Privacy Policy

About this privacy policy

We understand that individuals accessing National Disability Insurance Scheme (NDIS) services may share sensitive information about their health, disability, personal circumstances and support needs.

This Privacy Policy explains how we collect, use, store, protect and disclose personal information, and how you can access, correct or raise concerns about information we hold.

We are committed to managing personal information in accordance with applicable Australian privacy laws, including:

• Privacy Act 1988 (Cth)
• Australian Privacy Principles (APPs)
• Relevant NDIS Quality and Safeguards Commission requirements
• Applicable NDIS Practice Standards

This policy applies to NDIS participants, their families, nominees and representatives, referral partners, service providers, employees, contractors and visitors to our website.

Our services support NDIS participants across Sydney, particularly Western Sydney, including individuals requiring Support Coordination, Specialist Support Coordination and psychosocial recovery-related support.

What personal information we collect

We collect personal information reasonably necessary to provide our services, maintain appropriate records and meet our professional and legal obligations. The information collected depends on your relationship with All Is Well Care.

NDIS participants

We may collect:

• Full name, date of birth, address and contact details.
• NDIS participant number, plan dates, funding arrangements and support budgets.
• Details of disability, medical conditions, health needs and functional capacity.
• NDIS goals, support preferences and individual circumstances.
• Assessments, reports, behaviour support plans and relevant clinical documents.
• Details of family members, carers, guardians, nominees and emergency contacts.
• Cultural background, preferred language and communication requirements where relevant.
• Information regarding service providers, support arrangements and care coordination.
• Case notes, correspondence, meeting records and service delivery information.
• Financial information relevant to invoicing, service agreements and NDIS funding management.
• Information relating to incidents, risks, complaints and safeguarding concerns where relevant.

Health and disability information is considered sensitive information and is treated with additional care and confidentiality.

Families, nominees and representatives

We may collect contact details, relationships to participants, relevant authority or consent documentation, and information necessary for communication and support coordination.

Employees, contractors and applicants

We may collect employment and contact details, qualifications, professional registrations, screening clearances, employment history and other information reasonably necessary for recruitment or engagement.

Website visitors and enquiries

When you visit our website or submit an enquiry, we may collect:

• Your name, email address and phone number.
• Information included in contact or referral forms.
• General website usage and technical information.
• Information collected through cookies or analytics technologies, where used.

We encourage website visitors not to submit highly sensitive medical or disability records through general enquiry forms unless an appropriate secure submission method has been provided.

How we collect information

Where practical, we collect personal information directly from you. Information may be collected through:

• Initial enquiries and referrals.
• NDIS service agreements and consent forms.
• Phone calls, emails, meetings and consultations.
• Communication with participants, families and authorised representatives.
• NDIS plans, assessments and supporting reports.
• Communication with allied health professionals, plan managers, healthcare providers and relevant stakeholders.
• Our website and online contact forms.

We may also obtain information from third parties where you have provided appropriate consent, or where collection is otherwise permitted or required by law.

Where practical, you may make a general enquiry anonymously or using a pseudonym. However, identification is usually necessary when arranging or delivering NDIS Support Coordination services.

Why we collect and use your information

We collect and use personal information for purposes directly related to our services and business responsibilities. These purposes may include:

• Understanding participant needs, preferences and NDIS goals.
• Developing, implementing and monitoring support arrangements.
• Coordinating services with allied health professionals, disability providers, plan managers and other relevant stakeholders.
• Supporting participants to understand and effectively use their NDIS funding.
• Communicating with participants, families, nominees and authorised representatives.
• Preparing and maintaining case notes, service records and relevant documentation.
• Supporting plan reviews, reassessments and changes of circumstances.
• Managing service agreements, invoices and claims.
• Responding to complaints, incidents and safeguarding concerns.
• Improving service quality and maintaining regulatory compliance.
• Meeting legal, professional and NDIS obligations.

We only use or disclose sensitive information for authorised purposes, with appropriate consent or another lawful basis.

Sharing and disclosing personal information

All Is Well Care recognises the importance of confidentiality and participant choice and control. We may share relevant personal information with third parties where necessary and permitted, including:

• Allied health professionals, such as occupational therapists, psychologists, speech pathologists and physiotherapists.
• Disability support providers and other organisations involved in participant support.
• Plan managers and financial intermediaries.
• The National Disability Insurance Agency (NDIA).
• Hospitals, general practitioners and other healthcare professionals.
• Family members, guardians, nominees or representatives authorised to receive information.
• Government agencies and regulatory authorities where required or authorised by law.
• Professional advisers and technology service providers who assist with our operations.

Information will only be shared to the extent reasonably necessary for the relevant purpose and in accordance with consent arrangements or other lawful authority.

We do not sell personal information to third parties.

We may disclose information without consent where required or authorised by law, including where necessary to respond to serious threats to health or safety or meet applicable reporting obligations.

Consent and participant choice

We respect each participant's right to make informed decisions about their personal information. Where required, we seek consent before collecting sensitive information or sharing information with third parties. We explain, as appropriate:

• What information is being collected.
• Why the information is needed.
• How it may be used.
• Who it may be shared with.
• How consent can be withdrawn or amended.

Participants may request changes to their consent arrangements at any time. Withdrawal of consent may affect our ability to coordinate particular services. It will not necessarily require the deletion of information that we must retain under applicable laws.

Where an authorised representative or legally recognised substitute decision-maker is required, we will take appropriate steps to establish their authority.

Protecting and storing personal information

We take reasonable steps to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure. Our information security arrangements may include:

• Password-protected and access-controlled electronic systems.
• Secure document storage and communication processes.
• Restricted access based on work responsibilities.
• Confidentiality obligations for authorised personnel.
• Appropriate security controls for cloud-based systems.
• Secure handling and disposal of physical records.
• Procedures for identifying and responding to privacy and security incidents.

We may use third-party technology and administrative services to manage participant information, correspondence, documents, invoicing and business operations. Where third-party services are used, we seek to implement appropriate safeguards consistent with applicable privacy requirements.

Overseas storage and disclosure

Some technology providers may process, store or access information outside Australia. Where personal information is likely to be disclosed to overseas recipients, we will identify relevant overseas locations where practicable and take reasonable steps required by applicable Australian privacy laws.

We will not represent all information as being stored exclusively in Australia unless this has been verified across our systems and service providers.

How long we retain information

We retain personal information for as long as reasonably necessary to provide services, maintain appropriate business records and comply with applicable legal and regulatory obligations.

Different records may be subject to different retention requirements, including participant documentation, financial records, employment records and information relating to children.

When personal information is no longer required and there is no lawful reason to retain it, we take reasonable steps to securely destroy or de-identify the information.

Accessing and correcting your information

You may request access to personal information we hold about you. You may also request corrections if you believe information is inaccurate, incomplete, outdated, irrelevant or misleading.

To request access or correction, please contact us using the details at the end of this policy. We may need to verify your identity or authority before releasing information.

We will respond within a reasonable timeframe and explain any lawful limitations on access or correction. Where we cannot make a requested correction, we will explain why and advise you of available options, including requesting that an appropriate statement be associated with your record.

Confidentiality and participant dignity

All Is Well Care is committed to maintaining the privacy, dignity and confidentiality of every participant. We recognise that participants may have diverse cultural, linguistic, disability-related and communication needs.

We aim to communicate privacy information in a way that is accessible and understandable, including providing additional explanations or working with interpreters where appropriate.

Personal information is handled respectfully and shared only with individuals who have an appropriate reason and authority to receive it.

Website cookies and analytics

Our website, www.alliswell.com.au, may use cookies or similar technologies to support website functionality, maintain security and understand visitor interactions. Depending on the technologies enabled, this may include:

• Essential cookies required for website operation.
• Analytics tools used to understand general visitor activity.
• Technical information about devices, browsers and website performance.

You can manage cookies through your browser settings. Disabling certain cookies may affect website functionality. We encourage visitors to review this Privacy Policy when submitting personal information through our website.

Marketing and communications

We may communicate with individuals regarding service enquiries, referral arrangements, important service updates and other relevant operational matters.

Where we send direct marketing communications, we will comply with applicable Australian privacy and electronic marketing laws. You may opt out of marketing communications at any time by contacting us or using the unsubscribe facility provided.

We do not use participant health or disability information for unrelated advertising or marketing without an appropriate lawful basis.

Photographs, audio and video recordings

We respect the privacy of participants and their families when photographs, audio recordings or video recordings are involved. Where recordings are proposed, we will explain their intended purpose and obtain appropriate consent where required.

Separate consent will be sought before identifiable participant photographs, testimonials or recordings are used for promotional purposes.

Participants may withdraw consent for future use of promotional material. Where withdrawal occurs, we will take reasonable steps to stop further use and remove published material under our control where practicable. Some records may need to be retained where required by law.

Privacy breaches and data security incidents

All Is Well Care takes privacy and information security incidents seriously. Where a suspected privacy breach occurs, we will take appropriate steps to:

• Identify and contain the incident.
• Assess the nature and potential impact of the breach.
• Take reasonable measures to reduce the risk of harm.
• Notify affected individuals and relevant authorities where legally required.
• Review the circumstances and implement appropriate improvements.

Where applicable, we will comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

Changes to this privacy policy

All Is Well Care may update this Privacy Policy periodically to reflect changes in legislation, technology, service delivery arrangements or organisational practices. The most current version will be published on our website.

Significant changes affecting how participant information is handled will be communicated where appropriate.

Contact us or make a complaint

If you have concerns about how we have collected, used, stored or disclosed your personal information, we encourage you to contact us. We will:

1. Acknowledge your complaint within a reasonable timeframe.
2. Review the circumstances and relevant information.
3. Investigate the matter fairly and confidentially.
4. Explain the outcome and any corrective action where appropriate.

We aim to resolve privacy complaints promptly and transparently. For privacy-related enquiries, access requests, corrections, consent changes or complaints, please contact:

If you are dissatisfied with our response, you may contact the OAIC or the NDIS Quality and Safeguards Commission above.

We are committed to protecting your privacy, respecting your choices and maintaining the confidentiality of the information you entrust to us.