Privacy and Cancellations policy 

​

1. Purpose

​

Bubbles Therapy is committed to protecting the privacy, dignity and confidentiality of all people who use our services.

This policy outlines how Bubbles Therapy collects, uses, stores, discloses and protects personal information in accordance with:

• Privacy Act 1988 (Cth)

• Australian Privacy Principles (APPs)

• NDIS Act 2013

• NDIS Practice Standards

• NDIS Code of Conduct

• NDIS Quality and Safeguards Commission requirements

• Relevant State and Territory privacy and recordkeeping legislation.

Bubbles Therapy recognises that respecting privacy is fundamental to providing safe, person-centred and high-quality supports.

​

2. Scope

​

This policy applies to:

• Participants

• Families

• Carers

• Guardians

• Nominees

• Staff

• Contractors

• Consultants

• Any person acting on behalf of Bubbles Therapy.

​

3. Policy Statement

​

Bubbles Therapy will:

• Respect every person's right to privacy.

• Collect only information necessary to provide supports.

• Always maintain confidentiality.

• Store information securely.

• Only disclose information when authorised or legally required.

• Give participants access to their personal information.

• Ensure all workers understand their privacy obligations.

​

4. Personal Information We Collect

​

Information may include:

• Name

• Address

• Date of birth

• Telephone numbers

• Email address

• Emergency contacts

• NDIS participant number

• NDIS plan information

• Goals and support needs

• Therapy records

• Assessments

• Progress notes

• Behaviour support information

• Incident reports

• Medication information where relevant

• Financial and billing information

• Communication records

• Risk assessments

• Health information

• Cultural, language or accessibility needs.

Sensitive information is collected only where necessary and handled with additional care.

​

5. How Information is Collected

​

Information may be collected from:

• Participants

• Parents or guardians

• Nominees

• Healthcare professionals

• Support Coordinators

• Plan Managers

• The NDIA

• Referral agencies

• Other providers (with consent)

• Publicly available sources where permitted by law.

Where practical, information will be collected directly from the participant.

 

6. Why We Collect Information

 

Personal information is collected to:

• Deliver safe and effective supports.

• Develop service agreements.

• Complete assessments.

• Prepare therapy plans.

• Monitor participant outcomes.

• Coordinate services.

• Manage appointments.

• Process NDIS claims.

• Meet funding requirements.

• Manage complaints.

• Respond to incidents.

• Comply with legislation.

• Improve service quality.

 

7. Confidentiality

 

All information relating to participants is confidential.

Workers must:

• Keep participant information private.

• Discuss participant information only with authorised people.

• Access records only when required to perform their duties.

• Never share participant information in public areas.

• Protect information from accidental disclosure.

• Secure documents when unattended.

• Log out of electronic systems when not in use.

• Report any privacy breach immediately.

Confidentiality continues even after employment or engagement with Bubbles Therapy ends.

 

8. Consent

 

Where possible, Bubbles Therapy will obtain informed consent before collecting, using or sharing personal information.

Consent may be provided by:

• The participant.

• A legally authorised representative.

• A guardian.

• A nominee.

Participants may withdraw consent at any time unless disclosure is required by law.

 

9. Disclosure of Information

​

Information may be shared:

• With participant consent.

• With healthcare professionals involved in care.

• With authorised family members.

• With Support Coordinators.

• With Plan Managers.

• With the NDIA.

• With the NDIS Commission.

• With emergency services where required.

• Where authorised or required by law.

Only the minimum necessary information will be disclosed.

​

10. Disclosure Without Consent

​

Information may be disclosed without consent where required by law, including:

• Reportable incidents.

• Mandatory child protection reporting.

• Abuse or neglect investigations.

• Serious and imminent threats to life, health or safety.

• Court orders or subpoenas.

• Police investigations where legally authorised.

• Regulatory investigations.

Where lawful and appropriate, participants will be informed of the disclosure.

 

11. Storage and Security

​

Bubbles Therapy protects information through:

• Password-protected electronic systems.

• Secure cloud storage.

• User access controls.

• Multi-factor authentication where available.

• Locked storage for paper records.

• Secure disposal of confidential documents.

• Regular software updates.

• Virus and malware protection.

• Staff confidentiality agreements.

• Privacy training.

Only authorised personnel may access participant records.

 

12. Record Retention

​

Records will be retained in accordance with legislative requirements.

Unless legislation requires longer retention:

• Participant records are retained for a minimum of seven (7) years after services cease.

• Records relating to children are retained in accordance with applicable legal requirements.

• Records are securely destroyed or permanently de-identified once the retention period expires.

 

13. Access and Correction

 

Participants have the right to:

• Access their records.

• Request copies of records.

• Request corrections.

• Request incomplete information be updated.

Requests should be made in writing to Bubbles Therapy.

Requests will be responded to within a reasonable timeframe.

 

14. Privacy Breaches

​

A privacy breach includes:

• Loss of participant records.

• Unauthorised access.

• Accidental disclosure.

• Cybersecurity incidents.

• Sending information to the wrong person.

• Stolen devices containing participant information.

 

Where a breach occurs, Bubbles Therapy will:

1. Contain the breach.

2. Assess the risks.

3. Notify affected individuals where required.

4. Meet obligations under the Notifiable Data Breaches Scheme where applicable.

5. Implement corrective actions.

6. Review systems to prevent recurrence.

 

15. Responsibilities

 

Management

Management is responsible for:

• Implementing this policy.

• Monitoring compliance.

• Providing privacy training.

• Managing privacy complaints.

• Investigating breaches.

• Maintaining secure systems.

Workers

All workers must:

• Follow this policy.

• Maintain confidentiality.

• Complete privacy training.

• Protect passwords.

• Report suspected privacy breaches immediately.

• Respect participant dignity and choice.

 

16. Complaints

Participants may make a privacy complaint by contacting Bubbles Therapy.

Complaints will be:

• Acknowledged promptly.

• Investigated fairly.

• Responded to in writing where appropriate.

• Managed confidentially.

If a complainant is dissatisfied with the outcome, they may contact the Office of the Australian Information Commissioner (OAIC) or the NDIS Quality and Safeguards Commission.

​

17. Related Documents

• Participant Consent Form

• Service Agreement

• Records Management Policy

• Incident Management Policy

• Complaints Management Policy

• Information Technology Policy

• Code of Conduct

• Participant Rights and Responsibilities

• Document Retention Schedule

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

19. Policy Review

This policy will be reviewed every two years, or sooner if there are changes to legislation, NDIS requirements, or organisational practices.

​

Version :1     Policy Review Due: July 2028 

​​