Privacy policy

About this policy

This policy applies to Vitali Care Pty Ltd (ABN 49 656 738 368), called "Vitali Care", "we" or "us" here. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We also follow the NDIS Practice Standards, the NDIS Code of Conduct and the requirements of the Department of Veterans' Affairs (DVA).

It covers the people we support and their families, carers and representatives; people who enquire about our services or homes; job applicants; contractors and volunteers; and visitors to our website.

The information we collect

People we support

• Your name, date of birth, gender, address and contact details
• Emergency contacts, and details of your nominee, guardian, advocate, plan manager or support coordinator
• Your NDIS number and plan details, or your DVA file number and card type
• Health and disability information, support needs, care plans, medicines and nursing notes
• Your goals, preferences, cultural background and language
• Records of the support we provide, incidents, feedback and complaints

Enquiries

• Your name, phone number and email, the service or home you're interested in, and anything else you choose to tell us

Job applicants

• Your name, contact details, resume, work history, qualifications and registrations (such as AHPRA), and referees
• The results of checks such as the NDIS Worker Screening Check and the Working with Children Check (Blue Card)

Some of this is sensitive information, such as health and disability information. We only collect sensitive information with your consent, or where the law allows it.

How we collect it

Wherever we can, we collect personal information directly from you: in person, by phone, by email and through forms on our website.

Sometimes we collect it from other people, with your consent or where the law allows. This includes your family or representative, your plan manager or support coordinator, the NDIA or DVA, your doctor, hospital or other health professionals, and referees for job applicants.

You can contact us without giving your name, or using a different name, for example to ask a general question. We'll need your details to provide services or to consider a job application.

How we use it

We use personal information to:

• plan, provide and coordinate your supports and nursing care
• keep you safe, and respond to incidents and emergencies
• communicate with you and the people you've asked us to involve
• claim payment from the NDIA, DVA or your plan manager
• meet our legal and regulatory obligations, including reporting to the NDIS Quality and Safeguards Commission, audits and worker screening
• handle feedback and complaints, and improve our services
• respond to enquiries about our services and homes
• assess job applications

We won't use your information for marketing without your consent, and you can opt out at any time. We never sell personal information.

Who we share it with

We only share personal information when it's needed for the purposes above, when you've agreed, or when the law requires or allows it. This may include:

• your nominee, guardian, advocate or anyone else you've asked us to involve
• the NDIA, DVA, Services Australia, and your plan manager or support coordinator
• doctors, nurses, hospitals, ambulance services and other health professionals involved in your care
• the NDIS Quality and Safeguards Commission, auditors and other regulators
• service providers who help us run our business, such as IT, cloud storage and online form services, who must keep your information confidential
• police, courts or government agencies where the law requires it, or to lessen a serious threat to someone's life, health or safety

With your consent, we keep your family or other people you choose informed about your care.

Information stored overseas

We aim to store personal information in Australia. Some technology services we use, such as email and cloud software, may store or process data outside Australia. Our website is hosted by GoDaddy in a data centre in Europe and delivered through Cloudflare's network, so information you send through our website is stored in Europe and may pass through other countries. When that happens, we take reasonable steps to make sure the provider protects your information in line with the Australian Privacy Principles.

Our website

When you send a form on our website, we receive the details you enter so we can respond. Forms are sent through WPForms on our website and delivered to our team's email inbox, and may also be kept on our website's server for a limited time. The service or funding you choose on a form can show that you or someone you care for has a disability or health need, so we treat it as sensitive information. Please don't include other health details in website forms; we'll talk about those with you by phone.

Our website doesn’t use Facebook or Google advertising pixels or remarketing. We use Google Analytics to count phone-link taps and enquiries so we can tell which pages and ads lead to calls. It records the page address and that an event happened, not what you type into forms. Some pages use these services, which may set cookies or receive your device’s IP address and browser details:

• Google Analytics, which counts taps on our phone number and enquiries sent through our forms, along with the page address and general device and location details. We have turned off Google’s advertising personalisation features, and we do not send your name or phone number to Google
• our web host (GoDaddy) and its delivery network (Cloudflare), which count visits and protect the site
• WPForms, which runs our contact, enquiry and job application forms and checks them for spam
• on some older pages of our site, Google Fonts, an embedded Google Map and a spam check such as Google reCAPTCHA

Our web host also keeps standard server logs, such as IP addresses and browser types, to keep the site secure. You can block or delete cookies in your browser settings; the site will still work. Links to Google Maps, Facebook and Instagram take you to those services, which have their own privacy policies.

How we protect and keep it

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. These include secure, access-controlled systems, confidentiality obligations and privacy training for staff, and secure storage for paper records.

We keep personal information only as long as we need it or the law requires. We keep records of the supports and nursing care we provide for at least 7 years from when each record is made, as the NDIS rules require, and longer where another law or our DVA arrangements require it. We keep some records about children for longer. Applications from unsuccessful job applicants are kept for 12 months unless you ask us to delete them sooner. When we no longer need information, we securely destroy or de-identify it.

Data breaches

If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Accessing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it. Contact us using the details below. We'll need to confirm your identity first.

We aim to respond within 7 days, and within 30 days at the latest. There's no charge to make a request. If we can't give you access or make a correction, we'll explain why in writing and tell you how to complain. If we don't agree to correct your information, you can ask us to attach a statement to it saying you believe it's wrong, and we will.

If someone acts for you

A parent, guardian, NDIS nominee or other authorised representative can make privacy requests for the person they represent. We'll ask for evidence of their authority. We involve the person in decisions about their own information as much as we can, and respect their wishes wherever possible.

Privacy complaints

If you're concerned about how we've handled your personal information, please contact us first. We'll treat your complaint seriously and confidentially, and respond within 30 days. Making a complaint won't affect your services.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. NDIS participants can also contact the NDIS Quality and Safeguards Commission on 1800 035 544.

Staff records

The Privacy Act exempts how we handle an employee record when it relates directly to a current or former employee's employment with us. The exemption doesn't apply to job applicants, contractors or volunteers, and this policy covers them. We keep all staff records secure and confidential.

Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated.