UnitedTribe respects the privacy, dignity and rights of every person we support, work with and communicate with.

We understand that people may trust us with sensitive information about their disability, health, supports, family, goals and personal circumstances. We take that responsibility seriously.

This Privacy Policy explains how UnitedTribe collects, uses, stores, protects and shares personal information, and how you can access or correct information we hold about you.

Our approach is guided by applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply, the Health Records Act 2001 (Vic) and its Health Privacy Principles, and relevant NDIS requirements. The Victorian Health Records Act applies broadly to health and disability information handled by private disability service providers in Victoria. (Victorian Department of Health)

The information we collect depends on your relationship with UnitedTribe.

We may collect personal information such as:

• your name, date of birth and contact details
• address and emergency contact information
• NDIS participant details and relevant plan information
• nominee, guardian, family or representative details
• information about your goals, preferences and support needs
• service bookings, rosters and support records
• feedback, complaints and enquiries
• records of communications with us
• employment, contractor or recruitment information
• referral and professional contact information
• website enquiries and newsletter subscription details.

Where necessary to provide safe and appropriate supports, we may also collect sensitive or health information, including information about:

• disability
• physical or mental health
• medications and health conditions
• behaviours of concern or support needs
• communication requirements
• cultural or linguistic background
• assessments and support plans
• incidents, risks and safeguarding matters.

We only seek information that is reasonably necessary for our services, operations or legal obligations.

Where practical, we collect information directly from you.

We may collect information when you:

• contact UnitedTribe
• complete a referral, enquiry or website form
• engage us to provide disability supports
• enter into a service agreement
• communicate with our team by phone, email, SMS or in person
• participate in an assessment or planning discussion
• provide feedback or make a complaint
• attend one of our events
• subscribe to updates or marketing communications
• apply to work with UnitedTribe.

With your consent, or where otherwise permitted or required by law, we may also receive information from people or organisations involved in your supports, such as:

• family members or nominees
• support coordinators
• plan managers
• allied health professionals
• health practitioners
• other providers
• government or regulatory bodies.

UnitedTribe may use personal information to:

• understand your needs, goals and preferences
• assess whether our services are suitable
• provide and coordinate disability supports
• communicate with you and your authorised representatives
• organise workers, rosters and service delivery
• maintain accurate support and business records
• manage incidents, risks, complaints and feedback
• meet safeguarding, quality and regulatory obligations
• process billing and administrative matters
• recruit and manage employees and contractors
• improve our services and systems
• respond to enquiries and referrals
• manage events, partnerships and community engagement
• send updates or marketing communications where we have an appropriate basis to do so.

The NDIS Practice Standards expect participant information to be accurate, current, confidential and appropriately used, and expect participants to be informed about how their information is collected, stored, used, disclosed and corrected. (NDIS Quality and Safeguards Commission)

Where consent is required, we will explain why information is being collected and how it may be used or shared.

Participants may ask questions about how their information is handled and may withdraw or change consent where lawful and appropriate.

There may be circumstances where we are required or authorised to use or disclose information without consent, including where necessary to:

• comply with a legal obligation
• respond to a serious threat to health or safety
• respond to reportable incidents or regulatory requirements
• protect a participant or another person
• respond to lawful requests from government, courts or regulators.

UnitedTribe does not sell personal information.

We only disclose personal information where it is reasonably necessary, authorised by you, or permitted or required by law.

Depending on the circumstances, information may be shared with:

• your authorised nominee, guardian or representative
• support coordinators or plan managers
• allied health or health professionals
• workers involved in providing your supports
• service providers involved in delivering agreed supports
• auditors or professional advisers
• insurers
• NDIS-related regulatory or government bodies
• emergency services
• technology providers that support our operations.

We take reasonable steps to limit disclosures to information that is relevant and necessary.

UnitedTribe may store information electronically and, where required, in physical records.

We use reasonable administrative, technical and organisational safeguards to protect personal information from:

• misuse
• interference
• loss
• unauthorised access
• modification
• disclosure.

Access to participant and business information is limited according to role and operational need.

Where third-party systems are used for functions such as rostering, communications, cloud storage, email marketing, website hosting or record management, we seek to use reputable providers and manage access appropriately.

Participant support information should be maintained within approved operational systems rather than general marketing databases.

Some technology providers may store or process information outside Australia.

Where this occurs, UnitedTribe will take reasonable steps required by applicable privacy law to ensure appropriate handling of personal information.

We do not disclose sensitive participant information overseas simply for marketing purposes.

When you use the UnitedTribe website, certain technical information may be collected automatically, such as:

• browser type
• device information
• IP address
• pages visited
• date and time of access
• referring website.

Our website may use cookies and similar technologies to improve functionality, understand how the website is used and measure marketing performance.

You can usually control cookies through your browser settings.

Third-party websites linked from our website have their own privacy practices, and UnitedTribe is not responsible for how those organisations handle information.

UnitedTribe may send newsletters, event invitations, community updates or information about our services where we have consent or another lawful basis to contact you.

Marketing communications will identify UnitedTribe and provide a way to unsubscribe.

Australian spam rules generally require businesses sending commercial electronic messages to have consent, identify the sender and provide a functional unsubscribe facility. (ACMA)

We keep marketing information separate from participant service-delivery information wherever practical.

You can unsubscribe from marketing communications at any time.

UnitedTribe will seek appropriate permission before using identifiable photographs, video or participant stories for marketing, social media or promotional purposes.

Receiving services from UnitedTribe does not automatically mean you agree to appear in marketing content.

Consent for marketing images or stories should be voluntary and separate from consent to receive supports.

You may request access to personal or health information UnitedTribe holds about you and ask for incorrect information to be corrected.

Victorian privacy law provides individuals with rights relating to access to health information held by private-sector disability service providers. (Victorian Department of Health)

We may need to confirm your identity before providing access.

In some circumstances, access may be limited or refused where permitted by law. If this occurs, we will explain the reason where appropriate.

We take reasonable steps to ensure personal information is accurate, complete and current.

Please let us know if your:

• contact details
• representative details
• support needs
• health information
• preferences
• emergency information

change.

UnitedTribe retains records for as long as reasonably necessary to:

• provide services
• meet contractual requirements
• manage business operations
• meet NDIS, employment, taxation, insurance and other legal obligations.

When information is no longer required and there is no legal requirement to retain it, we will take reasonable steps to securely destroy or de-identify it.

If UnitedTribe becomes aware of unauthorised access, loss or disclosure of personal information, we will assess the incident and take appropriate steps to contain and respond to it.

Where required, we will make notifications under applicable privacy and data-breach laws.

If you believe UnitedTribe has not handled your personal information appropriately, we encourage you to contact us.

We will take privacy concerns seriously and aim to respond respectfully, fairly and promptly.

You may also have the right to raise a privacy complaint with the relevant external regulator, including:

• the Office of the Australian Information Commissioner
• the Victorian Health Complaints Commissioner
• the NDIS Quality and Safeguards Commission, where the matter relates to NDIS service delivery.

For privacy enquiries, requests for access or correction, or privacy complaints, please contact:

If your enquiry relates directly to the management of your supports, you may also contact your usual UnitedTribe representative.

UnitedTribe may update this Privacy Policy from time to time to reflect changes to our services, systems, legal obligations or information-handling practices.

The latest version will be published on our website.