Privacy Policy

1. Introduction

Firm Ground Care is committed to protecting the privacy of all NDIS participants, their families, nominees, and any other persons whose personal information we collect in the course of delivering disability support services. This Privacy Policy explains how Firm Ground Care collects, uses, stores, and discloses personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs).

This policy also addresses the specific privacy considerations arising from the use of smart home technology, sensors, and assistive devices in participants' homes.

2. What Personal Information We Collect

Firm Ground Care may collect the following categories of personal information:

• Identity and contact information: Name, date of birth, address, phone number, email address, NDIS participant number.
• NDIS plan information: Plan dates, funding categories, plan manager details, support coordinator details, stated goals.
• Service delivery records: Shift notes, progress notes, incident reports, service schedules, invoices.
• Health and disability information: Relevant health conditions, allergies, medication (only where directly relevant to safe service delivery), mobility and communication needs, behaviour support information.
• Emergency contact information: Names and contact details of nominated emergency contacts, nominees, and guardians.
• Worker information: Employee/contractor records including screening clearances, qualifications, training records.
• Smart home and sensor data: Motion detection events, door/window sensor data, temperature readings, device usage patterns, Wi-Fi connectivity logs. See Section 6 for full details.

3. How We Collect Personal Information

Firm Ground Care collects personal information:

• Directly from the participant (or their nominee/guardian) during intake and service delivery.
• From the participant's plan manager, support coordinator, or NDIS plan documentation.
• From workers delivering services (shift notes, incident reports).
• From smart home devices and sensors installed in the participant's home (with consent).
• From referral sources (e.g., allied health professionals, hospitals) with the participant's consent.

Firm Ground Care will only collect personal information that is reasonably necessary for the delivery of NDIS supports.

4. How We Use Personal Information

Personal information is used for the following purposes:

• Delivering safe, effective, and person-centred NDIS supports.
• Creating and maintaining service agreements and support plans.
• Invoicing and financial administration.
• Meeting NDIS reporting, compliance, and quality obligations.
• Responding to incidents, complaints, and feedback.
• Monitoring and improving service quality.
• Configuring, troubleshooting, and maintaining smart home and assistive technology devices.

5. Disclosure of Personal Information

Firm Ground Care will not disclose personal information to any third party without the participant's consent, except where:

• Required by law (e.g., mandatory reporting obligations, court orders).
• Necessary to prevent a serious and imminent threat to life, health, or safety.
• Required by the NDIS Quality and Safeguards Commission (e.g., reportable incidents).
• The participant's plan manager requires information for invoicing purposes.

Firm Ground Care does not sell, rent, or trade personal information.

6. Smart Sensor and Assistive Technology Privacy

Where Firm Ground Care installs or manages smart home technology — including motion sensors, door/window sensors, smart plugs, smart lighting, or voice-activated devices — the following privacy provisions apply.

6.1 Consent

No data-collecting device will be installed without the participant's informed, written consent. The consent form will specify the type of device, the data it collects, how the data is stored, and who has access.

6.2 Data Collected by Smart Devices

Depending on the device, data may include: motion detection events and timestamps, door/window open/close events, temperature and humidity readings, smart plug on/off status and energy usage, and voice assistant interaction logs (if a voice device is installed).

Firm Ground Care does not install cameras or audio recording devices unless specifically requested by the participant, and only with written consent that clearly explains the implications.

6.3 Data Storage

Sensor data is typically stored on the device manufacturer's cloud platform (e.g., Google Home, Amazon Alexa, Apple HomeKit, Samsung SmartThings). Firm Ground Care does not operate its own cloud storage for sensor data. Firm Ground Care may access sensor data through the manufacturer's app for the purposes of troubleshooting, configuration, and service delivery.

6.4 Data Access

Access to sensor data is limited to the participant (or their nominee) and authorised Firm Ground Care workers. Firm Ground Care will not share sensor data with any third party, including family members, without the participant's written consent.

6.5 Data Deletion

Upon request or upon termination of the service agreement, Firm Ground Care will assist the participant in removing devices and deleting associated cloud data and accounts.

7. Storage and Security of Personal Information

Firm Ground Care takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure, in accordance with Australian Privacy Principle 11.

Security measures include:

• Digital records stored on password-protected, encrypted devices and cloud storage with two-factor authentication.
• Physical records stored in a locked filing cabinet at Firm Ground Care's business premises.
• Access to personal information restricted to authorised personnel on a need-to-know basis.
• All workers trained in privacy and confidentiality obligations during induction.
• Regular review of security controls (at least annually).
• Secure disposal of personal information that is no longer required (shredding for paper, secure deletion for digital).

8. Access and Correction

Participants have the right to:

• Request access to the personal information Firm Ground Care holds about them.
• Request correction of inaccurate, incomplete, or out-of-date information.

Requests can be made by contacting us at admin@firmgroundcare.com.au or via our contact form.

9. Complaints

If a participant believes their privacy has been breached, they may:

• Contact the Director of Firm Ground Care on 0404 771 274 or 0404 018 902.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
• Contact the NDIS Quality and Safeguards Commission on 1800 035 544.

10. Retention and Destruction

Personal information will be retained for a minimum of seven (7) years from the date of last service delivery, in accordance with NDIS record-keeping requirements. After this period, information will be securely destroyed.

11. Review

This Privacy Policy will be reviewed annually, or following any significant change to legislation, technology, or service delivery.