Privacy Policy

1. About this policy

Grace & Mercy Care Services Pty Ltd ("we", "us", "our") is committed to protecting the privacy of personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what personal information we collect, why, how we use and store it, and how you can access or correct it.

2. What we collect

Depending on how you interact with us, we may collect:

• Contact details: name, email, phone number, address
• Enquiry and referral form content, including details you provide about a participant
• NDIS-related information: NDIS number, plan management type, plan details, funding and goals
• Sensitive information under the Privacy Act — including health information and information about disability — where relevant to delivering a support
• Employment application details, for people applying to work with us
• Website usage data collected through analytics (see section 8)

We only collect sensitive information (such as health or disability information) with your consent, or where otherwise permitted or required by law, and only what is reasonably necessary to deliver or coordinate your supports.

3. How we collect it

Mostly directly from you or your representative — through our website forms, by phone, email, or in person. We may also collect information from a support coordinator, plan manager, treating clinician, family member or guardian acting on your behalf, or from the NDIA, where you've consented to that or it's otherwise lawful.

4. Why we collect and use it

We use personal information to:

• Respond to enquiries and referrals
• Assess and coordinate the supports you're seeking
• Deliver services under a service agreement, including day-to-day support notes and incident records
• Meet our reporting and record-keeping obligations under the NDIS Practice Standards and the NDIS Act
• Manage staffing, including assessing job applications
• Improve this website, using de-identified analytics data

We don't use personal information for direct marketing without your consent, and we don't sell personal information.

5. Who we may share it with

We may disclose personal information to:

• Your support coordinator, plan manager, or other providers involved in your supports, with your consent
• The NDIS Quality and Safeguards Commission and the NDIA, where required by law or the NDIS Practice Standards — for example, reportable incidents
• Emergency services, treating medical practitioners or next of kin, where there's a serious risk to health or safety
• Our service providers — for example, website hosting, email delivery, or payroll — bound by confidentiality obligations
• A person's legal guardian or authorised representative, where applicable

We do not disclose personal information overseas except where a service provider we use (such as website hosting) stores data on servers located outside Australia — see section 6.

6. Storage, security and overseas hosting

We store information on access-controlled systems and take reasonable steps to protect it from misuse, loss, unauthorised access, modification or disclosure. This website may be hosted on servers located outside Australia (for example, through a cloud hosting provider); where that's the case, the provider is contractually required to protect data to a comparable standard.

Participant service records are retained for the period required under the NDIS Practice Standards and applicable record-keeping laws, and securely destroyed or de-identified once that period has passed.

7. Access and correction

You can ask to see what personal information we hold about you, or ask us to correct it, at any time. Email info@gmcservices.net.au or call 0404 185 123. We'll respond within a reasonable time and won't charge you for a straightforward request. In some circumstances permitted by law, we may need to refuse access — if so, we'll explain why.

8. Cookies and website analytics

This website does not use cookies for advertising or tracking you across other sites. Where analytics are enabled, they use aggregated, privacy-friendly measurement and do not identify individual visitors. Enquiry and referral forms are the only places this site asks for personal information directly.

9. Children and vulnerable people

Where a participant is a child or a person who requires a guardian or representative to provide consent, we collect and disclose personal information consistent with that person's consent arrangements, and take extra care with sensitive information about them.

10. Making a privacy complaint

If you think we've mishandled your personal information, tell us first — email info@gmcservices.net.au or call 0404 185 123, or see our Complaints page. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

1300 363 992
www.oaic.gov.au

11. Changes to this policy

We may update this policy from time to time. The current version will always be available on this page.

12. Contact us

Grace & Mercy Care Services Pty Ltd
25 Hayford Road, Haynes WA 6112
0404 185 123 · info@gmcservices.net.au