Your Story, Your Information, Your Rights

Your Story Community Supports (“Your Story”, “we”, “us” or “our”) is a registered NDIS provider (Provider Number 4-JFUSI9U), an NSW Community Justice & Regulation approved SSRC provider (CGVA0770) and a Carer Gateway delivery partner (CG-SPR-439). We deliver supports to people living with disability, older Australians and their carers across New South Wales and Queensland.

We are committed to protecting your privacy and handling your personal information openly, lawfully and transparently, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as well as our obligations under the NDIS Practice Standards and relevant state legislation.

This policy applies to everyone we interact with — NDIS participants, families and carers, clients and their representatives, website visitors, job applicants, and staff, support workers and volunteers.

We only collect information that is reasonably necessary for our services. Depending on how you interact with us, that may include:

• Identity and contact details — name, date of birth, address, phone number, email, preferred language and pronouns, emergency and support contacts.
• Support and care information — NDIS number and plan details, goals, support needs, behavioural and care plans, medication and health information, therapy reports, and hospital or discharge summaries.
• Service and funding records — service agreements, shift and progress notes, incident and complaints records, invoices, and plan manager or funding details.
• Sensitive information — information about disability, health (including psychosocial disability), cultural or Aboriginal and Torres Strait Islander background, religious or spiritual beliefs, sexual orientation, gender identity and criminal history where it is relevant to a role. We collect this only with your consent or where the law allows or requires it.
• Employment information — résumés, cover letters, work history, qualifications, referee details, and working with children or vulnerable person screening and police check outcomes for people who apply to work with us.
• Website information — the pages you view, how you arrived at our site, your device and browser type, and an abbreviated IP address, collected through cookies and analytics tools.
• Communications — messages, emails, call notes, form submissions, feedback and complaints you send us.

If you choose not to give us certain information, we may not be able to assess a referral, deliver supports, or process an application. We will always explain why when we ask.

• Directly from you — through our website forms (Contact, Referrals and Join Our Team), by phone, email, in person, or during an intake or home visit.
• From people involved in your care — your family, carer, plan manager, support coordinator, treating health or allied health professionals, or the NDIA, where you have told us it is OK.
• From government and partner programs — for example Carer Gateway and its delivery partners, where you have accessed or been referred to our carer services.
• Automatically — through cookies and analytics when you visit yourstorycommunitysupports.com.

We use your information to:

• Respond to enquiries, assess referrals, and work out whether our services are the right fit for you.
• Design, deliver and coordinate supports — including SIL placements, in-home support, respite, aged care and community access.
• Manage funding, scheduling and invoicing, and work with your plan manager or funding body.
• Meet our legal and regulatory obligations — including worker screening, incident reporting, audits, and records required by the NDIS Quality and Safeguards Commission.
• Keep in touch about your supports, and (where you have opted in) let you know about community events, programs and new resources.
• Recruit and manage staff, support workers and volunteers.
• Improve our services, websites and the way we communicate.

We do not sell your personal information, and we do not use it for targeted advertising.

We share information only where it is necessary, and only with people who are bound to keep it confidential:

• Our staff, support workers, contractors and volunteers — on a need-to-know basis for the supports you receive.
• Your support network — plan managers, support coordinators, family or carers you have nominated, and health or allied health professionals working with you.
• Regulators and government — the NDIS Quality and Safeguards Commission, NSW agencies, aged care regulators, or police and courts where we are required or authorised by law.
• Carer Gateway partners — such as Wellways, where you are receiving carer services through that program.
• Service providers who help us operate — website hosting, form processing (submissions sent through our website are handled by a third-party form service), payment processing, phone and email systems, and secure record storage.

Much of the information we handle about disability, health and personal circumstances is “sensitive information” under the Privacy Act. We collect it only with your voluntary consent (or where the law requires it), use it only for the purpose you gave it to us, and never use or disclose it for advertising. You can withdraw your consent at any time by contacting us, though that may limit the support we can provide.

We do not intend to send your personal information overseas. Some of the technology we use (such as website hosting, analytics or cloud storage) may store data outside Australia. Where that happens, we take reasonable steps to ensure the overseas recipient handles your information in line with the Australian Privacy Principles, and you can ask us for more detail about a specific service.

Your information is kept in secure systems and locked files, with access limited to the people who need it for your supports or our obligations. We have policies on confidentiality, device security, and how staff handle records, and we review them regularly.

• Care and service records are kept while you are with us, and afterwards for the periods required by law and by NDIS and state record-keeping rules, then securely destroyed.
• Applications for roles are kept for up to 12 months after the position closes so we can consider you for future opportunities — or deleted sooner if you ask.
• Marketing and event communications stop immediately when you ask us to unsubscribe.

No system is completely secure. If an eligible data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and tell you what we are doing to fix it.

You can ask us at any time to:

• Access the personal information we hold about you (we will usually provide it within 30 days, may ask for ID to protect your records, and may charge a reasonable admin fee for copies).
• Correct information that is inaccurate, out of date or incomplete.
• Delete your information, where we are not required by law to keep it.
• Stop contacting you for marketing, events or newsletters.
• Deal with us anonymously or by pseudonym where that is practicable.
• Receive information in an accessible format, or with an interpreter, if you need that.

To make a request, contact our Privacy Officer using the details below. We will confirm what we can do and why, in plain language.

Where a person is a child, or lacks the capacity to consent, we collect information with the consent of a parent, guardian or nominated representative — and we still include the person themselves in decisions about their information as far as is reasonable.

• Essential cookies keep the site working and remember your preferences.
• Analytics cookies tell us, in aggregate, which pages and resources are helpful so we can improve them.
• You can block or delete cookies in your browser settings; some parts of the site may not work as well if you do.
• Our site links to Facebook and Instagram. If you click through, those platforms collect data under their own privacy policies, which we encourage you to read.

If you think we have mishandled your information, please tell us. We take it seriously and will work to put it right:

• Step 1 — Contact our Privacy Officer by phone on 1300 023 194 or email Admin@yourstorycommunitysupports.com. We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days.
• Step 2 — If you are not satisfied with our response, you may contact the NDIS Quality and Safeguards Commission, or (for SSRC-related matters) the relevant NSW complaints body.
• Step 3 — You can also complain to the Office of the Australian Information Commissioner at privacy.gov.au, free of charge.

Making a complaint will never affect the supports you receive from us.

We may update this policy as our services, systems or the law change. The latest version is always available on this page, with the date it was last revised shown at the top.