Privacy Policy (Last updated: 08 Aug 2026)

Depending on your relationship with us, we may collect:

​

Personal information

• Name, date of birth, contact details (phone, email, address)

• Emergency contact and next of kin details

• NDIS participant number and plan management type (self-managed, plan-managed, or agency-managed)

Sensitive and health information (collected only with consent, or as otherwise permitted by law)

• Health, disability and diagnostic information

• Behaviour support and therapy records, assessment reports and treatment plans

• Information about support needs, goals and risk factors

• Information shared by other providers, family members, or support coordinators relevant to your care

Website and enquiry information

• Information submitted through our enquiry, booking, or feedback forms

• General website usage data (see Section 8: Website and Cookies)

We only collect sensitive information that is reasonably necessary for us to provide safe, high-quality therapeutic and behaviour support services.

Where a participant is a child, or requires support to make decisions, we collect and share information with the consent of their parent, guardian, or authorised representative. We involve the participant in decisions about their information wherever appropriate to their age, maturity, and understanding.

We collect information:

• Directly from you (forms, phone calls, emails, in-person conversations)

• From your NDIS plan manager, support coordinator, or nominee, with your consent

• From other health or service providers involved in your care, with your consent

• From the NDIS Commission or NDIA where required for registration, reporting, or safeguarding purposes

• Automatically through our website

Where practical, we collect information directly from you or your authorised representative.

We use your information to:

• Assess your needs and eligibility for our services

• Plan, deliver and review therapy, counselling and behaviour support services

• Communicate with you, your family, or your support network about your care

• Coordinate with your plan manager, support coordinator, or other providers involved in your support

• Meet our legal, clinical, and reporting obligations as a registered NDIS provider, including incident reporting and restrictive practice reporting where applicable

• Manage feedback, complaints and continuous improvement

• Maintain the safety and quality of our services

• Respond to enquiries and bookings made through our website

We do not use your information for marketing purposes without your explicit consent and you can withdraw that consent at any time.

We may disclose your information, only where necessary and in line with your consent or legal obligations, to:

• Your NDIS plan manager, support coordinator, or nominee

• Other treating health professionals or service providers involved in your care

• The NDIS Quality and Safeguards Commission and/or NDIA, where required by law (for example, mandatory incident reporting or audit purposes)

• Emergency services, if there is a serious risk to your safety or the safety of others

• Government agencies where required by law

We do not sell your personal information and we do not share it with third parties for their own marketing purposes.

Overseas disclosure: We do not currently store or disclose personal information overseas. If this changes, we will update this policy accordingly.

We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification, or disclosure, including:

• Secure, access-controlled electronic client management systems

• Restricted staff access based on role and need-to-know

• Regular staff training on privacy, confidentiality and the NDIS Code of Conduct

• Secure storage and disposal of physical and electronic records

We retain personal and health information for as long as required by law and NDIS record-keeping obligations, currently a minimum of [7 years], after which it is securely destroyed or de-identified.

In the unlikely event of a data breach involving your personal information, we will act quickly to contain, assess and respond to it. Where a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.

Our Privacy Officer is responsible for coordinating our response to any suspected or actual data breach and for reporting to relevant authorities where required. Common examples of privacy incidents include an email sent to the wrong recipient, a lost device, or unauthorised access to our client management system - staff are trained to identify and report these promptly so we can respond quickly.

You have the right to:

• Ask what personal information we hold about you

• Request access to your personal information

• Request correction of information that is inaccurate, out of date, or incomplete

• Withdraw consent for us to collect or share certain information (noting this may affect our ability to provide some services)

To make a request, contact us using the details in Section 11. We will respond within a reasonable timeframe, generally within 30 days and will only refuse a request where permitted by law (in which case we will explain why).

Our website may use basic analytics tools to understand general visitor behaviour (e.g. pages viewed, general location, device type). This information is aggregated and does not identify you personally.

If you submit an enquiry, referral, or feedback form on our website, the information you provide is sent securely and handled in line with this policy.

We do not use your website activity for targeted advertising.

If you believe we have mishandled your personal information, you can:

1. Contact us directly (see Section 11) - we aim to acknowledge your complaint within [1 business day] and work with you to resolve it.

2. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC):

   • Website: oaic.gov.au

   • Phone: 1300 363 992

We are committed to a fair, impartial resolution of any privacy complaint, without fear of reprisal or any impact on the support you receive.

You can also raise concerns about how your NDIS supports are delivered with the NDIS Quality and Safeguards Commission:

• Phone: 1800 035 544

• Website: ndiscommission.gov.au/complaints

See our separate Feedback and Complaints page for more information on raising a concern about our services more broadly.

If you have questions about this Privacy Policy or how we handle your information, contact:

New Dawn Therapy - Privacy Officer - admin@newdawntherapy.com.au

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The latest version will always be available on our website, with the date of the last update shown at the top of this page.