How We Handle Your Information

Ballarat Support Services Pty Ltd ("BSS", "we", "us", "our") is committed to protecting the privacy of the people we support, our staff, and everyone who engages with us. This policy explains how we collect, use, store, disclose, and protect personal information — and your rights in relation to that information.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Health Records Act 2001 (Vic), and the information-handling requirements under the National Disability Insurance Scheme Act 2013 and the NDIS Practice Standards.

1. What Information We Collect

Participants

To deliver safe, effective NDIS-funded supports we collect:

• Identifying information: name, date of birth, address, contact details, NDIS participant number
• NDIS plan details including funding, line items, plan management arrangements, and goals
• Health information relevant to support delivery — diagnoses, medications, allergies, medical contacts, GPs, allied health providers
• Behaviour support plans, positive behaviour support strategies, restrictive practice authorisations
• Risk assessments, incident history, communication preferences
• Cultural, religious, and language preferences
• Family, carer, and support coordinator contacts
• Shift notes, progress reports, and outcome data
• Photos and video (only with explicit written consent — see section 6)

Families & carers

• Name, relationship to participant, contact details
• Emergency contact information
• Correspondence and communications with BSS

Referrers (coordinators, LACs, plan managers, health professionals)

• Name, organisation, role, contact details
• Referral information and related correspondence

Staff and applicants

• Identifying and contact information
• Qualifications, certifications, Working With Children Check, NDIS Worker Screening Check, driver's licence
• Employment history, references, tax and superannuation details
• Training records and performance information

Website visitors

• Information you voluntarily provide through contact, referral, feedback, and application forms
• Standard web analytics (page views, device type, general location) — aggregated and de-identified

2. How We Collect Information

We collect personal information directly from you wherever practical — through intake conversations, service agreements, meetings, phone calls, emails, and forms on this website. Where relevant and with your knowledge, we may also receive information from:

• Support coordinators, LACs, plan managers, and NDIA planners
• Health professionals, hospitals, and previous providers (with consent)
• Behaviour support practitioners
• Referees you nominate (for staff recruitment)
• Government agencies where legally authorised

3. Why We Collect It

We only collect personal information for purposes that are reasonably necessary to do our job as an NDIS-registered disability support provider. Those purposes include:

• Assessing service suitability and capacity before accepting a participant
• Delivering safe, appropriate, individualised supports
• Rostering staff and coordinating services
• Managing incidents, complaints, and feedback
• Meeting NDIS Commission reporting obligations, including reportable incidents and restrictive practice reporting
• Billing, invoicing, and financial administration
• Recruitment, training, and employment administration
• Continuous improvement and quality assurance
• Responding to enquiries and referrals
• Complying with our legal and contractual obligations

4. Who We Share Information With

We only share personal information where we are legally permitted or required to, where you have consented, or where it is reasonably necessary to deliver safe supports. Parties we may share information with include:

• NDIS Quality and Safeguards Commission — for reportable incidents, restrictive practice reporting, complaints, and compliance purposes
• National Disability Insurance Agency (NDIA) — for plan-related matters
• Support coordinators, LACs, and plan managers — to coordinate your supports
• Health professionals and emergency services — where necessary to protect life, health, or safety
• Contractors and professional advisors (accountants, legal advisors, IT providers) — bound by confidentiality obligations
• Government authorities — where required by law (e.g. WorkSafe, Victoria Police, Department of Families, Fairness & Housing)

We do not sell personal information, and we do not share it for marketing purposes.

5. Storage and Security

We take the security of personal information seriously. We:

• Store digital records in access-controlled systems with role-based permissions
• Require strong passwords, multi-factor authentication where available, and encryption in transit
• Lock physical records in secured cabinets at our head office
• Train staff on confidentiality obligations and the NDIS Code of Conduct
• Maintain an Information Breach response process consistent with the Notifiable Data Breaches scheme
• Retain records for the periods required by NDIS, health, tax, and employment legislation — then securely destroy or de-identify them

6. Photos, Video, and Publication

We will not publish a participant's photo, video, name, or identifying details on our website, social media, marketing materials, or any public-facing channel without explicit written consent from the participant — or from their legal guardian or nominated decision-maker where the participant does not have capacity to consent.

Consent is specific (for a named purpose), documented, and revocable. You can withdraw consent at any time by contacting us — we will remove the relevant material from our public channels as soon as practicable, subject to the technical limits of third-party platforms.

Photos taken for internal purposes (documentation, shift handover, progress records) are covered by separate internal consent and are not published externally.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request corrections where information is inaccurate, incomplete, or out of date
• Withdraw consent where we rely on consent (e.g. photo/video publication)
• Complain about how we have handled your personal information — see section 9
• Request a copy of your records if you move to another provider

To exercise these rights, contact us at Chris@ballaratss.com.au or 0411 963 244. We will respond within 30 days. There is no charge for access requests, though a reasonable fee may apply for extensive copying or time-intensive retrieval.

8. Cookies and Website Analytics

This website uses minimal, functional cookies required for navigation and standard web analytics (such as page views) to understand how visitors interact with the site. We do not use behavioural advertising cookies or sell website data to third parties.

9. Complaints

If you believe we have mishandled your personal information, you can raise a complaint with us directly through any of the following channels:

• Our Complaint & Feedback form (anonymous submissions accepted)
• By email: Chris@ballaratss.com.au
• By phone: 0411 963 244
• By post: Ballarat Support Services, 901b La Trobe Street, Delacombe VIC 3356

You may also complain directly to external regulators at any time:

• NDIS Quality and Safeguards Commission — 1800 035 544 or ndiscommission.gov.au
• Office of the Australian Information Commissioner (OAIC) — 1300 363 992 or oaic.gov.au
• Health Complaints Commissioner (Victoria) — 1300 582 113 or hcc.vic.gov.au

10. Changes to This Policy

We review this policy at least annually and update it when our practices, or the law, change. The effective date above reflects the current version. Material changes affecting how we handle personal information will be notified to active participants and posted on this page.

11. Contact Us

Questions about this policy or your personal information?

Ballarat Support Services Pty Ltd
901b La Trobe Street, Delacombe VIC 3356
Phone: 0411 963 244
Email: Chris@ballaratss.com.au