YSS Rostering

Care workers and the people they support, side by side.

Privacy policy

Version 2026-11-04-draft · updated 4 November 2026

Draft: to be checked by a lawyer before it is final.

YSS Rostering is rostering and care-records software for disability support providers. It is run by Yegon Software Services, ABN 63 894 973 709 (“we”). We follow the Australian Privacy Principles in the Privacy Act 1988.
Each organisation that uses YSS Rostering decides what goes into it about its staff and clients, and is responsible for that information. We store and process it for the organisation, only to run YSS Rostering.

Your account: name, username, email, phone, and the organisation you work for. A photo, home address and vehicle registration are optional: they're only used to estimate travel to shifts and for travel claims.
Your work records: shifts, clock-in and clock-out times, progress notes, care charts, incidents, timesheets, leave and travel logs, and the checks and qualifications you upload.
Your location, only at two moments: once when you clock in and once when you clock out, so your organisation can confirm the shift happened at the right place. A travel log records your route only between the moment you start it and the moment you stop it. The app never tracks you in the background.
Clients' information that organisations enter: names, contact details, date of birth, NDIS number, health and support needs, care records and documents. This is sensitive information. Organisations must have the client's consent (or their parent's or guardian's, for a child) before entering it, and they confirm that for each client.
For organisations that pay: the organisation's name, billing email, address and ABN. Card and bank details go straight to Stripe; we never see or store them.
Your phone's notification token, so we can send you notifications, and the app version. Our server keeps short technical logs (such as IP addresses) to keep YSS Rostering secure.

Only to run YSS Rostering for your organisation: rostering, records, pay, compliance, notifications, billing and support, and to keep the service secure.
We don't sell information, show ads, or use analytics or tracking tools. We don't use clients' or staff information for anything else, including training AI.

Stripe processes subscription payments (for organisations only).
Expo and Google Firebase deliver phone notifications, so a notification's text passes through them.
OpenStreetMap services (Photon by Komoot, and Nominatim) turn an address you type into a map location when you press “Find on map”: only the address is sent.
Our email provider delivers account and notification emails.
Some of these services may store or process information outside Australia, for example in the United States. We use them only for the job above, and they must protect it.
We'll also share information if the law requires it (for example, a court order).

The website uses only the cookies it needs to work: keeping you signed in, protecting forms from forgery, and remembering your organisation code on the sign-in page. There are no advertising, analytics or tracking cookies, so there's nothing to opt in or out of.

YSS Rostering is for staff of support organisations, not for children to use. Some clients are under 18: their organisation must have a parent's or guardian's consent before entering their information.

While your organisation uses YSS Rostering, its records stay until its admins delete them. Organisations usually have to keep support records for 7 years under NDIS rules.
Notifications are deleted after 6 months.
When an organisation cancels, we keep its information for 90 days so it can ask for a copy or come back, then delete it. Backups are kept for up to 30 days.
When an organisation's admin asks us to delete it, its staff lose access straight away. Its information is kept for 30 days in case they change their mind, then deleted automatically. Billing records and invoices stay with us and Stripe for as long as tax law requires.
If you send a bug report, we keep its title and description, your name, your organisation and the browser or app version until we've dealt with it, or your organisation is deleted.

YSS Rostering uses encrypted connections (HTTPS), stores passwords only in a scrambled form that can't be read back, keeps uploaded documents private, and shows each person only what their role needs. Sign-ins are rate-limited, and website sessions end after 12 hours.
If a data breach is likely to cause serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the law requires.

You can see and correct your own details under More → My details. Your organisation's admins can correct other records.
To have your account deleted, choose “Delete my account” under More in the app or on the website, or follow the steps on the delete-account page. Your organisation's admins handle the request, because they may need to keep work records (such as shift notes and incidents) the law requires. Your sign-in, contact details and photo are removed.
You can also ask us directly, using the contact details below. We'll reply within 30 days.

Contact us first; we'll answer within 30 days. If you're not happy with the answer, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
Yegon Software Services, ABN 63 894 973 709
104 Linsell Boulevard, Cranbourne East VIC 3977
Email yegondk254@gmail.com · phone 0415 374 101

If this policy changes, we'll update the date at the top and tell organisations' admins about important changes.