Privacy Policy

ELM Care Pty Ltd (ABN 23 652 325 221) · Last updated October 2026

ELM Care is a registered NDIS provider. We respect your privacy, dignity and right to confidentiality. This policy explains how we collect, use, store, share and protect your personal information, including sensitive health and disability information, and what your rights are. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the NDIS Act 2013, the NDIS Practice Standards and Code of Conduct, and, where it applies to us, the Health Records and Information Privacy Act 2002 (NSW).

What we collect

Contact details: your name, address, phone, email and date of birth
NDIS details: your NDIS number, plan details, plan manager and support coordinator
Sensitive information: health, disability, medication, behaviour support, communication and cultural needs, and support and incident notes
Details of your family, guardian, nominee or other representatives and emergency contacts
Feedback and complaints
Website information such as pages visited and device type
For staff and applicants: employment, screening, qualification and training records

How we collect it

We collect information directly from you or your representative, by phone, email, interviews and assessments, our website and online forms, and while we provide supports. Where reasonable and practical, we collect it only from you. With your consent or where the law allows, we may also receive it from your family, support coordinator, plan manager, health professionals, the NDIA and other service providers. We will take reasonable steps to make sure you know about information we receive from others. We collect sensitive information only with consent or where the law requires or allows it.

Why we collect and use it

We only ask for and keep information we need to:

assess referrals and your eligibility for a service
plan and deliver safe, responsive supports that match your goals
monitor and improve the services we provide
claim payments from the NDIA, your plan manager or you
meet NDIS Commission requirements, including incident reporting and audits
give non-identifying data and statistics to funding bodies when required
respond to feedback and complaints

When we collect information, we will explain why we need it and how we plan to use it. We do not use your information for marketing without your consent, and we never sell it.

Who we share it with

We share your information only:

with people involved in your supports, such as your support coordinator or plan manager, with your or your representative’s permission
with written consent from a person with lawful authority to act for you
to prevent or lessen a serious and imminent threat to the life or health of you or another person
when required or authorised by law, including reporting to the NDIA, the NDIS Quality and Safeguards Commission, police or other agencies
with service providers who help us run our business, such as IT and website providers, who must keep it confidential

Overseas storage

Our website and online forms are provided through Wix, which may store data on servers outside Australia. We take reasonable steps to make sure overseas providers protect your information in line with Australian privacy law.

Security and how long we keep it

We store your information in a way that reasonably protects it from misuse, loss and unauthorised access, change or disclosure. This includes restricted access, staff confidentiality obligations and privacy training. We keep records for as long as the law and NDIS rules require, then take reasonable steps to destroy or permanently de-identify them. If a data breach is likely to cause serious harm, we will act quickly to contain it, and notify you and the Office of the Australian Information Commissioner (OAIC) as required.

Your rights

You can ask to see the information we hold about you, ask us to correct it if it is inaccurate, incomplete or out of date, withdraw your consent, or ask to deal with us anonymously or under a pseudonym where that is practical. You can use a family member, support person, nominee or advocate to help you. We may ask for proof of identity before releasing information. We will respond within 30 days, and sooner where we can. We do not charge for making a request, but we may charge a reasonable administrative fee for providing copies.

We may refuse access in some cases, for example if it would seriously threaten someone’s life or health, unreasonably affect another person’s privacy, prejudice an investigation of unlawful activity, or if the law requires or allows us to refuse. If we refuse, we will tell you why in writing.

Keeping your information accurate

Please tell us as soon as you can if your details change or you think something we hold is wrong, so we can keep our records correct and provide the right supports.

Our website

Our website may use cookies and analytics to understand how it is used. When you send a referral or enquiry through a website form, it is stored in our website’s form system and sent to our team. Please avoid putting detailed health information in website forms; we will gather those details with you directly and securely. Links to other websites are not covered by this policy.

Changes to this policy

We review this policy regularly, at least once a year, including feedback from participants, staff and other stakeholders. The latest version is always on this page.

Questions and privacy complaints

ELM Care Pty Ltd
Email: info@elmcare.com.au
Phone: 0481 877 773

We will acknowledge your complaint promptly and work with you to resolve it. If you are not satisfied, you can contact the OAIC at oaic.gov.au or 1300 363 992, the NDIS Quality and Safeguards Commission on 1800 035 544, or, for NSW health information, the NSW Information and Privacy Commission. See also our Feedback and Complaints page.