Privacy Policy
Effective 25 July 2026
Casebound is an NDIS plan-review tool made by Halcott (Hugo Murray, sole trader, ABN 49 487 966 952), based in Victoria, Australia. This policy explains what information Casebound holds, why, and what your rights are. It is written to be read, not skimmed past — it is short because the practices are simple.
What we collect
Your account. Your email address, used to sign you in with a one-time code. There are no passwords.
Your workspace. The documents you upload — NDIS plans and progress notes — and the participant records, drafts, and reports built from them. This includes health and disability information about NDIS participants, which Australian law treats as sensitive. Casebound holds it on your behalf: you, the coordinator, are responsible for having the participant’s consent to it, and Casebound gives you a place to record that consent against each participant.
How we use it
Workspace content is used for exactly one thing: drafting and checking the plan-review reports you ask for. When you upload documents, AI reads them and drafts a report in which every factual claim is tied to a quote from your sources; a second, independent model pass checks each quote; you review and edit every section before a report is finished.
We do not use your documents to train AI models — every request to our AI provider carries a no-training instruction. We do not sell your data, show ads, or share information with anyone beyond the services listed below. Casebound never reads across workspaces: one organisation’s documents are never visible to another.
Where it lives
Your workspace is stored in Sydney, Australia, encrypted in transit and at rest. The drafting service also runs in Sydney, and the web application’s server functions are pinned to Sydney. Document text passes through the processing services below transiently while a report is drafted.
Services we rely on
These are the only services that handle your information, and what each one does:
Supabase
Stores your workspace — participants, documents, drafts — and handles sign-in. This is where your data lives (Sydney region).
Anthropic (Claude)
Reads your documents and writes and checks drafts. Every request is sent with a no-training instruction.
LlamaCloud (LlamaParse)
Turns uploaded PDFs into plain text so the pipeline can read them. It receives the document, not your workspace.
Resend
Sends the six-digit sign-in code. It sees your email address, nothing from your documents.
Fly.io
Runs the drafting service (Sydney). Documents pass through it in memory while a report is drafted.
Vercel
Serves this web application, with its server functions pinned to Sydney.
Retention and deletion
Your workspace exists for as long as you use it — there is no retention beyond what running the service requires. You can export any report as a Word document or PDF at any time. You can permanently erase a participant’s records from inside the product, and erasure means erasure: documents, drafts, and stored files are deleted, not archived.
Your rights
Under the Privacy Act 1988 (Cth) you can ask for access to the personal information we hold about you (APP 12), ask us to correct it (APP 13), or ask for it to be deleted. Email us and we will do it — Casebound also gives coordinators a register for logging and working the same requests when participants make them.
If you believe we have mishandled your information, you can complain to us first, and to the Office of the Australian Information Commissioner (oaic.gov.au) if we don’t resolve it.
Changes
If our practices change, this page changes first, with a new effective date. We won’t weaken what this policy promises without telling you.
Questions, requests, complaints: murrayhugo5@gmail.com