Privacy & Confidentiality
Policy.

1. Context & Purpose

Super Rehab Pty Ltd is committed to protecting the privacy of participants, employees, and all individuals whose personal information we collect and hold. This policy ensures we protect and handle personal information in accordance with the NDIS and relevant privacy legislation.

We acknowledge each individual’s right to privacy while recognising that personal information is required to be collected, maintained, and administered in order to provide a safe working environment and a high standard of quality. The information we collect is used to:

• Provide services to participants in a safe and healthy environment, with individual requirements considered
• Meet our duty of care obligations
• Initiate appropriate referrals to support participant goals
• Conduct business activities to support the delivery of those services

2. Applicability

This policy applies to all personal information and sensitive personal information — including information belonging to employees and participants, and all company confidential information (that is, any information not publicly available).

It applies to all representatives of Super Rehab Pty Ltd, including key management personnel, directors, full-time, part-time and casual workers, contractors, and volunteers.

3. What is Personal Information?

Personal information includes any information that could be used to identify an individual, regardless of its accuracy. This includes name, address, phone number, email address, date of birth, recorded opinions or notes about someone, and any other information that could be used to identify an individual.

4. What is Sensitive Personal Information?

Sensitive personal information is a subset of personal information that is normally considered private. This includes health information, ethnicity, political opinions or membership of a political or trade association, religious beliefs, philosophical beliefs, sexual orientation or gender identity, criminal record, and biometric information such as fingerprints.

5. Data Breaches

A data breach occurs when personal, sensitive, or confidential information — normally protected — is deliberately or mistakenly copied, sent, viewed, stolen, or used by an unauthorised person. A data breach that places individuals at risk of serious harm must be reported to the Office of the Australian Information Commissioner (OAIC) under the Privacy Amendment (Notifiable Data Breaches) Act 2017.

If we know or suspect that your personal information has been accessed by unauthorised parties and believe this could cause you harm, we will take reasonable steps to reduce that harm, notify you as soon as practicable, and report the breach to the OAIC where required by law.

6. Privacy & Confidentiality Guidelines

• We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Privacy Amendment (Notifiable Data Breaches) Act 2017
• We comply with the consent requirements of the NDIS Quality and Safeguarding Framework and relevant state or territory requirements
• All individuals are provided with access to information about how their personal information is managed
• Individuals may request access to their personal records by contacting their allocated clinician or our customer service team
• Where we are required to report to government funding bodies, information provided is non-identifiable and relates only to services and support hours, age, disability, language, and nationality
• Personal information will only be used by Super Rehab and will not be shared outside the organisation without consent, unless required by law — for example, reporting of abuse, neglect, or where a court order is issued
• Images or video footage of participants will not be used without their explicit consent
• Participants have the option of being involved in external NDIS audits if they wish

7. Security of Information

• We take reasonable steps to protect the personal information we hold against misuse, interference, loss, unauthorised access, modification, and disclosure
• Personal information is accessible to the participant and to relevant workers involved in service delivery
• Security measures include password protection for IT systems, locked filing cabinets, and physical access restrictions — with only authorised personnel permitted access
• Personal information that is no longer required is securely destroyed or de-identified in accordance with our records retention obligations

8. Breach of Privacy & Confidentiality

A breach of privacy or confidentiality is treated as a reportable incident and must be managed in accordance with our incident management process. Such a breach may require a formal investigation. An intentional breach will result in disciplinary action, up to and including termination of employment or contract.

9. Our Website & Online Forms

When you use our website, or complete a form, survey, or newsletter sign-up on it, we may collect personal information that you provide directly to us. This may include your name, email address, phone number, postal address, the organisation you represent, and any information you choose to include in a message, referral, enquiry, or feedback response.

We collect this information so that we can respond to your enquiry, process a referral, provide the services you have requested, send you information you have asked to receive, and improve our website and services. Providing this information is voluntary; however, if you choose not to provide it, we may be unable to respond to your enquiry or provide the service you have requested.

Our website may also use cookies and similar technologies, and third-party analytics tools, to understand how visitors use the site so that we can improve it. You can usually disable cookies through your browser settings, though some parts of the website may not function as intended if you do.

10. Email Marketing & Your Choices

If you sign up to receive our newsletter or other updates, or otherwise provide us with your consent, we may use your contact details to send you news, service updates, and information we believe may be of interest to you.

We will only send you marketing communications where you have asked to receive them or have otherwise consented, and where permitted under the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth). Every marketing email we send includes a clear way to unsubscribe.

You can opt out of receiving marketing communications at any time by using the unsubscribe link in any message, or by contacting us at info@superrehab.com.au. If you opt out, we may still send you non-marketing messages that relate to a service you are receiving, such as appointment or administrative communications.

11. Third-Party Service Providers

We use trusted third-party service providers to help us operate our website and communicate with you. For example, we use an email marketing platform to manage newsletter sign-ups and send communications, and we may use analytics providers to understand website usage.

These providers only access the personal information necessary to perform their services for us, and are required to protect that information and use it only for the purposes we have specified. We do not sell your personal information to any third party.

Where we are legally required to do so, for example to comply with a court order, a request from a regulator, or a law enforcement agency, we may disclose personal information without your consent.

12. Overseas Disclosure of Information

Some of our third-party service providers, including our email marketing platform, are located overseas or store information on servers located overseas, primarily in the United States. This means that if you subscribe to our newsletter or provide information through certain online forms, your personal information (such as your name and email address) may be stored or processed outside Australia.

In accordance with Australian Privacy Principle 8, we take reasonable steps to ensure that any overseas recipient handles your personal information in a manner consistent with the Australian Privacy Principles. By providing your information through these channels, you consent to it being transferred to, and stored in, the countries described above.

We do not disclose participant health or clinical information overseas. Overseas transfer applies only to website and marketing contact information as described in this section.

13. Regulatory References

• Privacy Act 1988 (Cth), including the Australian Privacy Principles
• Privacy Amendment (Notifiable Data Breaches) Act 2017
• Spam Act 2003 (Cth)
• NDIS (Quality Indicators) Guidelines 2018
• NDIS (Provider Registration and Practice Standards) Rules 2018
• NDIS Quality and Safeguarding Framework