Privacy Policy

1. Information we collect

My Simple Support collects personal information that is necessary to provide disability and aged care supports. The types of information we may collect include:

• Full name, date of birth, and contact details
• NDIS number, plan details, and support budget information
• Health and medical information relevant to your support needs
• Emergency contact and next-of-kin details
• Cultural background, language preferences, and religious beliefs (where relevant to your care)
• Financial information for billing and service agreement purposes
• Progress notes, incident reports, and support records

We collect information directly from you, your authorised representative, or — with your consent — from other providers, healthcare professionals, or government agencies such as the NDIA or My Aged Care.

2. How we use your information

We use your personal information only for the purposes for which it was collected, including:

• Delivering and coordinating your supports and services
• Developing, reviewing, and updating your support plan or care plan
• Communicating with you and your authorised representatives
• Meeting our reporting obligations to the NDIS Quality and Safeguards Commission or Aged Care Quality and Safety Commission
• Processing payments, invoicing, and managing service agreements
• Responding to complaints, incidents, or feedback
• Staff training, quality improvement, and internal administration

We will not use your information for marketing purposes without your explicit consent.

3. Disclosure of information

We may share your information with third parties only where necessary, including:

• Other service providers involved in your care, with your consent
• Government bodies such as the NDIA, My Aged Care, or relevant state authorities, as required by law
• Emergency services or healthcare providers in urgent situations
• Our insurers, legal advisors, or auditors, where required

We do not sell, rent, or trade your personal information to any third party. All third parties we engage are required to handle your information in accordance with the Privacy Act 1988 (Cth).

4. Storage and security

Your information is stored securely in encrypted systems with restricted access. We take all reasonable steps to protect your information from misuse, loss, unauthorised access, modification, or disclosure.

Records are retained for a minimum of:

• 7 years for general participant records (or until the participant turns 25, whichever is later)
• Indefinitely where records relate to serious incidents or legal matters

When information is no longer required, it is securely destroyed or de-identified.

5. Access and correction

You have the right to access the personal information we hold about you and to request corrections if the information is inaccurate, incomplete, or out of date.

To make an access or correction request, please contact us in writing (see Section 8). We will respond as soon as we are able. In some cases, we may be unable to provide access — for example, if doing so would compromise another person's privacy — and we will explain the reason.

There is no charge for making a request, though we may charge a reasonable fee for providing access where the request is complex or requires significant time.

6. Cookies and website data

Our website may use cookies and similar technologies to improve your browsing experience and collect basic analytics data (such as pages visited and time spent on site). This information is aggregate and does not identify you personally.

You may disable cookies in your browser settings at any time. This may affect the functionality of some parts of our website.

We do not use third-party advertising trackers or share website analytics data with external parties for marketing purposes.

7. NDIS and Aged Care obligations

As a registered NDIS provider, we are bound by the NDIS Act 2013, the NDIS Practice Standards, and the NDIS Code of Conduct. As an Aged Care provider, we comply with the Aged Care Act 1997 and the Aged Care Quality Standards.

These frameworks impose specific obligations on how we collect, use, and protect participant and client information. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

8. Contact us

If you have a question, concern, or complaint about how we handle your personal information, please contact our Privacy Officer: