1. Purpose

Elevate Within respects your right to privacy.
This policy explains how personal information is collected, used, stored, and disclosed in the course of providing support coordination, consulting, and related services.

Elevate Within complies with:

• the Privacy Act 1988 (Cth)
  
• the Australian Privacy Principles (APPs)
  
• relevant state and territory privacy and health records legislation
  
• the NDIS Practice Standards (Privacy & Dignity and Information Management modules)
  

2. Scope

This policy applies to:

• Participants and clients
  
• Their families, nominees, and advocates
  
• Contractors and allied professionals engaged by Elevate Within
  
• Volunteers, students, and support network members
  
• Website users and subscribers
  

3. Our Commitment

Elevate Within personally manages all personal information collected under Elevate Within.
All reasonable steps are taken to:

• Protect personal information from misuse, loss or unauthorised access;
  
• Ensure information is accurate, complete, and current;
  
• Use and disclose information only for lawful and transparent purposes;
  
• Respect every individual’s right to privacy, dignity, and informed consent.
  

Elevate Within does not sell, rent, or trade personal information.

4. What Information We Collect

The type of information collected depends on your relationship with Elevate Within.

Personal Information

May include:

• Name, address, date of birth, gender, and contact details;
  
• Next of kin, nominee, or emergency contact details;
  
• Payment and billing information;
  
• Service history, goals, or preferences;
  
• Communication records, correspondence, or feedback;
  
• Internet Protocol (IP) address or domain name when using our website.
  

Sensitive Information

Collected only when necessary for service delivery, and with your explicit consent.
May include:

• Health or disability details
  
• Cultural, linguistic, or religious background
  
• Criminal record or background check results (e.g., NDIS Worker Screening, Blue Card)
  
• Information about risks to safety or wellbeing
  

5. How Information is Collected

Personal information is usually collected directly from you, for example:

• During intake or onboarding;
  
• Through forms, phone calls, email, or website contact forms;
  
• When you participate in services, surveys, or events.
  

Where necessary, information may also be collected from:

• Your nominee, carer, or guardian;
  
• Other service providers (with your consent);
  
• Government agencies or regulators (where required by law).
  

6. Why We Collect and Use Personal Information

We collect and use information to:

• Deliver and manage supports or consulting services
  
• Communicate with you about appointments, plans, or progress
  
• Maintain accurate records for accountability and reporting
  
• Comply with legal and funding requirements
  
• Seek feedback and improve service quality
  
• Manage accounts, payments, and administration
  
• Send updates, newsletters, or event invitations (you may opt out at any time)
  

7. Disclosure of Personal Information

Your personal information may be shared:

• With your consent, to coordinate supports or communicate with your nominated representatives
  
• With trusted service providers or contractors engaged to assist Elevate Within (e.g., IT, bookkeeping, legal)
  
• With government departments, regulatory bodies, or insurers when required by law
  
• When there are reasonable concerns for your safety or the safety of others
  

Elevate Within does not disclose personal information to overseas recipients unless:

• You have provided informed consent, and
  
• The recipient is bound by privacy laws substantially similar to the Australian Privacy Principles.
  

8. Photography, Audio, and Video

Photos, recordings, or videos are only taken with your prior consent.
You may withdraw consent at any time, and the material will no longer be used in future publications or promotions.

9. Anonymity and Pseudonyms

Where lawful and practicable, you may engage with Elevate Within anonymously or under a pseudonym (e.g., website or general enquiry).
However, if you are receiving direct services, accurate identification is required for safety, reporting, and compliance purposes.

10. Storage and Security

Personal information is stored securely in password-protected electronic systems and, where applicable, locked physical files.
Measures include:

• Secure digital storage on Australian servers
  
• Role-based access and device encryption
  
• Secure document disposal and data retention procedures
  

When information is no longer required, it is destroyed or de-identified in line with legal requirements.

Please note that while care is taken with electronic communication, the internet cannot be guaranteed as a fully secure environment.

11. Access and Correction

You have the right to access or request correction of your personal information.
Requests must be made in writing to privacy@elevatewithin.au so your identity can be verified.

Elevate Within will respond within 30 days and may charge a small administrative fee if retrieval requires significant time or resources.

If access or correction is refused, written reasons will be provided (unless unreasonable to do so).

12. Marketing and Communications

We may contact you about Elevate Within events, services, or initiatives.
You can opt out of these communications at any time by emailing Elevate Within or following the link provided in emails.

13. Making a Privacy Complaint

If you have a concern about how your information has been handled, please contact:
Email: thrive@elevatewithin.com.au

Your complaint will be acknowledged within 2 business days and investigated promptly.
If you are not satisfied with the outcome, you may contact the:
Office of the Australian Information Commissioner (OAIC)
www.oaic.gov.au | 1300 363 992

14. Policy Review and Updates

This policy is reviewed annually or when legislation or operational changes require it.
The latest version will always be available at elevatewithin.au/privacy

15. Definitions

Personal Information – Information about an identified individual (e.g., name, contact, address, opinions).
Sensitive Information – Information about health, disability, cultural identity, beliefs, or criminal record.
Consent – Voluntary agreement to collection or use of information after being fully informed.
Anonymised/De-identified Data – Information that no longer identifies an individual.

16. Responsibility

Elevate Within has the responsibility to:

• Ensures compliance with privacy legislation and NDIS Practice Standards;
  
• Maintains secure records and responds to access/correction requests;
  
• Reviews and updates this policy regularly.