1. About Choice Action and this Privacy Policy
Choice Action (ABN 78 511 492 506) provides disability, employment, community participation and capacity-building supports, including social work services where provided by a qualified social worker. Services are delivered in person in parts of New South Wales and may also be delivered remotely to participants and other clients anywhere in Australia where the service is suitable. Choice Action primarily supports self-managed and plan-managed NDIS participants.
This Privacy Policy explains the personal information Choice Action collects and holds, how it is collected and used, who it may be shared with, how it is protected and retained, and how you can access or correct your information or raise a privacy concern. It applies to participants and prospective participants, representatives and supporters, workers and applicants, referrers and business contacts, and people who use the Choice Action website or contact us.
Where this policy uses we, us or our, it means Choice Action. A current copy of this policy is available on the Choice Action website and can be provided in an accessible format on request.
2. Privacy laws and NDIS requirements
Choice Action is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because Choice Action provides health-related services and handles health information, the Privacy Act applies to the personal information we handle across Australia.
The Health Records and Information Privacy Act 2002 (NSW) and its Health Privacy Principles (HPPs) apply where Choice Action handles health information in New South Wales. Where Choice Action provides services to a person elsewhere in Australia, we also comply with any additional privacy, health-information or health-service requirements that apply to that service. Where more than one privacy regime applies, we comply with each applicable requirement.
For NDIS supports, Choice Action and its workers comply with the NDIS Code of Conduct, including the requirement to respect the privacy of people with disability. Privacy, dignity, choice, control and accessible communication are treated as participant rights. Where they apply to Choice Action's registration and services, Choice Action also follows the NDIS Practice Standards and Quality Indicators relevant to Privacy and Dignity and Information Management, including confidentiality, explaining what information is collected and why, consent and lawful disclosure, information accuracy and security, and participant access to and correction of information.
3. The information we collect
We collect only personal information that is reasonably necessary for a lawful service, business or legal purpose.
For participants and prospective participants, this may include identity and contact details; NDIS number, plan and funding information; referral and intake information; goals, supports and preferences; health, disability and mental health information relevant to the supports being provided; risk, safety and behaviour support information; communication, accessibility, cultural and language needs; representative and support-network details; service agreements, consents and authorities; progress notes, reports and reviews; complaints, incidents and feedback; transport, scheduling and attendance information; and claims, invoices and payment records.
Health information, disability information and other categories such as racial or ethnic origin, religious beliefs, sexual orientation or criminal history are sensitive information and receive additional legal protection. We collect sensitive information with consent unless a law or another permitted situation allows or requires collection without consent.
If you are a nominee, guardian, advocate, family member, supporter or other representative, we may collect your contact details, relationship to the participant and information needed to verify the nature and limits of your authority.
If you work for, apply to work for, or provide services to Choice Action, we may collect identity and contact details, qualifications, registrations, work rights, screening and clearance information, insurance, engagement and payment information, training and supervision records, and relevant complaint, incident or conduct information.
If you use our website or contact us online, we may collect the information you provide as well as technical information such as IP address, browser or device information, pages viewed and referral source.
Government-related identifiers, such as an NDIS number or another identifier assigned by a government body, are used or disclosed only where permitted by law. We do not adopt a government-related identifier as Choice Action's own identifier unless this is required or authorised by law.
4. How we collect information and tell you about it
Where it is reasonable and practicable, we collect information directly from you, including through conversations, referrals and intake, forms, email, telephone, online or digital services and the Choice Action website.
With your consent, or where the law otherwise permits it, we may also collect information from another person or organisation. This may include an authorised representative, family member or supporter; a referrer; another provider or health professional; a support coordinator or plan manager; a school, employer or workplace; the National Disability Insurance Agency (NDIA) or NDIS Quality and Safeguards Commission; an insurer; or another lawful source.
At or before collection, or as soon as practicable afterwards where required, we take reasonable steps to make you aware of relevant collection matters. This may be done through this Privacy Policy, a short Privacy Collection Notice, the form or service being used, or a direct explanation. The information provided may include who we are and how to contact us, why the information is being collected, whether a law requires the collection, the main consequences if important information is not provided, the usual types of recipients, and how to access or correct information or make a privacy complaint.
Where information is collected about you from somebody else, we take reasonable steps to notify you or ensure you are aware of the relevant collection matters where required by law. A collection notice is not itself consent to every use or disclosure; where consent is required, we ask for it separately.
If Choice Action receives personal information that we did not ask for, we assess whether we could lawfully have collected it. If we could not, and we are not required or authorised to keep it, we securely destroy or de-identify it as soon as practicable where lawful and reasonable.
You may deal with Choice Action anonymously or under a pseudonym where this is lawful and practicable, including for a general enquiry or anonymous feedback. Identification may be necessary or anonymous service may be impracticable for ongoing supports, billing, safety, verifying authority or meeting legal obligations.
5. Why we collect, hold, use and disclose information
We collect, hold, use and disclose personal information to respond to enquiries and referrals; assess whether we can provide the requested supports; plan, deliver and review services; communicate with you and people you authorise; support safety and safeguarding; manage transport, scheduling and attendance; make and manage claims, invoices and payments; handle complaints, incidents and feedback; manage workers and contractors; meet legal, NDIS, taxation, insurance and other obligations; and cooperate with audits, regulators and lawful investigations where required.
Information is generally used or disclosed for the purpose for which it was collected. It may also be used or disclosed for a secondary purpose where you have consented, where the secondary purpose is permitted by privacy law, or where another law requires or authorises the use or disclosure.
Choice Action does not sell personal information. We do not use participant health, disability or support information for targeted advertising. Sensitive information is not used or disclosed for direct marketing without consent. If Choice Action sends direct marketing, we comply with applicable privacy and spam laws and provide a simple way to opt out.
6. Consent and your choices
Where consent is the basis for collecting, using or disclosing information, consent must be voluntary, informed, current and specific, and given by a person who has capacity to understand and communicate the decision or by a person with lawful authority to decide on their behalf. Consent is not bundled with unrelated matters and is not inferred from silence alone.
You are entitled to time, accessible information and decision support. You may involve a supporter, advocate or representative of your choice. Information can be explained or provided in a format suited to your communication needs, which may include Easy Read, larger print, interpreter support or another reasonable format.
Consent for one purpose is not treated as consent for another. Saying no to an optional collection, use or disclosure will not affect unrelated supports. You may change or withdraw consent at any time. We record the change and explain any practical effect on your supports. Withdrawal applies from that point forward and does not undo information already handled lawfully or remove records we are required to keep.
7. When we share your information
With your consent, we may share relevant information with people and organisations you choose, such as family members and supporters, advocates and lawyers, health professionals and other providers, support coordinators and plan managers, schools, employers or workplaces. We check the purpose, recipient and any limits that apply before a consent-based disclosure.
We may share information with the NDIA and the NDIS Quality and Safeguards Commission where you have consented or where disclosure is required or authorised by law, including for claims and payments, complaints, incidents, compliance activity and audits. Where consent is not required because a law authorises or requires disclosure, we limit the information to what is relevant to the lawful purpose.
We may also provide information to approved service providers that support our operations, such as client-management, email and collaboration, website and hosting, accounting, insurance, technology and professional advisory services. We limit access to what is reasonably necessary and take reasonable steps to assess privacy, security, data location, breach response and other relevant safeguards.
Information may be disclosed without consent where a law requires or permits it, including in some emergencies or serious threats to life, health or safety; child protection or safeguarding matters; police or law enforcement matters; subpoenas, warrants or court or tribunal orders; regulator notices; work health and safety obligations; or insurance and legal processes.
A family member, nominee, guardian, advocate or other person does not automatically have access to your information because of their relationship or title. We verify identity and the scope of any consent or lawful authority before giving another person access to your information.
8. Information handled interstate or overseas
Choice Action may provide services to people anywhere in Australia. Providing a service to a person in another state or territory does not reduce the privacy protections described in this policy. Choice Action's primary participant management system stores participant data in Australia, and Choice Action does not routinely disclose participant information directly to an overseas recipient for ordinary support delivery.
Some approved website, cloud and technology providers may use infrastructure, subprocessors or support personnel in another Australian state or territory and, depending on the service, outside Australia. Provider locations and service arrangements can change over time, so Choice Action assesses the actual arrangement and maintains current provider and data-location information rather than listing locations that may not apply to Choice Action information. Where Choice Action is likely to disclose personal information to an overseas recipient, we identify the likely country or countries where practicable and take the reasonable steps required by Australian Privacy Principle 8, subject to any applicable exception. Transfers of health information outside New South Wales, including relevant transfers to Commonwealth agencies, are also assessed under Health Privacy Principle 14.
9. Website, online forms, telehealth and digital services
You can browse the Choice Action website without telling us who you are. Our website or hosting provider may automatically collect technical information such as IP address, device or browser information, pages viewed and referral source to operate, secure and improve the website.
The website may use essential cookies, server logs, spam-prevention tools and, where enabled, limited analytics. Choice Action does not use participant health, disability or support information for targeted advertising. If we introduce non-essential tracking, advertising or similar technology, we provide appropriate notice and obtain consent where required.
Online enquiry, referral, feedback or other forms collect information relevant to the stated purpose. Where required, the form includes or links to a short Privacy Collection Notice. Please do not send detailed health, incident or safeguarding information through a general website enquiry unless the form or secure method identified by Choice Action is intended for that information.
The same privacy and confidentiality protections apply when services are delivered by telephone, video, telehealth, email or another approved digital method. We take reasonable steps to confirm the correct participant or recipient and limit information to what is reasonably necessary for the communication or service.
Choice Action does not make audio or video recordings of support sessions without specific consent or another lawful authority.
10. Keeping information accurate and current
Choice Action takes reasonable steps to ensure personal information it collects is accurate, current and complete, and that information used or disclosed is accurate, current, complete, relevant and not misleading for the purpose.
We may ask you to confirm important contact, consent, representative, support, risk or health information during intake and review. If you become aware that information we hold is wrong or has changed, please tell us so that we can update the appropriate record.
11. How we protect your information
Choice Action uses reasonable physical, technical and administrative safeguards appropriate to the sensitivity of the information. These include approved systems, role-based and need-to-know access, individual user accounts, multi-factor authentication where appropriate, secure device and account controls, secure communication methods, worker confidentiality obligations, privacy and information-security training, and proportionate review of service providers.
Paper information is minimised and secured when used. Access is changed or removed when roles or service arrangements change, and workers are required to report suspected privacy or information-security incidents promptly.
No system can be guaranteed to be free from every risk. If there are reasonable grounds to suspect an eligible data breach, Choice Action assesses the breach as soon as practicable and takes reasonable steps to complete any required assessment within 30 days. If an eligible data breach is established, the Office of the Australian Information Commissioner and affected individuals are notified as required by the Notifiable Data Breaches scheme.
12. How long we keep information and how we dispose of it
Where the New South Wales health-record retention rules apply, health information collected while a person was an adult is kept for at least 7 years after the last health service provided by Choice Action. Health information collected while a person was under 18 is kept at least until the person reaches 25 years of age. Where another state or territory requirement applies to a service delivered elsewhere in Australia, Choice Action follows that requirement as well. A longer period is used where another legal, NDIS, insurance, professional or recordkeeping requirement applies.
Other records are kept for as long as they are reasonably needed for an authorised purpose and for any applicable legal, NDIS, taxation, employment, insurance, contractual or dispute-related period.
When personal information is no longer required and there is no lawful reason to retain it, we take reasonable steps to securely destroy or de-identify it. Where New South Wales law requires a record of health-information disposal or transfer, Choice Action retains that record.
13. Accessing your information and asking for a correction
You may ask to access personal or health information Choice Action holds about you, and you may ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. A request does not need to use legal wording or a particular form. You can contact admin@choiceaction.com.au, your usual Choice Action contact or another worker.
We verify identity before providing access and verify the authority of anyone making a request on another person's behalf. We provide access in the form requested where reasonable and practicable and can consider an accessible alternative where needed.
There is no charge to make an access or correction request and no charge to correct information. If a reasonable cost is permitted for providing access, we will explain it in advance and it will not be excessive.
We aim to respond to access and correction requests within 30 calendar days. The Privacy Act requires organisations to respond within a reasonable period, which the OAIC generally considers should not exceed 30 days. Formal requests for access to, or amendment of, health information under the Health Records and Information Privacy Act 2002 (NSW) have a 45-day statutory response period; Choice Action aims to respond sooner wherever possible. Other state or territory requirements are also followed where they apply to a service delivered elsewhere in Australia.
Access may be refused only where a lawful ground applies. Before refusing, we consider whether partial access, redaction, a summary, supervised access or another reasonable method can meet the request. If access or correction is refused, we provide written reasons where required and explain available review or complaint options.
If we do not agree to amend health information, you may ask us to attach a statement setting out the amendment you sought. If information is corrected, you may also ask us to take reasonable steps to notify relevant previous recipients where privacy law requires this.
14. Making a privacy complaint
If you are concerned about how Choice Action has handled your personal information, you can contact any worker or the Privacy Contact at admin@choiceaction.com.au. A privacy concern can be raised verbally, in writing or in another accessible way, and you may involve a supporter, advocate or authorised representative. You will not be disadvantaged or have your supports reduced because you raise a privacy concern or complaint.
We review privacy complaints promptly, ordinarily acknowledge them within 2 business days and aim to provide an outcome within 30 calendar days. We will keep you informed and explain the outcome in a way you can understand. If more time is reasonably required, we will explain why and give you a revised timeframe.
If you are not satisfied with our response, or we have not responded within a reasonable period, you may make a written privacy complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC generally expects a person to complain to the organisation first and allow about 30 days for a response. Information about privacy complaints is available at oaic.gov.au.
Complaints about the quality or delivery of NDIS supports are handled separately through Choice Action's Feedback & Complaints process.
15. Changes to this policy
This policy is reviewed at least annually and earlier if privacy law changes, a material system or provider changes, a new service or information practice is introduced, or another change materially affects how personal information is handled. The current version is available on the Choice Action website and the last-updated date appears on the first page.
16. How to contact us
Privacy enquiries, access and correction requests and privacy complaints can be sent to admin@choiceaction.com.au or by post to the Privacy Contact, Choice Action, PO Box 4004, Strathfield South NSW 2136. General information about Choice Action is available at https://choiceaction.com.au.