Privacy policy

Who this policy applies to

Glowina Rehab and Wellbeing is a registered NDIS provider delivering behaviour support, vocational assessment, vocational counselling and job seeking support across Western Sydney and the Hills District.

This policy explains how we collect, use, store and disclose personal information. It applies to participants, their families and carers, referrers, and anyone who contacts us through this website.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW), and the privacy and confidentiality obligations set out in the NDIS Practice Standards and the NDIS Code of Conduct.

What information we collect

We only collect information we actually need to deliver a support safely and well.

Personal information

• Name, date of birth, contact details and preferred method of contact
• NDIS number and plan details, including how the plan is managed
• Names and contact details of family members, carers, guardians, support coordinators and other providers involved in your supports
• Emergency contact details

Sensitive and health information

Disability and health information is sensitive information under the Privacy Act and attracts higher protection. We collect it only with consent, or where the law otherwise permits.

• Diagnosis, disability, and relevant medical or psychosocial history
• Functional capacity, support needs, risks and behaviours of concern
• Existing assessments, reports and behaviour support plans from other providers
• Records of restrictive practices, where these apply
• Progress notes, assessment findings and reports we create in the course of providing supports

Website information

When you submit our referral form or contact form, we receive the information you type into it. We do not use tracking or advertising cookies on this website.

How we collect it

Wherever possible we collect information directly from you. We may also receive information from a support coordinator, LAC, family member, school, GP or another provider who refers you, or from the NDIA.

If someone refers you, we ask them to confirm you know about and consent to the referral. If we receive information about you from a third party and you did not know, we will tell you we hold it and why, unless it is unreasonable or impracticable to do so.

Why we collect it

• To decide whether we are the right provider for you, and whether we have capacity
• To assess your needs and deliver the supports you have agreed to
• To write behaviour support plans, assessment reports and progress notes
• To communicate with you and, with your consent, with others in your support team
• To claim payment through the NDIS, a plan manager, or from you directly
• To meet our legal and regulatory obligations as a registered provider

If you choose not to give us certain information, we will explain what that means. In some cases we may not be able to deliver a support safely without it.

Who we share it with

We do not sell your information, and we do not share it for marketing.

With your consent, we may share information with:

• Your support coordinator, LAC, plan manager or nominee
• Other providers, allied health professionals, GPs or schools involved in your supports
• Employers, where you are receiving employment supports and have agreed to disclosure
• Family members, carers or guardians you have nominated

We may share information without your consent only where the law requires or permits it. This includes:

• Reporting to the NDIS Quality and Safeguards Commission, including reportable incidents and the use of regulated restrictive practices
• Where there is a serious and imminent risk to the life, health or safety of any person
• Mandatory reporting obligations relating to the safety of children
• Where we are required to by a court, tribunal, subpoena or other legal process

How we store and protect it

• Electronic records are held in password-protected systems with access limited to people who need it to do their work
• Any paper records are kept in locked storage
• Devices are password-protected and encrypted
• We do not discuss identifiable information in public settings

If a data breach occurs that is likely to result in serious harm, we will act in accordance with the Notifiable Data Breaches scheme, which includes notifying you and the Office of the Australian Information Commissioner.

How long we keep it

As a registered NDIS provider we are required to keep records for at least seven years from the date the record was made. Records relating to children may be kept longer. When records are no longer required, they are securely destroyed or de-identified.

Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct anything that is wrong, out of date or misleading. You do not need to give a reason.

Contact us and we will respond within 30 days. There is no charge for making a request. In limited circumstances we may need to refuse access, for example where giving access would seriously threaten someone's life or safety, or would unreasonably affect another person's privacy. If we refuse, we will explain why in writing and tell you how to have that decision reviewed.

Dealing with us anonymously

You can ask us a general question without giving your name. We cannot deliver a funded support anonymously, because we are required to identify participants for claiming and record keeping.

Privacy complaints

If you think we have mishandled your information, please tell us first. We take privacy complaints seriously and would rather hear about a problem than have you go elsewhere with it.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner on 1300 363 992 or at oaic.gov.au. For health information collected in New South Wales, you may also contact the NSW Information and Privacy Commission on 1800 472 679.

You can also raise concerns about a registered NDIS provider with the NDIS Quality and Safeguards Commission on 1800 035 544.

Changes to this policy

We review this policy from time to time. The current version is always the one published on this page, with the date shown at the top.