Privacy Policy

Bloom Supports is committed to protecting your privacy and handling your personal and health information with care, respect and transparency.

1. About this Policy

{name}{abnSuffix} is a Registered NDIS Provider operating across Gympie, Sunshine Coast and the Wide Bay region of Queensland, Australia. We provide disability supports under the National Disability Insurance Scheme (NDIS).

This Privacy Policy explains how we collect, use, disclose and protect personal information, including sensitive and health information. It describes our approach to the *Privacy Act 1988* (Cth), the Australian Privacy Principles and applicable NDIS privacy and information-management requirements.

This policy applies to information handled online and offline, including through enquiries, referrals, intake, service delivery, recruitment and other business activities.

Reading this policy, visiting our website or submitting an enquiry does not give blanket consent to collect, use or share your information. Where consent is required, we seek it for the particular activity.

You can ask us to explain this policy or provide it in an accessible format.

2. What personal information we collect

We collect information reasonably necessary for the activity involved. Depending on your dealings with us, this may include:

- **Contact and communication:** Your name, contact details and communication or accessibility preferences. - **Enquiries and referrals:** Referrer details and the nature of an enquiry or referral. - **Support needs:** Goals, requested supports, living circumstances and relevant funding information. - **Representation:** Information about a representative and their authority for a particular decision. - **Sensitive information:** Relevant support, safety and health information, as explained in Section 3. - **Records:** Correspondence, consent choices, service records, feedback and complaints. - **Recruitment:** Employment application details, qualifications and work history. - **Website use:** Usage and technical information, as explained in Section 9.

At initial enquiry, please provide only what is needed to explain your request. Avoid sending full clinical reports, identity documents or complete NDIS plans unless we have discussed why they are needed and how to provide them.

You may make a general enquiry anonymously or using a different name where practical. If we need particular information to assess a referral or provide support, we will explain why and what may be affected if you choose not to provide it.

3. Sensitive and health information

Sensitive information may include disability, health, cultural or other personal information given special protection by privacy law.

We generally collect sensitive information only where it is reasonably necessary for our activities **and you have given valid consent**, unless a specific legal exception applies. Information being relevant to NDIS supports does not, by itself, remove the need for consent.

We explain what information is needed and why, and support you to understand and communicate your decision. Consent must be voluntary, informed, current and specific.

You may choose someone to help you make decisions. A family relationship, support coordinator role or nominee appointment does not automatically give someone authority to make every privacy decision for you. Where another person makes a decision on your behalf, we check their authority for that decision.

4. How we collect information

We collect personal information in a number of ways, including:

- **Referral form:** When you or someone referring you submits information through our website. - **Contact and enquiry:** When you contact us by phone, email or through the website. - **Careers form:** When you submit an expression of interest for employment with Bloom Supports. - **Directly from you:** During intake, assessment or service delivery conversations. - **Third parties:** From an authorised representative, referrer, support coordinator, health professional or another person involved in your support, with appropriate consent or another lawful basis. - **Website:** Through website analytics tools and cookies, as explained in Section 9.

Where reasonable and practical, we collect information directly from you.

If you refer someone else, explain the referral to them and obtain any necessary permission before providing their information. Tell us if their consent or your authority is uncertain so we can discuss the next step.

Receiving a referral does not automatically authorise us to contact everyone in the person’s support network.

5. Why we collect information

We collect information to:

- **Respond to enquiries:** Assess whether we may be able to meet a person’s support needs. - **Understand the person:** Discuss goals, preferences, compatibility and relevant safety considerations. - **Provide supports:** Plan, coordinate and provide agreed supports. - **Manage administration:** Handle service administration, funding and payments. - **Respond to concerns:** Manage feedback, complaints and incidents. - **Meet obligations:** Fulfil applicable legal, reporting and safeguarding requirements. - **Recruit workers:** Assess employment applications. - **Maintain our systems:** Operate, maintain and improve our website and business systems.

We explain additional information needs as your involvement with Bloom Supports progresses.

6. How we use your information

We use information for the purpose for which it was collected. We use it for another purpose only with consent or where privacy law otherwise permits or requires this.

Initial intake and information-sharing consent do not themselves authorise services, tenancy arrangements, clinical treatment, photography or marketing.

**Sharing with your support network**

Where we ask to contact your support network, we discuss who may be contacted, what information may be requested or given, the purpose and any limits. Agreeing to one exchange does not automatically authorise other exchanges.

**Optional photographs and promotional uses**

We seek separate permission for optional uses such as identifiable participant photographs, testimonials or promotional stories. Declining these optional uses does not prevent you from making an enquiry or being considered for support.

7. Who we share information with

Depending on the purpose and lawful basis, relevant information may be shared with:

- **Our personnel:** Authorised Bloom Supports personnel who need it for their work. - **Your chosen contacts:** People you authorise, within the agreed limits. - **Support professionals:** Relevant support providers and health professionals. - **Funding bodies:** Plan managers or the NDIA for applicable funding and payment administration. - **NDIS Commission:** For applicable quality, safeguarding and regulatory matters. - **Other authorities:** Emergency services, regulators or other bodies where disclosure is required or permitted by law. - **Technology providers:** Providers supporting hosting, databases, email, file storage, analytics and other business functions.

This list does not give automatic permission for every disclosure. We limit information sharing to what is appropriate for the particular purpose.

**Technology services and overseas handling**

Our website is hosted through Replit in Australia. The referral system is configured to store submissions in a database and send notification emails through Resend. These notifications can contain submitted referral details, including support information and free text.

Technology providers may handle information outside Australia, including in the United States. Resend states that its account data is stored in the United States regardless of the sending region. Australian website hosting does not establish that database records, emails, backups and all other processing remain in Australia.

We are confirming the locations and arrangements applying to our other technology services. Contact us for the information currently available. Where overseas handling constitutes a disclosure, the applicable Australian privacy requirements continue to apply.

8. How we store and protect your information

Information may be held in electronic systems, email and paper records. We take reasonable steps to protect it from loss, misuse and unauthorised access, alteration or disclosure, taking account of its sensitivity.

Access should be limited to authorised people who need information for their work. No storage or transmission method can provide an absolute security guarantee.

**Retention and disposal**

Retention depends on the type of record, why it is held and applicable legal requirements. When information is no longer needed for a permitted purpose and does not need to be retained by law, we take reasonable steps to destroy it or de-identify it.

Archiving a record is not the same as deleting it. Email copies and backups may have separate retention arrangements. You can ask us about the handling of particular records.

9. Website analytics and cookies

**Google Analytics**

Our website uses Google Analytics to help us understand website use and improve content. Analytics may collect information such as pages visited, page addresses and titles, interactions, browser or device details and cookie or similar identifiers.

We do not describe all analytics information as anonymous. Google may process information outside Australia.

Please do not place names, contact details, NDIS numbers or health information in website addresses or links. We do not intend referral answers or health information to be sent to analytics.

**Other external requests**

Our website also loads Google Fonts, which creates requests to Google independently of Analytics.

**Your choices**

You can use browser settings to manage or block cookies, although some website features may be affected. Blocking cookies does not necessarily prevent every external request. Contact us if you would prefer to discuss an enquiry by phone.

10. Accessing and correcting your information

You can ask to access personal information we hold about you or request correction of information that is inaccurate, incomplete, out of date, irrelevant or misleading.

**Making a request**

Contact us using Section 12. We may need to confirm your identity and any representative’s authority before releasing information.

We will respond within a reasonable period. If access or correction is refused, we will explain the reasons, where permitted, and available complaint options.

**Charges**

There is no charge to make a request or request a correction. If a reasonable access charge is proposed, we will explain it beforehand.

11. Privacy complaints

**Contact Bloom Supports**

If you have a privacy concern, contact us using Section 12. You can raise it verbally or in writing, with assistance from a trusted person or advocate if you choose.

We will consider your concern, explain the next steps and aim to respond within 30 days. If more time is needed, we will explain why and keep you informed.

**Office of the Australian Information Commissioner**

If you are dissatisfied with our response, or have not received a response within 30 days, you can contact the Office of the Australian Information Commissioner:

- **Website:** [www.oaic.gov.au](https://www.oaic.gov.au) - **Phone:** 1300 363 992

**NDIS Quality and Safeguards Commission**

Concerns about an NDIS provider or worker can also be raised directly with the NDIS Quality and Safeguards Commission:

- **Website:** [www.ndiscommission.gov.au](https://www.ndiscommission.gov.au) - **Phone:** 1800 035 544

You do not need our permission to contact either body.

12. Contact us about privacy

**Withdrawing or limiting consent**

You can withdraw or limit consent by telling us, calling or emailing. You do not have to complete a new signed form just to withdraw consent.

We will stop future handling that relies on the withdrawn consent and explain any practical effect on the proposed activity or support. Withdrawal does not undo information already lawfully handled or remove obligations to retain records or make disclosures required by law.

**Communication support**

Please tell us if you need communication assistance, an interpreter, an accessible copy or support from a trusted person.

13. Updates to this policy

We may update this policy when our practices or relevant requirements change. The current version will be available on our website with its publication date.

Where a change requires fresh consent, we will seek it separately. Continuing to use the website does not, by itself, give consent to new uses or disclosures of personal information.