Privacy and Information Management Policy

1.1 Purpose

The purpose of this Privacy and Information Management Policy is to establish clear requirements for how Sound and Strength collect, uses, stores, accesses, corrects, discloses, transfers, retains and disposes of personal and sensitive information. The Policy is intended to protect each participant's privacy and dignity and to support accurate, timely, secure and appropriate information management.

This Policy is designed to support compliance with the NDIS Practice Standards relating to Privacy and Dignity and Information Management, the Australian Privacy Principles (APPs), the Privacy Act 1988 (Cth), and other applicable legal, professional, contractual and regulatory requirements.

1.2 Scope

This Policy applies to all workers affiliated with Sound and Strength, including employees, contractors, students, volunteers, key management personnel and the principal. All workers must understand and comply with this Policy and any associated procedures.

This Policy applies to participant, representative, referrer, worker and other personal information handled by Sound and Strength in paper, electronic, audio, visual or other formats, including information processed through approved digital systems and artificial intelligence (AI)-enabled functionality.

1.3 NDIS Practice Standards

Sound and Strength will maintain practices that support the following NDIS outcomes:

• Privacy and Dignity: each participant accesses support that respect and protect their dignity and right to privacy.
• Information Management: each participant's information is identifiable, accurately recorded, current and confidential, easily accessible to the participant, and appropriately used by relevant workers.

In particular, Sound and Strength will ensure that participants understand and agree to what personal information is collected and why, including any recorded material in audio or visual format; consent is obtained for collection, use, retention and disclosure; participants are informed about storage, use, access, correction and withdrawal or amendment of consent; and information is subject to appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes.

2.1 Relevant legislation and standards

Relevant legislation, standards and requirements include, where applicable:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles.
• National Disability Insurance Scheme Act 2013 (Cth), applicable NDIS Rules and NDIS Practice Standards.
• Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
• Applicable South Australian health records, records management and professional obligations.
• Other legislation and regulatory requirements recorded in the Sound and Strength Legislation Register.

2.2 Related documents

• Privacy and Consent Form.
• Incident Management Policy and Incident Reporting Procedure.
• Incident Report Form.
• Feedback and Complaints Policy.
• Service Agreement / Terms of Service.
• Information security, acceptable use or related technology procedures, where applicable.

5.1 Privacy, dignity and confidentiality

Workers must respect and protect each participant's privacy and dignity during all interactions and when handling their information. Confidential information must only be accessed, discussed, used or disclosed where there is a legitimate work-related need.

Participants must be advised of confidentiality and privacy practices in a language, mode of communication and terms they are most likely to understand. Reasonable communication supports should be used where required.

5.2 Collection of personal and sensitive information

Sound and Strength will only collect personal information that is reasonably necessary for its functions or activities. Sensitive information will only be collected where permitted by law, including where the participant or authorised representative has provided consent or collection is otherwise required or authorised by law.

Information collected may include:

• Participant identity and contact details, date of birth and relevant demographic information.
• NDIS, Medicare, funding, plan and service information.
• Health, disability, communication, swallowing, developmental, medical and support information relevant to service delivery.
• Participant goals, preferences, assessments, reports, therapy records, case notes and support plans.
• Appointment, attendance, travel and service delivery information.
• Billing, payment and financial administration information.
• Correspondence and interaction records, including emails, telephone communications, forms and messages.
• Information provided by representatives, support coordinators, schools, health professionals, government agencies and other authorised third parties.
• Audio, visual, photographic or transcribed material where this is used and appropriate consent has been obtained.

5.3 Data minimisation

Workers should collect and record only information that is reasonably necessary for service delivery, administration, safety, quality, legal, professional or regulatory purposes. Information should not be collected merely because it may be useful at some future time.

Where an approved AI-enabled system is used, workers must minimise the amount of personal and sensitive information processed to what is reasonably necessary for the task.

5.4 Obtaining and managing participant consent

Participants must be given clear information about what information will be collected, why it is required, how it will be used and stored, and the persons or organisations to whom it may be disclosed.

Consent must be informed, voluntary and appropriately documented. Workers must consider communication barriers and provide reasonable supports, including interpreters or involvement of a representative or support person where appropriate and directed by the participant.

Participants must be informed that information may be disclosed without consent where required or authorised by law.

Participants may withdraw or amend consent, subject to legal, professional, funding or record-keeping requirements. Changes to consent must be documented and communicated to relevant workers.

5.5 Informing participants about information management

At intake and when material changes occur, participants will be informed about how their information is collected, stored, used and disclosed; how they may request access or correction; how they may withdraw or amend consent; and how to make a privacy complaint.

Where Sound and Strength introduce a material new use of personal information, including relevant AI-enabled processing, it will consider whether updated participant information, collection notices or consent processes are required.

5.6 Collection methods

Information may be collected directly from participants or authorised representatives through onboarding and consent forms, face-to-face or telehealth interactions, telephone calls, email, SMS, online forms and other approved communication channels.

Information may also be received from authorised third parties such as referrers, schools, health professionals, support coordinators, plan managers, the NDIA, the NDIS Commission, Medicare, government agencies and funding bodies where appropriate.

5.7 Purpose of collection, use and retention

Sound and Strength may collect, use and retain information to:

• Assess participant needs, goals, preferences and suitability for services.
• Plan, deliver, document and review speech pathology and allied health services.
• Communicate with participants, representatives and relevant service partners.
• Manage referrals, waitlists, appointments, service agreements and participant records.
• Prepare assessments, reports, case notes, support plans and other clinical documentation.
• Process invoices, payments, Medicare, NDIS and other funding arrangements.
• Meet professional, legal, regulatory, audit, quality and safeguarding requirements.
• Manage complaints, incidents, risks and service improvement activities.
• Conduct appropriately authorised quality assurance, analysis and service evaluation.
• Communicate about Sound and Strength services where permitted and, where required, with consent.

5.8 Information management systems

Sound and Strength maintain information management systems proportionate to the size and scale of the organisation and the nature of the services delivered.

Approved systems may include Splose for practice management and client relationship management and approved Microsoft 365, SharePoint and OneDrive environments for organisational document storage and collaboration.

Participant information must be entered accurately and in a timely manner. Workers must use the appropriate participant record and take reasonable care to prevent information being saved to the wrong participant or location.

Management may conduct audits or reviews to assess record accuracy, completeness, access, security and compliance.

5.9 Splose and third-party technology providers

Sound and Strength uses third-party technology providers to support practice management, cloud storage, communications, billing and other operational functions. These providers may store or process personal and sensitive information on behalf of Sound and Strength.

Before approving a system that will handle participant information, Sound and Strength will take reasonable steps to consider privacy and security matters relevant to the proposed use, which may include the provider's privacy terms, information security arrangements, data location, subcontractors or sub processors, retention arrangements, breach processes and use of information for AI model training or product improvement.

Sound and Strength will review material changes to approved systems where those changes may affect how participant information is handled.

5.10 Artificial intelligence and automated functionality

Sound and Strength may use approved AI-enabled functionality, including functionality made available within Splose or other approved systems, to assist with administrative or clinical documentation tasks.

AI must be used as an assistive tool and not as a substitute for professional judgement, participant-centered decisionmaking or worker accountability.

Workers must not enter participant personal, health or sensitive information into publicly available, personal or otherwise unapproved AI systems or accounts.

Where AI-generated content relates to a participant, an appropriately authorised worker must review the output for accuracy, relevance, completeness, bias and appropriateness before it is saved to the participant record, communicated externally or relied upon for service delivery.

Workers remain responsible for the accuracy and professional appropriateness of records and communications they approve, regardless of whether AI assisted in producing them.

Where AI or automated functionality is used in a way that could materially affect a participant's rights or interests, Sound and Strength will ensure appropriate human oversight and will provide transparency about the role of the technology as required by applicable privacy law.

Sound and Strength will not use solely automated decision-making to make significant clinical, service access or participant-rights decisions unless the use has been specifically assessed and approved and complies with applicable legal and regulatory requirements.

5.11 Audio, visual, transcription and recording

Where Sound and Strength proposes to collect or process audio, visual or recorded material, including through transcription or AI-enabled functionality, the participant or authorised representative must be informed about what is being collected and why.

Consent must be obtained where required before recording or using such material. Any recording must be stored, accessed, retained and disposed of in accordance with this Policy and any applicable consent.

Workers must not make participant recordings using personal devices or unapproved applications.

5.12 Accuracy and quality of information

Workers must take reasonable steps to ensure personal information is accurate, complete, current and relevant for its intended use.

Clinical and participant records should clearly distinguish factual information, participant or third-party reports, professional observations and professional opinions where appropriate.

AI-generated summaries, transcriptions or suggested content must not be assumed to be accurate and must be checked against the relevant source information where appropriate.

5.13 Access and correction

Participants may request access to personal information held about them and may request correction of information they believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests will be handled in accordance with applicable privacy law and professional or legal record-keeping obligations. Where access or correction cannot be provided in the manner requested, Sound and Strength will provide an appropriate explanation and available review or complaint options where required.

5.14 Disclosure to third parties

Participant information may be disclosed where the participant has consented, where disclosure is reasonably necessary for an authorised purpose, or where disclosure is required or authorised by law.

Recipients may include, where relevant:

• The participant's authorised representative, nominee or guardian.
• Health professionals, schools, support coordinators and other service providers involved in the participant's supports, subject to consent or other lawful authority.
• NDIA, NDIS Quality and Safeguards Commission, Medicare and other government or funding bodies.
• Plan managers and funding providers.
• Courts, tribunals, law enforcement or regulators where required or authorised by law.
• Financial institutions and payment providers.
• Approved professional advisers and external technology or service providers acting on behalf of Sound and Strength.

Only information reasonably necessary for the relevant purpose should be disclosed.

5.15 Overseas disclosure and data processing

Where an approved technology provider stores, accesses or processes personal information outside Australia, Sound and Strength will consider its obligations under applicable privacy legislation, including any requirements relating to overseas disclosure.

Sound and Strength will not state or assume that a technology provider stores data exclusively in Australia unless this has been verified through current provider documentation or contractual arrangements.

5.16 Document storage and information security

Sound and Strength will take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Security measures may include:

• Approved cloud-based storage and practice management systems.
• Individual user accounts and password protection.
• Multi-factor authentication where supported and appropriate.
• Role-based or need-to-know access controls.
• Timely removal or adjustment of access when a worker changes role or ceases engagement.
• Firewalls, anti-malware and device security controls.
• Controlled physical access to premises and paper records.
• Secure backups and recovery arrangements where applicable.
• Worker privacy, confidentiality and information security training.

Workers must not share passwords or login credentials. Personal devices, personal email accounts, personal cloud storage and unapproved applications must not be used to store or transfer participant information unless specifically authorised under an approved organisational process.

5.17 Transfer and communication of confidential information

Before transferring personal or sensitive information, workers must confirm that the disclosure is authorised and that recipient details are correct.

Internal transfers must use approved company-controlled systems with access limited to workers who require the information.

External electronic transfers should use approved secure methods appropriate to the sensitivity of the information. Additional protections such as password protection or encryption should be used where appropriate, with passwords communicated separately where practical.

Physical confidential documents must be securely packaged and transferred using an appropriate secure and traceable method where required.

5.18 Retention of information

Participant records will be retained for the period required by applicable legislation, professional standards, funding requirements, contractual requirements and organisational retention schedules.

Unless a different legal or professional requirement applies, Sound and Strength's current minimum retention periods are:

• Adult participants: at least seven years after the participant ceases to receive services from Sound and Strength.
• Participants who were minors: records will be retained in accordance with applicable legal and professional requirements for records relating to children. Sound and Strength will maintain a documented retention schedule and will apply the longest applicable requirement where requirements overlap.

Records must not be destroyed where they are subject to a current complaint, investigation, legal hold, audit, access request or other requirement to preserve them.

5.19 Disposal of information

When information has reached the end of its authorised retention period and there is no requirement to preserve it, Sound and Strength will take reasonable steps to securely destroy or de-identify it.

• Paper containing confidential information must be securely shredded or disposed of through an approved confidential destruction service.
• Electronic media and devices must be securely sanitised before disposal or reuse.
• Workers must not rely solely on moving electronic information to a recycle bin where secure deletion or sanitisation is required.
• Where an external destruction provider is used, Sound and Strength may require evidence or certification of destruction appropriate to the information involved.

5.20 Privacy incidents and data breaches

All actual or suspected privacy, confidentiality or information security incidents, including near misses, must be reported internally as soon as practicable in accordance with the Incident Management Policy and Incident Reporting Procedure.

Sound and Strength will take reasonable steps to contain the incident, preserve relevant evidence, assess the nature and extent of the breach, identify affected information and individuals, and reduce the risk of harm.

Where the Notifiable Data Breaches scheme applies, Sound and Strength will assess a suspected eligible data breach as quickly as practicable and will take all reasonable steps to complete the assessment within the timeframe required by the Privacy Act 1988 (Cth).

Where Sound and Strength have reasonable grounds to believe an eligible data breach has occurred, it will notify the Office of the Australian Information Commissioner and affected individuals in accordance with the Privacy Act 1988 (Cth).

A privacy or information security incident will also be assessed to determine whether it triggers any separate notification, incident management or reportable incident obligations under the NDIS or another applicable regulatory framework.

NDIS notifications will be made within the applicable NDIS timeframe where required.

Not every privacy incident or near miss is automatically reportable to the OAIC or NDIS Commission; however, every incident must be internally reported and assessed.

5.21 Automated decisions and transparency

Sound and Strength will keep its use of automated systems under review. From 10 December 2026, where the Privacy Act requires disclosure in an APP Privacy Policy about computer programs used to make, or do things substantially and directly related to making, decisions that could reasonably be expected to significantly affect an individual's rights or interests, Sound and Strength will ensure its public-facing privacy information contains the required details.

Where such obligations apply, this may include information about the kinds of personal information used and the kinds of decisions made or supported by relevant computer programs.

5.22 Complaints

A participant who has concerns about how Sound and Strength have collected, used, stored, disclosed or otherwise handled personal information may raise the matter with Sound and Strength. Complaints will be handled in accordance with the Feedback and Complaints Policy and applicable privacy requirements.

Participants may also have rights to complain to external regulators, including the Office of the Australian Information Commissioner and, where relevant, the NDIS Quality and Safeguards Commission.

5.23 Training and worker awareness

Workers will receive privacy, confidentiality and information management training during induction and periodically thereafter, including when material changes are made to systems, procedures or legal requirements.

Training relating to AI-enabled systems will include appropriate use, data minimisation, confidentiality, verification of AI outputs, prohibited use of unapproved AI tools and incident reporting.

5.24 Monitoring and audits

Sound and Strength may undertake periodic audits of participant records, system access, consent documentation, information accuracy, AI use, security controls and compliance with this Policy.

Identified risks or non-conformities will be documented and addressed through the organisation's risk, quality and continuous improvement processes.