We are committed to protecting people’s privacy and to comply with privacy laws.
Melba Support Services collects and handles a range of personal, sensitive and health information for the purposes of providing high quality services to people with disabilities. This policy sets out how we protect that information and our compliance with the following Australian and Victorian legislation:
In delivering services as a registered provider under the NDIS, Melba complies with the principles set out in the above legislation as minimum standards in relation to handling personal information. We will:
This section describes who the policy applies to.
This policy applies to people who visit the Melba website, to people who we collect information from, including our supported people and their families, and to those who handle that information, as well as providing us with information of their own, including our employees, directors, contractors, casuals, students and volunteers.
This section describes some important definitions about the information that we handle.
Personal Information means information or an opinion about someone who is identified or can reasonably be identified.
Sensitive Information is a type of personal information and includes health or medical information.
Health Information has different definitions in some laws but essentially means personal information about your health or disability. Examples include notes of your diagnosis, information about a health service you’ve had or will receive, specialist reports and test results, prescriptions and other pharmaceutical purchases, dental records, your genetic information, your wishes about future health services, your wishes about potential organ donation, appointment and billing details and any other personal information about you when a health service provider collects it.
This section describes what information we collect and how we collect it. Usually, we collect the information we need to provide our services when we write or talk to you about it.
What personal information do we collect?
We aim to limit the collection of personal information, particularly sensitive and health information, to the minimum that we need.
We collect a range of personal information which varies according to, for example, whether you are a supported person, a website visitor or a staff member and includes:
name, gender, date of birth, cultural background and marital status;
contact details including address, telephone and email;
visual images and or audio eg photographs, recordings;
government identifiers including Medicare number, passport details, drivers licence details, and Tax File Number;
financial information (note payments made through our website are facilitated directly between the bank and payment gateway provider and we do not access credit card details);
particularly for supported persons, health information including information about your disability and support needs, information about your family or nominees, your learning and educational needs, living arrangements, employment details, court documents, details about your social activities, personal preferences, routine, information about services you receive and your goals;
records of our interactions with you;
information about qualifications, work history, union membership, police and similar checks and your rights to work; and
information you submit via our website.
We may collect personal information in a number of ways which varies according to, for example, whether you are a supported person, a website visitor or a staff member and includes:
when you submit information via our website;
when you receive services or apply to receive service from us;
when you contact us or ask about our services, or we contact you, including in person contact or via electronic means;
when you apply for employment or volunteering or during your time working with us;
via direct marketing activities; and
via our third-party service providers.
Where we can, we collect personal information directly from you or your representatives. We may though need to collect personal information from third parties. This may include your other health providers or government agencies. We may collect sensitive information where authorised or required by law.
It may be possible to deal with us on an anonymous basis or using a pseudonym, without providing personal information, but if you choose to do so, we may not be able to provide you with certain services. Please contact us to discuss further
This section describes how we use your information and when we may share it with others. We mostly use it to provide you with our service and only share it when we need to.
What do we use your personal information for?
We use the personal information provided by you for the purposes for which it was collected and any other authorised use. We aim to ensure that the use is both fair and reasonable in light of why it was provided to us.
We may collect, hold, use or disclose personal information for reasons including the following:
to deliver or provide you with information about our services or activities or manage our relationship with you;
to process payments;
to manage complaints;
to comply with laws or governance or contractual requirements including reporting to government;
to conduct surveys or quality assurance activities including inviting you to take part;
for internal business purposes including administration, audit, compliance, staff training, information technology and accounting;
when an eligible data breach declaration is in force, for responding to the declaration
for planning and research purposes to improve the services to the community;
to enable your further engagement with us including for fundraising purposes;
with regard to our workers, for the purposes of recruitment and ongoing employment; and
to support automated decision making such as for IT security purposes and providing personalised content or learning.
We may use personal information for purposes related to (or for health or sensitive information, directly related to) the purpose of collection where you would reasonably expect us to, or where authorised or required by law. Provision of our services may not be possible without certain personal information that we request.
We may use your personal information to provide marketing material concerning our functions and activities that we think may be of interest to you. Where we do so, we will include an opt-out function. If at any time you do not wish to receive any communications or marketing materials, please let us know so that your preferences can be registered by contacting us (please see the “Contact” section).
Who do we disclosure your personal information to?
The third parties to which we may disclose your personal information include:
our contracted service providers who deliver services to us or on our behalf, including but not limited to our marketing and technology partners who may use large language models/artificial intelligence to process information. Our providers are required to handle your personal information in line with privacy laws.
affiliated organisations;
our professional advisers (for example, lawyers, auditors and consultants);
Government and regulatory bodies, including the NDIA, the Department of Social Services, Services Australia, the Department of Health & Human Services, the Commonwealth Department of Human Services, Medicare and the Australian Taxation Office;
law enforcement agencies, courts or tribunals; and
people acting on your behalf including your guardians, trustees and legal representatives.
Our marketing and technology partners may make use of infrastructure and servers located outside Australia. Otherwise, we do not typically transfer personal information offshore. By providing your personal information to us or using our services, you are taken to have consented to this transfer.
If we transfer information offshore for other purposes, we will only do so with your consent or otherwise in accordance with Australian law. We will require that the recipient of the information complies with privacy obligations to maintain the security of the information.
Like many websites, ours may use tags (a small piece of code added to a website to track and collect data for Google services) or cookies (a small text file placed on your computer by a web server when you access a website) for various reasons, including to analyse website effectiveness and performance, or to measure or to recognise a computer which has previously visited our websites and to customise our websites according to previous preferences and site behaviour. You can choose if and how a cookie will be accepted by configuring your preferences in your web browser. For example, you can set your browser to notify you when you receive a cookie or to reject cookies. These cookies are not made available to any third party and are not used to track your activity beyond our website.
This section describes how long we keep your information and how we protect it. We work to keep it safely for as long as we need it.
We take all reasonable steps to ensure that your personal information is securely stored and protected. These steps include password protection for accessing our IT systems, securing paper files in locked cabinets and physical access restrictions to buildings. In addition, access to your personal information is restricted to those properly authorised to have access.
We keep your personal information for as long as it is needed for the purposes for which it was collected and to comply with legal requirements. When personal information we hold is no longer needed for any purpose, including legal purposes, and subject to our legal obligations, we will take reasonable steps to destroy or alter that information so that it no longer identifies you.
This section describes how you can access and update your information.
Melba takes all reasonable steps to ensure that the personal information we hold is accurate, complete and up to date. However, accuracy depends to a large extent on the information you provide. Please contact us if there are any updates required.
Under privacy laws, you have a right to request access to personal information we hold about you, and to request its correction. Please contact us if you wish to do so. We will respond to requests for access or correction within 30 days. We may need to verify your identity before processing your request. We will action requests unless an exception under the Privacy Act or other legislation applies.
If you have any concerns or complaints about the manner in which your personal information has been collected or handled by Melba, please contact us. Complaints will be dealt with under our complaints policy/procedure.
It is our intention to use our best endeavours to resolve any complaint to your satisfaction and in a reasonable period of time. However, if you are unhappy with our response, you may contact the Office of the Australian Information Commissioner who may investigate your complaint further. Further information about the application of the Privacy Act can be found at the website of the Office of the Australian Information Commissioner at https://www.oaic.gov.au/
If you have any questions in relation to this policy, you can contact Melba’s Privacy Officer by:
