Privacy Policy

This Privacy Policy (Policy) explains how Positive Moods Pty Ltd, NDIS Registered Provider number 405 004 8643 (Positive Moods, We, Us or Our), collects, holds, uses and discloses your Personal Information when you interact with Us, including through our website at www.positivemoods.com.au, our services, and our other channels of communication.

Positive Moods provides NDIS supports including Improved Daily Living, Positive Behaviour Support and Psychological Assessments. Because of the nature of these services, We often collect sensitive information, including health and disability-related information, about the people We support. We are committed to protecting the privacy of participants, families, representatives, staff and other individuals who interact with Us, and to being transparent about how We handle that information.

Privacy Legislation means, as applicable, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the National Disability Insurance Scheme Act 2013 (Cth) and associated NDIS Practice Standards, any applicable Australian state or territory privacy or health records law, and any legislation that replaces or supplements those laws.

In this Policy, Personal Information and Sensitive Information have the meanings given to them in the Privacy Legislation. Broadly, Personal Information is information about an identified or reasonably identifiable individual, and Sensitive Information is a subset of that which includes health information, disability status, and similar categories requiring extra protection.

This Policy applies to all individuals who interact with Positive Moods, including current and prospective NDIS participants, their families, guardians and authorised representatives, support coordinators and plan managers, referrers, employees, contractors, job applicants, and visitors to Our website.

We may update this Policy from time to time to reflect changes in Our practices or Our legal obligations. The current version will always be available on Our website. If you would like a copy sent to you, or have questions about this Policy, please contact Us using the details in clause 15.

The type of Personal Information We collect depends on the nature of your relationship with Us. We only collect Personal Information that is reasonably necessary for Our functions or activities, or where We are otherwise required or authorised by law to collect it.

Depending on the reason for collection, the information We collect may include:

• your name, date of birth, contact details and preferred method of communication;
• your NDIS participant number, plan details, and funding or plan management arrangements;
• Sensitive Information such as health information, diagnoses, disability, behavioural, medical and psychological information relevant to your support needs and goals;
• information about your family, carers, guardians, next-of-kin and support network;
• details of your support coordinator, plan manager, treating practitioners and other service providers;
• payment, invoicing and banking details;
• information contained in referral forms, assessments, service agreements, case notes and feedback;
• for employees, contractors and applicants: qualifications, work history, National Police Check and Working with Children/NDIS Worker Screening results, tax and superannuation details; and
• usage data from Our website, including IP address, browser and device information, pages visited, and referring websites.

Wherever reasonable and practicable, We collect Personal Information directly from you, or from your parent, guardian or authorised representative where you are a child or otherwise unable to provide it yourself.

We collect Personal Information only by lawful and fair means, including via Our referral form, telephone, email, in person during assessments and service delivery, and through Our website.

We may also collect Personal Information from third parties, including:

• the National Disability Insurance Agency (NDIA) or NDIS Commission;
• support coordinators, plan managers, referrers and other treating professionals, with your consent;
• family members, carers or representatives acting on your behalf; and
• publicly available sources, where appropriate.

Our website uses cookies and similar technologies to operate the site, remember preferences, and understand how visitors use Our website. You can adjust your browser settings to block or delete cookies, though this may limit some website functionality.

We generally obtain your consent, or the consent of your guardian or authorised representative, before collecting Sensitive Information. Consent may be given in writing (including via a signed service agreement or consent form), orally, or implied through your conduct in engaging with Our services.

You are not required to provide the Personal Information We request. However, if you choose not to provide it, We may be unable to assess your needs or deliver some or all of Our services to you.

If We receive Personal Information We did not request and determine We have no need for it, We will destroy or de-identify that information as soon as practicable, provided it is lawful and reasonable to do so.

We use your Personal Information to:

• assess your eligibility for, and deliver, Our NDIS supports, including Improved Daily Living, Positive Behaviour Support and Psychological Assessments;
• develop, implement and review support and behaviour support plans and clinical documentation;
• communicate with your support coordinator, plan manager, guardian, treating team and other relevant parties involved in your care, with your consent;
• process payments, invoices and NDIS claims;
• comply with reporting obligations to the NDIS Commission and other regulators;
• manage staffing, rostering and supervision of the practitioners supporting you;
• respond to enquiries, feedback and complaints;
• improve the quality and safety of Our services; and
• meet Our legal, regulatory and insurance obligations.

We only use or disclose your Personal Information for the purposes described above, purposes you would reasonably expect, purposes you have consented to, or purposes required or authorised by law.

If you have any concerns about how We are using your Personal Information, please contact Us using the details in clause 15.

We hold Personal Information in secure electronic client management and case-note systems, and, where necessary, in paper files stored in secure offices.

We take reasonable technical and organisational steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure, including access controls, staff confidentiality obligations and secure hosting arrangements.

We take reasonable steps to ensure Personal Information We hold is accurate, up to date and complete. We retain Personal Information only as long as necessary to fulfil the purpose for which it was collected, or as required by NDIS record-keeping obligations and other applicable law, after which it is securely destroyed or de-identified.

Any online account you hold with Us is password protected. You must not share your password with anyone, and We will never ask you for your password by phone or email.

You, or your authorised representative, may request:

• confirmation of the Personal Information We hold about you;
• access to that Personal Information; or
• correction of that Personal Information,

by contacting Us using the details in clause 15.

We will respond within a reasonable period, and within any timeframe required by the Privacy Legislation. Urgent requests should include the reason for urgency.

We may ask you to verify your identity before providing access. We will generally grant access unless a permitted exception applies, for example where access would unreasonably impact the privacy of others, or is not permitted by law. If We refuse access, We will explain why.

We engage reputable third-party service providers to support Our operations, such as client management software, IT and hosting providers, payment processors and communication platforms. We take reasonable steps to ensure these providers handle your Personal Information appropriately and only for authorised purposes.

Some of Our third-party service providers may store or process Personal Information outside Australia. Where this occurs, We take reasonable steps to ensure the overseas recipient handles your information consistently with this Policy and the Privacy Legislation, unless an exception applies. Where practicable, We will identify the likely location of overseas recipients on request.

We do not sell your Personal Information to any third party.

We will only send you marketing communications about Our services where We have your consent, or are otherwise permitted by law. You can opt out at any time by contacting Us, using the unsubscribe facility in Our electronic messages, or advising Us directly.

Even if you opt out of marketing, We may still send you service-related communications necessary to deliver Our services to you, such as appointment reminders and important updates.

We do not use your Sensitive Information for direct marketing purposes.

If We become aware of unauthorised access to, or loss of, your Personal Information, We will assess and contain the incident and take steps to remediate it. Where required under the Notifiable Data Breaches scheme, We will notify affected individuals and the Office of the Australian Information Commissioner (OAIC). Further information is available at oaic.gov.au/privacy/notifiable-data-breaches.

Many people We support are children, or adults who rely on a guardian or authorised representative to make decisions on their behalf. Where you are unable to provide informed consent yourself, We will seek consent from, and communicate with, your parent, guardian or authorised representative in relation to your Personal Information.

We take extra care with Personal Information about children and people with additional support needs, and only collect, use and disclose it as reasonably necessary to deliver safe and effective supports, or as required by law.

If you have a complaint about how We have collected or handled your Personal Information, please contact Us using the details in clause 15. We take privacy complaints seriously and will aim to respond within 7 days of receiving your complaint.

If you are not satisfied with Our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or to the NDIS Quality and Safeguards Commission at ndiscommission.gov.au.