We collect the information we need to provide behaviour support services safely and lawfully. We don't sell it. We don't share it without your consent except in narrow circumstances required by law. You can ask to see what we hold about you, and we'll respond within 30 days. You have the right to change your mind about what we share at any time.
This policy explains how Richer Support collects, stores, shares, and protects your personal information. We're committed to keeping your information safe, respecting your choices about what we share, and operating in line with Australian privacy law and NDIS standards.
This policy applies to everyone we work with: clients, their families, our staff, contractors, referral sources, and anyone else whose information we collect in the course of our work.
Personal Information: Any data that could be used to identify you (name, contact details, NDIS number, health information, behavioural data, family history).
Sensitive Information: Personal information about your health, disability, or support needs. We handle this with extra care and usually need your specific consent to collect and use it.
Disclosure: When we share your information with someone outside Richer Support (like a treating practitioner, implementing provider, or NDIS Commission).
Use: When we handle your information within Richer Support for the purpose of delivering or managing your care.
Consent: Your voluntary, informed agreement to something we're asking permission for. You can always change your mind or withdraw consent at any time.
We only collect information that's reasonably necessary to deliver your behaviour support services, meet NDIS requirements, and coordinate with other professionals involved in your care. This typically includes:
We collect this information in various ways: directly from you, from your representatives, from other professionals (with consent), and from your support network. If you give us information we didn't ask for, we'll let you know what we're doing with it and check we're allowed to keep it.
We collect personal information lawfully and only to the extent necessary. Sometimes we collect information directly from you. Sometimes we ask your family, your support network, or other professionals (like your GP or psychiatrist) with your permission.
Wherever it's practical and lawful, you can ask to engage with us anonymously or under a pseudonym. Let your practitioner know if that matters to you.
We use AI tools thoughtfully and only where they genuinely benefit you and your support. Here's what that means.
The main reason is so your practitioner can focus entirely on you during sessions. When they're not busy writing notes, they can listen, observe, and engage properly. This makes for better quality sessions and better quality support.
It also has a direct financial benefit for you. Notes written after a session are billable from your NDIS plan. AI helps us complete documentation more efficiently, which means less of your funding is spent on paperwork and more is available for direct support.
In February 2026, the NDIS Quality and Safeguards Commission published guidance on using AI in behaviour support planning. The standard is clear: your personal information should not be shared with general AI systems, and you need to stay at the centre of your plan. We've designed our practice to meet this standard:
We currently use AI features within Splose (our practice management system) and Heidi Health (an AI-assisted note-taking tool some practitioners use to transcribe conversations during sessions). Both are Australian-based and comply with Australian privacy laws. Neither retains audio recordings after transcription. For general-purpose AI work, we only use business-grade tools that operate under commercial terms prohibiting use of your information for AI training.
AHPRA requires us to get your consent before using AI tools that record your sessions or process your information. You can consent to one, both, or neither of these. Declining either option won't affect the quality of your support.
Your right to ask questions. You can ask your practitioner at any time which AI tools have been used for your support and to see the notes that were generated. If you have concerns about AI use at any point, raise them with your practitioner. We'll always work with you to find an approach you're comfortable with.
Your information is secure. Here's what we do:
Important: Information sent by email or over the internet without encryption can be accessed by unintended recipients. If you're sending personal information by email, please be aware of this risk.
When you fill in a form or book a time through our website, that information passes through trusted third-party tools. We name them here so you know exactly who handles your details:
If you'd rather not use these tools, you can always reach us directly by phone on 0413 213 810 or email at contact@richersupport.com.
We use secure, healthcare-grade platforms for telehealth sessions. These platforms comply with Australian privacy standards and the Australian Privacy Principles.
Recording sessions: Sessions are never recorded unless you give explicit written consent beforehand. If we do record (for example, for supervision purposes), you'll know exactly what's being recorded, who can access it, and how long we keep it.
Your privacy during sessions: We ask you to take reasonable steps to ensure your end of the call is private. This means:
If privacy is a concern on your end, let your practitioner know. We can work around it or arrange a face-to-face session instead.
We keep healthcare data for seven years from your last date of service, as required by AHPRA guidelines and best practice. For young people under 18, we keep records until they turn 25 (that is, seven years after they turn 18). After these periods, we securely destroy the information or de-identify it (remove anything that could identify you) in line with document retention laws.
There are three types of sharing: things we're legally required to do, sharing that supports your services, and sharing that's entirely your choice.
In some situations, we must share information regardless of your consent. We'll always tell you this is happening and why, unless the law prevents us from doing so. These situations include:
Even when we're required to share, we share only the minimum necessary. We'll let you know before we share (where we legally can) and explain what's being shared and why.
For your behaviour support to work well, we often need to share information with other people involved in your care. For example, your plan might need to be shared with your group home so their staff can follow it properly. Before we share anything, we'll talk to you about it. This type of sharing might include:
Some types of sharing are entirely up to you. You get to decide whether you're comfortable with them, and you can change your mind anytime. These include:
If you're not sure about any of these, we'll talk it through. You're always allowed to say no, and it won't affect the quality of your support.
Your consent to sharing isn't a one-off decision. You can change your mind about who we share information with at any time. Just let your practitioner know and we'll update things. Withdrawing consent won't affect the support we provide to you, and it won't affect any sharing we're legally required to do.
You have the right to access the information we hold about you, or to ask us to correct it, at any time. To request access or corrections, call 0413 213 810 or email contact@richersupport.com.
We'll verify your identity and aim to respond within 30 days. In some cases, the Privacy Act lets us refuse access (for example, if releasing information would harm your safety or someone else's). If we deny access, we'll give you a written explanation. There is no charge for accessing your own information. We may charge a reasonable fee only if you request an extensive copy that takes significant time to prepare.
If you're under 16, we usually involve a parent or guardian in your referral, intake, and treatment planning. However, young people have a right to confidentiality, and we discuss with each young person what will and won't be shared with their parents.
We follow the mature minor doctrine, which means we respect your right to privacy depending on your age and maturity. This means:
Mandatory reporting applies: If we become aware of a child at risk of harm, we're legally obligated to report to child protection authorities, regardless of consent. We'll tell you if this happens.
A data breach happens when we lose control of, or someone unauthorised accesses, your personal information. This might be loss of a device, hacking, or accidentally sending information to the wrong person.
We take breaches seriously. We have a response plan that covers detecting the breach, stopping unauthorised access, notifying affected people, investigating what happened, and making improvements so it doesn't happen again. If a breach occurs that affects your information, we'll let you and the NDIS Commission know as soon as we can, explain what happened, and tell you what we're doing about it.
Boudicea Hodgson is our Privacy Officer. She's responsible for handling privacy complaints, overseeing staff training, and making sure we follow this policy and the privacy laws. If you have concerns about how we handle your privacy, contact our Privacy Officer on 0413 213 810 or contact@richersupport.com.
You have every right to complain if you're unhappy with how we handle your information.
Start with us, if you're comfortable:
We take all complaints seriously and aim to respond within 48 hours. You'll never be disadvantaged for making a complaint.
If you're not satisfied with our response, you can contact external authorities at any time. You don't need to contact us first.
We review this policy regularly. If we make changes, we'll let you know before they take effect. New staff receive this policy during induction. Clients receive a copy once a service agreement is signed. The most up-to-date version is always available at www.richersupport.com. You can request a copy anytime by calling 0413 213 810 or emailing contact@richersupport.com.
If you have a question about this policy or how we handle your information, there are three ways to get in touch: call Bo directly on 0413 213 810, email contact@richersupport.com, or submit feedback through the Feedback & Complaints form. If you have a question, chances are someone else does too. Please ask.
This policy aligns with:
Last reviewed: June 2026 · Next review due: June 2027 · Owner: Bo (Boudicea Hodgson), Privacy Officer · Version 2.1