Privacy Policy

Who this policy applies to

This policy applies to Nova Cares, our employees, support workers, contractors and volunteers. We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the NDIS Act 2013 and the NDIS Practice Standards, along with state and territory health records laws.

Information we collect

• Your name, date of birth, contact details and NDIS participant number.
• Your NDIS plan, goals, funding details and service agreements.
• Health and disability information — diagnoses, medications, allied health reports, behaviour support plans and risk assessments.
• Details of the supports we deliver: shift notes, progress notes, incident records and feedback or complaints.
• Contact details for nominees, guardians, family, carers and other providers you ask us to work with.
• Payment and plan management details needed to claim through the NDIS or invoice a plan manager.

How we collect it

Usually directly from you or your nominee — by phone, email, our referral form, or in person during intake and reviews. With your consent we may also collect information from the NDIA, a support coordinator, a plan manager, a hospital, a treating practitioner or a previous provider.

Why we use it

• To assess a referral and decide whether we can safely meet your needs.
• To plan, deliver, review and improve your supports.
• To roster and brief the workers who support you.
• To claim payment for services and keep accurate financial records.
• To meet our legal duties — NDIS Commission reporting, reportable incidents, worker screening, audits, and work health and safety obligations.

Sharing your information

We only share your information with your consent, or where the law requires or permits it. That may include the NDIA or NDIS Quality and Safeguards Commission, your plan manager or support coordinator, allied health or medical practitioners involved in your care, emergency services, and independent auditors bound by confidentiality. We never sell your information, and we do not disclose it overseas without telling you first.

When we may share without consent

• To lessen or prevent a serious threat to life, health or safety.
• Where there is a mandatory reporting duty, such as suspected abuse or neglect.
• Where a court, tribunal or regulator lawfully requires it.

Keeping it safe

Records are held in access-controlled, encrypted systems hosted in Australia. Access is limited to workers who need it for your supports. Paper records are kept in locked storage. All workers sign confidentiality agreements and complete privacy training. We keep participant records for at least seven years — or, for a child, until they turn 25 — then securely destroy them.

Our website, accounts and stored documents

• Cookies and local storage: we use only what is needed to keep you signed in and remember accessibility settings (such as text size). We do not use advertising cookies or sell your information.
• Sign-in: if you sign in with email or Google, we receive your name and email address to create your account.
• Forms and uploads: referrals, complaints, service agreements and worker documents are stored in secure, private storage in our backend. Only authorised staff can open them.
• Google Drive and Google Sheets: we keep a working copy of some records (such as signed agreements and worker screening documents) in our restricted Google Workspace. Our own secure storage remains the main record.
• Email: we may email you a copy of what you submitted, and our team receives an alert. We never send health information to anyone else without your written consent, unless the law requires it.
• AI tools: see our AI privacy policy for how the AI helpers on this website handle your words.

The Australian Privacy Principles in plain words

• We tell you why we collect information and only collect what we need (APP 1, 3, 5).
• You can stay anonymous or use a different name when you just want general information (APP 2).
• We use information only for the reason we collected it, or with your consent (APP 6).
• We don't use your information for direct marketing without consent (APP 7).
• Some of our service providers, such as cloud and email services, may store information outside Australia; we choose providers with strong security (APP 8).
• We keep information accurate, secure and delete it when no longer needed — NDIS records are kept for at least 7 years (APP 10, 11).
• You can access and correct your information (APP 12, 13).

Access, correction and choice

You can ask to see the information we hold about you, ask us to correct it, or withdraw consent for a particular use at any time. Email ndis@ausfr8.com and we will respond within 30 days. If we can't give you access, we will explain why in writing.

Data breaches and complaints

If a breach is likely to cause you serious harm we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. If you are unhappy with how we handled your information, contact us first — we take complaints seriously and will not treat you differently for raising one. You can also contact the OAIC on 1300 363 992 or the NDIS Quality and Safeguards Commission on 1800 035 544.