation on a primary nominee's behalf, passing access to a second family member. It is capped at the nominee's own live scope, limited to notes and shifts, with its own consent record and an expiry date. Documents and messages cannot be delegated.
- Ceiling enforced · A delegate can never see more than the delegator, and only notes and shifts can be delegated.
- Recorded by your team · An admin or coordinator records it, with a consent record of its own.
- Always expires · A delegated grant carries an expiry date.
A delegation recorded by your team, capped at the delegator's own scope, with a wider request refused.
Any questions?
Can a family member see everything about a participant?
Only what has been granted. Notes, shifts, documents and care-team credential expiry are four separate grants with no blanket switch.
Where is that rule enforced?
In row-level security at the database, not in interface conditions, so it holds for every route into the data.
How quickly does revoking access take effect?
On the next query. Your team can also pause access for a set window (30 days by default) rather than revoking it outright.
Can a nominee give access to someone else?
Not directly. Your team records the delegation on the primary nominee's behalf; there is no self-serve step in the portal. It is capped at the nominee's own live scope, limited to notes and shifts (documents and messages cannot be delegated), with its own consent record and an expiry date.
What does the portal show?
Upcoming shifts, progress notes, progress toward goals, the typical-day routine, documents, messages and a feedback form, each subject to what has been granted.
Discover more of the platform
Run your NDIS operations without the chaos.
Early access is by invitation. Your trial starts the day your invite lands. No credit card, no setup fee, and your data stays in Sydney.