Privacy Policy

Holte Home and Community Care (Holte Group) · ABN 73 626 819 047

Effective date: 11 November 2026 · Version 1.0

1. About this policy

At Holte, the people we support are at the centre of everything we do, and that includes looking after their personal information. This policy explains what personal information we collect, why we collect it, how we keep it safe, who we share it with, and how you can see or correct it or make a complaint.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As a registered NDIS provider, we also follow the privacy and confidentiality requirements of the NDIS Practice Standards and the NDIS Code of Conduct.

This policy applies to everyone whose information we handle, including:

• people we support (NDIS participants) and people who enquire about our services
• family members, carers, guardians, nominees and other representatives
• support coordinators, plan managers and other referrers
• job applicants, contractors and visitors to our website and social media pages.

If you would like this policy in another format, such as Easy Read, large print or another language, or you would like someone to talk it through with you, please contact us (see section 17).

2. Who we are

Holte Home and Community Care (trading as Holte Group) is a registered NDIS provider based in Midland, Western Australia, supporting people across the Perth metropolitan area. Our supports include assistance with daily living, household tasks, social and community participation, travel and transport, Supported Independent Living (SIL) and home modifications.

In this policy, "Holte", "we", "us" and "our" mean Holte Group (ABN 73 626 819 047).

3. What personal information we collect

"Personal information" is information or an opinion that identifies you, or could reasonably identify you. We only collect information we need to provide safe, quality supports and to run our business.

People we support

• Identity and contact details: name, date of birth, gender, address, phone, email, and emergency contacts.
• NDIS details: NDIS number, plan details, funding and budget information, goals, and how your plan is managed (NDIA-managed, plan-managed or self-managed).
• Health and support information: disability and health conditions, medications, allergies, support needs, behaviour support plans, mealtime or manual handling plans, risk assessments, care plans, progress notes, and incident records.
• Representatives: details of guardians, nominees, family members or carers who help you make decisions or who you ask us to talk to.
• Cultural and personal background: such as language spoken, interpreter needs, cultural or religious preferences, and whether you identify as Aboriginal or Torres Strait Islander, where you choose to tell us.
• Billing information: information needed to issue invoices and receive payments, including plan manager details.
• Feedback and complaints: anything you tell us when giving feedback or making a complaint.

Much of this is sensitive information (for example, health information). We only collect sensitive information with your consent, or where the law allows or requires it, such as in an emergency.

Referrers and professionals

Name, organisation, role and contact details of support coordinators, plan managers, allied health professionals and others who refer to us or work with us on someone's supports.

Job applicants, staff and contractors

Name, contact details, résumé, qualifications, work history, referee comments, right-to-work information, NDIS Worker Screening Check, Working with Children Check, driver's licence and vehicle details, vaccination status where required for a role, and banking and tax details for pay.

Records about current and former employees that relate directly to their employment are generally exempt from the Privacy Act. We still handle them confidentially and securely.

Website, social media and advertising

When you fill in a form on our website (such as a New Client Enquiry, referral, contact, feedback or careers form) or book a discovery call, we collect the details you enter. When you visit our website or interact with our ads and social media pages, we and our service providers may collect technical information such as your IP address, browser type, pages visited and how you arrived at our site (see section 8).

4. How we collect personal information

Where we can, we collect information directly from you, for example when you call us, fill in a form, book a discovery call, meet with our team, or during your supports.

Sometimes we collect information from other people, with your consent or where the law allows, such as:

• your guardian, nominee, family member or carer
• your support coordinator, plan manager or the NDIA
• your doctor, therapists or other health professionals
• our support workers, who record progress notes and observations while supporting you.

If we receive information about you that we did not ask for, we will check whether we could have collected it lawfully. If not, we will destroy or de-identify it where it is lawful and reasonable to do so.

5. Why we collect and use personal information

We collect, hold and use personal information to:

• respond to enquiries, referrals and discovery-call bookings
• assess whether we can support you and develop your service agreement and support plans
• plan, roster and deliver your supports safely, and match you with suitable support workers
• keep records of the supports we provide, including progress notes and timesheets
• issue invoices and claim payment from the NDIA, your plan manager or you
• manage risks, incidents, emergencies and your health and safety
• meet our obligations under NDIS laws, including registration, audits, reportable incidents and worker screening
• handle feedback and complaints and improve our services
• recruit, screen, train and pay our staff and contractors
• tell you about our services, where you have not asked us to stop (see section 7)
• comply with the law and with requests from courts, regulators or police where the law requires.

We will only use or disclose your information for another purpose if you consent, if you would reasonably expect it and it is related to the original purpose, or if the law allows or requires it.

6. Who we share personal information with

We only share personal information when it is needed for the purposes above, when you have agreed, or when the law requires or allows it. This may include:

• The NDIA – for example, to claim payment for supports.
• The NDIS Quality and Safeguards Commission – for example, for registration, audits, complaints, reportable incidents and worker screening.
• Your plan manager and support coordinator – to arrange, coordinate and pay for your supports.
• Your representatives – your guardian, nominee or anyone you ask us to talk to.
• Health professionals and other providers involved in your care, where needed for your supports or safety.
• Our approved auditors – who check we meet the NDIS Practice Standards.
• Service providers who help us run our business – for example, client management and rostering software, accounting and payroll software, email and booking systems, IT support, insurers and professional advisers. These providers may only use your information to provide services to us.
• Emergency services, police or government agencies – where there is a serious threat to someone's life, health or safety, or where the law requires it.

We do not sell personal information.

7. Marketing and advertising

We may send you information about our services, events or news by email, SMS or post. We will not use sensitive information, such as health information, for marketing without your express consent.

You can opt out at any time by using the unsubscribe link in our messages or by contacting us. Opting out will not affect your supports.

We advertise on platforms such as Facebook and Instagram (Meta). When you respond to one of our ads, for example by submitting an enquiry form or booking a discovery call, we receive the details you provide. These platforms may also use cookies and similar technology to show you our ads and measure how they perform. You can manage your ad preferences in your account settings on those platforms.

8. Our website and cookies

Our website uses cookies and similar tools to make it work and to help us understand how people use it, for example which pages are visited most. Some of these tools may be provided by third parties such as our website host, analytics providers and advertising platforms.

You can set your browser to refuse or delete cookies. Some parts of our website may not work properly if you do.

Our website may contain links to other websites. We are not responsible for the privacy practices of those websites.

9. Automated decision-making

We do not use computer programs to make, or to substantially help make, decisions that could significantly affect your rights or interests, such as whether we can provide supports to you. Decisions about your supports are made by people on our team.

We use software to help us run our services, for example to manage rosters, record timesheets and progress notes, and prepare invoices, but our staff review and make the decisions involved.

If this changes, we will update this policy to explain what kinds of decisions are made by computer programs and what kinds of personal information they use.

10. Storing and protecting personal information

We store personal information in secure electronic systems, including cloud-based client management, accounting and email systems. Where we keep paper records, we store them securely and limit who can access them.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These steps include:

• giving staff access only to the information they need for their role
• individual logins, strong passwords and multi-factor authentication where available
• confidentiality obligations and privacy training for all staff and contractors
• choosing service providers with appropriate security practices
• securely destroying or de-identifying information we no longer need.

How long we keep information

We keep records about the supports we provide for at least seven years, as required by NDIS rules, and longer where another law requires it. After that, we securely destroy or de-identify the records.

11. Disclosure overseas

Some of the service providers we use, such as cloud software providers, may store or process information on servers outside Australia. Where this happens, we take reasonable steps to make sure those providers handle the information in line with the Australian Privacy Principles.

12. Data breaches

If a data breach happens that is likely to cause serious harm to the people affected, we will notify those people and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme. We will also take steps to contain the breach and reduce any harm.

13. Anonymity and pseudonyms

You can deal with us anonymously or using a pseudonym when making a general enquiry or giving feedback. However, we need to know who you are to provide NDIS supports, issue invoices or investigate some complaints.

14. Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong, out of date, incomplete or misleading.

To make a request, contact our Privacy Officer (see section 17). We will need to confirm your identity, or your authority to act for someone else, before we release any information. We will respond within 30 days.

We do not charge for making a request or for correcting information. In some cases the law allows us to refuse access, for example where giving access would unreasonably affect someone else's privacy or pose a serious threat to someone's safety. If we refuse, we will tell you why in writing and explain how to complain.

15. Consent and support to make decisions

We respect your right to make your own decisions about your personal information. If you need support to understand this policy or give consent, we will provide information in a way that suits you and involve your chosen supporters. Where you have a guardian or other legally appointed decision-maker, we will work with them as the law allows.

You can withdraw your consent to us collecting, using or sharing your information at any time, unless the law requires us to keep or share it. If you withdraw consent, it may affect the supports we can provide, and we will explain this to you.

16. Privacy complaints

If you think we have mishandled your personal information, please tell us. You can contact our Privacy Officer or use our Feedback and Complaints page. You can also ask a family member, advocate or anyone else to help you or make a complaint on your behalf.

We will acknowledge your complaint promptly, investigate it fairly and aim to give you a response within 30 days. Making a complaint will not affect your supports.

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC) – 1300 363 992 · www.oaic.gov.au
• NDIS Quality and Safeguards Commission – 1800 035 544 · www.ndiscommission.gov.au

If you need an interpreter, call the Translating and Interpreting Service (TIS National) on 131 450 and ask them to contact us. If you are deaf or have a hearing or speech impairment, you can use the National Relay Service.

17. Contact us

Privacy Officer
Holte Home and Community Care (Holte Group)
3/12 Keane Street, Midland WA 6056
Phone: 1300 850 477
Email: info@holtegroup.com.au

18. Changes to this policy

We review this policy at least once a year and when our practices or the law change. The latest version will always be on our website, and you can ask us for a copy at any time.

Last reviewed: November 2026 · Next review due: November 2027