1. Our commitment to privacy

Dolare Care Pty Ltd (“Dolare Care”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal and health information entrusted to us.

We provide disability support services, including services funded through the National Disability Insurance Scheme (NDIS).

We handle personal information in accordance with applicable privacy and health-records legislation, including:

• the Privacy Act 1988 (Cth);
• the Australian Privacy Principles;
• the Health Records Act 2001 (Vic) and Health Privacy Principles;
• applicable NDIS legislation, rules and provider obligations; and
• other laws requiring us to collect, use, disclose, protect or retain information.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information.

2. Who this policy applies to

This policy applies to personal information we hold about:

• NDIS participants and prospective participants;
• children and young people receiving support;
• family members, carers, nominees, guardians, advocates and authorised representatives;
• support coordinators, plan managers and health care professionals;
• employees, contractors, volunteers, students and job applicants;
• service providers and business contacts;
• people who make referrals, enquiries, complaints or provide feedback; and
• visitors to our website and social-media pages.

3. The information we may collect

The information we collect depends on our relationship with you and the services being requested or delivered.

Personal and contact information

This may include:

• name, date of birth, gender and preferred pronouns;
• residential, postal and email addresses;
• telephone number;
• photographs, signatures and identity documents;
• preferred language and communication requirements;
• cultural background and accessibility requirements; and
• details of family members, carers, guardians, nominees and emergency contacts.

Health and sensitive information

To provide safe and appropriate supports, we may collect:

• disability, medical and mental-health information;
• diagnoses, health conditions and relevant medical history;
• allergies, medications and medication-support requirements;
• mobility, communication, behavioural and personal-care needs;
• mealtime-management and swallowing information;
• risk assessments, support plans and behaviour-support information;
• information about incidents, injuries, restrictive practices or safeguarding concerns;
• religious, cultural or dietary requirements;
• sexual orientation or gender identity where relevant to providing safe and respectful support; and
• information received from health care professionals and other service providers.

We only collect sensitive information where it is reasonably necessary for our work and you consent, or where collection is otherwise permitted or required by law.

NDIS information

This may include:

• NDIS number, plan dates, goals, funding arrangements and relevant plan information;
• service agreements, support schedules and participant preferences;
• support-coordination and plan-management details;
• details of funding bodies or other relevant organisations;
• service-delivery records, case notes, progress notes and incident reports;
• invoices, claims, payments, travel records and service bookings; and
• information required for audits, quality reviews or regulatory reporting.

Workforce and business information

For workers, contractors and job applicants, we may collect:

• employment history, qualifications and references;
• identity and right-to-work information;
• NDIS Worker Screening Check and Working with Children Check details;
• police checks, licences, training and competency records;
• health or vaccination information where relevant and lawful;
• bank, taxation and superannuation information; and
• performance, supervision, complaint and incident information.

Website and electronic information

When you use our website or communicate with us electronically, we may collect:

• your IP address, browser type and device information;
• website usage and interaction information;
• information submitted through contact or referral forms;
• emails, text messages and other electronic communications; and
• cookie and analytics information.

You can control cookies through your browser settings, although disabling cookies may affect some website functions.

4. How we collect information

Where practical, we collect personal information directly from you or your authorised representative.

We may collect information:

• when you contact us or submit an enquiry or referral;
• during intake, assessment and service-agreement processes;
• while planning, delivering, reviewing or recording supports;
• through telephone calls, emails, forms, meetings and our website;
• from your family member, carer, nominee, guardian or advocate;
• from a support coordinator, plan manager or funding body;
• from a health care professional, allied health practitioner, hospital or other service provider;
• from the NDIS Commission, NDIA or another government body where permitted;
• from workers who provide or document your supports; and
• from publicly available sources where lawful and appropriate.

If another person provides information to us about you, we will take reasonable steps to ensure you are made aware of the collection, unless an exception applies.

5. Why we collect, use and disclose information

We may collect, use or disclose personal information to:

• assess whether we can safely and appropriately provide services;
• develop, deliver, monitor and review supports;
• communicate with you and your authorised representatives;
• understand your goals, preferences, needs and risks;
• coordinate services with your support team;
• arrange workers, appointments, transport and community activities;
• provide personal care, medication, mealtime or behaviour support;
• prepare progress notes, care records and incident reports;
• respond to emergencies or serious risks to health or safety;
• manage service agreements, bookings, cancellations and complaints;
• invoice for services and process NDIS claims;
• meet safeguarding, reportable-incident and regulatory obligations;
• manage our workforce, training, supervision and quality systems;
• conduct audits, investigations and continuous-improvement activities;
• maintain insurance and meet legal, contractual and financial obligations;
• respond to enquiries and referrals; and
• protect the rights, safety and wellbeing of participants, workers and the community.

We will not use or disclose personal information for an unrelated purpose unless you consent or the use or disclosure is authorised or required by law.

6. Consent and authorised representatives

We seek informed consent when required and explain, in an accessible way:

• what information is being collected;
• why it is needed;
• how it may be used or shared; and
• any likely consequences of not providing it.

Consent may be provided by the individual or, where legally appropriate, by an authorised nominee, guardian, parent or other representative.

You may withdraw consent for an optional use or disclosure by contacting us. Withdrawal will not affect actions already taken with valid consent and may limit our ability to provide some services.

We verify a representative’s authority before giving them access to personal information or accepting instructions on another person’s behalf.

7. Children and young people

We take additional care when handling information about children and young people.

Depending on the child’s age, maturity, circumstances and decision-making capacity, consent may be obtained from:

• the child or young person;
• their parent or legal guardian; or
• both the child or young person and their parent or guardian.

We encourage children and young people to participate in decisions about their information wherever practical. Their safety, rights, preferences and best interests remain central to our decisions.

8. When we may share information

Where necessary and permitted, we may disclose information to:

• your authorised family members, carers, nominees, guardians or advocates;
• support workers and other Dolare Care personnel who need the information;
• support coordinators, recovery coaches and plan managers;
• health care and allied health professionals;
• hospitals, pharmacists and emergency services;
• schools, childcare services and community organisations involved in your support;
• the NDIA, NDIS Quality and Safeguards Commission or other funding bodies;
• auditors, assessors, insurers and professional advisers;
• payroll, accounting, information-technology, document-signing and business-system providers;
• law-enforcement, child-protection or regulatory authorities; and
• another person or organisation where you have consented or disclosure is authorised or required by law.

We only disclose the information reasonably necessary for the relevant purpose.

9. Serious risks, incidents and legal disclosures

We may use or disclose information without consent where permitted or required by law, including where reasonably necessary to:

• prevent or lessen a serious threat to life, health or safety;
• report suspected abuse, neglect, exploitation or violence;
• respond to an NDIS reportable incident;
• comply with child-safety or mandatory-reporting obligations;
• manage an emergency;
• investigate suspected unlawful activity or serious misconduct;
• respond to a court order, subpoena or lawful government request; or
• establish, exercise or defend a legal or insurance claim.

10. Overseas storage and disclosure

Some technology and cloud-service providers used by Dolare Care may store or process

information outside Australia. Where personal information may be disclosed overseas, we take

reasonable steps to ensure it is handled consistently with applicable Australian privacy

requirements. Further information about relevant service providers and storage locations is available

on request, subject to security and confidentiality considerations.

11. Information security

We take reasonable administrative, physical and technical steps to protect personal information from:

• misuse, interference and loss;
• unauthorised access;
• unauthorised modification or disclosure; and
• accidental damage or destruction.

These safeguards may include:

• role-based access and user permissions;
• passwords and multi-factor authentication;
• secure cloud systems and protected devices;
• confidentiality agreements and privacy training;
• worker screening and access controls;
• secure storage and disposal of paper records;
• incident and data-breach response procedures; and
• regular review of our information-handling practices.

No electronic system is completely secure. If you communicate with us by ordinary email or text message, there may be risks outside our reasonable control.

12. Data breaches

A data breach may involve the loss of information or unauthorised access to or disclosure of personal information.

If a suspected breach occurs, we will:

• take steps to contain it;
• assess what information and individuals may be affected;
• take reasonable remedial action;
• document and review the incident; and
• notify affected individuals and the Office of the Australian Information Commissioner where required under the Notifiable Data Breaches scheme.

We will also notify other regulators or funding bodies where required.

13. Accuracy and correction

We take reasonable steps to ensure the information we hold is accurate, complete, up to date and relevant.

Please tell us if your contact details, health information, support needs, representatives or other circumstances change.

You may request correction of your personal information by contacting us. If we do not agree to a requested correction, we will explain our decision where required and advise you of available options, which may include attaching a statement to the record.

14. Access to your information

You may request access to personal information we hold about you.

Before providing access, we may need to verify your identity or authority to act for another person.

We will respond within a reasonable period, generally within 30 days.

Access may be refused or limited where permitted by law—for example, if providing access would unreasonably affect another person’s privacy, create a serious safety risk, reveal legally privileged information or otherwise be unlawful.

If access is refused, we will generally provide written reasons and explain how you may make a complaint. We will not charge for making a request, although reasonable administrative costs may apply where legally permitted. We will tell you about any proposed charge in advance.

15. Anonymity and pseudonyms

Where lawful and practical, you may interact with us anonymously or using a pseudonym, such as when making a general enquiry.

However, we usually need accurate identifying, health and funding information to safely provide and claim payment for disability services.

16. Direct marketing

We may send service updates, newsletters or other information where you have consented or where otherwise permitted by law.

You may opt out at any time by:

• using the unsubscribe option in the communication; or
• contacting us at support@dolarecare.com.au.

We do not use sensitive or health information for direct marketing without consent where consent is required.

17. Record retention and disposal

We retain personal information for as long as it is needed to provide services, meet legal and contractual obligations, manage complaints or claims, and satisfy NDIS, employment, taxation, insurance and audit requirements.

When information is no longer required and we are legally permitted to dispose of it, we take reasonable steps to securely destroy or permanently de-identify it.

18. Privacy complaints

If you believe we have mishandled your information or breached your privacy, please contact our Privacy Officer:

Privacy Officer
Dolare Care Pty Ltd
Email: support@dolarecare.com.au
Telephone: 0416 010 963
Postal address: PO Box 5059, Cranbourne VIC 3977

Please provide:

• your name and contact details;
• a description of your concern;
• relevant dates, people or documents; and
• the outcome you are seeking.

We will acknowledge your complaint, investigate it fairly and aim to provide a written response within 30 days. If more time is needed, we will explain why and provide an updated timeframe.

You will not be disadvantaged or have your services unfairly affected because you make a privacy complaint.

If you are dissatisfied with our response, or we do not respond within a reasonable period, you may contact:

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Telephone: 1300 363 992

For complaints specifically concerning health information in Victoria, you may also contact:

Health Complaints Commissioner Victoria
Website: www.hcc.vic.gov.au
Telephone: 1300 582 113

If your concern relates to the quality or safety of NDIS supports, you may contact:

NDIS Quality and Safeguards Commission
Website: www.ndiscommission.gov.au
Telephone: 1800 035 544

19. Changes to this policy

We may update this Privacy Policy when our services, systems or legal obligations change.

The current version will be published on our website. Material changes may also be communicated directly where appropriate.

20. Contact us

For questions about this policy, requests for access or correction, or privacy complaints, contact:

Dolare Care Pty Ltd
Email: support@dolarecare.com.au
Telephone: 0416 010 963
Postal address: PO Box 5059, Cranbourne VIC 3977
Website: www.dolarecare.com.au