Privacy and Confidentiality Policy
Privacy Act 1988 (Cth) | Australian Privacy Principles | NDIS Practice Standards
Purpose
This policy describes how Elastic Brain Academy collects, uses, stores, protects, and discloses personal and sensitive information about participants, their families, and workers, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the NDIS (Privacy and Related Matters) Rules 2014.
Scope
This policy applies to all personal information collected by Elastic Brain Academy about NDIS participants, their families/guardians, and all staff and contractors. It applies to information collected in any format written, digital, audio, or visual.
What information we collect
. Participant Information
- Full name, date of birth, gender, address, and contact details
- NDIS number, plan dates, fund management type, and plan manager details
- Medical history, diagnoses, assessments, and health information
- NDIS goals, support plans, and individualised programs
- Session notes, progress records, and clinical assessments
- Audio and/or video recordings of sessions (with consent)
- Emergency contact details
. Worker Information
- Full name, contact details, qualifications, and professional registration details
- NDIS Worker Screening Clearance and Working With Children Check details
- Employment records, performance information, and training history
How we collect information
Elastic Brain Academy collects information:
- Directly from participants and their families via the Intake Form, Consent Form, and Service Agreement
- From referrers, health professionals, and other providers (with participant consent)
- During the course of delivering supports (session notes, progress records, assessments)
- Via online platforms used for session delivery (Zoom, Google Meet, Teams) where recordings are consented to
How we use information
Information is used to:
- Develop, deliver, and review individualised NDIS support programs
- Communicate with participants, families, and their support networks
- Coordinate care with other providers and allied health professionals (with consent)
- Fulfil NDIS billing, service booking, and reporting obligations
- Comply with NDIS Practice Standards audit requirements
- Improve service quality and organisational practices
Disclosure of information
Elastic Brain Academy will only disclose personal information to third parties in the following circumstances:
- With the explicit written consent of the participant (or their parent/guardian/nominee)
- To other providers, specialists, or allied health professionals for the purpose of coordinating care (with consent)
- To the participant's Plan Manager for NDIS billing purposes
- To NDIS auditors for the purpose of compliance auditing — participants will be advised of this
- To emergency services where the participant's safety is at immediate risk
- Where required or authorised by law (e.g., mandatory reporting obligations, court orders)
Elastic Brain Academy will never sell, share for commercial purposes, or disclose participant information to any party without lawful authority or explicit consent.
Storage and security
This policy will be reviewed annually (or earlier if legislative changes occur), in consultation with participants and staff where possible.
Policy Review
All participant information is stored securely and in accordance with the Australian Privacy Principles:
- Paper records are stored in locked filing systems accessible only to authorised staff
- Digital records are stored in password-protected, encrypted systems with role-based access controls
- Session recordings are stored in secure cloud storage with restricted access and deleted once clinical use is complete or within 7 years
- Information is retained for a minimum of 7 years after the last service delivery (or until the participant turns 25 if they were a child at the time of service)
- When records are no longer required, they are securely destroyed (shredded for physical, permanently deleted for digital)
Access and correction
Participants have the right to:
- Request access to their personal information held by Elastic Brain Academy at any time
- Request correction of any inaccurate or incomplete information
- Withdraw consent for collection or use of their information (where lawfully possible)
Requests to access or correct information should be made in writing to info@ElasticBrainAcademy.com.au. Elastic Brain Academy will respond within 30 days.
Privacy breaches
In the event of an actual or suspected privacy breach, Elastic Brain Academy will:
- Immediately investigate and contain the breach
- Notify affected participants as soon as practicable if the breach is likely to result in serious harm
- Report the breach to the Office of the Australian Information Commissioner (OAIC) where required under the Notifiable Data Breaches scheme
- Document the breach and the steps taken in response
Complaints about Privacy
If a participant believes their privacy has been breached, they may raise a complaint with Elastic Brain Academy's CEO (info@ElasticBrainAcademy.com.au) or contact the OAIC directly: 1300 363 992 | www.oaic.gov.au
Policy review
This policy will be reviewed annually and updated as required to reflect changes in legislation, NDIS requirements, or organisational practices.