Privacy Policy

4.1 Consent to collection, use and retaining and disclosing Participant information

(a) Ensure Participant’s consent is obtained to collect, use and retain their information or to disclose their information (including assessments) to other parties, including details of the purpose of collection, use and disclosure.

(b) Such consent is obtained in accordance with:

(1) the Privacy Consent Form executed by each Participant;

(2) the Service Agreements between Wonder Lives Care and each Participant.

(c) Ensure the Privacy Consent Form informs each Participant that their information could be disclosed or provided without their consent if required or authorised by Relevant Laws.

Key Management Personnel and Workers

4.2 Storage and use of information

(a) Use the following EIMS to store information (as applicable):

(1) ShiftCare;

(2) OneDrive;

(3) Xero;

(4) Outlook.

(b) Use the following off-line systems to store information (as applicable):

(1) Secure drawers and cabinets;

(2) Secure off-site storage and back-up of certain important information as described in Wonder Lives Care’s Emergency and Disaster Management Plan;

(3) Forms used to collect information from Participants, their support network and others including initially using our Participant Intake Form and information gathered from the Participant during the induction process.

(A) Information includes a Participant’s Service Agreement(s), Privacy Consent Form, Participant Support Plan and progress and review notes.

(B) Information gathered in paper format may include information gathered in verbal conversations and via written progress notes.

Key Management Personnel and Workers

4.3 Use of electronic information management systems

(a) If permitted by a Participant, and to the maximum extent permitted by the Participant’s needs and preferences, deliver a “paperless” service which predominantly uses electronic information management systems (EIMS) so as to:

(1) Eliminate the need for manual document filing and retrieval, saving time and resources. Electronic documents can be accessed and shared quickly and easily, which can improve organisational efficiency and productivity;

(2) Protect Personal Information and Sensitive information by restricting access to authorised Workers, reducing the Risk of data breaches or theft;

(3) Provide a platform for sharing information and collaborating with team members, both internally and externally. This can improve communication and decision-making processes;

(4) Help Wonder Lives Care to comply with Relevant Laws by providing a centralised repository for storing and managing compliance-related documents and data;

(5) Provide a platform for backing up and recovering electronic documents and data, reducing the Risk of loss due to natural disasters or other unexpected events;

(6) Eliminate the need for physical document storage, reducing the costs associated with paper-based document management, such as printing, storage, and retrieval;

(7) Improve customer service by providing quick and easy access to relevant customer data, enabling Wonder Lives Care to respond to Participant inquiries and requests more efficiently.

Key Management Personnel and Workers

4.4 ShiftCare

(a) Ensure ShiftCare:

(1) Is the key system utilised by Workers to manage Wonder Lives Care’s day to day operations with respect to the provision of supports and services, including rostering of Workers;

(2) Is used to ensure workforce governance systems and processes are consistent with Relevant Laws;

(3) Is used to ensure that Wonder Lives Care has enough skilled and qualified Workers given the number and needs of Participants at any 1 time;

(4) Is the most appropriate system to achieve the goals of Wonder Lives Care with respect to Governance as set out in the Governance Policy, in particular that it:

(A) Has been designed and developed for use by Wonder Lives Care with reference to the regulatory framework and Relevant Laws;

(B) Allows for streamlined service scheduling and management;

(C) Enables the Service Manager to easily view and schedule supports and services, check availability of Workers, and coordinate with Third Party Providers and mainstream health providers, so that that Participants can be promptly scheduled for the supports and services they need, improving Participant satisfaction;

(D) Provides a centralised database to store and access Participant and Worker information securely;

(E) Can maintain detailed Participant and Worker profiles with demographic data, medical history, Support Plans, and other documents completed during Assessments such as Risk Assessments, and progress notes;

(F) Enables quick access to comprehensive Participant information to facilitate consumer directed care, allow for better coordination among Providers and enhance Participant safety.

(G) Includes features such as secure messaging or integrated communication tools, enabling efficient communication between Wonder Lives Care and each Participant, improving support coordination, appointment reminders, and follow-ups;

(H) Enables Participants to reach out with questions or concerns, and Workers to respond promptly, fostering a stronger Participant-provider relationship;

(I) Automates the process of documenting Participant encounters, Support Plans and other documents during Assessments such as Risk Assessments and progress notes;

(J) Includes templates and standardised forms that can be customised to a Participant’s needs;

(K) Includes accurate and comprehensive documentation to improve Participant care and assist in compliance with legal and regulatory requirements;

(L) Integrates with Xero and includes features to assist with generating accurate invoices for Service Fees, making accurate claims for NDIS Funding and creating Financial Information Statements, reducing administrative burdens, to help ensure accuracy, reducing errors and improving revenue cycle management and compliance with claiming NDIS Funding in accordance with Relevant Laws;

(M) Provides data analytics and reporting capabilities, offering valuable insights into Participant care;

(N) Enables Wonder Lives Care to track Participant outcomes, monitor treatment effectiveness, identify trends and measure performance indicators, to help Wonder Lives Care to make informed decisions, improve care protocols and optimise resource allocation;

(O) Incorporates security measures to protect Participant information, including data encryption, user access controls and compliance with Relevant Laws, so as to maintain Participant confidentiality and data security which is essential in building trust and ensuring compliance with legal and ethical obligations including Relevant Laws;

(P) Allows Wonder Lives Care to easily manage the key aspects of Worker administration and HR management, allowing Wonder Lives Care to track everything from training, qualifications, certifications, and any relevant expiration dates for NDIS Worker Screening Checks, as well as a module to track performance appraisals and manage employee leave, schedules which supports continuity of supports and services.

(Q) Tracks consideration of the Suitability Matters with respect to Key Management Personnel at least once every 12 months and as otherwise provided in the Governance Policy to ensure they are suitable to be involved in Wonder Lives Care and, if applicable, providing supports and services.

(R) Allows Wonder Lives Care to track Incidents and Complaints.

Key Management Personnel

4.5 Xero

(a) Ensure Xero:

(1) Is the key system utilised by Wonder Lives Care to manage its accounting and financial operations, financial reporting obligations and financial Governance, including as set out in the Governance Policy;

(2) Is the most appropriate accounting system to achieve the goals of Wonder Lives Care with respect to financial Governance as set out in the Governance Policy, when compared to other accounting systems, in particular that it:

(A) Has a user-friendly interface and intuitive design;

(B) Simplifies complex accounting processes, making it accessible to users without extensive accounting knowledge;

(C) Has a user-friendly dashboard, providing a clear overview of financial information, allowing users to navigate and manage their accounts with ease;

(D) Operates on a cloud-based platform, providing secure access to Wonder Lives Care’s financial data from anywhere with an internet connection, allowing business owners, accountants, and relevant stakeholders to collaborate and work on the same set of real-time financial information and ensuring that data is automatically backed up and protected from loss or physical damage;

(E) Offers a wide range of financial management features, including invoicing, accounts payable and receivable, bank reconciliation, expense tracking, and budgeting, so as to streamline financial tasks, automate processes and provide accurate real-time insights into Wonder Lives Care’s financial health;

(F) Simplifies the bank reconciliation process by connecting directly with Wonder Lives Care’s bank accounts and automatically importing and categorizing transactions, saving time and minimising errors, ensuring that accounts are always up to date and accurate;

(G) Integrates seamlessly with numerous third-party applications including Practice Management System and Document Management System (as applicable), so as to allow for a streamlined flow of data between different business systems, reducing manual data entry and improving overall efficiency;

(H) Offers a robust reporting system, providing a variety of customisable reports, including profit and loss statements, balance sheets, cash flow statements and more, so as to offer valuable insights into Wonder Lives Care’s financial performance, enabling informed decision-making, identifying trends and monitoring key performance indicators;

(I) Automates several manual accounting processes, such as recurring invoices, payment reminders, and bank feeds, so as to reduce the time and effort required for routine tasks, allowing Key Management Personnel to focus on more strategic activities and business growth;

(J) Prioritises data security and implements robust measures to protect Wonder Lives Care’s financial information, including use of encryption and secure data centers to safeguard data, and regular backs up information to ensure data integrity and availability.

Key Management Personnel

4.6 OneDrive

(a) Ensure OneDrive is:

(1) A secondary document management and EIMS utilised by Wonder Lives Care to store documents, templates, records, analysis and information which relate to Wonder Lives Care’s Governance systems set out in the Governance Policy and where such information is not more appropriately stored in another EIMS;

(2) Is the most appropriate system to achieve the goals of Wonder Lives Care with respect to document management as set out in the Governance Policy, when compared to other document management systems, in particular that it:

(A) Provides cloud storage that allows Wonder Lives Care to store, sync, and access files from anywhere with an internet connection;

(B) Provides ample storage space.

(C) Simplifies file sharing and collaboration among individuals and teams;

(D) Allows easy file and folder sharing with specific people and the creation of links to share with others;

(E) Has collaboration features that enable multiple users to work on the same document simultaneously, making it ideal for team projects or remote work scenarios and collaboration between Key Management Personnel, Workers, the Board or advisory bodies (as the case may be) and that enable users to co-author documents in real-time, leave comments, and track changes, enhancing productivity and efficiency;

(F) Seamlessly integrates with Microsoft Office suite applications, including Word, Excel, PowerPoint, and Outlook, so as to allow for direct editing of documents stored in OneDrive and real-time synchronisation;

(G) Enables Workers to start working on a document on 1 device and continue from where they left off on another device, ensuring a consistent and uninterrupted workflow;

(H) Automatically saves versions of files, enabling track changes and an ability to revert to previous versions if needed, which feature is particularly useful if files are accidentally deleted or overwritten or if Wonder Lives Care wants to review and restore earlier versions of a document and provides an added layer of protection and ensures that files are not permanently lost or corrupted;

(I) Incorporates robust security measures, including encryption, two-factor authentication, and compliance with industry standards and regulations.

Key Management Personnel

4.7 Security of Personal Information

(a) Protect Personal Information against misuse, interference, loss and from unauthorised access, modification or disclosure by:

(1) Using the EIMS which have been carefully selected by Wonder Lives Care based on their functionality and security posture with respect to protection of Personal Information and Sensitive information;

(2) Restricting access to such EIMS to authorised Workers, reducing the Risk of data breaches or theft;

(3) Using Website protection measures (such as the use of an SSL certificate);

(4) Using Security restrictions on access to Wonder Lives Care’s local computer systems (such as login and password protection);

(5) Controlling access to Wonder Lives Care’s premises;

(6) Implementing Personnel security (including restricting the use of Personal Information by Workers to those who have a legitimate need to know the information for the purposes set out above);

(7) Implementing training and Wonder Lives Care’s Policies, including:

(A) Ensuring Workers only access and use Personal Information for a valid work purpose;

(B) Ensuring when Workers are handling Personal Information, that they:

(i) Confirm recipient details before sending information;

(ii) Always store any hard copies of confidential information that is not capable of being stored in an appropriate EIMS in a secure cabinet or room;

(iii) Be aware of the surroundings and people nearby when holding Personal Information on their person and securing such information when travelling (e.g. in briefcase, folder etc.);

(iv) Limit creation of hard copy information and when necessary, taking such information away from secure sites;

(v) Scanning documents into EIMS and shredding or disposing of unneeded copies of information securely;

(vi) Destroying or permanently de-identify Personal Information that is no longer needed for any purpose that is permitted by the Australian Privacy Principles, subject to other legal obligations and retention requirements applicable to Wonder Lives Care under Relevant Laws;

(C) Ensuring Workers only share Personal Information as set out in this Policy.

Key Management Personnel and Workers

4.8 Records about Key Management Personnel

(a) Wonder Lives Care will collect and retain records about the members of its governing body that includes the following information:

(1) The names of the members that are independent non-executive members;

(2) The names of the members that are not independent non-executive members;

(3) and both:

(A) Names of the members who have experience in provision of Clinical Care;

(B) Details of each such member’s experience.

(b) Those records are recorded in a register of directors which is held in OneDrive.

Key Management Personnel

4.9 Records about Workers

(a) Wonder Lives Care must collect and is required to keep and retain the following documents from each Worker to ensure that:

(1) Workers have appropriate qualifications, skills or experience to provide the supports and services that Wonder Lives Care provides to Participants;

(2) Workers are given opportunities to develop their capability to provide supports and services.

(b) Wonder Lives Care must retain the following at all times during which the person remains a Worker:

(1) A NDIS Worker Screening Clearance that is not more than 5 years old and is not suspended.

(2) For any period that a Worker is without a NDIS Worker Screening Clearance, retain:

(A) The Worker’s Worker Screening Clearance Application details; and

(B) A statutory declaration from the Worker,

as required by Wonder Lives Care’s Human Resources Management Policy.

(3) Copies of:

(A) The Worker’s resume/CV/statement of experience;

(B) Any qualifications, trainings and professional memberships (as applicable).

(c) Ensure Worker records are held in Wonder Lives Care’s Practice Management System, or cloud-based storage system (as applicable).

Key Management Personnel

4.10 Records about Participants

(a) Participant Records may include:

(1) Assessments of Participants;

(2) NDIS Plans for Participants;

(3) Medical records, progress notes and other clinical records of Participants, including death certificates where appropriate;

(4) Agreements between Participants and Wonder Lives Care;

(5) Accounts of Participants;

(6) Records relating to Participants’ engagement, leave arrangements and transitions,

(7) The name and contact details of at least one Representative of each Participant, according to information given to Wonder Lives Care by the Participant or by the Representative;

(b) Ensure Wonder Lives Care collects, and keeps (as required), Participant Records for at least 7 years after a Participant ceases to be engaged by Wonder Lives Care.

(1) Ensure Wonder Lives Care retains Participant Records for longer than 7 years if required, according to Relevant Laws of the specific State or Territory where service delivery was provided by Wonder Lives Care to the Participant.

(c) Ensure Participant records are held in Wonder Lives Care’s EIMS.

Key Management Personnel and Workers

4.11 Access and Correction

(General)

(a) Request identity verification before processing any request to ensure information is not released to unauthorised individuals.

(1) Acceptable proof may include a driver's licence or proof of ID document.

(b) Escalate any uncertain or complex access requests to Key Management Personnel for review and final determination.

(c) Record all:

(1) Access and correction requests;

(2) Actions taken in the Participant’s file.

(Access)

(d) Acknowledge all requests for access to personal information within 5 business days of receipt.

(e) Request verification of identity before processing any request to ensure information is not released to unauthorised individuals.

(1) Acceptable proof may include a driver's licence or proof of ID document.

(f) Determine whether access can be granted based on Relevant Laws.

(1) For example, consider if access may pose a serious threat to the health or safety of any individual.

(g) If access is approved, provide the information in a timely manner,

(1) Within 30 calendar days;

(2) In the format requested, where reasonable.

(h) If access is refused, notify the participant in writing of the decision to refuse access.

(1) Explain the reasons behind the decision.

(2) Provide information on how they can lodge a complaint or request a review.

(Correction)

(i) Acknowledge all requests for correction to personal information within 5 business days of receipt.

(j) Review if the information held by Wonder Lives Care is inaccurate, out of date, incomplete, irrelevant or misleading.

(k) Assess whether the correction is justified.

(l) If the correction is accepted, update the relevant records in all applicable systems with the correction.

(2) Note the date and details of the correction made.

(3) Notify the participant in writing that the correction has been made.

(m) If the correction is refused, notify the participant in writing of the decision to refuse the correction.

(4) Explain the reasons behind the decision.

(5) Provide information on how they can lodge a complaint or request a review.

Key Management Personnel and Workers

4.12 Information Disposal

(a) Restrict information disposal to Key Management Personnel.

(1) Ensure no Worker disposes of any records without the prior written consent of Key Management Personnel.

(b) Ensure that record retention requirements have been met prior to disposal of Personal Information.

(c) When disposing of Personal Information:

(1) Place unneeded working documents or copies of information in secure bins or adequate shredders;

(2) Ensure any electronic media including computers, hard drives, USB keys etc. are sanitised when no longer required;

(3) Ensure information on cloud-based systems is permanently deleted.

Key Management Personnel

4.13 Third Party Disclosure

(a) Disclose Personal Information to third parties where appropriate, including to:

(1) Wonder Lives Care’s funding providers;

(2) Government and regulatory bodies, including the National Disability Insurance Agency, Medicare, the Department of Social Services, the Department of Health & Human Services, and the Australian Taxation Office;

(3) People acting on a Participant’s behalf, including their Representatives;

(4) The Police, or to the Commission, or to comply with compulsory notices from courts of law, tribunals or Government Agencies;

(5) Financial institutions for payment processing;

(6) Referees whose details are provided to Wonder Lives Care by job applicants;

(7) Wonder Lives Care's contracted service providers, including:

(A) Information technology service providers;

(B) Invoice processing service providers;

(C) Freight and courier services;

(D) External business advisers (e.g. recruitment advisors, auditors and lawyers).

(b) In the case of contracted service providers:

(1) only disclose Personal Information to the service provider as appropriate for the delivery of supports and services to Participants.

(2) collect all information from the service provider, as required for the delivery of supports and services, including for continuity of supports.

4.14 Complaints

Follow Wonder Lives Care’s Feedback and Complaints Management Policy where a complaint is made in relation to privacy or information management.

Key Management Personnel and Workers

4.15 Incidents

(General)

(a) Report and Manage Incidents, including a Near-Miss Incident, in accordance with Wonder Lives Care’s Incident Management and Reporting Policy.

(b) It is vital all privacy Incidents are reported as soon as possible so that their impact may be minimised.

(c) Ensure Workers:

(1) Identify potential privacy incidents;

(2) Report any Incidents, including Near-Misses, to Key Management Personnel, as they become aware of them.

(3) Understand the reason for reporting Incidents.

(Privacy-related Incidents)

(d) In the event of a Privacy-related incident, assess if the breach:

(1) has a major impact;

(1) has a non-major impact;

(2) was a Near Miss or an Incident with no apparent impact,

on a Participant.

(e) Regardless of impact, the breach must be reported and managed in accordance with Wonder Lives Care’s Incident Management and Reporting Policy.

(f) Wonder Lives Care must report all Participant-related privacy Incidents to the:

(1) Department of Health and Human Services;

(2) NDIS Commission;

(3) Office of the Australian Information Commissioner,

as applicable, within:

(4) one business day of becoming aware of, or being notified of a possible privacy Incident; or

(5) within one business day of an allegation being made of a potential breach.

Key Management Personnel and Workers

4.16 Training

Train Workers to assist them to understand how to apply this Policy and these procedures in everyday practice during their induction, and as part of ongoing refresher training and/or when processes change.

Key Management Personnel