Your privacy, handled with care.

This policy applies to Gencare Disability Services(“Gencare”, “we”, “us”), a registered NDIS provider (Registration 405 016 1543) based at Level 8, 276 Flinders Street, Melbourne VIC 3000. It covers this website (gencareservices.com.au), our participant and family portal, our enquiry and referral forms, and the emails we send you.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we follow the privacy obligations in the NDIS Code of Conduct and NDIS Practice Standards.

We only collect what we need to respond to you and to deliver safe, quality support:

• Contact & enquiry details— your name, email, phone, suburb, the service you’re interested in and the message you send us.
• Referral information — details about the person being referred (often initials and high-level needs at first contact), the referrer, funding pathway, the services requested, and any documents you choose to upload.
• Account & onboarding information — if you create a portal account: your login details, profile, NDIS plan details, support needs, emergency contacts and documents you upload.
• Sensitive information— health, disability and support information is “sensitive information” under the APPs. We collect it only with your consent and only to plan and deliver your supports.
• Technical & usage data — device and browser information, and analytics about how the site is used (see Cookies & analytics).

We use your information to:

• respond to your enquiry or referral and arrange a Meet & Greet;
• assess eligibility, plan supports and deliver services under your NDIS plan;
• create and manage your portal account and keep you updated on your referral;
• meet our safeguarding, record-keeping and reporting obligations as an NDIS provider;
• improve our website and services, and keep them secure.

We do not sell your personal information, and we do not use it for unrelated marketing without your consent.

We use cookies and similar technologies to run the site and to understand how it’s used. Non-essential analytics and marketing tools load only after you consent. The tools we may use include Google Analytics 4, Meta Pixel, the LinkedIn Insight Tag and Microsoft Clarity. You can withdraw consent or clear cookies in your browser at any time.

We take care not to send identifying information (such as your name, email or NDIS details) to analytics or advertising providers.

We share personal information only where it’s necessary to deliver your support or where the law requires it:

• Your care team — coordinators and support workers involved in your supports, and, with your consent, family members or advocates.
• Service providers who help us operate — our hosting and database provider (Supabase), email delivery provider (Resend), website hosting (Vercel) and analytics providers. They process data on our instructions under contract.
• Regulators and authorities — including the NDIS Quality and Safeguards Commission, where we are required or permitted by law (for example, reportable incidents).

Some providers may store or process data outside Australia. Where that happens, we take reasonable steps to ensure your information is handled consistently with the APPs.

Your information is held in secure, access-controlled systems. We use encryption in transit, row-level access controls so people only see the records they’re entitled to, and audit logging of access to sensitive records. While no system can be guaranteed perfectly secure, we work hard to protect your information and to respond quickly if something goes wrong.

We keep personal information only as long as we need it. General enquiries that don’t proceed are typically held for around 12 months. Participant and support records are kept for at least 7 years to meet NDIS and other legal record-keeping requirements. When information is no longer needed, we de-identify or securely delete it.

You can ask us to:

• access the personal information we hold about you;
• correct anything that’s inaccurate or out of date;
• delete your account and personal information (subject to our record-keeping duties);
• withdraw consent for analytics, marketing or optional data sharing.

Email info@gencareservices.com.auand we’ll respond promptly. If you’re not satisfied with how we’ve handled your privacy, you can contact the Office of the Australian Information Commissioner (OAIC).

We may update this policy from time to time. The “last reviewed” date above shows when it last changed. Where changes are significant, we’ll take reasonable steps to let you know.