Privacy Policy.

Last updated: 19 October 2026

This policy explains what personal information we collect, why we collect it, how we keep it safe and how you can see or correct it. We have written it in plain English. If you would like it in large print or another format, or you would like us to talk you through it, contact us.

Who we are

Access Disability & Support Services is the trading name of Access Disability and Support Services Pty Ltd
ABN 36 688 171 548 · ACN 688 171 548
Email: info@accessdisability.com.au
Phone: 0429 889 376

In this policy, "we", "us" and "Access" mean Access Disability & Support Services.

Access is not a registered NDIS provider. We support NDIS participants whose plans are self-managed or plan-managed.

The laws we follow

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to our activities. We also comply with the Health Records Act 2001 (Vic) and its Health Privacy Principles when handling health information covered by that Act.

We follow the NDIS Code of Conduct, including its requirements to respect the privacy and dignity of people with disability.

The short version

• We only collect what we need to answer you and to provide safe, good-quality support.
• We collect information from you, or from someone you have agreed can share it with us.
• We do not sell your information, and we do not use it for advertising.
• We share it only with people who need it to support you (such as your plan manager), when you agree, or when the law requires or allows us to.
• You can ask to see your information and ask us to correct it at any time.

What we collect

When you use our website forms (Contact, Quick enquiry, Request a Callback, Make a Referral), we collect:

• your name, phone number and/or email
• the best way to contact you, and for a callback, the day and time you choose
• how your NDIS plan is managed (Contact and Make a Referral forms)
• the kind of support you are looking for, and any short message you add
• the age bracket of the person who needs support: under 18, 18 to 64, or 65 and over (optional)
• how you heard about us (optional)
• your agreement to this policy (Request a Callback form)
• for referrals: the referrer's details, the participant's name and contact details, and confirmation that the participant (or their authorised representative) has agreed to the referral.

Optional questions. You can leave the age bracket and "how did you hear about us" questions blank. Your enquiry will be handled the same way either way. We ask for the age bracket so that, if the person is under 18, we can involve a parent or carer from the start. We ask how you heard about us so we know which ways of reaching people are working. We use the answers only for these purposes.

Please don't put detailed medical or other sensitive information in a website form. We will talk with you about anything we need to know in a secure way.

If you become a participant, we also collect the information we need to plan and deliver your supports. This can include:

• your date of birth, address, NDIS number and plan details
• your goals, preferences, routines and communication needs
• health and disability information relevant to your supports (for example, medication prompts, mealtime needs or risks we need to plan for)
• contact details for your emergency contacts, nominee, guardian, advocate or plan manager
• records of the supports we provide, such as progress notes, incident reports and invoices.

Children and young people

Where we provide services to children or young people, we take appropriate steps to protect their privacy and safety. We seek consent from a parent or legal guardian where required, consider the child's age and capacity to make decisions, and handle personal information in accordance with applicable privacy and safeguarding requirements.

Health and disability information is "sensitive information". We collect it only with your consent, or where the law allows.

About our workers and job applicants, we collect the information needed to employ and screen people safely (for example, NDIS Worker Screening and Working with Children Check details). Those records are covered by our internal staff privacy procedures.

How we collect it

We collect information:

• directly from you, in person, by phone, by email or through our website
• from someone acting for you, such as a family member, nominee, guardian or advocate
• from a support coordinator, plan manager or health professional, but only with your consent.

You can contact us without giving your name, or using a different name, to ask general questions. We will need your real details before we can provide or invoice supports.

If we receive information about you that we did not ask for, and we don't need it, we will destroy or de-identify it when it is lawful and reasonable to do so.

Why we use it

We use your information to:

• reply to your enquiry or referral and work out whether we can support you safely
• prepare your service agreement, support plan and risk assessments
• deliver, record and review your supports
• send invoices to you, your nominee or your plan manager
• keep you and our workers safe, including in an emergency
• manage feedback, complaints and incidents
• meet our legal obligations, including under the NDIS Code of Conduct
• improve our services. Where we can, we use de-identified information for this.

We will not use your information for another purpose unless you agree, or the law requires or allows it.

Who we share it with

We share only what is needed, with:

• your plan manager or nominee, to arrange payment
• people you have asked us to involve, such as family, a guardian or an advocate
• other providers or health professionals, with your consent
• the NDIS Quality and Safeguards Commission, the NDIA, police or other authorities, when the law requires or allows it (for example, to report certain incidents, or to prevent a serious threat to someone's life, health or safety)
• emergency services, if you or someone else is at risk
• businesses that help us run Access, such as IT, email, form-processing, software, accounting and insurance providers. They receive the information so they can provide their service to us.

We do not sell, rent or trade personal information. We will only send you marketing (for example, a newsletter) if you ask for it, and you can opt out at any time.

Information stored outside Australia

Some personal information from this website is handled outside Australia. It is disclosed to Netlify, Inc., Cloudflare, Inc. and Automattic, Inc. (Akismet) in the United States, as set out below. Microsoft 365 (Microsoft Corporation) provides our email and calendar. Microsoft may store or process this information in Australia or overseas.

Website hosting. Our website is hosted by Netlify, Inc., a company in the United States. When you visit, Netlify's servers receive technical information that every website receives, such as your IP address, browser type and the page you asked for, so the page can be delivered and the service kept secure. We do not use it to identify you.

Callback requests. A callback is processed by a Netlify Function in US East (Ohio). The function receives your name, phone number, email address if you give one, the day and time you choose, how you would like us to contact you, any message, your agreement to this policy, and your IP address.

We store the callback request, and a separate duplicate-check record, in Netlify Blobs in US East (Ohio). Netlify encrypts these records at rest and in transit. The duplicate-check record holds a reference number, the time, and whether the request was saved. It does not hold your name, phone number or message. We keep these records until we delete them.

Other website forms. Contact, Quick enquiry and Make a Referral, and a copy of each callback request, are received by Netlify Forms. Netlify is a company in the United States. Its documentation does not say where form submissions are stored, so we do not name a city or region for them. A submission includes what you enter, together with technical details such as your IP address and the time, and any campaign tag (UTM tag) in the link that brought you to our site. Form notifications are sent to info@accessdisability.com.au. To stop spam, our forms include a hidden "honeypot" field, and Netlify checks all form submissions with an automated spam filter (Akismet, run by Automattic, Inc. in the United States).

Security check on the callback page. The Request a Callback page uses Cloudflare Turnstile, a check from Cloudflare, Inc., a company in the United States. Turnstile receives your IP address, TLS fingerprint and user agent, with the site key and the page address. Cloudflare processes the check for us. Cloudflare may also use those signals to improve Turnstile, as its own controller. Read Cloudflare's Turnstile privacy addendum.

Email, calendar and our records. Microsoft 365 (Microsoft Corporation) provides our email and calendar. It is Access's interim system for website enquiries, correspondence and related business records. It is not the permanent system for managing participants. Other participant-management or invoicing software is not yet selected. If we adopt another system, we will update this policy.

When you request a callback, we send an email from our Microsoft 365 mailbox to info@accessdisability.com.au. The email contains every field you entered. We also add a private tentative entry to that mailbox's calendar, with your name or your reference, your phone number and the time you asked for.

Our website

Our website does not use cookies for advertising or tracking, and it does not use advertising or social media tracking pixels.

We do not use Google Analytics, Microsoft Clarity, session recording or heatmap tools. If we add another tool, we will update this policy first.

Some links to our website contain campaign tags (UTM tags) that help us understand how people find Access. These tags may be included with information submitted through our website forms. We do not use them for advertising profiles or cross-site tracking.

Links to other websites (such as the NDIS or the NDIS Commission) are covered by those websites' own privacy policies.

How we keep it safe

Callback requests and duplicate-check records in Netlify Blobs are encrypted at rest and in transit. That is the protection Netlify documents for those records.

How long we keep it

We keep participant records for as long as required by applicable laws and for legitimate purposes connected with providing supports, managing incidents, meeting financial obligations and responding to complaints.

Different types of records may have different minimum retention periods. Where a legal retention requirement applies, we keep the relevant records for at least that period.

When records are no longer needed and we are not legally required to retain them, we securely destroy or de-identify them.

We review website enquiries held in Netlify Forms and Netlify Blobs each month. Information needed for ongoing business or legal purposes is retained in our approved business records. Website-held copies are deleted when no longer needed. We do not currently use automatic deletion for website enquiries.

Callback alert emails and the tentative calendar entries in Microsoft 365 are business correspondence. Access manages them under its records practices and deletes them when they are no longer required. They are not kept indefinitely by default, and they are not deleted automatically after a callback.

Seeing and correcting your information

You can ask to see the information we hold about you, and ask us to correct anything that is wrong, out of date or incomplete. Email info@accessdisability.com.au or ask us in person.

• We will confirm who you are (or that you are authorised to act for the person) before we give out any information.
• We aim to respond within 30 days.
• There is no charge to make a request, and we do not usually charge for giving you access. If a large request would cost us a lot to copy or post, we will tell you the cost first. It will never be more than the law allows.
• If we can't give you access, or we don't agree that a correction is needed, we will tell you why in writing and how you can complain. You can ask us to attach a statement to your record.

If there is a data breach

If we become aware of a data breach, we will act promptly to contain it, assess the risks and reduce potential harm. Where the law requires notification, we will notify affected people and the relevant authorities, including the Office of the Australian Information Commissioner where applicable.

Questions and complaints

If you have a question or a concern about your privacy, contact us first:

• Email: info@accessdisability.com.au
• Phone: 0429 889 376

We will take your concern seriously and aim to respond within 30 days.

If you are not happy with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC): 1300 363 992 · www.oaic.gov.au
• Health Complaints Commissioner (Victoria), for health information: 1300 582 113 · www.hcc.vic.gov.au
• NDIS Quality and Safeguards Commission, for concerns about the quality or safety of NDIS supports: 1800 035 544 · www.ndiscommission.gov.au

Automated decisions

We do not use computer programs to make decisions about you automatically. A person makes every decision about your enquiry, referral or supports. If this changes, we will update this policy first.

Changes to this policy

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated.

---