Policies · Last reviewed July 2026
Privacy Policy
How Caring Buddy collects, stores and shares personal and health information, and how you can see or correct what we hold about you.
1. Who this policy applies to
This policy covers Caring Buddy Pty Ltd (ABN 20 675 447 186) and everyone who works for us, including employees, contracted support workers and students on placement.
We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the record-keeping requirements set by the NDIS Quality and Safeguards Commission.
2. What we collect
We only collect information we need to deliver your supports safely and to invoice for them correctly.
Identity and contact details, including your NDIS participant number.
Your NDIS plan, roster of care and service agreement.
Health information: diagnoses, medications, allergies, clinical reports and behaviour support plans.
Progress notes and incident records written by support workers during shifts.
Payment and invoicing details, including plan manager contacts.
3. How we collect it
Usually directly from you, or from a person you have nominated. We also receive information from referrers such as hospitals, support coordinators and allied health professionals, and from the NDIA through the myplace provider portal.
Where a referrer sends us information about you, we confirm at first contact that you consented to the referral.
4. How we use it
To plan and deliver your supports, roster the right workers, meet our clinical and safety obligations, claim payment, and improve our service through internal review.
We do not use your information for marketing, and we do not sell it to anyone under any circumstances.
6. Storage and security
Records are held in an Australian-hosted client management system with encryption in transit and at rest, role-based access, and audit logging. Paper records held at the Werribee office are locked and destroyed by a secure service.
We keep participant records for seven years after supports end, or until a participant who was a child turns 25, as required by law. Incident records are held for the period set by the NDIS Commission.
7. Access and correction
You can ask for a copy of anything we hold about you, and we will give it to you within 30 days at no cost. If a record is wrong we correct it and note the correction on the file.
There are narrow cases where we may refuse access — for example where releasing a record would seriously threaten someone else's safety. If we refuse, we tell you why in writing and how to challenge it.
8. Our website
The website uses essential cookies to keep the site working and anonymous analytics to understand which pages are read. We do not run advertising trackers and we do not build profiles of visitors.
Enquiry and referral forms are transmitted over TLS and land in a monitored inbox accessible only to the intake team.
9. Data breaches
We maintain a data breach response plan. Where a breach is likely to cause serious harm we notify affected people and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme, and we tell you what we are doing about it.
Privacy enquiries
Ask our Privacy Officer
Requests for access or correction are answered within 30 days. If you are not satisfied with our response you can take the matter to the Office of the Australian Information Commissioner.