Privacy Policy

1. Who this policy applies to

This Privacy Policy applies to personal information we handle about people who interact with Alchemy, including:

• people visiting or using our website;
• people making an enquiry or referral;
• prospective, current and former participants;
• families, carers, nominees, guardians, advocates and other supporters;
• people applying to work with Alchemy;
• current and former workers, contractors, volunteers and students, where applicable;
• referrers and other service providers;
• suppliers and professional advisers;
• people providing feedback, making a complaint or reporting a concern; and
• other people whose personal information we may reasonably need to collect.

In this policy:

• “you” means the person the information is about; and
• “we”, “us” and “Alchemy” mean Alchemy Services Pty Ltd.

We also handle personal information about job applicants, workers, contractors, students and volunteers. Some employment records are treated differently under Australian privacy law, but Alchemy remains committed to handling workforce information respectfully, confidentially and securely.

2. What information we collect

The information we collect depends on how you interact with Alchemy and the services or supports involved.

Personal and contact information

This may include:

• your name and date of birth;
• address, telephone number and email address;
• preferred way of communicating with you;
• emergency contact details;
• information needed to confirm your identity; and
• details of a nominee, guardian, advocate, carer or other authorised representative.

Participant and service information

If you receive or enquire about services from Alchemy, we may collect information such as:

• enquiry, intake and referral information;
• NDIS participant and funding details;
• service agreements;
• goals, preferences and support needs;
• communication needs and preferences;
• support plans and assessments;
• shift notes, case notes and progress records;
• scheduling, attendance and transport information;
• risk and safety information;
• consent records;
• complaints, feedback and incident information; and
• correspondence relating to your services.

Health and other sensitive information

Providing safe and appropriate disability services may require us to collect sensitive information, including information about:

• disability;
• physical or mental health;
• medication;
• behaviour support;
• communication needs;
• wellbeing and safety;
• cultural background where relevant to your support;
• incidents, allegations or safeguarding concerns; and
• other personal circumstances relevant to the services we provide.

We recognise that health, disability and other sensitive information requires particular care and protection.

Financial and administrative information

We may collect information needed to administer services and operate our organisation, including:

• invoicing and payment information;
• NDIS funding and plan-management information;
• service claims and supporting records;
• supplier or contractor information; and
• information required for taxation, insurance, audit or legal purposes.

Recruitment and workforce information

For applicants, workers, contractors, volunteers and students, we may collect information such as:

• employment and application history;
• qualifications and licences;
• worker screening and other required checks;
• training and professional development information;
• payroll, taxation and superannuation information; and
• information needed to manage an employment or engagement relationship.

3. How we collect information

Where practical, we collect personal information directly from you.

We may collect information:

• when you speak with us;
• through forms, emails or telephone calls;
• when you make an enquiry or referral;
• during meetings or service delivery;
• through our website;
• through service and support records;
• from a person you have authorised to assist or represent you;
• from another provider or professional involved in your supports;
• from the NDIA, a plan manager or support coordinator where appropriate; or
• where collection is required or authorised by law.

Where appropriate, we will explain:

• why we need the information;
• how it may be used;
• who it may be shared with; and
• what may happen if the information is not provided.

We aim to collect only information that is reasonably necessary for our work.

If we receive personal information that we did not request, we will consider whether we are permitted or required to keep it. If not, we will securely destroy or de-identify it where lawful and practicable.

4. Anonymous and pseudonymous contact

Where it is lawful and practical, you may interact with Alchemy anonymously or by using a pseudonym.

For example, you may be able to:

• make a general enquiry;
• provide feedback; or
• raise a concern or complaint without identifying yourself.

There will be circumstances where we need to know who you are. This may be necessary to:

• provide disability supports or services;
• manage your safety or the safety of others;
• administer NDIS funding;
• verify someone’s authority to act on your behalf;
• manage an employment or contractual relationship; or
• meet a legal or regulatory obligation.

If we need to identify you, we will explain why where appropriate.

5. Why we need your information

We collect, hold and use personal information so that we can provide safe, appropriate and responsive services and operate Alchemy effectively.

This may include using information to:

• respond to enquiries and referrals;
• understand whether we can provide the services you need;
• plan, provide, coordinate and review supports;
• understand your goals, strengths, preferences and communication needs;
• maintain your safety and wellbeing;
• manage risks and respond to emergencies;
• prepare service agreements and support plans;
• roster workers and maintain continuity of support;
• communicate with you and people you have authorised;
• work with other providers and professionals involved in your supports;
• manage NDIS funding, invoices and service claims;
• respond to feedback and complaints;
• manage incidents and safeguarding concerns;
• recruit and support our workforce;
• meet legal, regulatory, insurance and NDIS requirements;
• monitor and improve the quality of our services; and
• protect the rights, safety and wellbeing of participants, workers and others.

Good information helps us provide good support.

We expect records to be factual, timely, respectful, relevant and appropriate to their purpose.

6. Consent, choice and decision-making

We want people to understand and have a say in how their information is used.

Where consent is required, we aim to make sure it is:

• voluntary;
• informed;
• specific to the purpose;
• current; and
• communicated in a way the person can understand.

We recognise that people communicate and make decisions in different ways.

Where needed, we can support understanding by:

• using plain language;
• explaining information in smaller steps;
• allowing additional time;
• using appropriate communication aids; and
• involving a trusted supporter, advocate or representative at the person’s request.

Wherever possible, the person whose information is involved remains at the centre of decisions about that information.

Consent can generally be changed or withdrawn.

There may be circumstances where we are still required to retain, use or disclose information because of legal, safety, safeguarding, funding, regulatory or recordkeeping obligations.

7. Families, carers, nominees and representatives

We value the important role that families, carers, advocates and other supporters can play.

At the same time, being a family member, carer or support person does not automatically provide unrestricted access to another person’s personal information.

Where you want another person involved, we will seek to understand and record:

• who you want involved;
• what information they may receive;
• what decisions they may assist with; and
• any limits you want placed on their involvement.

Where someone is acting formally on another person’s behalf, we may need to confirm their identity and authority before providing information.

We also consider the privacy of other people, safety, safeguarding requirements and any legal restrictions before releasing information.

8. Children and people who need decision support

Where information relates to a child or a person who needs support to make decisions, we will take reasonable steps to:

• communicate in a way suited to the person;
• provide information in an accessible or age-appropriate way;
• involve the person in decisions as much as possible;
• listen to their wishes and preferences;
• support them to understand their choices;
• verify the authority of anyone making decisions on their behalf; and
• use supported decision-making wherever possible before relying on substitute decision-making.

Our focus remains on the rights, dignity, preferences, safety and wellbeing of the person.

9. When we share information

We do not share personal information simply because someone asks for it.

We may share information where it is reasonably necessary and appropriate with:

• Alchemy workers who need the information to perform their role;
• a nominee, guardian, advocate, carer or representative you have authorised;
• other providers or professionals involved in your supports;
• plan managers and support coordinators;
• the NDIA or NDIS Quality and Safeguards Commission where relevant;
• approved service providers that assist us to operate our organisation;
• professional advisers, auditors, insurers or legal representatives;
• emergency services;
• safeguarding or child-protection authorities;
• police or other authorised agencies; or
• courts, tribunals, regulators or government bodies where required or authorised by law.

We aim to share only the information reasonably necessary for the purpose.

Sharing information without consent

There are circumstances where we may need to share information without consent.

This may occur where:

• we are required or authorised by law;
• there is a serious concern about someone’s life, health, safety or wellbeing;
• information is needed in an emergency;
• safeguarding or mandatory reporting obligations apply;
• an incident must be reported to a regulator; or
• another lawful exception applies.

Where information must be shared without consent, we aim to share only what is reasonably necessary and only with people or organisations that have a legitimate reason to receive it.

10. Overseas disclosure

Alchemy Services is not likely to disclose personal information to recipients located outside Australia.

We use third-party technology and service providers to support our operations and take reasonable steps to ensure that personal information handled on our behalf is appropriately protected.

We review our service-provider arrangements and, if our likely overseas disclosure practices change, we will update this Privacy Policy and take the steps required under Australian privacy law.

11. How we protect your information

We take reasonable technical and organisational steps to protect personal information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.

We hold personal information in approved electronic systems, secure cloud-based services, business records and, where necessary, secure paper files.

Our safeguards include measures such as:

• access controls based on people’s roles and responsibilities;
• authentication and device-security controls;
• secure electronic and physical storage;
• confidentiality requirements;
• worker training;
• secure information-sharing practices;
• monitoring and review of access where appropriate;
• privacy and data-breach response processes; and
• secure archiving, destruction or de-identification.

Access to personal information is limited to people who have a legitimate reason to use it as part of their role.

We regularly review how information is managed and improve our safeguards where risks, technology or our services change.

12. How long we keep information

We retain personal information for as long as it is needed for the purpose for which it was collected and to meet applicable legal, safeguarding, funding, employment, insurance, audit and operational requirements.

This may include keeping information for:

• providing and reviewing services;
• participant safety and continuity of support;
• NDIS and funding requirements;
• legal and regulatory requirements;
• employment, taxation and insurance obligations;
• complaints and incident management;
• safeguarding and investigations;
• audit and governance purposes; or
• an active legal claim, investigation, subpoena or court order.

We do not destroy relevant records while a complaint, incident, investigation, safeguarding matter or legal claim remains active.

When information is no longer required and there is no lawful reason to retain it, we take reasonable steps to securely destroy or de-identify it.

13. Accessing or correcting your information

You have the right to ask about personal information we hold about you.

You may ask us to:

• provide access to your personal information;
• provide information in an accessible form where reasonable;
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading; or
• add an appropriate statement to a record where a requested correction is not made.

We may need to confirm your identity or authority before providing access.

There may also be circumstances where we need to protect another person’s privacy or where the law allows or requires us to limit access.

If we cannot provide access or make a requested correction, we will explain why where required and let you know what options are available.

We aim to respond to access and correction requests within a reasonable period, usually within 30 calendar days.

There is no charge for making a request. If there is a reasonable cost associated with providing access, we will discuss this with you first.

14. Photos, video and audio recordings

We recognise that photographs, video and audio recordings can be personal information.

We may collect or use photographs, video or audio where they are reasonably needed for an agreed service, activity, record or communication.

We will seek appropriate consent where required.

We will seek specific consent before using identifiable photographs, video or audio recordings publicly or for promotional or marketing purposes.

Choosing not to consent to promotional photography, video or other media will not affect your right to receive services from Alchemy.

You can talk to us at any time if you want to change or withdraw a previous consent.

We will explain what can reasonably be changed, including where material has already been published or where we are required to retain a record.

15. Our website and online services

When you visit our website, you may choose to provide personal information through:

• enquiry forms;
• referral forms;
• feedback or complaint forms;
• employment or recruitment enquiries; or
• other online forms and communications.

We use the information you provide for the purpose for which it was collected and for related purposes that you would reasonably expect.

Like most websites, our website and the services that support it may collect limited technical information necessary to operate, secure and improve the website. This may include:

• browser and device information;
• IP address;
• pages visited;
• date and time of access;
• website security and diagnostic information; and
• cookies or similar technologies used to support website functionality.

We may use this information to:

• operate and maintain our website;
• maintain website security;
• identify and resolve technical problems;
• understand generally how our website is being used; and
• improve the website experience.

We do not use information collected through general website browsing to determine whether a person can receive disability supports from Alchemy.

Where an online form collects personal information, the information provided through that form is handled in accordance with this Privacy Policy.

16. Automated decisions

Alchemy does not rely on automated computer-based decision-making to determine whether a person can access our disability supports or to make significant decisions about the supports we provide to a participant.

Technology may assist us with administrative activities, recordkeeping, scheduling and other business processes, but decisions affecting a person’s supports, rights, safety or wellbeing remain subject to appropriate human oversight.

If our use of automated decision-making changes in a way that significantly affects people’s rights or interests, we will update this Privacy Policy and our practices as required.

17. Privacy incidents and data breaches

We take privacy incidents seriously.

A privacy incident could include personal information being:

• sent to the wrong person;
• lost;
• accessed by someone without authority;
• discussed or displayed inappropriately;
• changed or deleted without authority;
• disclosed without permission; or
• affected by a cyber-security incident.

If a privacy incident occurs, we will take reasonable steps to:

1. contain the incident;
2. assess what has happened;
3. reduce the risk of harm;
4. support people who may be affected;
5. investigate the cause;
6. meet any notification or reporting obligations; and
7. improve our systems or practices where needed.

Where a data breach meets the requirements of the Notifiable Data Breaches scheme, we will notify affected people and the Office of the Australian Information Commissioner as required by law.

We may also notify people or other relevant organisations where this is appropriate to protect someone’s safety or reduce the risk of harm.

18. Marketing communications

We may occasionally provide information about Alchemy services, programs, activities or events where you have agreed to receive it or where Australian law otherwise permits us to do so.

You can ask us to stop sending marketing communications at any time.

Where an electronic communication includes an unsubscribe option, you can use that option or contact us directly.

We will act on an opt-out request within a reasonable period.

We will not use sensitive or health information for direct marketing unless we have the consent required by law.

19. Questions, concerns and privacy complaints

If you have a question or concern about your privacy, we encourage you to talk with us.

You can make a privacy complaint:

• in person;
• by telephone;
• by email;
• in writing;
• through an advocate or representative; or
• anonymously where we have enough information to consider the concern.

You will not be disadvantaged because you raise a privacy concern or make a complaint.

We will:

• listen respectfully;
• take your concern seriously;
• protect your privacy as far as reasonably possible;
• consider whether there are any immediate safety or safeguarding issues;
• investigate or review the matter appropriately;
• take action where something needs to be corrected or improved; and
• explain the outcome where possible.

We aim to respond to privacy complaints within a reasonable period. More complex matters may take longer, and if this occurs we will keep you informed where appropriate.

You do not have to make a complaint to Alchemy before seeking assistance from an appropriate external body.

Office of the Australian Information Commissioner

The Office of the Australian Information Commissioner (OAIC) handles complaints about privacy and the handling of personal information under Australian privacy law.

Visit the OAIC website

NDIS Quality and Safeguards Commission

The NDIS Quality and Safeguards Commission can receive complaints about the quality or safety of NDIS supports and services.

Visit the NDIS Commission website

Health and Community Services Complaints Commissioner South Australia

The Health and Community Services Complaints Commissioner (HCSCC) may also be able to assist with complaints about health or community services within its jurisdiction.

Visit the HCSCC website

20. Contact us

If you have a question about this Privacy Policy, want to access or correct your information, or want to raise a privacy concern, please contact us.

Phone: (08) 7544 2789
Email: admin@alchemysvcs.com.au
Website: alchemysvcs.com.au

For written privacy matters, you can mark your correspondence:

Private and Confidential – Privacy Contact

If you need help to communicate with us, you can ask a family member, advocate, nominee, interpreter or other trusted person to assist you.

We will take reasonable steps to communicate with you in a way that meets your needs.

21. Changes to this Privacy Policy

We review this Privacy Policy to make sure it remains accurate and reflects how Alchemy handles personal information.

We may update it when:

• our services change;
• our information-handling practices change;
• our website or technology changes;
• privacy or NDIS requirements change; or
• we identify opportunities to improve how we protect people’s information.

The current version will always be available on our website.

Where a significant change affects how we collect, use or disclose personal information, we will take reasonable steps to communicate that change where appropriate.

You can also ask us for a copy of this Privacy Policy in another accessible format, and we will take reasonable steps to meet your communication needs.