Privacy Policy

About this policy

Able to Thrive PTY LTD (ACN 656 521 265) is a registered NDIS provider operating across Greater Sydney and the Inner West. We handle your personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the privacy requirements of the NDIS Quality and Safeguards Commission.

This policy covers information we collect through our website, in person, by phone, by email, and during the delivery of our NDIS support services.

What information we collect

The information we collect depends on who you are and how you interact with us.

Participants and their family

• Name, date of birth, and contact details
• NDIS participant number and plan details
• Health, disability, and care information
• Goals, preferences, routines, and behavioural support plans
• Emergency contacts and cultural or language information
• Photos and videos (only with consent)

Job applicants and staff

• Name, contact details, and right-to-work documentation
• CV, qualifications, and references
• Working with Children Check and NDIS Worker Screening clearance
• Background information from reference checks

Website visitors

• Information you give us through forms (name, email, phone, message)
• Anonymous analytics: page views, browser type, general location
• Cookies (see below)

Business contacts

• Plan managers, support coordinators, allied health professionals, and other providers: name, role, organisation, and contact details

How we collect information

We collect information directly from you whenever possible. We may also collect it from people you've authorised (such as a plan manager or family member), from referrers, from background check providers (with your consent), and automatically through our website.

Why we collect and use your information

We use your personal information to:

• Deliver NDIS supports tailored to your needs
• Maintain accurate records as required by the NDIS Practice Standards
• Communicate with you and your support network
• Process invoices, claims, and payments
• Recruit, screen, and train staff
• Improve our services and respond to feedback
• Meet legal and regulatory obligations
• Send service updates and program information (only with consent)

Who we share information with

We may share your information with:

• Our support workers and contractors (only what's needed to deliver your service)
• Your plan manager and support coordinator
• Other providers in your care team (with your consent)
• The NDIS Quality and Safeguards Commission when required
• Law enforcement or government agencies where required by law
• Service providers we engage (such as payroll, IT, and accounting) under confidentiality obligations

How we protect your information

• Staff only see what they need to do their job
• Physical records are stored securely
• Digital records are kept in encrypted cloud systems with multi-factor authentication
• Staff are trained on privacy and confidentiality
• We have data breach response procedures aligned with the Notifiable Data Breaches scheme

How long we keep your information

We keep your personal information for as long as required by the NDIS Act, Privacy Act, and other applicable laws. This is generally seven years after our service to you ends. After that, we securely destroy or de-identify it.

Your rights

You have the right to:

• Ask what personal information we hold about you
• Request access to that information
• Ask us to correct anything that's inaccurate
• Withdraw consent (for example, for photos or marketing)
• Make a complaint about how we've handled your information

We respond to access and correction requests within 30 days.

Cookies and website analytics

Our website uses essential cookies to function and analytics cookies to understand how visitors use the site. You can disable cookies through your browser settings, but some parts of the site may not work properly without them.

Marketing

We only send you service updates, newsletters, or program information by email or SMS with your consent. You can unsubscribe any time using the link in the message or by emailing us.

Photos and media

We may collect, store, and share photos or video of participants, but only with consent. Where a participant cannot give their own consent, we seek it from their substitute decision-maker.

We ask for different consent depending on how an image will be used:

• Internal records and participant albums: to document activities, support delivery, and progress
• Sharing with family and support networks: updates from day programs and activities
• Marketing materials: website, social media, brochures, only with separate explicit written consent

You can withdraw consent for the use of your image at any time. When you do, we will:

• Stop using your image in any new materials immediately
• Remove your image from our website and social channels where possible
• Take reasonable steps to recall or remove printed and distributed materials

Photos and video are stored in secure, access-controlled systems and treated with the same care as other personal information.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page tells you when it last changed. We'll let current participants and staff know directly about significant changes.

Contact us or make a complaint

If you have a question, want to access your information, or want to make a complaint about how we've handled it, contact our Privacy Officer:

If you're not satisfied with our response, you can also contact:

For NDIS-specific concerns: