Your information, handled with care.

Effective: 20 May 2026

1. About this policy

This Privacy Policy explains how Nurtured Spark Pty Ltd (ABN 31 634 001 415) manages the personal information we collect, hold, use and disclose. It applies to all the people we work with — National Disability Insurance Scheme (NDIS) participants, Department of Veterans' Affairs (DVA) clients, private senior care clients, their families and representatives, referrers, job applicants, and visitors to our website.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the privacy obligations that apply to private sector health and disability service providers, the NDIS Code of Conduct and NDIS Practice Standards, and the Australian Association of Social Workers (AASW) Code of Ethics (2020).

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. "Health information" is a sensitive subset that receives extra protection under the Act.

2. What information we collect

We only collect information that is reasonably necessary for one or more of our functions or activities. Depending on the service, this can include:

• Identifying details — name, date of birth, address, phone, email, emergency contacts.
• Funding details — NDIS participant number and plan dates, DVA card type and number, Medicare, Home Care Package details, or private billing details.
• Health and social information — medical history, disability, mental health, medications, supports already in place, social history, cultural background, and goals you'd like to work on.
• Service notes — assessment notes, case notes, reports, correspondence with your treating team.
• Referral information — GP, allied health, DVA, NDIS plan manager, support coordinator, family or carer.
• Veteran-specific information — service history relevant to your care, where you choose to share it.

If you choose not to provide requested information, we will let you know — some gaps may limit what we can do safely for you.

3. How we collect information

We usually collect information directly from you, in conversation, by phone, email, our referral and contact forms, or in a home visit. With your consent, we may collect information from third parties such as:

• Your GP or treating doctor and allied health professionals.
• The National Disability Insurance Agency, your plan manager or support coordinator.
• The Department of Veterans' Affairs.
• Your family, carer, guardian, attorney or nominee.
• Hospitals, community health services, or other providers involved in your care.

If we collect information about you from someone else, we will take reasonable steps to let you know.

4. Why we collect it — how we use your information

We use your personal and health information to:

• Provide social work, NDIS supports, DVA Veteran Social Work and Private Senior Care services.
• Plan and coordinate your care, write reports, and review goals.
• Communicate with you about appointments, reminders, follow-up care, and changes to your supports.
• Bill your funding source or invoice you for private services.
• Meet our legal, professional and accreditation obligations — including NDIS Practice Standards, AASW Code of Ethics, and mandatory reporting where it applies.
• Continuously improve our services through supervision, audit, and quality processes (always handled confidentially).

5. Who we may disclose your information to

We will only disclose your personal information where you have consented, where it is reasonably expected and connected to the reason it was collected, or where the law requires or permits it. The people we may share information with include:

• Your treating team — GP, psychiatrist, psychologist, occupational therapist, speech pathologist, nurse, or other allied health professionals involved in your care.
• Your referrer — usually your GP. We may send a closing summary or progress updates as clinically appropriate. Tell us if you'd prefer we didn't.
• Funding bodies — the NDIA, NDIS plan managers, support coordinators, the Department of Veterans' Affairs, Medicare, My Aged Care, or another funder, to verify and bill for services delivered.
• Family, carers and nominees — where you have authorised us to do so, or where necessary in a serious risk-to-safety situation.
• Regulators — the NDIS Quality and Safeguards Commission, AHPRA, the AASW, or other authorities, where required by law.
• Our contractors — for example, IT, secure cloud storage, accountants, and insurers, all bound by confidentiality.

We do not sell your information. We do not disclose it to anyone outside Australia without your consent, except where required by law.

6. How we store and protect your information

Your records are held in secure electronic systems hosted in Australia, with access limited to staff who need it for your care. We use the protections expected of a private health provider: password and multi-factor controls, encryption in transit, audited access logs, secure backup, locked physical files where paper is unavoidable, and routine staff training.

We retain clinical records for the periods required by Australian law — generally a minimum of seven years after our last contact with you, or until age 25 for clients who were under 18. After that we securely destroy or permanently de-identify your information.

7. Accessing and correcting your information

You can ask to see the information we hold about you and to correct anything that is out of date or inaccurate. We aim to respond within 30 days. We may ask you to verify your identity first, and a reasonable administrative fee may apply for large requests. Where we don't agree to a correction, we will note your requested change on the record.

To make a request, contact us using the details at the bottom of this page.

8. Our website, cookies and analytics

When you browse nurturedspark.com.au we don't try to identify you personally. Our server logs may record standard information such as your IP address, the pages you visited, your browser, and the time of your visit, for security and to understand how the site is used.

We use temporary cookies to make the site work properly. You can refuse cookies in your browser settings; some parts of the site may then not work as expected. If we link to external websites, we are not responsible for their content or their privacy practices.

9. Reminders and electronic communications

If you give us your phone number or email, we may use them to send appointment reminders, follow-up notes, invoices, and short service updates. We will not add you to a marketing list without your consent, and you can opt out of any non-essential communication at any time.

10. NDIS-specific privacy obligations

As a service that supports NDIS participants, we follow the privacy obligations set out in the NDIS Code of Conduct and NDIS Practice Standards. That means we:

• Respect each participant's privacy and dignity in how we collect, store and share information.
• Only share information needed to deliver agreed supports, and only with people you've nominated.
• Make our records available to the NDIS Quality and Safeguards Commission and the NDIA where required.
• Tell you who your support workers are and what information they will see.

11. Data breaches

If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

12. Complaints about privacy

If you are unhappy with how we have handled your personal information, please contact us first — we take complaints seriously and try to resolve them quickly. If you are not satisfied with our response, you can also raise it with:

• Office of the Australian Information Commissioner (OAIC) — 1300 363 992 or oaic.gov.au.
• NDIS Quality and Safeguards Commission — 1800 035 544 or ndiscommission.gov.au (for NDIS-related concerns).
• Australian Association of Social Workers — 03 9320 1044 or ethicscomplaint@aasw.asn.au (for concerns about social work conduct).

13. Updates to this policy

We review this policy regularly. The current version is always published on our website with the effective date at the top. Significant changes will be communicated to active clients.

14. Contact us

Privacy Officer, Nurtured Spark Pty Ltd
Email: admin@nurturedspark.com.au
Phone: 1300 677 166
Post: Nurtured Spark Pty Ltd, Metropolitan & Regional Victoria, Australia
ABN: 31 634 001 415