1. About this policy

Disability and Nursing Solutions Pty Ltd, ABN 88 667 460 497, is a registered NDIS provider. We provide disability support services, including Positive Behaviour Support.

This policy applies when you visit our website, contact us, make or receive a referral, enquire about services, enter into a service agreement or receive services from DANS.

It applies to participants, prospective participants, family members, carers, nominees, guardians, advocates, referrers, support coordinators, plan managers, service providers, employees and contractors whose information we handle.

We handle information in accordance with applicable Australian privacy and health-records laws and the NDIS Practice Standards. This policy should be read together with any privacy collection notice or consent form provided when information is collected.

2. Information we may collect

The information DANS collects depends on your relationship with us and the services being requested or provided. It may include:

• Your name, date of birth, address, telephone number and email address.
• Your preferred language, communication needs and accessibility requirements.
• Your NDIS participant number, plan dates, goals, funding information and plan-management arrangements.
• Disability, health and clinical information, including diagnoses, medications, communication needs and relevant medical history.
• Information about behaviours of concern, risks, incidents, restrictive practices, assessments and support requirements.
• Details about guardians, nominees, family members, carers, advocates, referrers and other service providers involved in your support.
• Service records, progress notes, behaviour support plans, reports, correspondence and appointment information.
• Complaints, feedback, safeguarding and incident information.
• Billing, claims and administrative information required to arrange and manage services.
• Website and technical information, such as your browser, device, IP address and website activity, where this is collected by our website systems.

Because DANS provides disability and behaviour support services, much of the information we handle may be considered health information or sensitive information. We only collect information that is reasonably necessary for our services and business activities.

3. How we collect information

We usually collect information directly from the participant or their authorised representative. This may occur through:

• our website and referral forms;
• telephone calls and emails;
• meetings, assessments and appointments;
• service agreements and consent forms;
• clinical and service delivery records; and
• feedback, complaint and incident processes.

With consent or another lawful authority, we may also collect information from a referrer, guardian, nominee, family member, support coordinator, plan manager, treating practitioner, school, employer, implementing provider, government body, the NDIA or the NDIS Quality and Safeguards Commission.

If another person makes a referral, that person should have authority to provide the information and should tell the participant or authorised representative about the referral. DANS will take reasonable steps to provide an appropriate privacy notice to the participant.

4. Why we collect and use information

DANS may collect and use personal and health information to:

• assess a referral, service suitability, capacity, urgency and risk;
• contact the participant or authorised representative;
• complete intake and verify identity, authority, funding and consent;
• prepare a service agreement and arrange services;
• provide Positive Behaviour Support and other agreed supports;
• prepare assessments, behaviour support plans, progress notes and reports;
• coordinate with authorised people involved in the participant’s support;
• manage appointments, invoicing, claims and business administration;
• respond to complaints, incidents, risks and safeguarding concerns;
• meet our professional, legal, quality, audit, insurance and NDIS registration obligations; and
• improve the accessibility, security and quality of our services and website.

5. Consent and choice

DANS seeks informed consent where consent is required and records the purpose and scope of that consent. Where someone gives consent on behalf of a participant, we may ask for evidence of their authority.

A participant or authorised representative may ask to limit, change or withdraw consent by contacting us. The change will apply from the time it is recorded and will not undo information handling that has already occurred lawfully.

Limiting or withdrawing consent may affect our ability to assess a referral, coordinate supports, meet safety requirements or continue providing a service. We will explain the likely consequences before acting on the request where practicable.

DANS may collect, use or disclose information without consent where this is required or authorised by law, necessary to respond to a serious threat, or otherwise permitted by applicable privacy law.

6. When we may share information

DANS only shares information where it is reasonably necessary, authorised and relevant to the purpose. Depending on the circumstances, information may be shared with:

• authorised DANS practitioners, employees and contractors who need the information for their role;
• the participant’s authorised representative, guardian, nominee or advocate;
• an authorised support coordinator, plan manager, implementing provider or treating professional;
• secure technology, records, communications, accounting and professional service providers acting for DANS;
• auditors, insurers, lawyers and accreditation or registration bodies;
• the NDIA, NDIS Quality and Safeguards Commission, police, courts or other authorities where required or authorised; and
• emergency or health services where disclosure is necessary to respond to an urgent safety concern or serious threat.

7. Storage and security

DANS may store information in approved customer relationship management, clinical record, email, cloud storage, accounting and business administration systems. Where physical records are required, they are stored securely.

We use reasonable safeguards appropriate to the information and our operations. These may include:

• role-based access controls;
• multi-factor authentication;
• secure business devices and accounts;
• encryption where available;
• access logging and system backups;
• confidentiality obligations;
• staff and contractor training; and
• secure record destruction.

Access is limited to people who need the information for an authorised business or service-delivery purpose. However, no electronic transmission or storage system can be guaranteed to be completely secure.

8. Overseas processing

Some technology or professional service providers used by DANS may store or process information outside Australia or permit authorised support access from another country.

Before using such providers, DANS considers the nature of the information, the service provider’s security arrangements and the requirements of Australian privacy law. You may contact us if you would like further information about the systems currently used to handle your information.

9. Website data and cookies

Our website may use cookies and similar technologies that are necessary for security, forms, accessibility and basic website functionality.

We may also use limited analytics to understand how visitors use the website and to improve its performance. Analytics information should not include the health, clinical or referral information entered into a secure referral form.

You can adjust cookie settings through your browser. Disabling essential cookies may affect how some parts of the website operate.

Links to other websites

Our website may contain links to government agencies, service providers or other external websites. DANS is not responsible for the privacy practices of external websites. You should review the privacy policy of the relevant website before providing information.

10. Accessing or correcting your information

You may ask to access personal information DANS holds about you or request that information be corrected if it is inaccurate, incomplete, out of date or misleading.

We may need to verify your identity or your authority to act for another person before providing access or making a correction.

In some circumstances, access may be refused or limited where permitted by law. If this occurs, we will explain the reason and any available review or complaint options.

11. Record retention and disposal

DANS keeps records for the periods required by applicable privacy, health-records, NDIS, taxation, employment, insurance, contractual and professional obligations.

When information is no longer required and there is no legal or operational reason to retain it, we take reasonable steps to securely destroy it or permanently de-identify it.

12. Data breaches

DANS takes suspected privacy and security incidents seriously. We will take reasonable steps to contain, investigate and assess a suspected data breach and reduce the risk of harm.

Where a breach meets the legal requirements of an eligible data breach, DANS will notify affected individuals and the Office of the Australian Information Commissioner as required. Other NDIS, contractual, insurance or professional notification obligations may also apply.

13. Privacy questions and complaints

If you have a question or concern about how DANS has handled your information, please contact us using the details below.

Please explain what happened, the information involved and the outcome you are seeking. We will acknowledge and investigate your concern, communicate the outcome and explain any further complaint options.

If your concern is not resolved, you may contact the Office of the Australian Information Commissioner .

A NSW health-privacy concern may also fall within the jurisdiction of the Information and Privacy Commission NSW . Depending on the nature of the concern, the NDIS Quality and Safeguards Commission may also be able to assist.

14. Children and authorised representatives

Where a participant is a child or requires support to make decisions, DANS will consider the participant’s capacity, preferences and rights, together with the authority of a parent, guardian, nominee or other representative.

We aim to involve the participant in decisions as much as practicable and record who has authority to provide consent and receive information.

15. Changes to this policy

DANS may update this Privacy Policy when our services, systems or legal obligations change. The current version will be published on this website with the date it was last updated.