Privacy Policy

1. About This Policy

ThriveAssist Solutions Pty Ltd (ABN 61 681 022 999) ("we", "us", "our") is committed to protecting the privacy of personal information we collect, hold, use, and disclose. This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

As a provider of disability support services under the National Disability Insurance Scheme (NDIS), we are bound by the NDIS Code of Conduct and comply with the NDIS Act 2013 (Cth) in relation to information privacy and confidentiality. While we are not a registered NDIS provider, we deliver services to plan-managed and self-managed participants and uphold the same standards of care and privacy.

2. Information We Collect

We may collect and hold the following types of personal information:

• Identity information: name, date of birth, address, phone number, and email address
• NDIS plan details: NDIS participant number, plan dates, funding categories, and plan manager or support coordinator details
• Health and disability information: medical conditions, support needs, behavioural support plans, allied health reports, and medication details (classified as "sensitive information" under the Privacy Act)
• Service records: support notes, incident reports, progress records, and shift logs
• Financial information: bank details for invoicing, NDIS claiming records
• Emergency contacts and nominee/guardian details
• Website enquiry information: any information you provide through our online contact form

3. How We Collect Information

We collect personal information:

• Directly from you (or your nominee, guardian, or plan manager) when you enquire about or commence services
• From the NDIS (including via the NDIS portal and plan documentation)
• From other service providers with your consent (such as allied health professionals, hospitals, or support coordinators)
• Through our website contact form
• Through telephone and email communications

We will only collect sensitive information (such as health information) with your express consent, unless the collection is required or authorised by law or is necessary to prevent a serious threat to life, health, or safety.

4. How We Use Your Information

We use personal information for the purposes for which it was collected, including:

• Providing, coordinating, and managing your disability support services
• Developing and reviewing your individual support plan
• Invoicing and claiming through the NDIS
• Meeting our legal, regulatory, and contractual obligations (including NDIS reporting and auditing requirements)
• Responding to your enquiries and communicating with you about your services
• Internal training, quality improvement, and incident management
• Protecting the safety and wellbeing of participants, staff, and the community

5. Disclosure of Your Information

We may share your personal information with:

• The National Disability Insurance Agency (NDIA) for the purposes of plan management and claiming
• Your plan manager or support coordinator (where applicable)
• Other service providers involved in your care, with your consent
• Government agencies where required or authorised by law (e.g. mandatory reporting obligations)
• Our professional advisors (e.g. legal, accounting, insurance) under strict confidentiality obligations

We will not sell, rent, or trade your personal information to third parties for marketing purposes. We do not disclose personal information to overseas recipients unless required by law or with your explicit consent.

6. Storage and Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:

• Secure electronic storage with access controls and encryption
• Physical security of paper records (where applicable)
• Staff training on privacy and confidentiality obligations
• Restricting access to personal information to authorised staff on a need-to-know basis

We retain personal information for the period required by law. Under NDIS record-keeping requirements, participant records are generally retained for a minimum of 7 years after the last service was provided (or until the participant turns 25 if they were a child at the time of service, whichever is longer).

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading
• Withdraw consent for the collection or use of your information (noting this may affect our ability to provide services)
• Make a complaint if you believe we have breached the APPs

To exercise any of these rights, please contact our Privacy Officer using the details below. We will respond to access and correction requests within 30 days.

8. Website and Cookies

Our website may use essential cookies to ensure basic functionality. We do not currently use tracking cookies or third-party analytics that collect personal information. If this changes in the future, we will update this policy and implement appropriate consent mechanisms.

Our website is hosted via Cloudflare, which may collect limited technical data (such as IP addresses) for security and performance purposes. Please refer to Cloudflare's Privacy Policy for details.

9. Complaints

If you believe we have breached your privacy, you may lodge a complaint using the contact details below or through our Complaints & Feedback process. We will investigate all complaints and respond within 30 days.

If you are not satisfied with our response, you may escalate your complaint to:

• The Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au | Phone: 1300 363 992
• The NDIS Quality and Safeguards Commission — www.ndiscommission.gov.au | Phone: 1800 035 544