Privacy Policy
Last Updated: October 2026IncidentSign is a digital compliance and incident workflow software provided and operated by Pixel Blanco (Pty) Ltd (‘Pixel Blanco’, ‘we’, ‘us’, or ‘our’). We are committed to protecting personal and sensitive health-related information in accordance with the Australian Privacy Principles (APPs) established under the Privacy Act 1988 (Cth) and relevant disability care regulatory frameworks.
Section 1: Information We Collect
We collect information across three categories:
1. Agency / Provider Account Data (Collected at Sign Up)
- Business name / Provider trade name.
- Australian Business Number (ABN).
- Account holder's name, email address, and billing contact details.
- Provider branding assets (uploaded company logos used for PDF report headers).
2. Frontline Incident Report & Health Data (Entered by Support Workers & Managers)
- Participant Details: Full name, date of birth, contact number, and relationship status.
- Incident Facts: Date, time, physical location, witness names and witness contact information.
- Sensitive & Injury Data: Descriptive narratives of incidents, incident classifications (e.g., medication errors, behavioral concerns, unauthorized restrictive practices), marked anatomical injury points (body map coordinates), mechanisms of injury, medical treatments administered, and emergency notifications (NDIS Commission, Police, Safe Work).
- Internal Investigation Notes: Root-cause checklist responses, corrective action assignments, staff names, positions, and executive findings.
3. Electronic Signature & Audit Trail Metadata (Captured Automatically)
- Visual digital signature artwork (PNG base64 drawing).
- Signer role (Support Worker, Investigator/Manager, Participant/Representative).
- Exact timestamp (UTC/AEST).
- Signer IP address and browser user-agent string for audit verification.
Section 2: How We Use Your Information
- To generate, render, and seal legally formatted NDIS incident reports.
- To route sequential magic review links between frontline workers, investigators, and participants.
- To deliver automated notifications and completed PDF reports via email to authorized parties.
- To maintain an active Incident Register for agency compliance audits.
- We never sell, rent, or monetize participant or incident data for advertising or analytics.
Section 3: Data Storage & Sovereignty
- All customer incident records, database entries, and generated PDF documents are hosted strictly within Australian cloud regions (Sydney
ap-southeast-2). - Data is retained for the minimum 7-year statutory period required for NDIS provider compliance unless instructed otherwise by the account-holding agency.
Operated by Pixel Blanco (Pty) LtdView Terms of Service →