Our Privacy Policy

1. Purpose and scope

Renee provides supports and services to people with disability, and holds personal information about the people it works with as a routine part of that work. This policy sets out how we collect, use, store, share and protect that information, so that clients can trust us with it and understand the choices they have.

This policy applies to everyone who works for Renee — employees, contractors and volunteers — and to every current, past or prospective client, along with their families, carers and authorised representatives.

2. Why privacy matters here

People accessing disability supports can be more exposed to harm than the general community if their personal information is mishandled. For that reason, anyone at Renee who has access to client records is treated as occupying a risk-assessed role under the NDIS Practice Standards.

The most significant risk is unauthorised access to client information — for example, records being viewed, copied or shared by someone who has no legitimate reason to see them. A second, quieter risk is accidental disclosure: information shared informally through a work phone or app, mentioned to a colleague on the assumption it’s already public, or made identifiable through a photo or post on social media.

We reduce these risks by training workers on their privacy obligations from induction onward, applying clear rules about how information is collected and stored, and actively encouraging clients to speak up if they have concerns about how their information is being handled.

3. Key terms

4. Our commitment

Renee is committed to handling personal information openly and responsibly, and to meeting our obligations under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). Where state or territory health records legislation also applies, we meet the higher of the applicable standards.

5. Collecting information

Where information comes from

We collect personal information:

• directly from the client, in person, by phone, or in writing;
• from third parties such as treating doctors, allied health providers, support coordinators, or government agencies;
• through referrals from another service or organisation; and
• from information that is already publicly available.

Collecting sensitive information

Sensitive information is only collected with the client’s consent, unless the law requires or permits us to collect it without consent — for example, where a court order applies or where collection is necessary to prevent a serious threat to someone’s life or health. When we do collect it, we do so fairly, transparently, and only to the extent it’s genuinely needed to deliver or manage a client’s supports. Where it’s practical and lawful, clients can also choose to interact with us without providing their identity.

6. How we use information

We use client information to:

• assess a person’s support needs and provide services accordingly;
• administer, coordinate and improve the supports we deliver;
• meet our reporting obligations to the NDIS Commission and other regulators;
• contact a family member, carer or representative where this is necessary or requested; and
• contribute, with consent, to quality improvement activities or research.

7. Consent

Before or at the point of collecting personal information, workers will explain to the client:

• that their information is being collected, and why;
• who is likely to see or use it;
• that they can ask to access or correct their information; and
• how to raise a concern or make a complaint about how it’s handled.

Every client is asked to complete a Client Consent Form when they start receiving supports from us. Signed forms are kept on the client’s file, with access limited to staff who need it to do their job. Where we want to use information for a specific purpose beyond routine service delivery — such as photos for marketing, or documentation for an audit — we ask for separate, specific consent.

8. Storing and protecting information

We take reasonable steps to protect the personal information we hold from loss, misuse, unauthorised access, and improper disclosure or alteration. This includes physical safeguards for paper records and technical safeguards — such as access controls and secure systems — for electronic records.

Information is kept only for as long as it’s needed for the purpose it was collected, required by law, or relevant to a legal proceeding. Once none of these apply, records are securely destroyed or de-identified. Client files follow a defined archiving schedule so they remain confidential throughout their life, including at the point of destruction.

If a privacy breach occurs — for example, a lost device, stolen laptop, or unauthorised system access — the worker who becomes aware of it must notify their supervisor immediately, who escalates it to the Director for urgent action. See section 13 for our data breach response process.

9. Sharing information

We don’t disclose a client’s personal information except where doing so protects the client or others, is necessary to deliver a good standard of service, or is required by law. Depending on the circumstances, this may mean sharing information with:

• treating doctors, allied health practitioners, or other services supporting the client;
• a person responsible for the client — such as a guardian, next of kin, or carer — where the client is unable to give or communicate consent;
• an authorised representative, such as a legal adviser;
• our professional advisers, including auditors;
• government or regulatory bodies, such as the NDIS Commission or the Australian Taxation Office; and
• researchers, where the information supports public health or safety and appropriate protections are in place.

Wherever practical, information shared for these purposes is de-identified first.

10. Accessing and correcting your information

Clients (or their authorised representative) can request access to the personal information we hold about them, subject to any exceptions permitted by law. Requests can be made verbally or in writing, and should specify what information is being requested and how the client would prefer to receive it. Requests should be directed to:

24 Barton St Blairgowrie VIC 3942 Australia
[email protected]
+61 495 035 533

The Director will consider each request, including whether any lawful exception applies, and will respond within 30 days. If access is declined, we’ll explain why in writing and outline how the client can complain or appeal. Where access is granted, we’ll contact the client within 30 days to arrange it. If we can’t provide the information in the format requested, we’ll work with the client on a suitable alternative. Reasonable costs of retrieving and providing the information may be passed on.

11. Keeping information accurate and current

We review and update client information whenever we review a client’s service, or when a client or another stakeholder tells us something has changed. Correcting inaccurate information is always free of charge. Where we’ve previously shared a client’s details with another organisation and the client asks us to notify them of a correction, we’ll take reasonable steps to do so.

12. Feedback and complaints

Questions or concerns about how we handle personal information should be raised with the Director in the first instance, by email or phone:

[email protected]
+61 495 035 533

We treat every privacy-related complaint as a major complaint and manage it in line with our Feedback and Complaints Policy and Procedure. We may contact the person who raised the complaint to gather more information as part of our review.

If someone isn’t satisfied with how we’ve handled their complaint, they can also raise it with the Office of the Australian Information Commissioner (OAIC):

• Post: GPO Box 5218, Sydney NSW 2001
• Phone: 1300 363 992
• Web: oaic.gov.au

13. Responding to a data breach

Where a breach involves personal information and is likely to result in serious harm — physical, psychological, financial or reputational — we are required to report it to the OAIC. Any worker who suspects a breach has occurred must tell their supervisor immediately; the supervisor is responsible for escalating it to the Director without delay, so the breach can be contained and assessed.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The most current version will always be available on our website and from the Director on request.