Privacy Policy for Participants and Families

We hold some of the most private information a person has. Your health. Your disability. Who helps you shower. What happened on a hard day. This policy explains what we collect, why, who we share it with, and how you can see it.

It applies to participants, families, carers, guardians, nominees, workers, job applicants and anyone who contacts us through this website.

Who we are

J&J Supports Pty Ltd, trading as J&J Supports
ABN 80 687 399 006
Registered NDIS provider
329A Point Nepean Road, Dromana VIC 3936
[email protected]
1300 815 471

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which set the rules for handling personal information. Health information we hold in Victoria is also covered by the Health Records Act 2001 (Vic). As a registered NDIS provider we also have duties under the NDIS Act 2013, the NDIS Practice Standards and the NDIS Code of Conduct.

You can read the Australian Privacy Principles on the website of the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Dealing with us anonymously or under another name

You can ask us a general question without telling us who you are. You can use a different name if you prefer. Ring us to ask what we do, which suburbs we cover, or how the NDIS works. You'll get an answer.

Support is different. We cannot deliver support to a person we cannot identify. We need to know who you are so we can keep you safe, roster the right worker, record your health needs, give medication correctly, claim payment, and keep the records the law requires us to keep. So for anything past a general enquiry, dealing with us anonymously or under a false name is not practicable, and you will need to identify yourself.

What we collect

If you are a participant, or you are enquiring about support, we may collect:

Your name, date of birth, address, phone number and email
Your NDIS participant number, and your NDIS plan details, including funding categories, budgets and plan dates
Whether your plan is NDIA-managed, plan-managed or self-managed (who pays your invoices), and your plan manager's details
Your support plan, your goals and your service agreement with us
Health and disability information, including diagnoses, allergies, mobility, communication needs, mental health information and dietary needs
Medication information, including medication charts, administration records and prescriber instructions
Nursing and care records, progress notes, shift notes and daily records
Behaviour support plans, and any restrictive practice authorisation (approval to limit someone's rights) that applies to you
Incident reports, including reportable incidents we must give to the NDIS Commission
Next of kin, emergency contacts, guardians, nominees and other decision makers
Details of other people in your care team, such as your GP, your support coordinator and allied health providers
Rostering data, which includes which worker attended, when they arrived, when they left and what was done
Risk assessments and home safety notes about the place we support you
Billing and claim records, and bank or payment details for private services
Consent forms, complaints, feedback and your communication preferences
Interpreter, Auslan or communication support needs

We only collect what we need to deliver the support you have asked for and to meet our legal duties. If you would rather not give us something, tell us. We'll explain what we can still do without it, and what we can't.

Sensitive information and health information

The Privacy Act treats health information as sensitive information. Sensitive information also covers things like your racial or ethnic origin, religious beliefs, sexual orientation, criminal record and union membership. It gets stronger protection than ordinary personal information.

Most of what we hold about a participant is sensitive information. We use it only:

For the reason we collected it
For a closely related reason you would reasonably expect
With your consent
Where a law requires or allows it, or where there is a serious threat to someone's life, health or safety

How we collect it

We collect information from you first, wherever we can. We also collect it from other people involved in your support, with your consent or where the law allows. That can include your family, your guardian or nominee, your support coordinator, your plan manager, the National Disability Insurance Agency (NDIA), your GP, allied health providers, hospitals and previous providers.

When we collect information about you from someone else, we take reasonable steps to let you know.

Information we did not ask for

Sometimes information arrives that we did not ask for. A hospital sends a discharge summary for a person we do not support. A family sends a folder of reports before there is any agreement in place.

When that happens, we check whether we could have collected that information ourselves under this policy. If we could have, we handle it the same way as everything else described here. If we could not have, and no law requires us to keep it, we destroy it or de-identify it as soon as it is lawful and reasonable to do so.

Consent, guardians, nominees and supported decision-making

Many of the people we support make their own decisions. Some have someone appointed to help, or to decide for them. Some sit in between, and it can change from one week to the next. Here is how we handle it.

We start with you. We ask you first. We give you the information in a form you can use, and you get time to think. You can ask for plain words, Easy Read, pictures or an interpreter. Having a decision maker appointed does not mean you stop being asked.

We check appointments in writing. If someone else is going to make decisions or receive your records, we ask to see the paperwork. That might be:

A plan nominee or a correspondence nominee appointed by the NDIA under the NDIS Act
A guardian or an administrator appointed by VCAT (the Victorian Civil and Administrative Tribunal)
A supportive guardian or a supportive administrator
An attorney under an enduring power of attorney
A medical treatment decision maker under Victorian law
A parent or carer, where the participant is a child

We record who holds the appointment, what it covers and when it ends. We share your information with that person only as far as their appointment allows. Not every nominee is entitled to see everything, so we check the scope rather than assume it.

We record your views either way. Even where someone else can decide, we ask what you want and we write it down. It goes in your support plan. If your view and your decision maker's view are different, we record both, and we raise it with them. If we are worried a decision is not in your interest, we can raise it with the Office of the Public Advocate or the NDIS Commission.

You can bring anyone you like. A family member, a friend, an advocate. They do not need a formal appointment to sit with you and help you think. They cannot make decisions for you or receive your records unless you tell us they can, or unless they hold an appointment.

Consent can change. You can withdraw or narrow your consent at any time, and you do not have to give us a reason. If a guardianship or nominee arrangement starts, ends or changes, tell us. We will update our records and change who we share with.

Why we use your information

To deliver and coordinate the supports in your service agreement
To roster and match workers, and to tell you who is coming and when
To keep you, our workers and other people safe
To give medication, provide nursing care and respond in an emergency
To write the progress notes, reports and plans your supports require
To claim payment from the NDIA, your plan manager, or you if you are a private client
To record and respond to incidents, feedback and complaints
To meet our duties under the NDIS Act, the NDIS Practice Standards and the NDIS Code of Conduct, including audits
To review and improve our services and train our team, using de-identified information wherever we can
To answer your enquiry if you contacted us through this website or by phone

We may also use your information for a second reason that is closely related to the first, where you would reasonably expect it. For sensitive information, that second reason has to be directly related.

Who we share it with

We share your information in these situations, and no others.

Our support workers and registered nurses. They get the parts of your plan they need to do the shift safely, and no more. Basis: delivering the service you agreed to.
The National Disability Insurance Agency (NDIA). For plan, service booking, claiming and payment purposes. Basis: your service agreement and the NDIS Act.
The NDIS Quality and Safeguards Commission. For reportable incidents, complaints, restrictive practice reporting, worker screening matters and audits. Basis: our legal duties under the NDIS Act and the NDIS rules. Some of these reports are required by law, so we make them whether or not you consent, and we will tell you where we can.
Your support coordinator and your plan manager. Basis: your consent, recorded in your service agreement.
Allied health providers, your GP and others in your care team. Basis: your consent, or where the sharing is needed for your care and you would reasonably expect it.
Hospitals, ambulance and emergency services. Basis: your consent, or a serious threat to someone's life, health or safety where getting consent is not possible.
Your guardian, nominee or decision maker. Basis: their appointment, to the extent it covers.
Our software and IT providers. Client management, rostering, email, phone and backup services. They may only use your information to provide that service to us, and they are bound to keep it confidential.
Our auditors and insurer. Where it is needed for a registration audit or an insurance claim.
Police, courts, tribunals, a coroner, child protection or another agency. Where a law requires or authorises it.

We do not sell your information. We never use your health or disability information for marketing.

Marketing and how to opt out

We may send you news about our services by email, post or SMS. We only do that where you gave us your contact details and would reasonably expect to hear from us, or where you opted in. We do not use your health information, your disability information or your NDIS plan details to decide what to send you.

Every marketing email has an unsubscribe link. You can also email [email protected] or call 1300 815 471 and ask us to stop. We will action it, and we won't ask you why. Opting out of marketing never changes the supports you receive. Our contact lists are never sold, rented or swapped.

Our website, cookies and tracking

Our website hosting keeps standard server logs. These record things like your IP address, your browser and the pages you looked at. We use them for security and to keep the site working.

If you fill in our enquiry form, we receive the name, phone number, email address and message you type. It comes to our office inbox and we use it to reply to you.

Our site can store a small amount of information in your browser about how you arrived here, for example if you clicked one of our ads. This tells us which ads are worth running. You can clear it any time by clearing your browser data.

The site is set up to use website analytics and advertising tools, such as Google Analytics and the Meta pixel. When they are switched on, they set cookies (small files stored by your browser). They give us grouped numbers about how people find and use the site. If you send us an enquiry while they are on, your name, email and phone number are also used to match your enquiry to an ad click. That information goes to Google and Meta, who store it in the United States. You can block or delete cookies in your browser settings. The site still works if you do.

Sending information overseas

We do not send your support records, care records or health information overseas. Some of the software behind this website does store data outside Australia: our website form service, and, when they are switched on, our analytics and advertising tools (United States). Where that happens, we take reasonable steps to make sure the provider handles your information in a way consistent with the Australian Privacy Principles. Your support records, care records and health information are managed by our team here in Dromana.

Some of the everyday software we use, such as email and website services, is supplied by companies that may store data on servers outside Australia. Where that happens, we take reasonable steps to make sure the provider handles your information in a way consistent with the Australian Privacy Principles. If that ever changes in a way that affects your records, we will update this policy and tell you.

How we keep your information safe

Paper files are locked at our Dromana office
Digital records sit in password-protected systems, with access set by role. A support worker sees the parts of your plan they need for the shift, and no more
Every worker signs a confidentiality agreement and completes privacy training
Every worker in a role that requires it holds a current NDIS Worker Screening Check
We back up our systems, and we review who has access
When information is no longer needed, and no law requires us to keep it, we destroy it securely or de-identify it

If something goes wrong: data breaches

The Notifiable Data Breaches scheme sits in Part IIIC of the Privacy Act 1988. It applies to us. Here is what we do if your information is lost, or accessed or shared without permission.

We contain it straight away, and work out what happened
We assess it, and we finish that assessment within 30 days
If it is likely to cause you serious harm, we notify you and the Office of the Australian Information Commissioner as soon as practicable
We tell you plainly what happened, what information was involved, and the steps you can take
We fix the cause, record it, and review how it happened

If we cannot contact affected people directly, we will publish the statement on this website. Where the breach involves NDIS supports, we will also report it to the NDIS Commission.

How long we keep records

We keep records for as long as the law requires, then destroy or de-identify them safely.

Health records. The Health Records Act 2001 (Vic) requires us to keep health information for at least 7 years from the last time we provided a service to you. If the person was under 18 when we made the record, we keep it until they turn 25.
NDIS records. As a registered NDIS provider we must keep records of the supports we deliver, our incident records, our restrictive practice records and our claims. We keep these for at least 7 years from the date of the last entry.
Employment and worker records. Kept for the periods set by the Fair Work Act 2009 and related laws.

Retention runs from the last time we provided a service to you. Some records are kept longer where another law, an insurance requirement or a legal claim applies.

Seeing and correcting your information

You can ask to see the information we hold about you. That includes your support plan, your progress notes, your shift notes, your incident reports and your care records. You do not have to give a reason.

Ask us in writing, by email to [email protected] or by post to our Dromana office. If writing is hard, ring us. We can take the request over the phone and write it down for you.
You will need to show identification, so your records go to the right person.
You will have an answer within 30 days.
There is no fee to make a request. We may charge a reasonable amount for copying or postage if you want a large volume of material, and you will know the cost before we start.

There are limited situations where we can refuse access. The Privacy Act and the Health Records Act set them out. An example is where giving access would put someone's life or health at serious risk, or would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing, and how to complain about that decision.

If something we hold about you is wrong, out of date or incomplete, tell us and we will correct it. If we disagree with the change, you can ask us to attach your statement to the record, and we will. If we have already shared the wrong information with someone else, tell us and we will let them know it was corrected.

This policy in a format that works for you

You can ask for this policy in Easy Read or large print, or ask us to read it to you over the phone. Ring 1300 815 471 or email [email protected] and tell us what would work. If you need an interpreter or an Auslan interpreter, tell us and we will organise one for the conversation.

Complaints

If you are unhappy with how we handled your information, tell us first. We would rather hear it from you than not hear it at all.

Email [email protected], ring 1300 815 471, or write to the Privacy Officer at 329A Point Nepean Road, Dromana VIC 3936. Tell us what happened and what you would like us to do.
We will look into it, and you will get a written response within 30 days.
You can ask a family member, a friend or an advocate to complain for you. You can complain without giving your name, though that limits what we can do about it.
Making a complaint will never affect the supports you receive.

If you are not satisfied with our response, you can take a privacy complaint to the Office of the Australian Information Commissioner. Visit www.oaic.gov.au or call 1300 363 992. For health records held in Victoria, you can also go to the Health Complaints Commissioner Victoria on 1300 582 113.

Complaints about the quality or safety of your supports are different, and they go to the NDIS Quality and Safeguards Commission on 1800 035 544 or at www.ndiscommission.gov.au.

If you work with us or apply for a job

We collect what we need to employ you and roster you safely. That covers your contact details, your right to work, your qualifications, your NDIS Worker Screening Check, your police check where required, your bank and superannuation details, your availability, your shift records and any performance or incident records. We keep it for the periods required by employment law, and we share it only where the law requires or where it is needed to run the roster.

Changes to this policy

We review this policy from time to time. The current version is always on this page, with the date it was last updated at the top. If we make a change that affects how we handle participant information, we will tell participants and their nominees directly.

Contact us about privacy

Write to the Privacy Officer:

J&J Supports Pty Ltd, ABN 80 687 399 006
329A Point Nepean Road, Dromana VIC 3936
[email protected]
1300 815 471