This privacy policy explains how we handle personal and health information. It applies to participants, families, carers, guardians, referrers and anyone who contacts us or uses this website.
We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). As a provider of health services in New South Wales, we also follow the Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW). As a registered NDIS provider, we meet the privacy and record keeping rules of the NDIS Quality and Safeguards Commission.
You can read the Australian Privacy Principles on the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.
Who this policy covers
In this policy, "we", "us" and "our" means My Behaviour Support Pty Ltd (ABN 11 674 296 578). Our office is at Suite 6, Shops 10-11, 38 Exchange Parade, Narellan NSW 2567. We provide Positive Behaviour Support to NDIS participants across South West and Western Sydney.
Our contact details are at the end of this policy. You can ask us for a free copy of this policy in another format, such as a printed copy.
Personal information we collect
Personal information is information or an opinion about a person who is identified, or who can reasonably be identified. The information we collect depends on how you deal with us. It can include:
- Names, dates of birth, addresses, phone numbers and email addresses
- Contact details for family members, carers, guardians, Support Coordinators, plan managers and other providers
- Details of who can make decisions for a participant, such as a guardianship order
- Billing, invoicing and payment records
- Records of your contact with us, such as emails, messages and notes of phone calls
- For job applicants and staff, the information needed for recruitment, NDIS worker screening and employment
Health and other sensitive information
Health information is a type of sensitive information. The Privacy Act gives it extra protection. For a behaviour support provider, health information covers much more than a name and a diagnosis. It includes:
- Details about a participant's disability, diagnoses, health, medications and communication needs
- Information about behaviours of concern, triggers, risks and safety concerns
- Functional Behaviour Assessment reports, observation notes, interview notes and the results of assessment tools
- Interim and comprehensive Behaviour Support Plans, progress notes and review reports
- NDIS plan details, including your NDIS number, goals, funded supports, budgets and plan management arrangements
- Information about restrictive practices, including their use, their authorisation and our reports about them
- Incident records, including reportable incidents and the information we give the NDIS Commission about them
- Referral letters and reports from doctors, schools, allied health providers and other services
- Records of the services we provide, such as dates, times, locations and who was present
Sensitive information also includes information about racial or ethnic origin, religious beliefs, sexual orientation and criminal record. We only collect sensitive information that we need to provide our services. We collect it with consent, or where the law requires or allows it.
How we collect information
Where it is reasonable and practical, we collect information directly from you. We collect it in person, by phone, by email, through this website and during assessments and sessions.
We also collect information from other people when you agree, or when the law allows it. This includes family members, carers, guardians, Support Coordinators, schools, doctors, allied health providers, support workers and the NDIA.
Many referrals come from someone other than the participant. If you make a referral for someone else, please tell them (or their guardian) about the referral and this policy. When we receive information from a third party, we take reasonable steps to let the person know we have it.
Staying anonymous or using a different name
You can ask us a general question without telling us who you are. You can also use a different name for a general enquiry.
Due to the nature of the services we provide, it is generally impracticable for us to deal with individuals who have not identified themselves. Accurate identification is required to ensure the safety and continuity of support, to comply with our legal obligations as a registered NDIS provider, and to claim payment through the NDIS. For this reason, we cannot accept a referral or provide behaviour support to a person we cannot identify.
Information we did not ask for
From time to time, we may receive personal or health information that we did not solicit. Where we receive unsolicited personal information, we will promptly assess whether that information is of a kind we could have collected under our standard collection practices.
If we could have collected it, we handle it under this policy. If we could not, we destroy it or remove anything that identifies a person. We do this as soon as it is lawful and reasonable.
How we use your information
We use personal and health information to:
- Respond to enquiries and referrals
- Carry out Functional Behaviour Assessments and write Behaviour Support Plans
- Provide Family & Carer Training, Implementation & Review and work on Reducing Restrictive Practices
- Coordinate support with the people and services around a participant
- Prepare service agreements, invoices and NDIS claims
- Meet our legal, reporting and NDIS registration obligations
- Handle feedback, complaints and incidents, and improve our services
We may also use information for a related purpose that you would reasonably expect. For health information, that purpose must be directly related to why we collected it. Otherwise, we ask for your consent first, unless the law requires or allows the use.
Who we share information with
We share information when you agree, or when it is part of the service you would reasonably expect. We also share it when the law requires or allows it. We may share information with:
- The participant's support team, such as family, carers, guardians, support workers, schools and other providers, with consent
- Support Coordinators and plan managers
- The NDIA, for plan reviews, reports and payment claims
- The NDIS Quality and Safeguards Commission, as explained in the next section
- The NSW restrictive practices authorisation process, where a plan includes a regulated restrictive practice
- Service providers who help us run our business, such as our practice management, IT, email and website providers
- Government agencies, courts and police, where the law requires or allows it
We do not sell personal information. We do not share it with anyone for their own marketing.
NDIS reporting and the limits of confidentiality
We keep what you tell us confidential. As a registered NDIS provider, there are times when the law requires us to share information without consent. These limits apply to everyone we support:
- Reportable incidents. We must notify the NDIS Commission of reportable incidents. These include the death or serious injury of a participant, abuse or neglect, unlawful sexual or physical contact, and sexual misconduct.
- Restrictive practices. We lodge Behaviour Support Plans that include regulated restrictive practices with the NDIS Commission. The use of a restrictive practice without authorisation, or outside a plan, is a reportable incident. Providers who use regulated restrictive practices must also report their use to the NDIS Commission.
- Child protection. NSW law requires us to report a child or young person at risk of significant harm.
- Serious threats. We may share information to lessen or prevent a serious threat to a person's life, health or safety, or to public safety.
- Legal requirements. We must comply with subpoenas, court orders, warrants and other legal requests.
- Commission requests. The NDIS Commission can ask registered providers for information, such as during an audit or an investigation.
Restrictive practices are always a last resort. Our work aims to reduce them over time. Where it is safe and appropriate, we tell you before we share information under these rules.
NDIS numbers and government identifiers
We collect NDIS numbers so we can claim payment and work with the NDIA. We do not use an NDIS number, or any other government identifier, as our own way of identifying you. We only use or share these numbers where the law allows it, such as for NDIS claims.
Website forms, cookies and tracking
Forms on this website
- Contact form: collects your name, phone number, email address and message so we can reply to your enquiry. Your message is sent to our team by email.
- Referral and feedback forms: provided by Astalty, a practice management platform, and embedded on our referrals and feedback pages. What you enter goes directly to Astalty, which stores it for us.
Our contact form may also record how you found our website, such as the page or online campaign that brought you here. Your browser stores this for up to 30 days. We use it to understand which of our activities help people find us.
Cookies and tracking tools
The pages you visit on a health or disability website can reveal sensitive things about you. We take this seriously.
At the date of this policy, this website does not run any analytics or advertising tracking tools. That means no Google Analytics, no Google Tag Manager and no Meta Pixel. If we add a tracking tool in the future, it will only run after you give consent. We will update this policy first and name each tool.
The website may use essential cookies or browser storage that it needs to work, such as for form security. You can block or delete cookies in your browser settings. Some parts of the website may not work as intended if you do.
Direct marketing
We only send you marketing, such as news about our services or events, if you have given express consent. We never use health information to target marketing.
Every marketing email includes a simple way to unsubscribe. You can also ask us to stop at any time by phone or email. We act on your request promptly and at no cost to you.
Computer systems and automated decisions
We use software to store records, manage bookings and send invoices. A person makes every decision about a participant's assessment, Behaviour Support Plan and services. We do not use computer programs to make those decisions on their own.
Overseas disclosure
We do not send personal or health information to people overseas as part of our services.
Some of our service providers use cloud systems for practice management, email and website form delivery. These providers may store or process information outside Australia. Before we use a provider like this, we take reasonable steps to check it handles information in line with the Australian Privacy Principles. APP 8 requires this. Where the law needs your consent for a transfer, we ask for it first.
How we store and protect information
We store information electronically in secure systems, and in paper files where needed. We take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, change or disclosure.
These steps include password protected systems, access limited to staff who need it, staff privacy training and confidentiality agreements.
How long we keep records
The Health Records and Information Privacy Act 2002 (NSW) sets minimum retention periods for health information. For an adult, we keep health records for at least 7 years from the last time we provided a service. For information collected while a person was under 18, we keep it at least until they turn 25.
NDIS rules also require registered providers to keep certain records, including records about Behaviour Support Plans, restrictive practices and incidents, for at least 7 years. Where more than one rule applies, we keep the record for the longest period required.
Once a record is no longer needed or legally required, we destroy it securely. Or we remove anything in it that identifies a person.
Notifiable data breaches
We are bound by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suspect a data breach, we act quickly to contain it. We then assess within 30 days whether it is likely to cause serious harm.
If the breach is an eligible data breach, we notify the affected people and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. We tell you what happened, what information was involved and what steps you can take.
Access and correction
You can ask to see the personal and health information we hold about you. You can also ask us to correct it if it is wrong, out of date, incomplete or misleading. A guardian or other authorised person can ask on a participant's behalf.
Please contact us in writing. We may ask for proof of identity, or proof of your authority to act for someone, before we release anything. We aim to respond within 30 days.
There is no fee to ask for access. We may charge a reasonable fee to cover the cost of providing copies, and we tell you the amount first. In some cases the law allows us to refuse access. If we refuse, we tell you why in writing and how to complain.
We may not agree to a correction. If so, you can ask us to add a note to the record that says you believe it is wrong.
Privacy questions and complaints
If you have a question or a complaint about how we handle your information, please contact us first:
- My Behaviour Support Pty Ltd, ABN 11 674 296 578
- Suite 6, Shops 10-11, 38 Exchange Parade, Narellan NSW 2567
- [email protected]
- 0415 930 548
We will acknowledge your complaint and aim to respond within 30 days. If you are not happy with our response, you can contact:
- The Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at www.oaic.gov.au
- The NSW Information and Privacy Commission, for complaints about health information, on 1800 472 679 or at www.ipc.nsw.gov.au
- The NDIS Quality and Safeguards Commission, for concerns about NDIS services, on 1800 035 544 or at www.ndiscommission.gov.au
You can read more about how we handle feedback on our feedback and complaints page.
Changes to this policy
We may update this policy when the law or our practices change. The current version is always on this page, with the date it was last updated.