Privacy Policy

1. Our commitment to privacy

Kindred Coast is committed to protecting the privacy, dignity and confidentiality of participants,

families, representatives, workers and other people who interact with our services. We handle

personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy

Principles (APPs), the Notifiable Data Breaches scheme and other privacy, disability and

safeguarding obligations that apply to us.

This policy explains the kinds of information we collect and hold, how and why we handle it, when

it may be shared, how we protect it, and how a person can access, correct or complain about the

handling of their information.

2. Information we may collect and hold

Depending on the services requested or provided, we may collect and hold:

Personal and contact information

• name, date of birth, address, phone number and email address

• emergency contacts and details of parents, guardians, nominees or authorised representatives

• identity information reasonably required to verify a person or provide services safely

NDIS and service information

• NDIS participant number, plan information, funding and plan-management arrangements

• support goals, preferences, routines, communication needs and service agreements

• support schedules, progress notes, incident records and other service-delivery records

• support coordinator, plan manager and other provider details where relevant

Sensitive and health information

• disability and relevant health information, medical conditions, allergies and medication

information

• risk, behaviour-support or safeguarding information where relevant to safe service delivery

• cultural, communication or accessibility needs and other sensitive information a person chooses

to provide.

We only collect sensitive or health information where it is reasonably necessary for our functions

or activities and where we have consent or another lawful basis to collect it.

3. How we collect information

We generally collect information directly from the individual or their authorised representative,

including through:

• website enquiries, referral forms, telephone calls, emails and face-to-face discussions

• service agreements, intake and assessment documents, support planning and risk assessments

• records created while providing supports, responding to incidents or managing complaints

With appropriate authority, consent or where permitted by law, we may also receive relevant

information from family members, nominees, guardians, support coordinators, plan managers,

health or allied-health professionals, the NDIA, the NDIS Quality and Safeguards Commission, or

other organisations involved in a person's supports.

4. Why we collect, hold, use and disclose information

We may handle personal information to:

• respond to enquiries and referrals and assess whether our services are suitable

• plan, coordinate and deliver safe, person-centred disability supports

• communicate with participants and people they have authorised

• manage appointments, rosters, invoicing, payments and funding arrangements

• coordinate with other providers or professionals where authorised and relevant

• manage incidents, complaints, safeguarding concerns, quality improvement and risk

• meet legal, insurance, regulatory, taxation and record-keeping requirements

• recruit, screen, train and manage workers, contractors and volunteers

We will not sell personal information. We will not use health information for direct marketing

without appropriate consent and any other requirements of Australian privacy law being met.

5. Sharing personal information

Where necessary, authorised or required by law, we may disclose relevant information to:

• a participant's authorised representative, nominee or guardian

• support coordinators, plan managers and other service providers involved in the participant's

supports

• the NDIA, the NDIS Quality and Safeguards Commission or other regulators

• healthcare, allied-health or emergency services where appropriate

• insurers, auditors, legal advisers and professional advisers

• technology, communications, cloud-storage and business-service providers that support our

operations

• government agencies, police, courts or other authorities where disclosure is required or

authorised by law,

We aim to disclose only the information reasonably necessary for the relevant purpose. We do not

publish or make identifiable participant health or disability information publicly available.

6. Website, cookies and online enquiries

Our website may use cookies or similar technologies needed for functionality, security, analytics or

service improvement. When a person submits an online enquiry, we may collect the information

entered in the form together with basic technical information generated by the website or hosting

service.

Third-party services may have their own privacy practices. Where practical, Kindred Coast selects

reputable service providers and limits the personal information made available to them to what is

reasonably necessary.

7. Storage, security and access controls

Kindred Coast takes reasonable steps to protect personal information from misuse, interference,

loss and unauthorised access, modification or disclosure. Measures may include:

• password-protected accounts, multi-factor authentication and role-based access controls

• secure cloud storage and device-security practices

• confidentiality obligations, privacy training and worker access restrictions

• secure handling, transfer and disposal of records

• incident-response processes for suspected privacy or cyber-security events

Access to participant information is limited to people who reasonably require it to perform their

role or meet a legal obligation.

8. Overseas recipients and cloud services

Kindred Coast may use technology and cloud-service providers whose systems or personnel operate

outside Australia. Where our use of a service involves a disclosure of personal information to an

overseas recipient, we will take reasonable steps required by the Privacy Act to protect that

information.

The countries in which overseas recipients may be located can change with provider infrastructure.

Where it is practicable to identify likely overseas recipient countries, we will provide that

information on request or update this policy when our practices become sufficiently settled to

specify them.

9. Accessing and correcting personal information

A person may request access to personal information Kindred Coast holds about them and may ask

us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We will respond within a reasonable period and in accordance with applicable privacy law. In

limited circumstances, the law may allow or require us to refuse access to particular information. If

this occurs, we will explain the reason where we are permitted to do so.

10. Anonymity and pseudonyms

Where practical, a person may contact us anonymously or using a pseudonym. However, we may

need to know a person's identity and collect relevant information where this is necessary to

provide supports, verify authority, manage funding, protect safety or meet legal obligations.

11. Children and supported decision-making

Where a participant is a child or requires support with decision-making, we may collect

information from and communicate with an authorised parent, guardian, nominee or

representative. We will continue to respect the participant's privacy, preferences, dignity and

involvement in decisions to the greatest extent appropriate.

12. Data breaches

If Kindred Coast becomes aware of a suspected privacy or data-security incident, we will take

reasonable steps to contain it, assess what information has been affected and reduce the risk of

harm.

Where an eligible data breach is likely to result in serious harm and the requirements of the

Notifiable Data Breaches scheme are met, we will notify affected individuals and the Office of the

Australian Information Commissioner (OAIC) as required.

Examples may include:

• personal information being sent to the wrong person

• lost or stolen devices containing participant information

• unauthorised access to participant files or email accounts

• cyber-attacks, hacking or accidental disclosure of sensitive information

13. Retention and disposal

We retain personal information for as long as reasonably required to provide services and meet

applicable NDIS, legal, regulatory, taxation, insurance, complaint, incident and record-keeping

obligations. When information is no longer required to be retained, we take reasonable steps to

securely destroy it or de-identify it where appropriate.

14. Privacy complaints

A person who believes Kindred Coast has mishandled their personal information may make a

privacy complaint to us. We will acknowledge the complaint, assess and investigate the

circumstances, take appropriate corrective action where required, and respond within a

reasonable timeframe.

If a person is not satisfied with our response, they may be able to complain to the Office of the

Australian Information Commissioner (OAIC) at www.oaic.gov.au.

15. Automated decision-making

Kindred Coast does not currently arrange for computer programs to make decisions using personal

information where those decisions could reasonably be expected to significantly affect a person's

rights or interests. If this changes, we will update this policy and our privacy practices.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology,

legal or regulatory requirements, or the way we handle personal information. The current version

will be made available through our website.

17. Contact us

For privacy enquiries, requests for access or correction, or privacy complaints, contact Kindred

Coast using the contact details or contact form published on our website. Please include enough

information for us to understand and respond to the request.

Policy owner: Kindred Coast | Version 1.0 | Effective 28 September 2026