People tell us things about themselves at some of the hardest moments of their lives. We treat that as a responsibility, not paperwork.
This policy explains what personal information Good Works Support Work collects, why we collect it, how we look after it, and what rights you have over it. It applies to this website and to the support we deliver.
We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the NDIS Act 2013, and the NDIS Practice Standards. Charles Barker is our Privacy Officer and is responsible for privacy across the business.
If you submit a referral through our website, we collect only what we need to respond to it:
You do not have to fill in every field. Only a handful are required, because we would rather start a conversation than turn someone away over a form.
If you are referring someone else, please only share what they would be comfortable with you sharing. We will always confirm consent with the participant before we go any further.
If a referral becomes an ongoing support relationship, we collect more, because safe and useful support depends on it:
We collect this directly from the participant wherever possible. Where it comes from a support coordinator, family member, carer or another provider, it is collected with the participant's knowledge and consent. At intake, we explain what we collect and why, in plain language, and we are happy to go through it as many times as it takes.
We use personal information to plan and deliver support in line with a participant's goals, to keep people safe, to meet our obligations under the NDIS Practice Standards and Australian law, and to coordinate with other providers where the participant has agreed to that.
We do not sell personal information. We do not use it for marketing. We do not use it for anything a participant has not agreed to.
Digital records are kept on encrypted, password-protected devices and in secure cloud storage with two-factor authentication, accessible only to authorised workers, with devices set to lock automatically after inactivity. Participant information is never kept in personal email accounts, unencrypted apps, or on shared or public devices. Where a cloud provider stores data outside Australia, we choose providers with appropriate security certification, consistent with Australian Privacy Principle 8.
Paper records, where they exist, are stored securely, never left unattended in a public or shared space, and securely destroyed once they are no longer needed.
We keep participant records for a minimum of seven years from the date of last service, as NDIS requirements set out, and then securely delete or destroy them.
We do not disclose personal information to anyone else without explicit consent, except where the law requires or permits it. At intake, participants tell us who, if anyone, we may share information with, and they can give, update or withdraw that consent at any time. Withdrawal takes effect immediately, other than for a disclosure already underway. If someone contacts us asking about a participant, we share nothing until we have confirmed current consent.
We may disclose information without consent only where:
In those situations we share only what is strictly necessary, and nothing more.
Running a website and a referral form means a small number of third parties handle information on our behalf:
These providers are bound by their own privacy and security obligations. We have chosen each of them deliberately, and we keep the number of them small on purpose.
This website does not set advertising cookies or track you across other websites. If we introduce website analytics or advertising tools in future, we will update this policy before doing so and describe clearly what is collected.
Your browser can block or delete cookies at any time through its settings, and this website will continue to work normally if you do.
You can ask to see any personal information we hold about you, at any time. You can ask us to correct anything that is wrong, incomplete or out of date. Requests can be made verbally or in writing, there is no fee, and we will respond promptly.
You never have to explain why you want to see your own information. It is yours.
If you think we have not handled your privacy properly, please tell us. You can raise it directly with Charles Barker, and we will take it seriously and respond promptly, in line with our Complaints and Feedback Policy. Raising a concern will never affect the support you receive.
You can also complain to the Office of the Australian Information Commissioner at any time, at www.oaic.gov.au or on 1300 363 992. You do not need to come to us first.
If personal information is ever compromised, we will act immediately to contain it, assess what happened and who is affected, notify affected people as soon as practicable, and report to the Office of the Australian Information Commissioner within 30 days where the breach is likely to cause serious harm, in line with the Notifiable Data Breaches scheme. We document every breach and what we did about it.
Charles Barker, Privacy Officer
Phone 0458 261 014
Email charles@goodworkssupportwork.com
This policy is reviewed every year, and sooner if there is a privacy breach, a change in the law, or an update to the NDIS Practice Standards.