ThevaCare Privacy Policy

Privacy Statement

ThevaCare is committed to protecting the privacy of an individual's personal information.

The following sets out how we aim to protect the privacy of your personal information, your rights in relation to your personal information managed by us, and the way we collect, use and disclose your personal information.

In handling your personal information, we will comply with the Privacy Act 1988 (Cth), the thirteen Australian Privacy Principles in the Privacy Act, and the Health Records and Information Privacy Act 2002 (NSW). As a NDIS provider, we also comply with the NDIS Act 2013 (Cth), the NDIS Practice Standards (Core Module 1: Rights and Responsibilities), and the Notifiable Data Breach (NDB) Scheme under Part IIIC of the Privacy Act 1988 (Cth).

We have policies and procedures in place to ensure that personal information is managed in an open and transparent way, the privacy of personal information of participants and staff are protected, we collect and handle personal information fairly, personal information we collect is used and disclosed for legally permitted purposes only, we regulate access to and correction of personal information, and we maintain the confidentiality of personal information through appropriate storage and security. The kinds of information we collect

Consumer personal information is collected to provide care and services. Personal information we collect could include your name, address, telephone number and email address, date of birth, gender, advocate or emergency contact's telephone number and email, health information, and diversity status including ethnicity and lifestyle preferences.

As a NDIS provider, we handle sensitive information as defined under the Privacy Act 1988 (Cth). This includes health and medical information, disability-related information and support needs, behavioural support plans, mental health information, racial or ethnic origin, cultural and religious background, and sexual orientation or gender identity where disclosed for care planning purposes. Sensitive information will only be collected with your explicit consent, or as otherwise permitted or required by law.

How we collect personal information

Participant personal information may be collected from you, the participant, your family members or significant others, your advocate, and your doctor or other service providers or facilities. We will collect personal information directly from you unless we have your consent to collect the information from someone else, we are required or authorised by law to collect the information from someone else, or it is unreasonable or impractical to do so.

You can withdraw your consent at any time by contacting us; however, you should be aware that this may impact on our capacity to provide services. Declining to provide consent, or withdrawing consent, will not affect your right to access NDIS supports or services, unless the information is essential to providing those supports safely.

Consent and decision-making capacity

Where a participant lacks the decision-making capacity to provide consent, we will obtain consent from their authorised representative — a guardian, administrator, or person responsible under applicable NSW or Commonwealth legislation. We will verify the authority of any person purporting to act on a participant's behalf before accepting their consent, and will not assume that a family member has legal authority to consent without verifying that authority. We will document how capacity was assessed and by whom.

Purpose of collecting personal information

Personal information is collected for the purposes of providing care and services. The information may be used to provide support services and enable service providers and medical practitioners to provide care and services, to meet our obligations as a registered NDIS provider under the NDIS Act 2013 and NDIS Practice Standards, to comply with mandatory reporting obligations to the NDIS Quality and Safeguards Commission, to maintain accurate records for auditing and quality improvement, and to process invoices and manage billing through the NDIS portal. Disclosure of personal information We may disclose your personal and health information, for the purpose of your care and services, to: • Service providers who assist us in providing care and services • Medical practitioners, allied health professionals, and medical specialists • External health agencies such as the ambulance service and hospitals • The National Disability Insurance Agency (NDIA) and NDIS portal • The NDIS Quality and Safeguards Commission (for mandatory reporting of reportable incidents) • Your Support Coordinator or Plan Manager • Other relevant government organisations • A person you have nominated as your advocate such as a parent, child or sibling, spouse, a relative, a member of your household, a guardian, an enduring power of attorney, or a person nominated to be contacted in case of emergency, provided they are at least 18 years of age • Our professional advisers including legal, accounting, and insurance advisers, who are bound by confidentiality obligations

We may not use or disclose personal information for a purpose other than providing care and services unless you have consented, the purpose is related to providing care and services and you would reasonably expect disclosure of the information for that purpose, we believe on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to your life, health or safety or a serious threat to public health or public safety, or we have reason to suspect unlawful activity and disclosure is required or authorised by law.

Photography and video consent

ThevaCare will not take photographs or video recordings of participants, or use such material in any promotional, training, or reporting context, without obtaining separate written consent specific to that purpose. Consent for photography or video may be withdrawn at any time. Security of personal information

We take all reasonable steps to ensure that the personal information we hold is protected against misuse, loss, unauthorised access, modification or disclosure. We hold personal information in both hard copy and electronic forms in secure databases on secure premises and on secure, cloud-based technology, accessible only by our authorised staff. All employees and volunteers are bound by confidentiality obligations as a condition of their engagement.

Record retention and destruction

We retain participant records for a minimum of 7 years from the date of last service, or in the case of a participant who was a child at the time services were provided, until that person turns 25 years of age whichever is the later. When personal information is no longer required, we will take reasonable steps to destroy or permanently de-identify it in a secure manner, subject to any legal record-keeping obligations.

Accessing the personal information that we hold about you

Under the Privacy Act, you have a right to access your personal information that is collected and held by us. If at any time you would like to access or change the personal information that we hold about you, or you would like more information on our approach to privacy, please contact our Privacy Officer. To obtain access to your personal information, you will need to provide proof of identity. We will take all reasonable steps to provide access to your personal information within thirty (30) days from your request. In some circumstances, a fee may apply to cover the reasonable cost of retrieving and providing access to your information. We will advise you of any applicable fee before proceeding. Website and digital data collection

When you visit our website (thevacare.com.au), we collect limited, anonymous visit statistics to help us understand how the website is used and to improve it. This includes the pages you view, how long you spend on each page, the type of device you are using (mobile, tablet or desktop), the website that referred you to us (if any), the date and time of your visit, and your approximate location (city, state and country).

Your approximate location is estimated from your internet connection at the time of your visit. Your IP address is not stored. We do not use cookies or third-party analytics tools to collect these statistics, and the information we collect cannot be used to identify you personally. Visit statistics are stored securely in Australia and are automatically deleted after 13 months.

If you submit an enquiry, feedback or complaint through our website, the personal information you provide will be handled in accordance with this Policy.

Employee information

Records of current and past employees which are related to the employment relationship are managed in accordance with workplace laws, including the Fair Work Act 2009 (Cth). Privacy laws may apply to employee personal information if the information is used for something that is not related to the employment relationship between our organisation and the employee.

Volunteer records

Personal information collected and held by us in relation to our volunteers will be managed in accordance with the Privacy Act.

Privacy data breaches

ThevaCare is subject to the Notifiable Data Breach (NDB) Scheme under Part IIIC of the Privacy Act 1988 (Cth). If your personal information is lost, stolen or subject to unauthorised access or disclosure, we will implement our Management of Data Breach Policy and Procedure. In the event of a suspected breach, we will conduct an initial assessment within 72 hours of becoming aware of the suspected breach, and complete a full assessment to determine whether an eligible data breach has occurred within 30 days. Where an eligible data breach is identified, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

Privacy complaints

All complaints regarding privacy can be lodged via our complaint handling process by contacting us at info@thevacare.com.au. At all times, privacy complaints will be treated seriously, dealt with as promptly as possible, handled in a confidential manner, and will not affect your existing obligations or the commercial arrangements between you and us.

You will be informed of the outcome of your complaint following completion of the investigation. If you are not satisfied with our response, you may escalate your complaint to the following external bodies: Office of the Australian Information Commissioner (OAIC) Website: oaic.gov.au | Phone: 1300 363 992 NDIS Quality and Safeguards Commission Website: ndiscommission.gov.au | Phone: 1800 035 544 Policy review

This Policy will be reviewed annually or following any significant change in legislation, our operations, or NDIS requirements. The current version is always available on our website and upon request.