Privacy Policy
Our Commitment to Privacy
At Tumble N’ Nuts: Early Intervention Hub, we are dedicated to protecting the privacy of all participants, families, staff, and partners. We recognise that personal information is sensitive and must be handled with the highest standards of care.
We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the NDIS Code of Conduct, ensuring that information is collected, stored, and shared in a lawful, safe, and ethical manner.
This Privacy Policy outlines:
- What information we collect and hold
- How and why we collect, use, and store your information
- Who we share your information with and under what circumstances
- Your rights regarding access, correction, and consent
- How to make a complaint if you believe your privacy has been mishandled
Any reference to “we,” “our,” or “us” refers to Tumble N’ Nuts: Early Intervention Hub and its related entities under Worthy Ability Services.
Scope
This policy applies to all participants, families, guardians, nominees, staff, volunteers, and external partners connected with Tumble N’ Nuts. It covers:
- In-person interactions, phone calls, emails, and online communications
- Forms, assessments, service agreements, therapy notes, and progress reports
- Information provided by third-party professionals, schools, childcare, or community services
- Data collected from government or funding bodies
We may update this Privacy Policy from time to time. The most current version will always be available on our website.
Types of Information We Collect
We collect both personal information and sensitive information, including but not limited to:
- Identification and contact details: name, date of birth, address, phone number, email address
- NDIS details: participant number, plan information, service agreements
- Guardians, nominees, or key contacts: parent, guardian, or nominated representative
- Health and therapy information: medical reports, therapy assessments, progress notes, goals, and treatment plans
- Emergency contacts: for urgent communication
- Funding and insurance details: Medicare, health fund information, or other identifiers
- Education and community information: reports from schools, childcare, or community support services
- Lifestyle or daily activity information: routines, hobbies, interests, or any other information relevant to therapy or support
Sensitive information, including health and disability records, is handled with the highest confidentiality and protected by strict security measures.
How We Collect Information
We collect information through multiple channels, including:
- Directly from participants: during appointments, via phone, email, forms, or our website
- From parents, guardians, or nominees when participants cannot provide information themselves
- With your consent, from health professionals, schools, childcare, and community services involved in your care
- From NDIS documentation: including plans, assessments, progress reports, and service agreements
- From government agencies or funding bodies: where lawful and relevant
We aim to collect information directly from participants whenever possible to ensure accuracy and transparency.
Why We Collect and Use Your Information
We collect and use personal information to deliver safe, high-quality, person-centred services in compliance with NDIS Practice Standards. This includes:
- Understanding your needs and tailoring therapy or support programs
- Coordinating multidisciplinary services: OT, Speech, Psychology, Behaviour Support, AHA and Support Work .
- Reporting and accountability: preparing progress notes, reports, and updates for the NDIS or other funding bodies
- Administrative purposes: appointment scheduling, billing, service agreements, and internal record-keeping
- Quality assurance: monitoring service delivery, accreditation, and compliance
- Communication: providing updates, appointment reminders, notifications of changes to services
- Legal and safeguarding obligations: mandatory reporting, court orders, and safety concerns
- Research and evaluation: only using de-identified information unless otherwise consented
We do not sell, trade, or rent your personal information to external organisations.
How and When We Share Information
We only share personal information when necessary and appropriate:
- With your consent
- When required by law: child protection, court orders, or urgent safety concerns
- With healthcare professionals or service providers involved in your care
- With the NDIS or other funding bodies for reporting, audits, or claims
- With third-party service providers: e.g., IT services, appointment reminders, document storage—bound by confidentiality agreements
- To prevent serious harm to life, health, or safety
We do not share information overseas unless legally required and only with your explicit consent.
Storing and Protecting Information
We take all reasonable measures to ensure your information is secure:
- Secure electronic records with limited access to authorised staff only
- Confidentiality agreements for all staff, contractors, and volunteers
- Regular audits and reviews of ata accuracy and currency
- Secure disposal or de-identification of information no longer required
- Continuous monitoring of technical, administrative, and physical safeguards
Any unauthorised access, misuse, or disclosure of information is considered serious misconduct and may result in disciplinary or legal action.
Retention and Destruction
We retain personal and sensitive information only as long as necessary to provide services and meet legal, regulatory, or funding obligations. When information is no longer required, it is securely destroyed or de-identified.
Your Rights
As an NDIS participant, parent, guardian, or nominee, you have the right to:
- Access your information: request copies of records, progress reports, or assessments
- Correct your information: ensure it is accurate, complete, and up-to-date
- Be informed: understand how your information is collected, used, and shared
- Anonymity or pseudonyms: request to be treated anonymously where lawful and practical
- Withdraw consent: note that withdrawing consent may affect the services we can provide
Requests for access, correction, or withdrawal of consent can be made by contacting us directly. For safety, we may ask for proof of identity before releasing records.
Complaints
If you believe your privacy has been mishandled:
1. Contact us directly – we will investigate and respond within 30 days
2. Escalate externally if needed:
If you believe your privacy has been mishandled:
- 1300 363 992
- enquiries@oaic.gov.au
- GPO Box 5218, Sydney NSW 2001
- OAIC Privacy Complaints
NDIS Quality and Safeguards Commission
- www.ndiscommission.gov.au
We take all privacy concerns seriously and ensure they are addressed promptly.
Electronic Communications & Website
When you interact with our website or communicate electronically:
- We may collect non-identifiable information: IP address, browser type, pages visited, documents downloaded, referring website
- Cookies may be used to improve user experience, analyse traffic, and personalise content. You can block cookies, but some features may be affected
- Emails and online messages are treated as confidential and managed according to this Privacy Policy
Contact Us
For any questions, requests, or complaints regarding your privacy:
Privacy Officer – Tumble N’ Nuts: Early Intervention Hub
Email: info@tumblennuts.com.au
Phone: 0429689764
