Stronger Organisations. Better Outcomes.
Keystone Quality Partners is an independent, fully remote consultancy run by Marcelo Luengo. We help NDIS providers with registration, audit preparation, policies and governance, and we help small organisations improve their processes and use AI responsibly.
Services
We start with NDIS providers, and we're extending the same practical approach to other small and growing organisations. We scope the work around where you are now and what's coming up, and you'll know what's included before any work begins.
NDIS registration and audit preparation
Choosing the right registration groups, preparing your application to the NDIS Quality and Safeguards Commission, and getting ready for your audit.
Learn more
- Registration support. Working out the right registration groups and preparing your registration application.
- Audit preparation. A gap analysis against the NDIS Practice Standards, a walk-through of what the audit involves and help organising your evidence. Audits are conducted by approved quality auditors, not by us.
- Ongoing compliance. Internal reviews, continuous improvement planning and guidance when requirements change.
NDIS policies, governance and training
Policies and procedures written with you, governance and risk systems built around participant safety, and training for your team.
Learn more
- Policies and procedures. Developed with you, in your words, so your team understands and owns them.
- Governance and risk. Risk registers, incident management, and complaints and feedback processes designed around the relevant NDIS requirements.
- Staff training and induction. Induction programs and refresher sessions covering worker obligations and the NDIS Code of Conduct.
Process and efficiency consultancy
A practical look at how work gets done in your organisation, and simpler ways to do it.
Learn more
- Process review. Mapping how a task or service runs today, step by step, with the people who do it.
- Efficiency improvements. Finding duplication, rework and bottlenecks, and agreeing practical changes.
- Systems and tools. Templates, checklists and simple systems that fit the way your team works.
AI consultancy
Plain-English advice for small organisations on where AI tools can help, and how to use them responsibly.
Learn more
- Where AI fits. Identifying everyday tasks where AI tools could save time, and where they shouldn't be used.
- Responsible use. Simple guidelines for your team, covering privacy, confidentiality and human checking of AI output.
- Workflow improvement. Trying an AI tool in one workflow first, and reviewing it with your team before wider use.
NDIS Practice Standards
The NDIS Practice Standards are grouped into modules. Which ones apply depends on the supports you deliver. For each one, we can help with readiness, policies and procedures, organising your evidence, a gap review and team training. Audits are conducted by approved quality auditors, not by us.
The foundation for registered providers
Applies to registered providers delivering higher-risk supports, and usually sits alongside the supplementary modules (an SDA-only provider is assessed against Module 5 alone). It has four parts.
- Rights and responsibilities
- Respecting rights, privacy, dignity and choice, and keeping people safe from harm.
- Governance and operational management
- How you run things: risk, quality, records, complaints, incidents, staff and continuity.
- Provision of supports
- How supports are accessed, planned, agreed, delivered and handed over.
- Support provision environment
- Safe settings, money and property, medication, mealtimes and waste.
High intensity daily personal activities
For providers delivering complex daily care, such as tracheostomy, ventilator, catheter, enteral feeding or complex wound care.
In practice: Support plans for each activity · Worker training and competency records · Clear procedures and escalation
Specialist behaviour support
For practitioners who assess participants and develop behaviour support plans.
In practice: Developing and reviewing plans · Restrictive practice reporting · Practitioner records
Implementing behaviour support plans
For providers who use regulated restrictive practices while following a participant's behaviour support plan.
In practice: Following plans in daily support · Monitoring and reporting use · Staff training
Early childhood supports
For early childhood providers working with young children and their families.
In practice: Family-centred planning · Working with other services · Tracking outcomes
Specialised support coordination
For providers delivering specialised support coordination.
In practice: Conflict of interest policy · Coordination records · Managing supports
Specialist disability accommodation
For providers of specialist disability accommodation (SDA).
In practice: Tenancy and service agreements · Dwelling enrolment records · Managing conflicts of interest
Assistance with supported independent living
For providers of supported independent living (SIL), alongside the Core Module, from 1 July 2026 (with transitional arrangements for existing providers).
In practice: Decision-making support · Safeguarding processes · Housing and support agreements
Providers of lower-risk supports are assessed against a separate Verification Module. Module names follow the NDIS Practice Standards.
AI and implementation
We help small and growing organisations, NDIS providers included, bring in AI tools and new systems in small, practical steps. People stay responsible for decisions, and your compliance obligations don't change.
- Assess fitLook at where AI or a new system could genuinely help, and where it shouldn't be used.
- Pick one workflowStart small, with one task your team does often.
- PilotTry it with a few people and agree what good looks like.
- Implement with your teamYour team sets it up, with our guidance, around the way you already work.
- TrainShort, practical sessions so people feel confident.
- ReviewCheck what worked, adjust, then decide on wider use.
Where it can help
- First drafts of documents, for your team to tailor and own
- Rostering and scheduling
- Summarising meeting notes and internal updates
- Reports
- Records and admin
Always with human review of anything an AI tool produces.
Responsible use and privacy
Simple rules on what information can go into AI tools, how outputs are checked and who signs off.
We're independent of AI tool vendors and don't take commissions.
Who we help
From new applicants to established registered providers, we help you understand what's required and keep your systems up to date. Our process and AI advice is also open to other small organisations.
- New NDIS applicants
- Providers facing a renewal audit
- Registered NDIS providers
- Providers with corrective actions
- SIL providers
- Small and growing organisations
How we work
Remote, wherever you are. Sessions fit around your rosters, and capacity is limited because this is a one-person practice.
Understand
You tell us about your organisation, your services and what you need, and we reply with a suggested next step.
Plan
We assess your current systems and processes against what's required and agree a prioritised plan.
Implement
We work with your team to put policies, systems and new ways of working in place that your team owns.
Sustain
We help you prepare for your audit with an approved quality auditor, or settle changes into everyday work, then support you as you grow.
Why Keystone
Independent by design
Keystone Quality Partners is not an approved quality auditor and does not conduct audits or grant registration or certification. Audits are conducted by approved quality auditors, not by us.
Systems your team will use
Policies and procedures developed with you, in your words, so your team understands and owns them. Templates, checklists and simple systems that fit the way your team works.
Founder-led, plain English
Keystone Quality Partners is a one-person consultancy run by Marcelo Luengo. You work directly with Marcelo, remotely and around your rosters.
What we don't do: we don't guarantee audit outcomes, and we don't make decisions that belong to your auditor or the NDIS Commission.
Insights
We're preparing plain-English guides for providers and small organisations. They'll appear here once they're ready.
NDIS compliance
Coming soonA plain-English guide for NDIS providers.
Process and efficiency
Coming soonA plain-English guide to improving everyday processes.
Practical AI
Coming soonA plain-English guide to using AI tools responsibly.
Who you'll work with
You get practical quality and compliance support built around how your organisation actually runs — policies, evidence, day-to-day operations and the systems that hold them together.
We work alongside your team as a partner, not a revolving cast of consultants. A keystone is the wedge-shaped stone at the top of an arch. It goes in last, and it’s what locks every other stone in place. Good systems work the same way: people, policies and daily operations need something that brings them together. That’s the work we help with.
Get in touch
Tell us where your organisation is today and what's ahead, and we'll reply with a suggested next step.
Prices are quoted on enquiry.
- Coverage
- Remote, Australia-wide
- Based in
- Queensland
- [email protected]
- ABN
- 58 813 103 417
Privacy note
Last updated: 29 October 2026
1. Who we are
1.1 Keystone Quality Partners is an Australian consultancy based in Queensland (ABN 58 813 103 417). We help NDIS providers with registration, audit preparation, policies and governance, and help small organisations strengthen their processes and use AI responsibly. In this note, "we", "us" and "our" mean that business.
1.2 To contact us about privacy, use the contact form linked on this website: https://form.jotform.com/263011115547043, or email [email protected].
2. This website
2.1 This website does not use cookies, analytics, tracking pixels or advertising tools.
2.2 The website has a plain link to a short contact form. The form is provided by Jotform and opens on Jotform's site, not ours. What you enter in it goes to Jotform and then to us, as explained in sections 3 to 6.
2.3 Like any website, it is delivered by a hosting provider (Cloudflare Pages), which may automatically process technical information such as your IP address and browser details to deliver the site and keep it secure. We do not use that information to identify you.
3. What we collect and why
3.1 We only collect personal information you choose to give us, or that is created when you use our online forms. In practice, this comes from four places:
- (a) our contact form, which asks for your name, contact details, organisation and your message;
- (b) emails we exchange with you after you contact us, usually your name, contact details, organisation and role, and whatever is in your message;
- (c) our online intake form, which an organisation fills in before we quote, and which asks for the name, role and work contact details of one business contact, and information about the organisation; and
- (d) our online signing forms, if your organisation becomes a client, which ask for the name, role, signing capacity and work email of the person signing, their signature, and the work contact details of any other contact people the client gives us.
3.2 We use this information to reply to you, to prepare a quote, to discuss and provide the services you ask for, to identify who signed for a client and in what capacity, to keep a record of our agreements, and to keep the business and tax records the law requires. If you don't give us your contact details, we can't reply or quote. Without the signer's details and signature, we can't accept a signing or start work.
3.3 If you give us the details of other people at your organisation, please let them know about this note.
4. Our online forms
4.1 Our contact, intake and signing forms use an online form and signing service, Jotform. Each form shows a short privacy notice before you submit it.
4.2 When a form is submitted or a document is signed, Jotform also keeps a record of it. This includes the date and time of each submission and, for documents we send for signing, when they were sent, viewed and signed, as well as the IP address of the device used and technical details about that device and its browser.
4.3 Our forms don't ask for sensitive information and don't accept file uploads. Please don't enter information about NDIS participants, their families or your workers on any of our forms. If you've included participant or staff details by mistake, tell us at [email protected] and we'll delete them from our form system and email, and confirm when that's done.
4.4 If we work together and some client information is needed for the work, we'll agree in writing what is shared, how it is sent and how it is handled, and we'll ask for the minimum needed, de-identified where possible.
5. Who we share it with
5.1 We don't sell or rent personal information, and we don't share it for marketing. We share it only with service providers we need to run the business, with your consent, or where the law requires or allows it.
5.2 Our main service providers are:
- (a) Apple, which hosts our business email (iCloud Mail for [email protected]), including the emails that tell us a form has been submitted and completed signing records;
- (b) Jotform Inc., based in the United States, which provides our online forms and signing service, and uses cloud providers including Amazon Web Services and Google Cloud;
- (c) Microsoft OneDrive on the Keystone Quality Partners Outlook account, where we keep downloaded signed documents (separate from our business email); and
- (d) our accountant and other professional advisers, where needed.
6. Information held outside Australia
6.1 Some of our service providers store or access information outside Australia. We use a standard Jotform account based in the United States, so Jotform stores our form and signing data on servers in the United States. Jotform's own service providers may access form data from other countries.
6.2 Apple says it may store and process iCloud data in the United States and in other places where it or its service providers operate. Microsoft says the same for OneDrive data in the user's region, in the United States and in other places where it or its service providers operate.
6.3 So personal information you give us through our forms is held in the United States, our email and our file storage may also be held outside Australia, and all of them may be accessed from other countries. We choose providers that publish privacy and security terms, we keep what we send them to the minimum, and our forms don't ask for sensitive information or information about NDIS participants.
7. How we look after it
7.1 We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure.
7.2 We download each signed document with its signing record (audit trail) and keep it in our own storage, outside Jotform, for 7 years after the SOW ends, then securely destroy it or de-identify it. We keep it longer only if the law requires it, or for an actual or reasonably expected claim or regulatory inquiry. We haven't yet decided when copies held in our Jotform account will be deleted; we'll update this note when we do. We delete contact form messages, intake form answers and other information when we no longer need them for replying, the quote, the work or our business records.
8. Accessing or correcting your information
8.1 You can ask to see or correct the personal information we hold about you by emailing [email protected]. We aim to respond within 30 days.
9. Questions and complaints
9.1 If you have a concern about how we've handled your personal information, please email us first at [email protected]. We'll acknowledge it promptly and aim to give you a written response within 30 days.
9.2 If you're not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints or on 1300 363 992. The OAIC usually expects you to complain to the business first and allow 30 days for a response.
9.3 As a small business, we may not be covered by the Australian Privacy Principles in the Privacy Act 1988, so the OAIC may not be able to deal with every complaint, but we handle personal information with those principles as our guide.
10. Changes to this note
10.1 We'll update this note if our practices change, for example if we add analytics to this website, change the contact form, or change the services we use for forms, signing, storage or email. The date at the top shows when it last changed.
10.2 This note is published on this website. Clients also receive a copy with our first statement of work (SOW).