Privacy Policy

Next Step Living Pty Ltd (ABN 64 686 937 682, NDIS Registration ID 4-LF0QW0M)
Last updated: 2 November 2026. This page is a plain-language summary of our Privacy and Information Management Policy (version 1, approved June 2025).

Your privacy matters to us. This page explains what personal information we collect, why we collect it, how we keep it safe, and what your rights are.

We follow the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the NDIS Practice Standards on Privacy and Dignity and Information Management.

Who this policy covers

  • People who use our supports (participants), and their families, carers, guardians and representatives
  • Support coordinators, plan managers and other people who refer to us or work with us
  • People who apply for jobs with us
  • People who visit our website or contact us

What information we collect

We only collect what we need to provide safe, quality supports. This may include:

  • Your details: name, contact details, gender, date of birth, marital status, and your disability and support needs
  • Identifiers: numbers used by government or other organisations, such as your NDIS number
  • Service details: the supports we provide and how we deliver them
  • Health and medical information that is relevant to your supports
  • Financial information: billing details and information about your NDIS-funded (or other) supports
  • Records of our conversations and contact with our workers
  • Photos, audio or video: only if you agree. You can say yes or no to each of these on our consent form, including whether photos can be used on our website or social media.

Health, medical and disability information is "sensitive information". We only collect it if you give us your consent, or if the law requires or allows it.

How we collect it

We usually collect information directly from you or the person supporting you:

  • in person
  • by phone or email
  • on forms
  • through our website

We may also receive information from people who refer you to us, such as the NDIA or your support coordinator, or from funding bodies and government agencies.

When you start with us, one of our workers will go through our Privacy Consent Form with you. They'll explain, in plain language, what we collect, why, and who we may share it with. We can arrange an interpreter or other help if you need it. You can change or withdraw your consent at any time by letting us know in writing.

Why we collect and use it

We use your information to:

  • understand your needs, preferences and goals, and plan your supports
  • deliver your supports, answer your questions and process payments
  • keep you informed about your plan, our services and the NDIS
  • check and improve the quality of our services, including surveys and handling complaints
  • meet our legal, NDIS and reporting obligations, including incident reporting and record keeping

We'll only send you newsletters or marketing if you've agreed, and you can opt out at any time. We don't sell personal information.

Who we may share it with

We share information when it's needed to deliver your supports, when you've agreed, or when the law requires or allows it. This may include:

  • the NDIS Quality and Safeguards Commission, the NDIA and Medicare
  • funding bodies and external auditors (for example, NDIS audits)
  • your plan manager, support coordinator, or other providers and health professionals you've agreed we can talk to
  • people acting on your behalf, such as a guardian or representative
  • banks and payment providers, to process payments
  • trusted service providers who help us run our business, who must keep your information confidential

Sometimes we may have to share information without your consent. This happens if there is an immediate risk of harm to you or someone else, or if the law requires it, for example a court order, police request or mandatory report.

You can also tell us who we must not share your information with.

How we store and protect it

  • We keep electronic records in secure, cloud-based storage. Paper documents are scanned and then either locked away or securely destroyed.
  • Our systems include Google Workspace (Google Drive and Gmail).
  • We protect information with password-protected and restricted access, firewalls, anti-virus software and encryption. We also control access to our premises, give access only to workers who need it, and train our workers in privacy.

Information stored overseas

  • Google Workspace: may store data on servers outside Australia.
  • Website forms: our website is hosted by Squarespace. Information you send through our website forms may be stored on Squarespace's servers outside Australia, including in the United States.
  • We take reasonable steps to make sure these providers protect your information.

How long we keep it

Unless the law requires something different, we keep participant records for at least:

  • 7 years after an adult stops using our services
  • 25 years after a child (under 18) stops using our services

After that, we destroy records securely, for example by cross-cut shredding paper and securely wiping electronic records.

If something goes wrong

We take any privacy breach seriously. Our workers must report any privacy incident straight away, even a near miss.

We report privacy incidents to the relevant authorities, including the NDIS Commission and the Office of the Australian Information Commissioner (OAIC). Our policy is to do this within one business day of becoming aware of a possible breach. If a breach affects you, we'll tell you.

Seeing and correcting your information

You can ask to see the information we hold about you, or ask us to correct it if it's wrong, out of date or incomplete. Contact us using the details below.

  • We'll respond within a reasonable time, usually 30 days, and we won't charge you to make a request.
  • If we can't give you access or make a change, we'll explain why and tell you how to complain.

Our website

Our website platform (Squarespace) uses cookies and collects basic statistics, such as pages visited and the type of device used, to help the site work and to improve your experience. You can turn cookies off in your browser settings. Our website may link to other websites, and we're not responsible for their privacy practices.

Questions or privacy complaints

Please talk to us first. We handle privacy complaints the same way as other complaints, through our Feedback & Complaints process, and you'll never be treated differently for raising a concern.

We'll let you know we've received your complaint within 3 days and keep you updated.

If you're not happy with our response, or you haven't heard back within 30 days, you can contact:

You can ask us for a copy of our full Privacy and Information Management Policy at any time.

Help to read this policy

  • Interpreter: call TIS National on 131 450 and ask them to call us on 0451 839 147.
  • Deaf, or a hearing or speech impairment: use the National Relay Service: www.accesshub.gov.au
  • We can go through this policy with you in person, or provide it in Easy Read or another format. Just ask.

We may update this policy from time to time. The latest version is always on this page.