How we collect information

We collect information directly from you through enquiries, telephone calls, email, consultations, service delivery, and our online contact, participant referral and Easy Read consent forms. We may also collect information from your authorised representative, support coordinator, healthcare professionals, referring organisations or relevant funding bodies where you consent or the law permits.

When you provide information about another person, please ensure you have their consent or another lawful authority and make them aware of this policy. We verify a representative’s authority where appropriate and support participants to make their own decisions wherever possible.

You can make general enquiries anonymously or using a pseudonym where practicable. For referrals, clinical care, funding claims and service delivery, we usually need to identify you and obtain relevant information. Without it, we may be unable to respond fully or provide safe services.

Please do not include detailed medical records or sensitive health information in the general contact form or ordinary email. Contact us to arrange an appropriate way to share this information

Why we use your information

We may use information that has been appropriately de-identified for service improvement and reporting. We do not treat information as de-identified merely because names have been removed.

Sharing your information

We share information only where reasonably necessary for the relevant purpose and with your consent or another lawful basis. Recipients may include staff and contractors involved in your services; authorised guardians, nominees or carers; your GP, nurses, allied health professionals and support coordinator; plan managers, the NDIA and the NDIS Commission; and service providers supporting our IT, records, communications, accounting or professional advice.

Family members do not automatically have access to your records. We consider your wishes and their authority before sharing information. Regulators, emergency services, insurers, legal advisers or other authorities may receive information where permitted or required by law, including to address a serious threat to health or safety. We limit disclosure to information relevant to the purpose.

We do not sell your personal information. Identifiable health or disability information is not to be used for advertising, audience matching or retargeting.

Consent and your choices

We explain information collection and sharing in a way you can understand. You may ask questions, limit optional sharing or withdraw consent by contacting us. Withdrawal applies to future activities that depend on that consent; it does not reverse past lawful handling or remove our legal recordkeeping duties. We will explain if your choices affect our ability to deliver services safely.

We seek separate permission before using identifiable photographs, videos, recordings or testimonials for promotional purposes. Agreeing to care or submitting a referral does not, by itself, give permission for these uses.

Cookies, tracking and third-party content

Our website includes Google Tag Manager, Meta Pixel references and embedded Google Maps content. Tag Manager manages website tags; what information it processes depends on the tags configured through it. These tools may collect or receive technical and browsing information, including IP addresses, device details, cookie identifiers, pages viewed and interactions. Meta Pixel may support advertising measurement and remarketing. Embedded maps may transmit information to Google when loaded.

Google and Meta may associate browsing information with other information they hold, including an account you are logged into. Their handling is described in their own privacy policies: policies.google.com/privacy and facebook.com/privacy/policy/. Links to external websites are governed by those websites’ privacy practices.

You can block or delete cookies through your browser and adjust advertising preferences through Google or Meta. Where website cookie controls are offered, you can use those controls to manage optional tracking. Blocking cookies may affect some website functions. Browser settings do not necessarily stop all tracking technologies.

Our privacy safeguards require that health details, NDIS numbers, signatures and referral or consent form contents are not transmitted through advertising tags or analytics events. We seek consent before disclosing sensitive information where required by law. Browsing this website is not blanket consent to unrelated uses of sensitive information.

Overseas handling of information

Some technology providers may process or store information outside Australia, or allow access from overseas. This may affect website data, communications or service records depending on the systems used.

Personal information is not likely to be disclosed to any overseas recipients. Our hosting servers are located on the cloud. The cloud instance may be overseas beyond our knowledge. All the data on our website is stored within WordPress and its plugins. The forms on the website are all within WordPress and the outputs are received via a managed email inbox within our offices. The email inbox requires strict credentials to access the data as well as knowledge about our email hosting. 

Where we disclose information overseas, we take the steps required by applicable privacy law to protect it, including reasonable steps to ensure recipients handle it consistently with the Australian Privacy Principles unless a lawful exception applies. We also consider applicable Victorian requirements for transferring health information outside Victoria.

Storage, security and retention

We hold information in electronic systems and, where applicable, paper records. We take reasonable steps to protect it against misuse, interference, loss and unauthorised access, modification or disclosure. Safeguards appropriate to the information include restricted access, secure storage, staff confidentiality obligations and oversight of service providers. No internet transmission or storage method is completely secure.

We retain information for as long as needed for its purpose and applicable legal, clinical, funding and recordkeeping obligations. Victorian health records are generally retained for at least seven years after the last health service for an adult. Longer retention may be required for other legal obligations or ongoing proceedings. When lawful and no longer needed, information is securely destroyed or de-identified.

If a data breach occurs, we assess and respond to it and notify affected people and the OAIC where required under the Notifiable Data Breaches scheme.

Access and correction

You can ask to access or correct information we hold about you by contacting us. We may verify your identity and any representative’s authority. We respond within a reasonable period and any applicable statutory time limit, generally aiming for 30 days. Requests are free to make. Any lawful fee for providing access will be explained in advance and will comply with applicable limits; correction requests are free.

If access or correction is refused on lawful grounds, we provide reasons and explain complaint options, unless the law prevents us from doing so. Where appropriate, we can attach a statement of your requested correction to the record and notify relevant recipients of a correction as required by law.

Newsletters and marketing

We send optional newsletters, event invitations or promotional messages where you have agreed to receive them or where otherwise permitted by law. You may unsubscribe using the message instructions or contact us. Opting out does not prevent essential communications about your care, appointments, accounts or safety. We do not use sensitive information for direct marketing without your consent.

Questions and complaints

Contact our Privacy Officer at info@rahacaregroup.com.au or 0411 877 768. Our head office is in Ringwood, VIC 3134; contact us for a postal address. Please describe your concern and preferred contact method. We acknowledge complaints promptly, investigate and aim to provide a response within 30 days. If more time is needed, we explain why and keep you informed. You may use an authorised representative or ask for communication assistance.

If you are dissatisfied or do not receive a response within 30 days, you may complain to the Office of the Australian Information Commissioner: www.oaic.gov.au/privacy/privacy-complaints (enquiries: 1300 363 992). Victorian health-information concerns may also be raised with the Health Complaints Commissioner: hcc.vic.gov.au, 1300 582 113. NDIS service concerns may be raised with the NDIS Quality and Safeguards Commission: www.ndiscommission.gov.au.

Policy availability and updates

This policy is available free of charge. Contact us for help understanding it, an accessible format or language assistance. We may update it to reflect changes to our services, systems or legal obligations. The current version will be published on our website with its updated date.