Privacy policy

1. About this policy

Horizon Care (ABN 77 617 035 426, NDIS provider NDIS0020881) is committed to protecting your privacy. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW), and the NDIS Code of Conduct and Practice Standards.

This policy applies to the people we support and their families, carers and representatives, people who make referrals or enquiries, job applicants, staff and contractors, and visitors to our website.

2. Information we collect

Depending on how you deal with us, we may collect:

• Your name, date of birth, address, phone number and email
• Emergency contacts, and details of guardians, nominees or representatives
• Your NDIS number, plan details, funding and plan manager information
• Health and disability information, such as diagnoses, medications, allergies, support needs, behaviour support plans and reports from health professionals
• Cultural background, language and communication preferences, where you choose to share them
• Records of the support we provide, including shift notes, incident reports and feedback
• For job applicants and staff: résumés, references, qualifications, screening checks and banking and tax details

Health and disability information is sensitive information. We take extra care with it and only collect it with your consent, or where the law allows.

3. How we collect it

Wherever we can, we collect information directly from you: in person, by phone, by email or through forms on our website. With your consent, we may also receive information from your family or carers, support coordinator, plan manager, the NDIA, doctors and other health professionals.

4. How we use it

• To plan, deliver and review your supports safely
• To match you with suitable support workers and health professionals
• To communicate with you and the people you choose
• To make claims and send invoices for the services we provide
• To manage incidents, feedback and complaints
• To meet our legal, insurance and NDIS obligations
• To recruit and manage our staff
• To improve our services, using de-identified information wherever possible

We will not use your information for marketing without your permission, and you can opt out at any time. We never sell your information.

5. Your consent

We ask for your consent when you start with us, and explain it in a way that works for you. Consent can be given by you or by your guardian or nominee. You can change or withdraw your consent at any time by telling us. If this affects how we can support you, we’ll talk it through with you first.

6. Who we share it with

We only share your information when you agree, or when the law requires or allows it. This may include:

• The NDIA, your plan manager or support coordinator
• Health professionals and other providers involved in your support
• The NDIS Quality and Safeguards Commission, for example when we must report an incident
• Emergency services, if there is a serious threat to someone’s life, health or safety
• Trusted service providers who help us run our business, such as IT and payroll providers, under strict confidentiality

We do not send personal information overseas. All information we hold, including information held by our software providers, is stored in Australia.

7. Storage and security

We store information in secure, password-protected electronic systems hosted in Australia, and any paper records in locked storage. Only staff who need your information to do their job can access it. Our staff are trained in privacy and confidentiality, and are bound by confidentiality agreements and the NDIS Code of Conduct.

8. How long we keep it

We keep records for as long as the law requires. For the people we support, this is at least 7 years from when the record was made, in line with NDIS requirements. When information is no longer needed, we securely destroy or de-identify it.

9. Seeing and correcting your information

You can ask to see the information we hold about you, or ask us to correct it if it’s wrong or out of date. Contact our Privacy Officer. We’ll respond within 30 days, and there’s no charge for asking. If we can’t give you access, we’ll explain why in writing.

10. Data breaches

If your information is lost, accessed or shared without permission, we will act quickly to contain the breach and assess the risk. If the breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.

11. Our website

When you fill in a form on our website, we collect the details you enter so we can respond to you. Our website may use cookies and analytics tools to understand how visitors use the site. This information doesn’t identify you personally. You can turn cookies off in your browser settings. Our website may link to other sites, such as Google Maps, which have their own privacy policies.

12. Staying anonymous

You can make a general enquiry or give feedback without telling us your name. To provide support services, though, we do need to know who you are.

13. Questions and complaints

If you have a question about privacy, or think we’ve mishandled your information, please contact our Privacy Officer. We’ll acknowledge your complaint within 24 hours and aim to resolve it within 30 days.

If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at oaic.gov.au. For complaints about health information in NSW, you can also contact the NSW Information and Privacy Commission at ipc.nsw.gov.au. You can also give us feedback or make a complaint.

14. Changes to this policy

We may update this policy from time to time. The latest version will always be on our website, and you can ask us for a printed copy at any time.