Privacy Policy

1. About This Privacy Policy

Yafa Care (ABN: 63189833166) is committed to protecting your privacy and handling your personal information with care, respect, and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information as a registered NDIS provider delivering disability support services across Sydney and surrounding areas, including Auburn, Lidcombe, Granville, and the broader Cumberland Council region.

Who We Are

Yafa Care is a registered NDIS provider offering 24/7 disability support services including in-home personal care, nursing and clinical care, community access support, and specialized disability services.

Why Privacy Matters in Disability Support

As an NDIS provider, we recognize that privacy is a fundamental human right. The NDIS Code of Conduct specifically requires us to “respect the privacy of people with disability.” We understand the sensitive and personal nature of the information you share with us, and we take our privacy obligations seriously.

Your Rights

Under Australian privacy law, you have the right to:

• Know why your personal information is being collected, how it will be used, and who it will be disclosed to
• Access the personal information we hold about you
• Request correction of your personal information if it’s inaccurate, out-of-date, incomplete, or misleading
• Make a complaint if you believe we have breached your privacy
• Request that we de-identify or destroy your personal information in certain circumstances
• Remain anonymous or use a pseudonym where practicable (though this may limit our ability to provide NDIS services)

2. What Personal Information We Collect

Types of Personal Information

We collect personal information that is reasonably necessary to provide you with quality disability support services under your NDIS plan. This includes:

Identity and Contact Information:

• Full name, date of birth, gender, and preferred pronouns
• Residential address, postal address, and contact details (phone, email)
• Emergency contact information
• Identification documents (e.g., driver’s license, Medicare card, passport for identity verification)
• NDIS participant number and plan details

Health and Medical Information (Sensitive Information):

• Disability type and diagnosis
• Medical history and current health conditions
• Medication lists and medication management requirements
• Allergies and dietary requirements
• Clinical assessments and reports
• Doctor and specialist contact information
• Hospital admission records
• Mental health information
• Information about your physical, psychological, or psychiatric disability

Support and Care Information:

• Your NDIS goals and support needs
• Current support arrangements and service providers
• Support coordinator and plan manager details
• Care plans and service agreements
• Progress notes and incident reports
• Risk assessments and behavior support plans
• Communication preferences and methods
• Cultural, religious, or spiritual preferences
• Language and interpreter requirements

Financial Information:

• NDIS funding category and budget details
• Payment and invoicing information
• Plan management details
• Medicare and health insurance information

Family and Relationships:

• Next of kin and emergency contacts
• Information about family members, carers, or guardians who may be involved in your care
• Authorized representative or nominee details
• Consent forms for family communication

Other Information:

• Photographs or videos (only with your explicit consent, for service delivery or documentation purposes)
• Audio recordings of support sessions (only with your explicit consent)
• Information about your living situation and home environment
• Your preferences, interests, and hobbies (to personalize support)
• Feedback and complaints
• Any other information you choose to provide to us

Sensitive Information

Under the Privacy Act, sensitive information includes information about your health, disability, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record. We only collect sensitive information:

• With your explicit consent (or your authorized representative’s consent if you’re unable to provide consent)
• When it’s reasonably necessary to provide NDIS services to you
• When required or authorized by law
• In emergency situations to prevent serious threat to life, health, or safety

Information About Children

If you’re a child (under 18 years) or the parent/guardian of a child receiving NDIS services, we may collect information about the child including their health, disability, education, and family circumstances. We obtain consent from parents or legal guardians before collecting personal information about children.

3. How We Collect Your Personal Information

Direct Collection

We primarily collect personal information directly from you through:

• Initial intake assessments and service agreements
• Registration and enrollment forms (paper or digital)
• Phone calls, emails, text messages, and face-to-face conversations
• Our website contact forms and inquiry submissions
• Support coordination meetings
• Clinical assessments and care planning sessions
• Daily support notes and progress reports
• Feedback surveys and satisfaction reviews

Collection from Third Parties

We may also collect your personal information from third parties, including:

NDIS-Related Sources:

• National Disability Insurance Agency (NDIA)
• Your NDIS support coordinator or plan manager
• NDIS Commission (for compliance and quality purposes)

Healthcare Providers:

• Your GP, specialists, or treating doctors
• Hospitals, clinics, or rehabilitation centers
• Allied health professionals (occupational therapists, physiotherapists, psychologists)
• Pharmacists

Other Service Providers:

• Other disability support providers currently or previously supporting you
• Schools, educational institutions, or employment services
• Community organizations

Family and Representatives:

• Parents, guardians, or authorized representatives
• Family members involved in your care (with your consent)
• Advocates or case managers

Legal and Government:

• Courts or tribunals
• Government agencies (Centrelink, Medicare, child protection services)
• Police or emergency services (in emergency situations)

When We Collect Information Without Your Knowledge

In limited circumstances, we may collect information about you from third parties without your direct knowledge, but only when:

• It’s unreasonable or impracticable to collect it directly from you
• Required or authorized by law
• Necessary to prevent or lessen a serious threat to life, health, or safety
• For legal proceedings or complaints handling

We will take reasonable steps to inform you about the collection as soon as practicable.

Unsolicited Information

If we receive personal information about you that we haven’t solicited, we will determine within a reasonable period whether we could have collected it under the APPs. If we could not have collected it, we will destroy or de-identify the information as soon as lawful and reasonable to do so.

4. Why We Collect and Use Your Personal Information

Primary Purposes

We collect and use your personal information for the following primary purposes:

Service Delivery:

• Assessing your support needs and eligibility for our services
• Developing personalized care plans aligned with your NDIS goals
• Delivering disability support services as outlined in your NDIS plan
• Matching you with appropriate support workers
• Providing 24/7 on-call support and emergency assistance
• Coordinating with other healthcare and support providers
• Managing medication, clinical care, and health monitoring
• Facilitating community access and social participation
• Recording progress notes and maintaining accurate service records

NDIS Compliance and Reporting:

• Claiming payment from the NDIS for services provided
• Reporting to the NDIA as required under the NDIS Act
• Complying with NDIS Practice Standards and quality requirements
• Responding to NDIS Commission audits, investigations, or reviews
• Managing incident reporting and safeguarding requirements

Business Operations:

• Processing payments and managing your account
• Scheduling support workers and coordinating services
• Communicating with you about your services
• Managing complaints and feedback
• Quality improvement and service evaluation
• Training and supporting our staff to deliver better care
• Meeting our legal and regulatory obligations

Safety and Risk Management:

• Assessing and managing risks to your safety and wellbeing
• Responding to emergencies and critical incidents
• Preventing and addressing abuse, neglect, violence, or exploitation
• Complying with mandatory reporting obligations

Secondary Purposes

We may also use your personal information for secondary purposes, including:

• Sending you information about new services or programs that may benefit you (with your consent)
• Research and de-identified data analysis to improve disability services (only with your consent or in de-identified form)
• Responding to legal requests, court orders, or government investigations
• Internal auditing and quality assurance
• Protecting our legal rights and defending legal claims

We will only use your information for secondary purposes if:

• You would reasonably expect us to use it for that purpose, and it’s related to the primary purpose (or directly related if it’s sensitive information)
• You have consented to the use
• It’s required or authorized by law
• It’s necessary to prevent serious threat to life, health, or safety

5. How We Share Your Personal Information

When We Disclose Your Information

We understand the importance of confidentiality in disability support services. We will only disclose your personal information in the following circumstances:

With Your Consent:

When you provide explicit consent, we may share your information with:

• Family members, carers, or friends you authorize
• Your chosen representatives or advocates
• Other support providers as you request

NDIS-Related Disclosures:

• NDIA: For plan management, service bookings, claiming payments, and compliance reporting
• NDIS Commission: For registration, worker screening, incident reporting, quality audits, and complaint investigations
• Your Support Coordinator or Plan Manager: To coordinate services and manage your NDIS funding
• Other NDIS Providers: When necessary for coordinated care (e.g., sharing relevant health information with your physiotherapist)

Healthcare Providers:

• Your GP, specialists, or treating doctors for medical coordination
• Hospitals or emergency departments in medical emergencies
• Allied health professionals involved in your care
• Pharmacists for medication management

Legal and Mandatory Reporting:

We are required by law to disclose personal information in certain circumstances:

• Child Protection: When there are reasonable grounds to suspect a child is at risk of significant harm
• Reportable Incidents: To the NDIS Commission regarding incidents involving NDIS participants
• Elder Abuse: When we suspect abuse or neglect of a vulnerable person
• Court Orders or Subpoenas: When legally compelled to disclose information
• Law Enforcement: In response to lawful requests from police or regulatory authorities
• Serious Threat: To prevent or lessen a serious threat to life, health, or safety

Service Providers and Business Operations:

• Support Workers and Staff: On a need-to-know basis to deliver your services
• Rostering and Scheduling Software: To coordinate your support (stored securely in Australia)
• Payroll and Accounting Providers: For payment processing
• IT Service Providers: Who maintain our systems (all bound by confidentiality agreements)
• Legal Advisors: When seeking legal advice about our services
• Insurance Providers: For insurance claims or risk management
• Auditors: For compliance and financial audits

Quality and Safety:

• Behavior Support Practitioners: For restrictive practices oversight or behavior support planning
• Quality and Safeguarding Authorities: For quality improvement and safeguarding investigations
• External Consultants: For service reviews or clinical supervision (de-identified where possible)

De-identification

Wherever practicable, we de-identify your personal information before disclosing it for research, quality improvement, or statistical purposes. De-identified information cannot reasonably identify you.

We Never Sell Your Information

Yafa Care will never sell, rent, or trade your personal information to third parties for marketing purposes.

6. Overseas Disclosure

Our Policy on Overseas Transfers

Yafa Care primarily stores and processes all personal information within Australia. We do not routinely transfer personal information overseas.

However, in limited circumstances, your personal information may be accessed or stored by overseas service providers, including:

Cloud Storage Providers:

Some of our technology systems use cloud services that may store data on servers located overseas. Where this occurs:

• We only use reputable providers with servers in secure jurisdictions (such as Amazon Web Services, Microsoft Azure)
• We ensure contractual protections are in place requiring compliance with the APPs
• Data is encrypted during transmission and at rest

7. How We Protect Your Personal Information

Security Measures

Yafa Care takes the security of your personal information seriously and implements comprehensive technical and organizational measures to protect it from misuse, interference, loss, unauthorized access, modification, or disclosure.

Physical Security:

• Secure office premises with controlled access (swipe cards, locks, security systems)
• Locked filing cabinets for paper records
• Secure document storage rooms
• Visitor sign-in procedures
• Clean desk policy for staff
• Secure destruction of paper records (shredding)

Technical Security:

• Password-protected computer systems with multi-factor authentication
• Encrypted data storage and transmission (SSL/TLS encryption)
• Regular software updates and security patches
• Firewalls and anti-virus protection
• Secure cloud storage with Australian servers where possible
• Regular data backups
• Access logs and monitoring
• Automatic session timeouts

Organizational Security:

• Strict privacy and confidentiality policies for all staff
• Role-based access controls (staff only access information necessary for their role)
• Regular privacy and security training for all workers
• Background checks and NDIS Worker Screening Clearances for all staff
• Confidentiality agreements with staff and contractors
• Incident response and data breach protocols
• Regular security audits and risk assessments

Mobile and Remote Access:

• Encrypted mobile devices for support workers
• Secure mobile apps for progress notes and communication
• Remote access via VPN (Virtual Private Network)
• Lost or stolen device procedures

Staff Training and Obligations

All Yafa Care staff, contractors, and volunteers are required to:

• Complete privacy and confidentiality training upon commencement and annually
• Sign confidentiality agreements
• Only access personal information necessary to perform their role
• Report any suspected privacy breaches immediately
• Follow secure information handling procedures
• Return or destroy all information upon cessation of employment

Retention and Destruction

We retain your personal information for as long as:

• You are receiving services from us
• Required by law (minimum 7 years for NDIS and health records)
• Necessary for legal, regulatory, or quality purposes

When information is no longer required, we:

• Securely destroy paper records through shredding
• Permanently delete electronic records using secure deletion methods
• De-identify information if it’s retained for research or quality purposes

Third-Party Service Providers

When we engage third-party service providers (such as IT support, cloud storage, or software providers), we:

• Conduct due diligence on their security practices
• Require contractual obligations to protect personal information
• Ensure they comply with the APPs
• Regularly review their performance
• Only provide minimum necessary information

Limitations

While we take all reasonable steps to protect your information, no system is completely secure. We cannot guarantee absolute security of information transmitted over the internet or stored electronically. You also have a responsibility to keep your passwords and login details secure.

8. Your Rights to Access and Correct Your Information

Right to Access

You have the right to request access to the personal information we hold about you. This includes the right to:

• See copies of your support notes and care plans
• Review your health and medical information
• Understand how we’ve used and disclosed your information
• Obtain copies of documents in your file

How to Request Access

To request access to your personal information:

1. Submit a Written Request to our Privacy Officer (contact details in Section 13)
2. Include:
   • Your name and contact details
   • Details of the information you’re requesting
   • Your preferred format (email, physical copies, in-person viewing)
   • Proof of identity (to protect your privacy)
   • Authority to request on behalf of someone else (if applicable)

Our Response

We will respond to your access request:

• Within 30 days of receiving your request
• By providing access in the format you’ve requested where reasonable
• Free of charge (except for reasonable photocopying or administrative costs, which we’ll inform you about)

We will provide access unless there’s a valid reason to deny or limit access.

Reasons We May Deny Access

We may deny or limit access if:

• Providing access would pose a serious threat to life, health, or safety
• It would have an unreasonable impact on another person’s privacy
• The request is frivolous or vexatious
• Information relates to legal proceedings or would prejudice law enforcement
• Providing access would reveal confidential commercial information
• Access is unlawful or would prejudice enforcement activities
• Required or authorized by law

If we deny access, we will provide you with written reasons and information about how to complain.

Right to Correction

You have the right to request correction of your personal information if it’s:

• Inaccurate (incorrect or false)
• Out-of-date (old information that’s no longer current)
• Incomplete (missing important details)
• Irrelevant (not necessary for our purposes)
• Misleading (could create wrong impression)

How to Request Correction

To request correction:

1. Contact us in writing (details in Section 13)
2. Specify what information is incorrect and how it should be corrected
3. Provide supporting evidence if available

Our Response to Correction Requests

We will:

• Respond within 30 days
• Correct the information if we agree it’s inaccurate, out-of-date, incomplete, irrelevant, or misleading
• If we’ve disclosed the incorrect information to third parties, take reasonable steps to notify them of the correction
• Provide written reasons if we refuse to correct the information

If We Refuse Correction

If we refuse your correction request:

• We will provide written reasons for the refusal
• You have the right to request that we attach a statement to your record noting that you believe the information is inaccurate, out-of-date, incomplete, irrelevant, or misleading
• We will attach this statement and include it whenever we use or disclose that information
• You have the right to make a complaint (see Section 11)

No Charge for Access or Correction

We do not charge for:

• Making an access or correction request
• Correcting your information
• Attaching a statement to your record

We may charge reasonable costs for:

• Photocopying or printing large volumes of records
• Sending records by post
• Converting records to your requested format

We will inform you of any costs before proceeding.

9. Consent and Withdrawal of Consent

When We Need Your Consent

We need your explicit consent to:

• Collect sensitive information (such as health and disability information)
• Use or disclose your information for purposes other than the primary purpose
• Share your information with family members or others not directly involved in your NDIS services
• Take photographs or videos of you
• Contact you for marketing purposes

How We Obtain Consent

We obtain consent:

• In writing through consent forms and service agreements
• Verbally (which we document in writing)
• Through your actions (implied consent in some circumstances)
• From your authorized representative, guardian, or parent if you’re unable to provide consent

We ensure consent is:

• Voluntary – Freely given without pressure or coercion
• Informed – You understand what you’re consenting to
• Specific – Related to particular uses or disclosures
• Current – We regularly review and update consent

Consent for Children

If you’re under 18 years of age, we obtain consent from your parent or legal guardian. However, we will also seek your consent where you’re capable of understanding and consenting.

Consent for People Unable to Consent

If you’re unable to provide consent due to cognitive impairment, disability, or other circumstances, we may obtain consent from:

• Your legal guardian
• Your appointed decision-maker or attorney
• A “responsible person” under the Privacy Act (family member or carer)

Withdrawing Consent

You have the right to withdraw your consent at any time by:

• Contacting us in writing or verbally
• Notifying your support coordinator
• Completing a consent withdrawal form

Important: Withdrawing consent may affect our ability to provide certain services to you. We will discuss this with you before you withdraw consent.

When you withdraw consent:

• We will stop using or disclosing your information for that purpose
• We will document the withdrawal
• Information already collected and used with consent remains valid for those past uses
• We may still use or disclose information if required by law

Exceptions to Consent

We may collect, use, or disclose your personal information without consent when:

• Required or authorized by law
• Necessary to prevent or lessen a serious threat to life, health, or safety
• For law enforcement or regulatory purposes
• Information is publicly available
• For legal proceedings or complaints handling

10. How to Make a Complaint

You can make a complaint:

• Phone: +61 401 449 998 
• Email: info@yafacare.com.au
• In writing: Yafa Care Complaints Officer, 16 Park Rd, Auburn NSW 2144, Australia
• In person: Speak directly with your support coordinator or service manager

Complaint Process

1. Acknowledgment: We acknowledge complaints within 2 business days
2. Investigation: We investigate thoroughly and impartially
3. Response: We provide a written response within 21 days
4. Resolution: We work with you to resolve concerns satisfactorily

11. Cookies and Website Privacy

Our Website

Yafa Care operates a website at [www.yafacare.com.au]. This section explains how we handle information collected through our website.

What are Cookies?

Cookies are small text files placed on your device by websites you visit. They help websites remember your preferences and improve your experience.

How We Use Cookies

Our website uses the following types of cookies:

Essential Cookies (Always On):

• Enable core website functionality
• Remember your session as you navigate pages
• Cannot be disabled as the website won’t work properly without them

Analytics Cookies (Can be Disabled):

• Help us understand how visitors use our website
• Track page views, time spent, and navigation patterns
• Information is aggregated and anonymous
• We use [Google Analytics / other service]

Functionality Cookies (Can be Disabled):

• Remember your preferences (language, location)
• Enhance website features and personalization

Advertising Cookies (If applicable):

• We do not currently use advertising cookies
• If we do in future, we will update this policy and seek your consent

Managing Cookies

You can control cookies through your browser settings:

• Chrome: Settings > Privacy and Security > Cookies
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies and website data
• Edge: Settings > Cookies and site permissions

Blocking all cookies may affect website functionality.

Information Collected Through Our Website

Automatically Collected:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring website
• Device type (desktop, mobile, tablet)

Voluntarily Provided:

• Name, email, phone (through contact forms)
• Service inquiry information
• Feedback or comments
• Any information you provide in forms or emails

How We Use Website Information

Website information is used to:

• Respond to your inquiries
• Improve website performance and user experience
• Understand visitor demographics and behavior
• Prevent fraud and security threats
• Comply with legal obligations

Third-Party Links

Our website may contain links to third-party websites (such as social media, NDIA website, or partner organizations). We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.

Third-Party Services

Our website may use:

• Google Analytics – To analyze website traffic
• Google Maps – To display our office location
• Social Media Plugins – Facebook, LinkedIn (these may collect data according to their own policies)

Security

Our website uses SSL/TLS encryption (https://) to protect information transmitted between your browser and our servers. However, no internet transmission is 100% secure.

Changes to Website Privacy Practices

We may update our website privacy practices from time to time. Changes will be posted on this page with an updated “Last Updated” date.