Endless PossAbilities Disability & Aged Care Services Pty Ltd is committed to protecting the privacy, dignity and confidentiality of every person who engages with our disability support, NDIS, community care and aged care services.
We understand that NDIS participants, families, carers, nominees, advocates and support networks trust us with sensitive information about their health, disability, personal circumstances and support needs. We take this responsibility seriously and aim to handle all personal information respectfully, securely, transparently and only for legitimate service-related purposes.
This Privacy Policy explains:
What personal and sensitive information we collect
Why we collect this information
How we use, store and protect information
When information may be disclosed
How participants can access or correct their records
How to make a privacy enquiry or complaint
How we respond to privacy incidents and data breaches
This policy applies to participants, prospective participants, family members, carers, authorised representatives, nominees, advocates, referrers, employees, contractors, volunteers, website visitors and other people who interact with us.
Endless PossAbilities Disability & Aged Care Services Pty Ltd is a family-operated disability and aged care provider delivering person-centred support services across Sydney.
Our services may include:
Assistance with employment and higher education
High-intensity personal care supports
Daily personal care and assistance
Transport and travel assistance
Community nursing care
Innovative community participation
Community-based activities
Children’s school holiday programs
Support planning and service coordination activities
Other disability and community care supports agreed with participants
We collect and use personal information only where it is reasonably necessary to understand a person’s needs, provide safe and suitable supports, meet our legal responsibilities and operate our organisation effectively.
We aim to manage personal and health information in accordance with applicable Australian privacy, disability and health information requirements, including:
The Privacy Act 1988 (Cth)
The Australian Privacy Principles
The Notifiable Data Breaches Scheme
The Health Records and Information Privacy Act 2002 (NSW)
The NSW Health Privacy Principles
The National Disability Insurance Scheme Act 2013
The NDIS Code of Conduct
Applicable NDIS Practice Standards and Quality Indicators
Applicable NDIS incident, complaints and record-management requirements
Other Commonwealth or NSW laws that apply to our services
Where different legal requirements apply, we will follow the requirement that provides the appropriate level of privacy protection and regulatory compliance.
Personal information is information or an opinion about an identified individual, or a person who can reasonably be identified from that information.
Personal information may include:
Full name
Residential or postal address
Email address
Telephone numbers
Date of birth
Gender or preferred pronouns
Emergency contact information
Identification documents
NDIS participant number
Medicare or healthcare details
Employment or education information
Financial, invoicing and payment information
Photographs, video recordings or audio recordings
Information about family members, carers or authorised representatives
Records of communications, enquiries, referrals and complaints
Some information we collect is classified as sensitive information and receives a higher level of protection.
Because we provide disability, personal care and community nursing services, we may need to collect sensitive and health information.
This may include information about:
A person’s disability, injury, illness or medical condition
Physical health and mental health
Medical history, diagnoses and treatment
Medications, allergies and healthcare requirements
Mobility, communication or cognitive support needs
Personal care and high-intensity support requirements
Behaviour support needs and behaviour support plans
Risk assessments and safety plans
Hospital admissions or healthcare appointments
Nursing assessments and clinical notes
Incidents, injuries and emergency events
Cultural background
Country of birth
Preferred language
Aboriginal or Torres Strait Islander status
Religious beliefs where relevant to support delivery
Dietary, cultural or personal preferences
Criminal history or worker screening information where legally required
Biometric information, photographs or recordings where authorised
Information about abuse, neglect, exploitation or safeguarding concerns
We will generally collect sensitive information with the individual’s consent or the consent of an authorised decision-maker, unless collection is required or authorised by law or is otherwise permitted in an emergency or serious safety situation.
The information we collect will depend on the person’s relationship with us and the services being requested or delivered.
We may collect:
Participant and referrer contact details
NDIS participant number and plan information
Plan management arrangements
Funding information
Service agreements
Support goals and desired outcomes
Requested services and preferred schedules
Details of current service providers
Support coordinator or plan manager details
Guardian, nominee, advocate or representative details
Communication and accessibility requirements
Interpreter requirements
Cultural and linguistic information
Emergency contacts
Consent forms and participant authorisations
We may collect:
Support plans
Personal care plans
Health management plans
Nursing and clinical records
Medication information
Mealtime management requirements
Manual handling and mobility information
Behaviour support plans
Risk assessments
Incident reports
Progress notes
Daily support records
Participant goals and progress
Community participation records
Transport and travel records
Appointment information
Feedback and complaints
Information supplied by healthcare professionals
For children participating in our school holiday programs or receiving other supports, we may collect:
The child’s name and date of birth
Parent or guardian contact details
Medical conditions and allergies
Medication requirements
Disability and support needs
Emergency contacts
Behavioural or communication needs
Dietary requirements
Activity permissions
Collection and drop-off authorisations
Photography or media consent
Information needed to provide safe and inclusive activities
For employees, applicants, contractors and volunteers, we may collect:
Contact and identity information
Employment history
Qualifications and professional registrations
References
Police checks
NDIS Worker Screening Check information
Working with Children Check information
Right-to-work information
Training and competency records
Payroll, superannuation and banking details
Health information relevant to workplace safety
Performance, conduct and incident records
When a person visits our website or submits an online form, we may collect:
Name
Phone number
Email address
Service required
Referral details
Information included in enquiry messages
IP address
Browser and device type
Website usage information
Pages visited
Date and time of access
Cookie and analytics information
People should only provide information through our website that is reasonably necessary for their enquiry or referral.
Where reasonable and practical, we collect personal information directly from the individual concerned.
We may collect information through:
Telephone conversations
Emails
Website enquiry forms
Referral forms
Face-to-face meetings
Participant intake and assessment processes
Service agreements
Consent forms
Support planning meetings
Progress notes and service delivery records
Incident and complaint reports
Surveys and feedback forms
Employment applications
Our website, cookies and analytics systems
We may also receive information from:
Parents, family members and carers
Guardians and nominees
Advocates and authorised representatives
Support coordinators
Plan managers
The National Disability Insurance Agency
The NDIS Quality and Safeguards Commission
Healthcare professionals
Hospitals and community health services
Allied health providers
Schools and educational organisations
Government departments
Other service providers
Emergency services
Referring organisations
When information is provided by another person, we will take reasonable steps to confirm that the person is authorised to provide it and that the participant has been informed where required.
We may collect, hold, use and disclose information to:
Respond to enquiries and referrals
Confirm a person’s identity
Assess support needs and service suitability
Develop individual support plans
Prepare and manage service agreements
Deliver safe, appropriate and person-centred supports
Provide personal care and community nursing
Support participant choice, control and independence
Communicate with participants and their representatives
Coordinate services with healthcare and allied health providers
Manage appointments, transport and community activities
Monitor participant progress and outcomes
Manage medications, health risks and emergency requirements
Prevent or respond to abuse, neglect, exploitation or harm
Manage incidents and reportable incidents
Process NDIS claims, invoices and payments
Communicate with plan managers and the NDIA
Manage complaints, feedback and service improvements
Conduct quality assurance, audits and compliance reviews
Meet NDIS registration or regulatory requirements
Train, supervise and manage workers
Maintain appropriate business and financial records
Meet insurance, legal and contractual obligations
Protect the rights, safety and wellbeing of participants and workers
Improve our services and internal systems
Manage recruitment and employment
Operate and improve our website
We will not use personal information for an unrelated purpose unless the person has consented or the use is required or authorised by law.
We support the right of participants to understand and control how their information is collected and used.
Before collecting sensitive information, we will take reasonable steps to explain:
What information is being requested
Why the information is needed
How it will be used
Who it may be shared with
Whether collection is required by law
What may happen if the information is not provided
How consent may be changed or withdrawn
Consent may be written, verbal or otherwise clearly communicated, depending on the circumstances and legal requirements.
Participants may withdraw or change their consent by contacting us. Withdrawal will not affect actions already taken with valid consent, and some information may still need to be retained or used where required by law.
Where withdrawing consent means we cannot safely or lawfully deliver a service, we will explain the consequences and discuss available options.
We aim to provide privacy information in a language, format and communication method that the participant is most likely to understand.
This may include:
Easy Read information
Plain English explanations
Interpreters
Visual or picture-based information
Additional time to consider decisions
Communication devices
Assistance from an advocate
Involvement of a guardian, nominee or authorised representative
We will involve the participant in privacy and consent decisions to the greatest extent possible, even where another person has legal authority to make decisions on their behalf.
We will verify the authority of guardians, nominees and representatives before disclosing personal information to them.
We take additional care when handling information about children and young people.
Depending on the child’s age, understanding and circumstances, consent may be obtained from:
The child or young person
A parent
A legal guardian
Another legally authorised representative
We will consider the child’s maturity, capacity, best interests, safety and right to participate in decisions affecting them.
Information about a child will only be shared with authorised people, service providers or authorities where necessary for safe service delivery, where consent has been provided or where disclosure is required or permitted by law.
We may disclose personal information where reasonably necessary to provide services, protect a person’s safety, meet legal requirements or operate our organisation.
Information may be disclosed to:
The participant’s authorised family members or carers
Guardians, nominees and advocates
Employees and support workers involved in service delivery
Community nurses and healthcare professionals
Allied health professionals
Support coordinators
Plan managers
The National Disability Insurance Agency
The NDIS Quality and Safeguards Commission
Hospitals and emergency services
Government departments and regulators
Schools or activity providers, where authorised
Auditors and quality assessors
Insurers
Lawyers and professional advisers
Financial and accounting providers
Information technology and cloud-service providers
Records-management and document-storage providers
Contractors who assist us in delivering services
We seek to limit disclosures to the minimum information reasonably necessary for the relevant purpose.
Our employees, contractors and service providers are expected to protect confidential information and only access information required for their authorised duties.
We may use or disclose information without consent where permitted or required by law, including where:
There is a serious threat to a person’s life, health or safety
Emergency medical assistance is required
We reasonably suspect abuse, neglect, exploitation or unlawful conduct
Mandatory reporting obligations apply
A reportable incident must be notified
A court, tribunal or law-enforcement authority lawfully requires information
Disclosure is necessary for an investigation
Disclosure is necessary to establish or defend a legal claim
The disclosure is otherwise authorised under applicable privacy or health information laws
Where possible and lawful, we will inform the affected person about the disclosure.
We will generally obtain consent before taking or using identifiable photographs, video recordings or audio recordings.
Consent will describe the intended purpose, which may include:
Participant records
Support planning
Progress monitoring
Incident investigation
Training
Program activities
Website or social media marketing
A participant’s decision not to consent to marketing photography will not affect their access to services.
Marketing images or testimonials will not be published without appropriate consent. A person may withdraw consent for future use by contacting us, although it may not always be possible to remove material that has already been lawfully printed, distributed or shared by third parties.
People may contact us anonymously or use a pseudonym when making a general enquiry, where practical.
However, we will generally need accurate identifying information to:
Complete participant intake
Verify NDIS funding
Provide disability or nursing supports
Manage health and safety risks
Respond to emergencies
Maintain service records
Process payments
Meet legal and regulatory requirements
We will explain when identifying information is required.
We may use contact information to provide service updates, program information or other communications where:
The person has consented
The person would reasonably expect the communication
The communication is otherwise permitted by law
People may opt out of marketing communications at any time by using the unsubscribe option or contacting us directly.
We will not sell participant contact information to third-party marketing organisations.
Our website may use cookies and similar technologies to support website functionality and understand how visitors interact with the website.
This information may include:
IP address
Browser type
Device information
Pages viewed
Time spent on the website
Referral source
General location information
Website analytics are generally used to improve website performance, accessibility and user experience.
Users may be able to control cookies through their browser settings. Disabling some cookies may affect website functionality.
Our website may contain links to external websites. We are not responsible for the privacy practices or content of external websites, and users should review the privacy policies of those organisations.
Some technology, email, data-hosting, software or cloud-service providers may store or process information using systems located outside Australia.
Before using third-party systems, we aim to consider their privacy, confidentiality and security arrangements.
Where personal information may be disclosed or accessed overseas, we will take reasonable steps required under applicable privacy laws to ensure that the information is handled appropriately.
Further information about relevant technology providers or overseas data arrangements may be requested from our Privacy Officer.
We take reasonable administrative, physical and technical measures to protect personal information from:
Misuse
Interference
Loss
Unauthorised access
Unauthorised modification
Unauthorised disclosure
Cybersecurity threats
Our safeguards may include:
Password-protected systems
Access controls based on worker roles
Secure cloud storage
Multi-factor authentication where available
Secure email and communication practices
Locked storage for paper records
Confidentiality agreements
Worker privacy and information-security training
Secure disposal processes
System backups
Software and security updates
Incident and data-breach response procedures
Regular review of access permissions
Monitoring and auditing of information-management practices
Only workers who require information to perform their duties should be permitted to access participant records.
Participants should understand that no method of electronic transmission or storage can be guaranteed to be completely secure. We will nevertheless take reasonable steps to reduce privacy and cybersecurity risks.
A data breach may occur when personal information is lost, accessed, disclosed or altered without authorisation.
If we become aware of a suspected privacy or data-security incident, we will take reasonable steps to:
Contain the incident and prevent further unauthorised access.
Investigate what information and individuals may be affected.
Assess the likely risk of harm.
Take remedial action where possible.
Notify affected individuals and relevant regulators where required.
Review the incident and improve our systems.
Where the Notifiable Data Breaches Scheme applies, we will assess whether the incident is likely to result in serious harm and notify affected individuals and the Office of the Australian Information Commissioner when legally required.
We may also notify the NDIS Quality and Safeguards Commission, the NDIA, law-enforcement authorities, insurers or other regulators where required or appropriate.
We take reasonable steps to ensure that personal information is accurate, complete, relevant and up to date.
Participants and representatives should tell us when information changes, including:
Contact details
Emergency contacts
Medical conditions
Medications
Allergies
Support needs
Guardianship or nominee arrangements
NDIS plan or funding information
A person may request correction of information they believe is inaccurate, incomplete, out of date, irrelevant or misleading.
We may need to verify the person’s identity before making a correction. Where we do not agree to a requested correction, we will explain the reason where required and may attach a statement to the record noting the person’s requested correction.
Individuals may request access to personal information we hold about them.
A request can be made by contacting our Privacy Officer using the contact details below.
We may ask for:
Proof of identity
Details of the information being requested
Evidence that a representative is authorised to act for the participant
Access may be provided through:
A copy of the relevant documents
Inspection of records
A written summary
An explanation of the information
Access through an agreed healthcare professional where appropriate
We will respond within applicable legal timeframes.
Access may be refused or limited where permitted by law, including where access would:
Create a serious threat to a person’s life, health or safety
Unreasonably affect another person’s privacy
Reveal confidential commercial information
Prejudice an investigation
Be unlawful
Relate to legal proceedings or anticipated legal proceedings
Be otherwise restricted under applicable privacy or health records legislation
Where access is refused, we will generally provide written reasons and information about available complaint options, unless it would be unlawful or inappropriate to do so.
A reasonable administrative fee may apply where permitted by law, but we will not charge for making an access request.
We retain participant information for as long as it is needed for service delivery, legal compliance, quality assurance, insurance, auditing and legitimate business purposes.
Where NSW health-record retention requirements apply, health information collected while a person was an adult will generally be retained for at least seven years from the last occasion on which a health service was provided.
Health information collected while a person was under 18 will generally be retained until the person reaches 25 years of age.
Some records may need to be retained for a longer period because of NDIS, taxation, employment, insurance, incident-management, safeguarding, contractual or legal requirements.
When information is no longer required and there is no legal requirement to retain it, we will take reasonable steps to securely destroy or permanently de-identify it.
Secure disposal may include:
Shredding paper records
Securely deleting electronic records
Destroying storage devices
Using approved confidential-waste services
We will maintain required records relating to the disposal or transfer of health information.
We may remove information that identifies an individual and use the remaining de-identified information for:
Service evaluation
Quality improvement
Staff training
Statistical reporting
Funding or regulatory reporting
Organisational planning
Research where legally permitted
We will take reasonable steps to reduce the risk that de-identified information could be linked back to an individual.
People have the right to raise concerns about how their personal information has been handled.
Privacy complaints may relate to:
Unauthorised access or disclosure
Inaccurate records
Failure to provide access
Inappropriate collection
Information being used for an unexpected purpose
Lost documents
Email or cybersecurity incidents
Photography or recording concerns
Failure to respect consent preferences
A complaint should include:
The person’s name and contact details
A description of what happened
Relevant dates
The information affected
The outcome being requested
Copies of relevant documents, where available
We will treat complaints respectfully and confidentially. Making a complaint will not negatively affect a participant’s access to services.
We will acknowledge the complaint, investigate the circumstances and aim to provide a response within 30 days. More complex matters may require additional time, and we will keep the complainant informed.
If a person is not satisfied with our response, they may contact:
The Office of the Australian Information Commissioner
The Information and Privacy Commission NSW
The NDIS Quality and Safeguards Commission, where the concern relates to NDIS services
Another relevant regulator or complaints body
For privacy enquiries, access requests, correction requests, consent changes or complaints, please contact:
Privacy Officer
Endless PossAbilities Disability & Aged Care Services Pty Ltd
Address: 13A Mort Street, Blacktown NSW 2148
Phone: 0415 055 651
Email: peter.tawdrous@hotmail.com
ABN: 24 690 139 783
Please write “Privacy Enquiry” or “Privacy Complaint” in the email subject line so your request can be directed appropriately.
We may update this Privacy Policy when our services, information-management systems, legal obligations or regulatory requirements change.
The current version will be published on our website with the date of the latest update.
We encourage participants, families, representatives, employees and website visitors to review this policy periodically.
