Legal

Privacy Policy

Last updated: 15 January 2025

RideDirect (“RideDirect”, “we”, “us”, “our”) is a Sydney-based passenger transport operator providing medical, NDIS, workers compensation, CTP, airport, corporate, and event transport across the Sydney metropolitan area. ABN 38 685 558 945.

We respect your privacy. This Privacy Policy explains what personal information we collect when you book transport with us, why we collect it, how we use and disclose it, how long we keep it, how we protect it, and the choices and rights you have. It applies to bookings made online, by phone, by email, and to bookings made on your behalf by a plan manager, support coordinator, insurance case manager, hospital, or corporate booker.

We handle personal information in line with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs). Where we provide supports to NDIS participants we also follow the NDIS Code of Conduct.

1. Information we collect

We only collect personal information that is reasonably necessary to provide your transport, bill the trip, comply with our legal obligations, and operate and improve our service.

a. Booking details

• Pickup and drop-off addresses (and any intermediate stops).
• Date, time, and direction of travel (one-way or return).
• Vehicle class and seating requirements.
• Accessibility needs — wheelchair type and dimensions, mobility aid, transfer requirements, assistance animals.
• Trip purpose where relevant (for example, hospital appointment, dialysis, court, NDIS support hours).
• Number of passengers, carers, and support workers.
• Trip notes you or your booker provide.

b. Identity and contact information

• Full name and preferred name.
• Contact phone number, email address, and (optionally) date of birth.
• Emergency contact details where you choose to provide them.
• Authorised representative details (next of kin, advocate, support coordinator, carer).

c. Funder and claim information

• NDIS participant number and plan management arrangement (self-managed, plan-managed, or agency-managed).
• Plan manager or support coordinator contact details.
• Workers compensation claim number, insurer, and insurance case manager.
• CTP claim number and insurer.
• Corporate or hospital account reference, cost centre, and approver.
• Purchase order, authorisation reference, or approval form.

d. Sensitive information (including health information)

We only collect sensitive information where you (or someone authorised to act for you) provide it, and where it is necessary to deliver the trip safely and appropriately. This may include:

• The fact that a trip is health-related (for example, hospital discharge, oncology, dialysis, mental health).
• Mobility and disability information needed to dispatch the right vehicle and brief the driver.
• Cognitive or behavioural support needs that affect how a trip is delivered.
• Allergies or medical alerts you ask us to record.

We treat sensitive information with additional care under APP 3 and only share it with the driver and operational staff who need it to deliver the trip.

e. Payment information

• Billing name and address.
• Payment method details. Card payments (Visa, Mastercard, American Express, Apple Pay, Google Pay) are processed by Stripe Payments Australia Pty Ltd. Full card numbers and CVCs are entered directly into Stripe’s PCI-DSS compliant infrastructure; RideDirect stores only a tokenised reference, the last four digits, and the card brand and expiry.
• Direct billing details for plan managers, insurers, and approved corporate accounts.
• Invoice and remittance correspondence.

f. Communications

• Emails, SMS, and chat messages exchanged with our team.
• Feedback, complaints, and reviews you provide.

g. Trip and operational data

• GPS location of the vehicle for dispatch, ETA, navigation, and incident response.
• Trip start and end times, kilometres travelled, route taken, and wait time.
• In-vehicle dash camera footage, fitted for driver and passenger safety. Footage is overwritten automatically and only retained in connection with a specific safety incident.

h. Website and device information

• Pages viewed and links clicked on this website.
• Approximate location (city / region) derived from your IP address.
• Browser type and version, operating system, and screen size.
• Essential cookies used for the booking flow and security — see our Cookie Policy.

2. How we collect your information

We collect personal information directly from you wherever practicable — when you book online, call us, email us, or speak with a driver or dispatcher. We may also collect information from:

• A person you have authorised to book on your behalf — a family member, carer, advocate, support worker, plan manager, support coordinator, or insurance case manager.
• Insurers, plan managers, hospitals, aged-care providers, and corporate bookers who arrange transport for you under an approval or referral.
• Public sources where necessary to verify identity, address, or claim details.

Where another person provides information about you to us, we ask them to confirm they have your authority to do so.

3. How we use your information

• Accept, confirm, dispatch, and deliver your booking.
• Match the right vehicle and driver to your trip (including wheelchair-accessible vehicles, mobility-aid securement, and assistance animals).
• Brief drivers with the information they need to support you safely and respectfully.
• Send booking confirmations, driver-on-the-way notifications, ETA updates, and post-trip receipts.
• Bill, invoice, and reconcile payments — including direct billing to NDIS plan managers, workers compensation and CTP insurers, hospitals, and corporate accounts.
• Verify NDIS, workers compensation, and CTP entitlements with the relevant funder or insurer.
• Respond to enquiries, feedback, and complaints, and resolve disputes.
• Manage safety incidents, accidents, near-misses, and insurance claims.
• Train and supervise drivers and dispatch staff.
• Improve our service — for example, by analysing aggregated trip and complaint data to identify trends and fix root causes.
• Comply with our legal obligations, including under transport, tax, work health and safety, and consumer protection laws.
• Respond to lawful requests from regulators, courts, and law enforcement.
• Send service communications about your booking. We will only send you marketing communications if you have consented or where the Spam Act 2003 (Cth) otherwise permits, and every marketing message will include a clear unsubscribe option.

4. Who we share your information with

We share the minimum information needed to deliver your trip and run our business. We never sell personal information, and we do not share it for unrelated third-party marketing.

a. Drivers and operational staff

Drivers receive only what they need for your trip: your name, pickup and drop-off, contact number, mobility or accessibility requirements, and any safety-relevant notes. Dispatch and customer-care staff see the full booking record.

b. Funders, plan managers, insurance case managers, and insurers

Where a third party arranges or pays for your transport, we share trip details, invoices, and supporting documentation with them so they can administer your support or claim. This includes NDIS plan managers, support coordinators, workers compensation insurers and their case managers, CTP insurers, and corporate or hospital accounts.

c. Payment processors

Card payments are processed by Stripe Payments Australia Pty Ltd. Stripe processes the payment as an independent controller of card data under its own privacy terms — stripe.com/au/privacy. Bank transfer and direct billing payments are processed by our bank and accounting providers.

d. Technology and service providers

We use trusted providers for hosting, dispatch and booking software, email and SMS delivery, accounting, customer support, and IT security. These providers operate under contract on our behalf and may only use your information for the purposes we specify.

e. Professional advisers

Our lawyers, accountants, auditors, and insurers, where there is a legitimate need and on a confidential basis.

f. Regulators and law enforcement

We disclose information when required or authorised by law, including in response to a court order, search warrant, or formal request from a regulator such as the NDIS Quality and Safeguards Commission, the Australian Taxation Office, the OAIC, or NSW Police.

g. In a safety emergency

We may share information with emergency services or your nominated emergency contact where we reasonably believe it is necessary to prevent or respond to a serious threat to life, health, or safety.

h. Business transitions

If RideDirect is reorganised, sold, or merged with another entity, personal information may be transferred to the successor entity, subject to this Privacy Policy and the Privacy Act.

5. Overseas disclosures

We primarily store and process information in Australia. Some of our service providers (including parts of our payment, email, and cloud infrastructure) may store or process data overseas. Where this occurs, we take reasonable steps under APP 8 to ensure those providers handle your information consistently with the Australian Privacy Principles.

6. How long we keep your information

We keep personal information only for as long as we need it for the purposes we collected it, or for as long as we are legally required to retain it.

• Booking and trip records: retained as long as required by law and relevant funder recordkeeping expectations.
• Financial and tax records: 7 years from the end of the relevant financial year, in line with the Income Tax Assessment Act 1997.
• Complaints, incidents, and insurance records: retained until the matter is resolved and any related claim or investigation is closed.
• Dash camera footage: fitted for driver and passenger safety. Footage is overwritten automatically unless retained for an incident.
• Marketing data: until you unsubscribe or for a reasonable inactivity period after your last interaction with us.

When we no longer need information, we securely destroy or de-identify it.

7. Data security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These steps include:

• Encryption of data in transit (TLS / HTTPS) and at rest for sensitive systems.
• Role-based access controls so staff only see what they need.
• Multi-factor authentication for staff accounts.
• Regular software updates, patching, and security reviews.
• Confidentiality and privacy training for drivers and office staff.
• Vendor due diligence and contractual privacy obligations on our service providers.
• Secure destruction of paper records and decommissioned devices.

No system is perfectly secure. If we ever become aware of a notifiable data breach affecting your information, we will respond in line with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act — assess, contain, and (where required) notify you and the OAIC.

8. Your rights and choices

You have the right under the Privacy Act to:

• Access the personal information we hold about you. We will normally respond within 30 days.
• Correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Request deletion of information we no longer need, subject to our legal retention obligations and any open claim, complaint, or investigation.
• Object to particular uses of your information (for example, recordings or marketing).
• Withdraw consent to optional uses at any time.
• Be anonymous or use a pseudonym where lawful and practicable. For most transport bookings we need your real name and contact details so the driver can find you and we can communicate trip updates.
• Unsubscribe from any marketing communication using the unsubscribe link in the message, or by emailing us.
• Complain about the way we have handled your personal information — see section 11.

To make a request, contact our Privacy Officer using the details in section 11. We may need to verify your identity before acting on a request.

9. Cookies and tracking

Our website uses a small number of essential cookies needed for the booking flow, your preferences, and basic security. We do not currently run third-party advertising trackers. If we add analytics or advertising cookies in the future we will update this policy and our Cookie Policy.

See our Cookie Policy for a full description and instructions on managing cookies.

10. Children and young people

Our website and booking platform are intended for adults. Where a young person travels with us — for example, a child on a school-related medical or NDIS trip — we collect information through the parent, guardian, or authorised support person who books the trip. We do not knowingly market directly to children.

11. Contact and complaints

For privacy questions, access or correction requests, or complaints about how we have handled your information, contact our Privacy Officer:

• Email: Admin@ridedirect.com.au
• Phone: 02 9052 6042 (Mon–Fri 8am–5pm; after-hours dispatch via online booking)
• Post: [TBC postal address]

We aim to acknowledge privacy enquiries within 2 business days and provide a substantive response within 30 calendar days. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our service, our suppliers, or the law. The current version is always posted on this page with the “Last updated” date above. Where a change is material we will take additional steps to inform you, for example by notice on the website or by email.