Privacy

Your privacy matters to us. This page explains, in plain language, what information Ellira collects, why we collect it, who we may share it with, and the choices and rights you have. We handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Health Records Act 2001 (Vic).

Ellira Pty Ltd (ABN 96 688 683 301) is a mental health and disability support provider. Ellira is not yet a registered NDIS provider - we are working toward NDIS registration.

What we collect

We only collect what we need to support you well. Depending on the supports you receive, this can include:

• Your name, contact details, NDIS number and date of birth.
• Information about your goals, the supports you've had before, and what works for you.
• Sensitive information, where it's needed - including health, disability, medication, risk, emergency, family, cultural, communication and behaviour information.
• Notes from your support shifts ("progress notes"), and incident or complaint records if something goes wrong.
• Your Service Agreement, support plan and consent forms.

Some information is optional. We will never refuse you supports just because you chose not to provide optional information. If required information isn't provided, though, we may not be able to assess a request, deliver a support safely, or respond properly to a risk or concern.

Why we collect it

We collect information that is reasonably necessary to:

• Assess your request and confirm eligibility and funding.
• Plan and deliver your supports safely.
• Bill the NDIS or your plan manager.
• Communicate with the people you've approved.
• Manage safety, and respond to incidents or complaints.
• Meet our obligations as a provider of NDIS supports and keep required records.

Consent - and changing your mind

We usually ask for your consent before collecting sensitive information or sharing your information with other people or organisations. You can withdraw your consent at any time - just tell us.

There are limited times the law requires or allows us to use or share information without consent - for example, if you or someone else is at serious risk of harm, if we have mandatory reporting obligations, or if a subpoena, warrant or regulator's notice requires it. Where it's safe and appropriate, we will tell you what we're doing and why.

Who we may share information with

With your consent, and only where it's needed, we may share relevant information with:

• Your authorised representatives or nominees.
• Your plan manager or support coordinator.
• Health practitioners involved in your care.
• Emergency services.
• Regulators, auditors, insurers and legal advisers, where required for compliance, audit or legal purposes.
• Other providers involved in your supports.

We share only what is reasonably needed for the purpose.

How we store and protect your information

We store your records securely and limit access to workers who need the information for their role. We use physical, digital and operational safeguards - secure systems, controlled access, secure passwords and device handling, locked storage for any paper records, and secure disposal. We back up electronic records and take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.

Website referral records may be stored in Ellira's secure signing/referral system, including our self-hosted Documenso service at sign.ellira.com.au where it is enabled. Access is limited to authorised staff. When that secure referral system is enabled, staff receive a notification and reference number rather than the full referral contents by email.

Seeing and correcting your information

You can ask to see the information we hold about you, and ask us to correct it, at any time. We provide your records to you free of charge within 14 days - usually sooner. Just ask.

How long we keep records

We keep your records for 7 years after your services with us end, in line with privacy and NDIS requirements. After that, records are securely destroyed or de-identified when they're no longer needed and no longer required to be kept.

Our website

Visiting ellira.com.au is not the same as being a participant, and the information involved is different.

We use Google Analytics to understand how people find and use this website - which pages are read, how visitors arrived, roughly which region they are in, and what device they used. This is measurement of website use. It is not linked to your NDIS records, your support notes, or anything you have told a worker, and we do not use it to identify individual visitors.

To do this, Google sets cookies in your browser and collects technical information such as a truncated version of your IP address, your browser and device type, and the pages you visit. That information is processed by Google and may be stored on servers outside Australia, including in the United States. Google's handling of it is covered by Google's privacy policy.

We switch analytics off where it matters. There is no analytics on our referral form or our complaints form. Those are the pages where people type health, disability and safeguarding information, and no measurement is worth telling a third party that a particular device visited them. If we add another page of that kind, it gets the same treatment.

You can opt out. Most browsers let you block or delete cookies, and Google publishes a browser add-on that switches Google Analytics off for every site you visit. Blocking analytics does not affect your access to anything on this site, and it has no effect on your supports.

Information you deliberately send us through this website - the referral app, a careers application, a complaint, an enquiry - is not analytics. It is handled as personal information under the rest of this policy.

Bot protection. Our forms use Cloudflare Turnstile to check that submissions come from people, not automated programs. It checks technical details about your browser and device, not what you type, and this may be processed outside Australia. See the Cloudflare Turnstile Privacy Addendum.

Overseas disclosure

We do not routinely send the personal information we hold about you as a participant overseas. We would only do so with your consent, where the law requires or allows it, or after taking the privacy steps the law requires first. The routine exceptions are website analytics and the bot protection on our forms, both described above, which involve website-use and device information rather than your support records.

If something goes wrong with your data

We take all reasonable steps to prevent data breaches. If we ever suspect a breach involving your personal information, we act immediately: we contain it, assess the risk of harm, and notify you and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it. We treat every breach as a critical incident and use what we learn to strengthen our security.

Privacy questions or complaints

If you have a question, or you think your privacy has been breached, please tell us first - we will fix what we can.

• Phone: 1300 487 996
• Email: [email protected]

If you're not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC) - 1300 363 992 · oaic.gov.au
• Health Complaints Commissioner Victoria (for health information held in Victoria) - 1300 582 113