Privacy & Data Management Policy

1. What this policy is about

Facilitatrix wants everyone to feel safe sharing information with us. We commit to keep your information private and confidential.

This policy explains: what information we collect, how we keep it safe, who can see it, and what to do if something goes wrong.

2. What information we collect

We collect personal information so we can provide services and run our organisation.

This includes: your contact details, emergency contacts, client information (NDIS plans, reports, case notes), and staff information (qualifications, checks, HR documents).

3. How we collect information

We may collect information from you directly, from family, health professionals, or legal decision-makers, by phone, in person, online, or in writing. Paper documents are uploaded and then shredded.

4. How we store information

We keep information safe by using secure computer systems (CMS, OneDrive), using passwords and access levels, locking paper files in cabinets until they can be shredded, and destroying documents after 7 years.

5. How we use your information

We only use your information to provide services, for things you would expect (e.g., referrals), or when the law requires it (e.g., police, courts, NDIA). We will not share your information without your consent unless someone is unsafe, the law requires it, or a crime has happened or may happen.

6. Your rights

Participant/Client Rights: You can ask to see your information, ask us to fix information that is wrong, choose who we can talk to, or make a complaint if you are unhappy. We may refuse access only if the law allows it.

Staff Rights: You can access your staff file, ask for corrections, or make a grievance if needed.

7. Consent

We ask for your consent when collecting information, sharing information, or storing information. If you have a substitute decision-maker (guardian, administrator, EPG) we will consult with them and get their consent where the law requires this.

8. Privacy breaches

If something goes wrong we will tell you as soon as possible, investigate, and give you the outcome in writing or your preferred format. NDIS participants will be supported to contact the NDIS Commission if they want to.

9. Complaints

If you are worried about your privacy you can complain to Facilitatrix. If you are not happy with the outcome, you can contact the Australian Information Commissioner, the NDIS Commission (for NDIS participants), or HaDSCO (WA).

Date: 17.11.25. Next Review Date: 17.11.27