Privacy policy.
The information you share with us is personal, and often about your health. This policy explains what we collect, why we need it, who sees it and how you stay in control of it.
Last updated 9 October 2026
1. About this policy
My Support and Care (MySupportAndCare Pty Ltd, ABN 70 669 568 058) is a registered NDIS provider in Melbourne (registration no. 4050130101). We handle personal and health information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic) and the NDIS Practice Standards.
This policy applies to participants, families and carers, referrers, support workers and job applicants, and anyone who contacts us or uses this website.
2. What we collect
We only collect what we need to provide safe, suitable support. Depending on how you deal with us, this may include:
- name, date of birth, address, phone and email
- NDIS number, plan details and funding information
- health and disability information, medications, care plans, behaviour support plans and risk information
- cultural background, language, preferences and goals
- contact details for family, guardians, nominees, support coordinators and treating health professionals
- for staff and applicants: work history, qualifications, references, NDIS worker screening and Working with Children checks
Health information is sensitive information. We collect it only with your consent, or where the law allows or requires it.
3. How we collect it
Usually directly from you: in person, by phone or email, or through our referral, feedback and job forms.
With your consent, we may also receive information from people involved in your support, such as family, guardians, support coordinators, plan managers, hospitals, health professionals and the NDIA.
4. Why we use it
- to respond to referrals and enquiries
- to plan, deliver and review your supports safely
- to match you with the right support workers and home
- to claim NDIS payments and manage service agreements
- to meet legal duties, including incident reporting to the NDIS Commission and worker screening
- to recruit, train and support our staff
- to handle feedback and complaints, and improve our services
6. This website
Our website forms send your details straight to our team. Please share only what we need. Detailed clinical information is better sent once we are in touch.
The site uses Google Fonts and links to YouTube, Google reviews and social media. Videos only load from YouTube when you press play. Those services may collect basic technical information, such as your IP address, under their own privacy policies.
7. AI and technology
Like many organisations, we use artificial intelligence (AI) tools to help run our business. These include general AI assistants and the AI features built into our rostering, client management, email and meeting software.
We use AI for operational work only: drafting documents and messages, summarising meetings, admin tasks and automating routine processes. AI does not make decisions about your supports, your eligibility, your support workers or employment. A staff member reviews AI-assisted work, and people make the decisions.
We redact identifying details before documents are put into general AI tools wherever practical. Some of our systems, such as our rostering and client management software, include AI features that work with the information already stored in them. We choose tools with appropriate security, and where possible we store data in Australia. Some providers may process information overseas, and when they do we take reasonable steps to keep it protected.
Some meetings may be recorded and transcribed by an AI notetaker. We will let you know at the start, and you can ask us not to record.
If you have questions about how we use AI, or would prefer that your information is not used with AI tools, please contact us and we will talk it through with you.
8. Keeping it safe
Records are kept in secure systems, with access limited to staff who need it. Staff are trained in privacy and confidentiality. We keep records for as long as the law requires (generally at least seven years under NDIS rules), then destroy or de-identify them securely.
9. Access and correction
You can ask to see the information we hold about you, or ask us to correct it, at any time. Contact us and we will respond within 30 days. If we can’t give you access, for example where it would affect someone else’s privacy, we will explain why in writing.
10. Staying anonymous
You can make general enquiries, give feedback or raise a complaint without giving your name. We do need to identify you to provide NDIS supports.
11. If something goes wrong
If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme.
12. Privacy complaints
If you are worried about how we have handled your information, please tell us through our Feedback page or by contacting us directly. We will acknowledge your complaint promptly and aim to resolve it within 30 days.
If you are not satisfied, you can contact the OAIC on 1300 363 992 or at oaic.gov.au ↗, the Victorian Health Complaints Commissioner, or the NDIS Commission on 1800 035 544.
13. Changes and contact
We may update this policy from time to time, and the date at the top will show the latest version. For privacy questions, access requests or a printed copy, contact us Monday to Friday, 9am to 5pm.