Confidentiality and Privacy Policy

1. Purpose

This policy sets out how Bounce Back Co protects the privacy and confidentiality of the participants and families we support, and of our team and stakeholders. It explains how we collect, use, store, share and protect personal and sensitive information, including when we use digital systems and artificial intelligence tools.

2. Scope

This policy applies to:

• Bounce Back Co, its director, and all practitioners, contractors and students
• All participant records and communications
• All information collected, stored or shared in any form, including written, verbal and digital

3. Policy statement

Bounce Back Co respects every person's right to privacy. We manage personal and sensitive information lawfully, fairly and transparently, in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), the NDIS Code of Conduct, and the requirements of the NDIS Quality and Safeguards Commission.

4. Definitions

Personal information: information that identifies, or could reasonably identify, a person (for example, a name, date of birth or address).

Sensitive information: a category of personal information that includes health information, disability information, cultural background and criminal history. Most information we hold about participants is sensitive information.

Confidentiality: the obligation to keep information private unless the person has agreed to it being shared or we are required by law to share it.

Nominee or guardian: a person with legal authority to make decisions for a participant, such as a parent of a child, an NDIS plan nominee, or a guardian or administrator appointed by a tribunal.

AI tools: software that uses artificial intelligence to help produce content, such as transcribing, summarising or drafting text.

5. Collection of information

We collect only the information we need to:

• Deliver safe, person-centred and neurodiversity-affirming behaviour support
• Meet our legal, funding and NDIS Commission requirements
• Keep accurate service and support records

Wherever possible, we collect information directly from the participant or their nominee or guardian. With consent, we may also collect information from other people involved in the participant's life, such as other providers, schools, support coordinators and health professionals.

6. Consent

• We ask for consent before collecting, using or sharing information, unless the law allows or requires otherwise.
• Where a participant is a child, or has a nominee or guardian, consent is given by the person with legal authority to make that decision. We still involve the participant in decisions about their information as much as possible, in a way that suits their age and communication.
• Consent can be withdrawn at any time by letting us know. Withdrawing consent will not affect the services a participant receives, although it may limit what we can do (for example, if information cannot be shared with someone implementing a plan).
• We record consent, and any changes to it, on the participant's file.

7. Use and disclosure

We only use and share information for the purpose it was collected, unless:

• The person (or their nominee or guardian) has given consent
• We are required or authorised by law to share it, including to prevent serious harm, for child safety reporting, or for safeguarding
• It is necessary to provide support, for example sharing with an advocate, support worker, other provider or guardian

Disclosures that are part of behaviour support

Because we provide specialist behaviour support, some sharing of information is a routine and required part of our work. This includes:

• Lodging behaviour support plans and related information with the NDIS Quality and Safeguards Commission
• Providing information needed for reporting on regulated restrictive practices and incidents
• Sharing information for authorisation of restrictive practices under Queensland law, including the Disability Services Act 2006 (Qld)
• Sharing behaviour support plans with the people and providers who implement them, so the plan can be delivered safely
• Sharing information with the NDIA, plan managers or our subcontracting partner provider for funding and billing purposes

We explain these disclosures when a participant starts with us, and only share what is needed for each purpose.

8. Practice systems and use of AI software

Our practice management system

Participant records, appointments, case notes and reports are stored in Splose, a secure, Australian-built practice management system designed for allied health practices working within the NDIS. Splose stores data with strong encryption and is bound by Australian privacy law.

How we use Splose AI

Splose AI is an optional feature built into Splose, the practice management system Bounce Back Co uses to keep client records. It helps our practitioners with admin and writing tasks so funding can be used more efficiently. Splose AI runs on OpenAI, which means some data is processed in the United States. However, your data is stored securely in Australia-compliant systems in line with the Privacy Act 1988 and the Australian Privacy Principles.

When we use AI tools:

• AI does not make decisions about anyone's supports. We do not use AI or any automated system to make decisions about participants.
• Everything AI produces is a draft. A practitioner reviews, edits and approves all AI-assisted content before it is used or shared, and remains responsible for its accuracy.
• Your information is not used to train AI. We only use AI tools under settings or agreements that do not allow participant information to be used to train AI models.
• We share only what is needed. We limit the information given to AI tools to what the task requires, and remove identifying details where practicable.
• Only approved tools are used. Practitioners must not enter participant information into any AI tool that Bounce Back Co has not approved, including personal accounts.

Choosing not to have AI used

Participants, nominees and guardians can choose not to have AI tools used with their information, or change their mind at any time, by contacting us. We will record this on the participant's file and let the team know. This will not affect the services you receive.

9. Storage and security

We keep personal information secure through:

• Secure, password-protected systems with two-factor authentication where available
• Role-based access, so team members only see what they need for their work
• Keeping paper records to a minimum. Any hard copies are stored securely, scanned to the participant's file where appropriate, and securely destroyed.
• Secure methods for sending information, and checking recipients before sending

Team members must not share participant information with anyone who is not authorised to receive it. This obligation continues after their engagement with Bounce Back Co ends.

10. Record retention

We keep participant records for at least 7 years after they are created, in line with NDIS requirements, or longer where another law requires it. When records are no longer needed, they are securely destroyed or de-identified.

11. Access and correction

Participants, and their nominees or guardians, have the right to:

• Ask for access to the personal information we hold about them
• Ask us to correct information they believe is inaccurate, out of date or incomplete

Requests can be made in writing to our Privacy Officer. We will respond within 30 days. If we cannot give access or make a correction, we will explain why in writing and let you know how to make a complaint.

12. Privacy breaches

A privacy breach may occur if personal information is lost, or accessed or shared without authorisation. This includes information entered into an unapproved AI tool or shared with the wrong person. If a breach happens or is suspected:

• It will be reported to the Privacy Officer straight away and investigated
• We will act quickly to contain it and reduce any harm
• Affected people will be told
• If the breach is likely to cause serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme
• We will take steps to prevent it happening again

13. Responsibilities

Bounce Back Co

• Make sure this policy and relevant privacy laws are followed
• Approve the systems and software tools used, and check their privacy and security settings
• Provide training and guidance to the team, including on the safe use of software, including AI
• Maintain secure record-keeping systems

All practitioners and contractors

• Follow this policy at all times
• Keep participant information secure and confidential
• Only use approved AI tools, and review all AI-assisted content before it is used
• Report any suspected or actual privacy breach to the Privacy Officer immediately

14. Questions and complaints

If you have a question or concern about how we handle your information, please contact our Privacy Officer:

If your concern is not resolved, you can contact:

• Office of the Australian Information Commissioner: www.oaic.gov.au or 1300 363 992
• NDIS Quality and Safeguards Commission: www.ndiscommission.gov.au or 1800 035 544

15. Review

This policy is reviewed every year, or sooner if legislation, NDIS requirements or the tools we use change. Participants and families will be told about any significant changes.

16. Related policies and legislation

• Privacy Act 1988 (Cth) and the Australian Privacy Principles
• National Disability Insurance Scheme Act 2013 (Cth)
• NDIS (Restrictive Practices and Behaviour Support) Rules 2018
• NDIS Code of Conduct and NDIS Practice Standards
• Disability Services Act 2006 (Qld)
• OAIC guidance on privacy and the use of commercially available AI products
• Bounce Back Co Records Management Policy
• Bounce Back Co Complaints and Feedback Policy