Privacy Policy - Person Centred Services

Our Privacy commitment

Person Centred Services is strongly committed to maintaining the privacy of personal information we collect as part of the services we offer. It is vital that you are aware of, and understand, all your obligations under the Privacy Act and the Australian Privacy Principles regarding the collection, use, storage and protection of personal information. We place great importance on protecting the privacy of our employees, valued clients and other stakeholders and your diligent and careful awareness of privacy issues is required to achieve this. If you have any questions regarding the Privacy Policy or privacy generally, please do not hesitate to contact Person Centred Service’s Privacy Officer at David@personcentred.com.au.

Purpose

The purpose of this policy is to:

Give you a better and more complete understanding of the kinds of personal information that we collect and hold
Clearly and concisely communicate how and when your personal information is collected, disclosed, used, held and otherwise handled by us
Inform you about the purposes for which we collect, hold, use and disclose personal information
Provide you with information about how you may access your personal information and seek correction of your personal information
Provide you with information about how you may make a complaint, and how we will deal with any such complaint

Policy Statement

This policy sets out how we will comply with our obligations under the Privacy Act 1988 (Cth) (Act). We are bound by the Australian Privacy Principles (APPs), which regulate how we may collect, use, disclose and hold your personal information, and how you may access and correct personal information held about you.

We will ensure that all of our officers, employees and subcontractors are aware of and understand our obligations and their own obligations under the Act and are provided with training to enable them to fulfil these obligations.

We will also achieve this through maintaining internal policies and processes to prevent personal information being improperly collected, held, shared/exchanged, accessed or disposed of.

What is personal information?

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not. It includes your name, date of birth/age, gender and contact details as well as health information (which is also sensitive information). In this privacy policy, a reference to personal information includes sensitive/health information.

Collection of personal information

We do not collect personal information unless it is reasonably necessary for, or directly related to, one or more of our functions or activities.

Personal information collected by us will usually fall into one of the following categories:

Contact information (name, age, address, email address and telephone numbers)
Commonwealth identifiers (e.g. CRN, TFN)
Employment information (e.g. employment history, work performance, absences, workplace incidents, next of kin information)
Financial information (e.g. bank account details)
Sensitive information (e.g. health, medical history, criminal history, religious beliefs, trade union activity)
Information obtained to assist in managing client and business relationships

We may collect your information from you in a variety of ways including face-to-face, over the telephone, through an on-line form or portal, through a paper form or by email. Sometimes we will collect personal information from a third party or a publicly available source if it is unreasonable or impracticable to collect the personal information directly from you.

You may choose to deal with us anonymously or under a pseudonym where lawful and practical. Where anonymity or the use of a pseudonym will render us unable to provide the relevant service or reasonably conduct business, we may request that you identify yourself. For example, it would not be practical to deal with you anonymously if we are providing NDIS Support Services to you.

Where personal information is sensitive information, we will only collect that information where:

It is reasonably necessary for one or more of our functions,
We have the individual’s consent to the collection of that information, or
We are required or authorised by law to collect the sensitive information

Why do we collect, use and store your personal information?

We collect, use and store your personal information to provide you with services including:

Services under the National Disability Insurance Scheme
Client and business relationship management
Client referral information
Occupational safety and health
Psychological assessments/counselling
Employment applications and referrals
Training/education
Research

We may also collect, use and store your personal information for marketing purposes in order to inform you of the services we offer.

Our services, functions and activities, as well as those of our contracted service providers, may change from time to time.

Protecting and storing your personal information

We are committed to keeping personal information secure and safe. Some of the ways we do this are:

Requiring employees and contractors to enter into confidentiality agreements
Securing hard copy document storage (i.e. storing hard copy documents in locked filing cabinets)
Security measures for access to computer systems to protect information from unauthorised access, modification or disclosure and loss, misuse and interference
Password protected data storage devices such as laptops, tablets and smart phones
Providing a discreet environment for confidential discussions
Security measures for our website(s)

Person Centred Services reviews and update these measures from time to time to ensure security is maintained.

Personal information may be stored in document (Hard copy) form but will generally be stored electronically on our software or systems.

Although we take all reasonable steps to secure personal information from loss, misuse and unauthorised access, there is an inherent risk of loss of, misuse of or unauthorised access to such information. We will not be held responsible for such actions where the security of the personal information is not within our control or we cannot reasonably prevent such an incident, for example, a technical malfunction, computer virus, third party interference or any action or event that is beyond our reasonable control.

Who will we disclose your personal information to?

We will only use and disclose personal information for the primary purpose for which it was initially collected, or for purposes which are directly related to one of our functions or activities. This may include providing relevant client information to providers who will be providing services to our mutual clients, or when providing information to the National Disability Insurance Agency or other government and regulatory bodies.

We will not disclose your personal information to government agencies, private sector organisations or any third parties unless one of the following applies:

You have consented.
We believe that you would reasonably expect, or have been told, that information of that kind is usually passed to those individuals, bodies or agencies
It is otherwise required or authorised by law
It is reasonably necessary for enforcement related activities conducted by, or on behalf of, an enforcement body (e.g. police, ASIC, Immigration Department)

Accuracy of Personal Information

We will ensure that all personal information we collect, use or disclose is accurate, complete and up to date. Please contact our Privacy Officer (details below) if you are aware of any personal information that does not meet this objective.

If we are aware that we hold personal information that (having regard to the purpose for which it was collected) is inaccurate, out of date, incomplete, or irrelevant, we will take reasonable steps to correct that information.

You may seek access to, and correction of, personal information held by us in accordance with the section below 'How can I access my personal information and contact Person Centred Services?'

How can I access my personal information and contact Person Centred Services?

You can request access to personal information that we hold about you.

The procedure for requesting and obtaining access is as follows:

All requests for access to personal information must be in writing and addressed to your primary point of contract at Person Centred Services or to our Privacy Officer (see contact details below). All requests should specify how the information is proposed to be accessed (photocopies, electronic copy, or visual sighting).
Please provide as much detail as possible regarding the organisation and / or person to whom you believe your personal information has been provided and when. This will allow us to process your request more efficiently.
We will acknowledge your request within 14 days of the request being made.
Access will usually be granted within 14 days of our acknowledgment. If the request cannot be processed within that time for whatever reason, we will let you know the anticipated timeframe for a response to be provided.
We may refuse to grant access to personal information under certain circumstances (see below).
If, as a result of access being granted, you are aware that we hold personal information that you regard as being no longer accurate or incorrect, you may request the deletion or correction of such information.
Upon receipt of a request to correct or delete personal information, we will either make such corrections or deletions or provide written reasons as to why we declined to make such alterations (see below).

Under the Act, we may refuse to grant access to personal information if:

We believe that granting access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety.
Granting access would have an unreasonable impact upon the privacy of other individuals.
Denial of access is required or authorised by law or by a Court or Tribunal order.
Giving access would be unlawful.
The request for access is frivolous or vexatious.
Legal proceedings are underway or anticipated and the information would not be accessible by way of the discovery process in those proceedings.
Giving access is likely to prejudice enforcement related activities conducted by, or on behalf of, an enforcement body.
Giving access is likely to prejudice action being taken or to be taken with respect to suspected unlawful activity or serious misconduct relating to our functions or activities.
Giving access would reveal information in connection with a commercially sensitive decision-making process.

If we do not agree to make a correction to personal information, you may provide a statement about the requested corrections, and we will ensure that the statement is apparent to any users of the relevant personal information.

If we do not agree to provide access to personal information or to correct the personal information, we will provide you with written reasons for the refusal and the mechanisms available to complain about the refusal.

Person Centred Services has a designated Privacy Officer who is responsible for the management of:

Requests for access to personal information
Complaints regarding our management of personal information

For information regarding privacy, the Privacy Officer can be contacted at:

David Mitchell – Person Centred Services Privacy Officer

10 Williams Ave, Hackham West, SA, 5163

E: david@personcentred.com.au

P: 0411 237 111

How do we handle complaints?

If you consider that there has been a breach of the Australian Privacy Principles, you are entitled to complain to Person Centred Services.

All complaints are to be in writing and directed to the Privacy Officer using the contact details above. The Privacy Officer will acknowledge receipt of a written complaint within 2 business days.

Our Privacy Officer will investigate the complaint and attempt to resolve it within 20 business days after the written complaint was received. Where it is anticipated that this timeframe is not achievable, we will contact the person making the complaint to provide an estimate of how long it will take to investigate and respond to it.

Monitoring and training

Compliance with this Privacy Policy is subject to internal and regulatory audit. Person Centred Services will comply with all reporting requirements of the Act as they exist from time to time. All staff will receive training with regard to privacy and the application of this Privacy Policy as part of their induction.

Review

The Person Centred Services Privacy Policy will be reviewed every three years or upon legislation changes.