Back to home
Privacy & confidentiality
Confidentiality & Privacy Policy
OIT Million respects each participant's dignity and right to privacy. This policy explains how we collect, use, store, protect, access, correct and disclose personal information.
1. Purpose
- OIT Million Pty Ltd respects each participant's dignity and right to privacy. This policy explains how OIT Million collects, uses, stores, protects, accesses, corrects and discloses personal information and sensitive information in connection with NDIS supports and business operations.
2. Scope
- This policy applies to directors, employees, contractors, practitioners, volunteers and other persons acting for OIT Million.
- It applies to participant, representative, worker, referrer and other personal information held in paper, electronic, photographic, audio, video or other formats.
3. Principles
- Collect only information reasonably necessary for safe, appropriate and lawful service delivery or business administration.
- Explain what information is being collected, why it is needed, how it may be used and who it may be disclosed to.
- Seek informed, voluntary, current and sufficiently specific consent where consent is required or relied upon.
- Use additional care when handling health, disability, cultural and other sensitive information.
- Give participants reasonable access to their information and a way to request correction.
- Protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
- Respect confidentiality in conversations, records, transport, homes, community settings and digital communications.
- Do not use participant information, photographs, recordings or stories for marketing or social media without separate, specific consent.
4. Information OIT Million may collect
- Identity and contact details, NDIS number and representative/nominee information where relevant.
- NDIS plan, funding-management and service information needed to arrange or invoice agreed supports.
- Health, disability, communication, accessibility, mobility, allergy and other support-related information.
- Cultural and linguistic preferences and information voluntarily provided to support culturally responsive services.
- Risk assessments, support notes, incident and complaint records, consent records and service communications.
- Professional assessments or reports provided by the participant or authorised third parties.
- Billing and payment information and records required for legal, insurance, audit or quality purposes.
- Images, audio or video only where there is a legitimate purpose and appropriate consent or lawful authority.
5. How information is collected
- Information will usually be collected directly from the participant or authorised representative through referrals, intake, assessments, service delivery, forms, telephone, email and other agreed communications.
- Information may also be received from a plan manager, support coordinator, health/allied-health professional, family member, advocate or other provider where the participant has authorised the sharing or another lawful basis applies.
6. Consent
- Participants will be told the purpose of collection, use and disclosure in language and a communication method they are likely to understand.
- Consent will not be broader than reasonably necessary for the stated purpose.
- Consent for sensitive information, photographs, video/audio, marketing and non-routine information sharing will be expressly documented where appropriate.
- A participant may amend or withdraw consent at any time, subject to legal obligations and the practical consequences of withdrawal.
- Withdrawal will apply prospectively; OIT Million may still retain records it is legally required or reasonably entitled to retain.
- Where a representative gives consent, OIT Million will take reasonable steps to confirm that the person has authority to do so and will involve the participant to the greatest extent practicable.
7. Use and disclosure
- OIT Million will use or disclose personal information for the purpose for which it was collected and for related purposes that are reasonably expected or otherwise permitted by law.
- Examples include delivering supports, coordinating agreed services, billing, safety and risk management, complaints and incidents, quality improvement, insurance and legal/regulatory compliance.
- Information may be shared with persons or organisations identified in a participant's consent, such as a representative, plan manager, support coordinator, allied-health professional or other provider.
- OIT Million will limit disclosure to information reasonably necessary for the stated purpose.
8. Disclosure without consent
- OIT Million may disclose information without consent where required or authorised by law or where another lawful exception applies.
- This may include responding to a serious threat to life, health or safety, mandatory reporting, reportable incidents, lawful requests from regulators or courts, or safeguarding concerns.
- The reason and disclosure should be documented where appropriate.
9. Privacy and dignity during service delivery
- OIT Million workers are trained to knock, seek permission and respect private spaces in participant homes.
- Discuss personal matters discreetly and only with people who need the information.
- Do not leave participant files, screens or messages visible to unauthorised people.
- Do not discuss participants in public areas or on personal social-media accounts.
- Respect personal-care privacy and dignity where applicable to the agreed support.
- Use participant-preferred names, communication methods and culturally respectful practices.
10. Storage and security
- Paper records will be stored in secure locations with controlled access.
- Electronic records will use reasonable access controls, passwords and secure systems appropriate to OIT Million's size and risk profile.
- Workers must not store participant records on unauthorised personal devices, accounts or applications.
- Information sent electronically must be handled carefully and recipient details checked before sending.
- Access is limited to workers who require the information for their role.
- Records will be securely destroyed or de-identified when no longer required, subject to legal, contractual and regulatory retention requirements.
11. Accuracy, access and correction
- OIT Million will take reasonable steps to keep participant information accurate, complete and current.
- Participants may ask to access personal information OIT Million holds about them or request correction.
- Requests will be handled within a reasonable period and any lawful reason for refusing or limiting access will be explained.
12. Confidentiality obligations of workers
- OIT Million's workers sign or otherwise acknowledge confidentiality and privacy obligations.
- Confidential information is only accessed for legitimate work purposes.
- Passwords, access credentials and participant information are not shared improperly.
- Confidentiality continues after employment or engagement with OIT Million ends.
- Suspected privacy breaches will be reported immediately to the Director/Compliance responsible person.
13. Photographs, video, audio and marketing
- Consent to receive NDIS support does not automatically include consent for photographs, video, audio recording, testimonials, marketing, websites or social media.
- OIT Million will seek separate and specific permission for these purposes.
- Refusing marketing/media consent will not disadvantage a participant's access to supports.
14. Privacy breaches
- A suspected loss, unauthorised access, disclosure or misuse of personal information will be reported immediately.
- OIT Million will contain the breach, assess the risk of harm, take remedial action, document the event and determine whether notification to affected individuals, the Office of the Australian Information Commissioner, the NDIS Commission or another authority is required.
15. Privacy complaints
- Participants may raise privacy concerns through OIT Million's Complaints Management & Resolution process without retaliation.
- OIT Million will investigate concerns fairly and may provide information about external complaint avenues, including the Office of the Australian Information Commissioner and the NDIS Quality and Safeguards Commission where relevant.
16. Cross-border and third-party systems
- Before using external service providers or systems to store or process participant information, OIT Million will consider privacy, confidentiality and security risks.
- Where personal information may be disclosed overseas, OIT Million will consider applicable privacy-law requirements and inform or seek consent from the participant where required.
Questions about privacy?
If you have any questions about this policy, would like to access your information, or wish to make a privacy complaint, please contact us.