Privacy and Confidentiality Policy

St Giles Society Limited is committed to protecting the privacy and confidentiality of participants and their families, staff, volunteers, prospective employees, service providers, donors, sponsors, community partners and stakeholders in the way information is collected, stored and used.

This client-friendly version of our Privacy and Confidentiality Policy provides participants and families with an overview of how we collect, use, and protect your information, in line with the Australian Privacy Principles and the Privacy Act 1988. A full version of our Privacy and Confidentiality Policy is available on request.

This policy aims to provide clarification on:

• what guides us when we collect personal information,
• what we must do before personal information is used or disclosed,
• the choices you have about giving us personal information,
• your rights to access and correct personal information,
• your rights to complain about our handling of your personal information, and
• employee’s responsibility to maintain privacy and confidentiality, at all times.

When you use our website and/or utilise our services, you consent to the collection, use and disclosure of your personal information in line with this policy and any contract, agreement, or other arrangement between us.

How We Collect Your Information
We collect only the personal information necessary to provide safe, high-quality services. This may include:

• Your name, contact details, and demographic information
• Health, medical, and disability information when needed to deliver services
• Government identifiers (e.g., NDIS Participant Number) if required by law

We may collect information directly from you or, when necessary, from third parties such as parents, carers, health providers, or government agencies. We will seek your consent where possible.

Collection Notice

When we collect your information, we will let you know:

• What information we collect and why
• How it will be used and who it may be shared with
• Your rights to access or correct your information
• How to make a privacy enquiry or complaint
• Whether information may be stored overseas and the safeguards in place

We will provide this in a way you can understand, including plain language or accessible formats.

Where possible, you may interact with us anonymously or using a pseudonym. However, identifiable information is usually required to provide safe and effective services.

How We Use Your Information
We use your information to:

• Provide and improve our services
• Communicate with you about your services and related information
• Meet legal, funding, and reporting obligations
• Manage donations, employment, volunteering, and other participation

We may also need to share certain information with the NDIS Commission and/or other government / regulatory bodies as required by law to ensure safe and effective service delivery.

We only use or share information for other purposes if:

• You consent
• It is required or authorised by law
• It is necessary to prevent a serious threat to life, health, or safety

Third-Party Service Providers
We may engage third parties to help deliver services or manage data. We ensure they:

• Comply with privacy and confidentiality obligations and that they adhere to the Australian Privacy Principles protections
• Protect information from misuse, loss, or unauthorised access
• Report privacy incidents promptly

Marketing and Communications
We will only send marketing or promotional information if you give consent. You can change your preferences or opt out at any time. Your choices are recorded and promptly applied.

Keeping Your Information Safe
We protect your information with:

• Secure electronic systems, firewalls, and password protections
• Controlled access to paper records
• Procedures to securely destroy or de-identify information when no longer needed

We take all reasonable steps to ensure your information is accurate and up-to-date. Please notify us promptly of any changes.

Access and Correction
You can request access to your personal information or ask us to correct it.

• Requests should be made in writing: feedback@stgiles.org.au or by post
• We aim to respond within 30 days
• In some cases, access may be limited by law

Data Breaches
A data breach occurs when personal information is lost, accessed, or disclosed without authorisation. If a breach occurs, we will:

1. Contain and assess the breach
2. Investigate the cause and impact
3. Notify affected individuals and regulatory bodies if required
4. Take steps to prevent future breaches

Governance and Staff Responsibilities
Our staff are trained to maintain confidentiality and handle information according to this policy. The Risk and Compliance Team monitors compliance, manages incidents, and reports to the Executive Leadership Team and Board.

Contact Us
To request access to or correction of personal information, or to make a privacy complaint, please do not hesitate to contact us;

Version 1 23-02-2026