Privacy Policy

1. About this policy

Experience Life (ABN 12 687 887 276) is committed to protecting your privacy. We are an incorporated association, an ACNC-registered charity, and a registered NDIS provider. We have supported Victorians living with disability since 2006, providing one-on-one disability support in Melbourne's Eastern, Metro and South Eastern suburbs, and the Bass Coast.

This policy explains how we collect, use, store, disclose and protect personal information - including sensitive information such as health and disability information. It applies to information collected through our website and our enquiry and referral channels, and in the course of providing support services.

We handle personal information in accordance with:

the Privacy Act 1988 (Cth) and the Australian Privacy Principles;
the Health Records Act 2001 (Vic) and the Victorian Health Privacy Principles; and
our obligations as a registered provider under the National Disability Insurance Scheme Act 2013 (Cth), the NDIS Practice Standards and the NDIS Code of Conduct.

2. Your consent, and your right not to identify yourself

When we collect your personal information, we will discuss this policy with you and ask for your consent. You have the right not to identify yourself when you first approach us, and you may ask us to deal with you using a pseudonym. In either case the level or type of service we can offer may be limited, and you may be asked to repeat information you have given before.

3. What we collect

When you make an enquiry: your name, email address, phone number, and whatever you tell us by phone or email.

When you make a referral by phone or email: the participant's name, contact details, date of birth, NDIS participant number, plan details, the supports being sought, and the health, disability and care information we need to work out whether we can meet those needs safely. We may also collect the referrer's name, organisation, role and contact details.

When we deliver support: care and support plans, medication information, emergency contacts, and records of support provided.

Automatically, when you use our website: technical information such as your IP address, browser and device type, the pages you visit and the site you arrived from. See section 9.

Much of what we hold is sensitive information under the Privacy Act and health information under the Health Records Act. We collect it only where you or your authorised representative have consented and it is reasonably necessary, or where the law requires or authorises us to. We apply a higher level of protection to it.

4. How we collect it

We collect information in a respectful, lawful and non-intrusive way. Wherever reasonable and practicable we collect it directly from you. Where we receive information about you from a third party - a support coordinator, family member, guardian, health professional or the NDIA - we will tell you that we have.

5. How we use it

to respond to your enquiry;
to assess a referral and decide whether we can meet the support needs described;
to plan, coordinate and deliver one-on-one support;
to roster and brief the support workers who will be working with you;
to communicate with you, your nominated representatives and your support network;
to meet our obligations to the NDIA and the NDIS Quality and Safeguards Commission, including claiming, billing and reporting;
to keep records, manage quality and safety, and handle complaints and incidents; and
to meet our legal and regulatory obligations.

We also use de-identified information for service planning, quality improvement and reporting to funding bodies. Because it cannot identify you, we do not seek separate consent. If you would prefer your de-identified data not to be used this way, contact us.

6. When we disclose it

Personnel involved in your care and support will access your personal information. Some administrative staff may need access in the course of their duties, limited to what is relevant. Beyond that, we do not disclose your personal information unless: you have consented; you would reasonably expect it; it is required or authorised by law; it will prevent or lessen a serious threat to somebody's life, health or safety; or it is reasonably necessary for a law enforcement function.

Organisations we may disclose information to include:

the National Disability Insurance Agency - section 55(1) of the NDIS Act gives the NDIA power to require information relevant to its functions;
the NDIS Quality and Safeguards Commission, for compliance, incident and complaint purposes;
Victorian government departments that fund our services, including the Department of Health and the Department of Families, Fairness and Housing;
other providers and health professionals involved in your support, where you have consented or it is necessary for your care; and
contracted providers who help us operate - IT, website hosting and software providers - under confidentiality obligations.

Information may be shared without consent to assess or manage family violence risk, or to promote the wellbeing or safety of a child, under the Family Violence Protection Act 2008 (Vic) and the Children Legislation Amendment (Information Sharing) Act 2018 (Vic).

We do not sell your personal information, and we do not disclose it for third-party marketing. Our website is hosted by Wix, which processes website data in Israel and may transfer it to Wix entities and service providers in other countries for storage and service delivery. The website also loads fonts from Google, which means a visitor's browser may send technical information such as an IP address and the page URL to Google for that purpose. These providers may process information outside Australia.

7. Keeping it accurate

We take reasonable steps to keep the information we hold accurate, complete and up to date. Please tell us when your details change.

8. Storing it securely

We take reasonable steps to protect personal information from loss, misuse and interference, and from unauthorised access, modification or disclosure - including password protection and encryption of digital records, physical access restrictions on paper files, and access controls and monitoring on our systems. Only personnel whose duties require access to participant records are authorised to have it.

We keep personal information only as long as it is needed for the purposes in this policy or as required by law, including NDIS record-keeping requirements. After that we destroy or de-identify it securely.

Information stored or accessed overseas

Experience Life may use third-party service providers, including cloud-based software and data-storage providers, whose servers or support services are located outside Australia. As a result, personal and sensitive information may be stored, processed or accessed overseas.

Where personal information is disclosed overseas, Experience Life will take reasonable steps to ensure the information is handled securely and in accordance with the Australian Privacy Principles.

If something goes wrong

If a data breach occurs that is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.

9. Cookies and analytics

Our website uses cookies and similar technologies so the site works and so we can understand how visitors use it. These may collect your IP address, device and browser information, and the pages you visit. We use this information in aggregate to improve the website. You can control or block cookies through your browser settings, though parts of the site may not work as intended if you do.

10. Direct marketing

We will only send you information about our services where the law permits it and you would reasonably expect it, or where you have consented. You can opt out at any time.

11. Accessing and correcting your information

You can ask us for access to the personal information we hold about you, and we will provide it on request. We will need proof of identity first. We may not be able to give you information that relates to other people, or that the law exempts from disclosure. If we decline, we will tell you why and explain how to seek a review.

You can also ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. Please make correction requests in writing. If we do not agree to make the change, you may give us a statement of your view and we will attach it to the record.

12. Complaints

If you think we have mishandled your personal information, please tell us. We will acknowledge your complaint within five working days and give you a written response within 20 working days. If we need longer to investigate properly, we will discuss that with you.

If you are not satisfied with our response, you can escalate to:

the Office of the Australian Information Commissioner - oaic.gov.au, 1300 363 992;
the Office of the Victorian Information Commissioner - ovic.vic.gov.au, 1300 006 842;
the Health Complaints Commissioner (Victoria) - hcc.vic.gov.au, 1300 582 113; or
the NDIS Quality and Safeguards Commission - ndiscommission.gov.au, 1800 035 544.

You do not have to complain to us first, and using our complaints process will never affect the support you receive.

13. Contact us

Privacy Officer: Chelsea Thorne
Experience Life · ABN 12 687 887 276
Email: contact@experiencelife.com.au
Phone: 1300 507 994

14. Changes to this policy

We review this policy periodically and may update it. The current version is always available on this page.