Privacy Statement

Buenavista Services Pty Ltd trading as Buena Vista Healthcare

ABN 29 648 795 877. NDIS registered provider 405 009 4438.

Version 2.0. Effective 27/10/2026. This policy replaces our earlier Privacy Statement.

1. About this policy

Buenavista Services Pty Ltd, trading as Buena Vista Healthcare ("we", "us", "our"), is committed to protecting the privacy of everyone's personal information. This policy explains, in plain language, what personal information we collect and why, how we use, share, store and protect it, how we use technology including AI tools, and how you can see or correct your information or make a complaint.

We follow the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles. As a health service provider in New South Wales, we also follow the Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW) for health information we handle in NSW. As an NDIS registered provider, we also meet the privacy requirements of the NDIS Act 2013, the NDIS Practice Standards and the NDIS Code of Conduct.

We have policies and procedures in place so that personal information is managed in an open and transparent way, and the privacy of participants, families, staff and volunteers is protected. We collect and handle personal information fairly and lawfully, and only use and share it for purposes the law allows. People can access and correct their personal information, and we keep it confidential through secure storage and security.

This policy applies to everyone whose information we handle: participants, their families, carers and representatives, referrers, other providers, job applicants, contractors, volunteers and website visitors.

You can ask for this policy in another format, such as Easy Read or large print, have it read to you, or have it explained in your language with an interpreter. Please contact us (see section 15).

2. Our services

We provide NDIS supports, including occupational therapy, support coordination, psychosocial recovery coaching and other support services. We work across South East Queensland (Brisbane, Sunshine Coast, Ipswich and Logan), regional Queensland (Rockhampton and Townsville) and New South Wales (Newcastle, Central Coast and Hunter).

3. The information we collect

We only collect information we reasonably need to provide and manage our services.

Contact and identity details: your name, address, phone, email, date of birth, gender and pronouns.

NDIS details: your NDIS number, plan dates, funding type, goals, and plan manager or support coordinator details.

Health information: your disability, diagnoses, mental health, allergies, health plans, medicines (recorded for emergencies only), and reports from your GP, treating team or allied health professionals.

Support and planning information: support plans, recovery plans, risk profiles, emergency plans, home safety checks, case notes and progress reports.

Diversity and other sensitive information (only when relevant and with your consent): cultural background, Aboriginal and Torres Strait Islander status, language, religion, sexuality and lifestyle preferences, and legal orders.

People in your life: contact details for your advocate, representative, guardian, nominee, emergency contacts, family and carers.

Payment information: funding and claim details, invoices, and bank details for self-managed participants.

Staff and applicant information: résumés, qualifications, references, worker screening and training records.

Website information: pages visited, device and browser type, and cookies (see section 11).

We collect sensitive information, including health information, only with your consent, or where the law allows it, for example in an emergency.

4. How we collect information

We collect information from you directly wherever we can, for example through our online service agreement and planning forms, in person, or by phone, video or email.

With your consent, we may also collect information from your representative, family or carer, your GP, psychiatrist, mental health team, case manager or other health professionals, your support coordinator, plan manager or other providers, and the NDIA.

You can withdraw your consent at any time by contacting us. This may affect what services we can safely provide, and we will explain what that means.

We may also collect information without your consent where the law requires or allows it, or where it is unreasonable or impracticable to ask you, for example when someone's life or safety is at risk.

You can choose not to give us some information, or use a pseudonym when making a general enquiry. However, we usually need your real name and details to provide and claim for NDIS supports. If you don't give us information we need, we may not be able to provide some supports safely, and we will explain what that means.

If we receive information about you that we didn't ask for, we will check whether we could have collected it. If not, we will destroy or de-identify it if it is lawful and reasonable to do so.

5. Why we use your information

We use your information to decide whether our services suit you and set up your service agreement, and to plan, deliver, coordinate, monitor and review your supports. We use it to write your support plan, recovery plan, risk profile, emergency plan and home safety plan with you, and to keep you, our staff and others safe, including in emergencies.

We also use it to communicate with you and the people you have agreed to, claim payment from the NDIA, your plan manager or you, and write progress reports, including for your NDIS plan reassessment. We use it to manage feedback, complaints and incidents, meet our legal, NDIS, audit, insurance and work health and safety obligations, improve the quality of our services (using de-identified information where possible), and recruit, train and manage staff.

We will only use or share your information for another purpose if you consent, or if you would reasonably expect it and it is directly related to the reason we collected it. We may also do so if the law, a court or a tribunal requires or allows it, or if we reasonably believe it is needed to lessen or prevent a serious threat to anyone's life, health or safety and it is unreasonable or impracticable to get your consent. We may also share it if we suspect unlawful activity or serious misconduct, or to help find a missing person.

6. Who we share information with

We share only what is needed, and only with people and organisations you have agreed to or where the law allows.

This may include our staff and contractors who support you (who are bound by confidentiality), the NDIA, your plan manager or support coordinator, and your GP, treating team, hospital or other providers you have agreed to.

We may share information with a person you have nominated, such as your advocate, parent, child, sibling, partner, relative, household member, guardian, enduring power of attorney or emergency contact, as long as they are at least 18 years old.

In an emergency, we may share information with emergency services such as ambulance or police. We may also share information with the NDIS Quality and Safeguards Commission for incidents, complaints and compliance, and with government bodies, courts or tribunals where the law requires it.

Our independent NDIS auditor may look at a sample of records. The auditor is checking Buena Vista Healthcare, not you, and will only speak with you if you agree.

We also use service providers that help us run our business, such as IT, cloud storage, e-signature, accounting and insurance providers. They must keep your information confidential and secure.

We never sell your personal information. We don't use it for marketing unless you agree, and you can opt out at any time.

7. How we use technology and AI

Technology we use

We use secure, business-grade systems to run our services. Access is limited to authorised staff, and we only put into each system the information it needs.

Splose is our practice management system, used for participant records, case notes, appointments, invoicing and NDIS claims. Data is stored in Australia.

Adobe Acrobat Sign is used for online forms and electronic signatures. Data is stored in Australia.

Microsoft 365 (Outlook, Teams, SharePoint, OneDrive and Copilot) is used for email, documents, file storage and AI drafting. Core data is stored in Australia.

Google Workspace is used for email, calendars, documents and file storage. Data may be stored in the United States and other countries.

Xero is used for accounting, invoices, payments and payroll. Data is stored in the United States.

Connecteam is used for staff rostering, timesheets, staff communication and training. Data is stored in the European Union (Germany and the Netherlands), and the company is based in Israel.

Perplexity Enterprise is used for AI drafting and research. Data is processed in the United States.

We keep detailed health and support information in Splose, and limit what goes into other systems. For example, Xero holds only what is needed for invoices and payments, and Connecteam holds only what staff need to attend a shift, such as a first name, suburb and any safety alerts.

AI tools

With your consent, authorised staff may use business-grade AI tools (Perplexity Enterprise and Microsoft 365 Copilot) to help draft documents such as support plans, recovery plans, risk profiles and reports.

We use information from your planning questionnaire, such as your goals, strengths, support needs, health and safety information, preferences and risk information. Before we use AI, we remove your name, contact details, date of birth and NDIS number, and use a reference code instead.

AI does not make decisions about you. It does not decide whether you can receive supports, what supports you get, your risk rating, or anything else that affects your rights or interests. AI only helps write drafts. A qualified staff member checks, corrects and approves every AI-assisted document, and you then review the draft with us before it is final.

Your information is not used to train AI models. Perplexity Enterprise data is never used to train its models.

You can say no to AI, or change your mind at any time. If you say no, we will not use AI with your information and your services will not change.

We do not use any other AI tools with your information, including AI features in Splose or Google Workspace. If this changes, we will update this policy and ask for your consent first.

Automated decisions

We do not use computer programs to make decisions about you that could significantly affect your rights or interests, and we do not use them to do things substantially and directly related to making such decisions. If this changes, we will update this policy first and tell you, as required by the Privacy Act from 10 December 2026.

8. Sending information outside Australia

We store our main records in Australia. Participant records in Splose are stored in Australia, and online forms are stored in Adobe Acrobat Sign's Australian data centre.

Some of our service providers store or process information outside Australia. In the United States, this includes Xero (accounting), Google Workspace (email and documents), Perplexity Enterprise (AI) and some Microsoft 365 Copilot processing. Connecteam (staff rostering) stores data in the European Union (Germany and the Netherlands) and is based in Israel. Support and backup services used by these providers may also be in other countries.

Before using an overseas service, we take reasonable steps to make sure the provider protects your information in line with the Australian Privacy Principles. We use business-grade accounts with security and data protection terms, keep detailed health information in Australia (in Splose), limit what goes into overseas systems, and remove identifying details before using AI.

9. Keeping your information secure

We take reasonable steps to protect your information from misuse, loss, and unauthorised access, change or sharing.

We use password protection and multi-factor authentication on our systems, and only staff who need access have it, under confidentiality agreements. We use encrypted, secure cloud storage, with health and support records kept in Splose. Staff use only approved business accounts for participant information, never personal email, apps or AI tools. Paper records are scanned and then securely destroyed, or stored in locked cabinets. Staff receive privacy training, and we check our systems regularly.

10. How long we keep information

We keep participant records for at least 7 years after your last support, or longer if the law requires. This includes records related to NDIS claims, incidents and complaints. For health information about a child collected in NSW, we keep it until the person turns 25, if that is later. When we no longer need information, we securely destroy or de-identify it.

11. Our website, cookies and online forms

Our website bvhc.com.au is hosted by Squarespace. Like most websites, it uses cookies and analytics to work properly and to help us understand how people use it, for example which pages are visited. This information is generally not used to identify you. You can turn off cookies in your browser settings, but some parts of the site may not work.

Our online forms open on Adobe Acrobat Sign's secure website, which verifies your email before you sign. When you visit another website from ours, that website's privacy policy applies.

12. Seeing and correcting your information

You can ask to see or get a copy of the information we hold about you, and ask us to correct anything that is wrong, out of date or incomplete.

To do this, contact our Privacy Officer (see section 15). We will check your identity before giving you access. We will try to respond within 7 days, and no later than 30 days. There is no fee to ask, and we will not charge you for access to your own records.

In rare cases the law lets us refuse access, for example if it would seriously threaten someone's life, health or safety. If we refuse, we will explain why in writing and tell you how to complain. If we don't agree to make a correction, you can ask us to attach a note to your record saying what you think is wrong.

13. If there is a data breach

If your information is lost, or accessed or shared without permission, we will act quickly to contain it and assess the risk. If the breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will explain what happened and what you can do. We follow our Management of Data Breach Policy and Procedure.

14. Questions and complaints

If you have a question or are unhappy with how we have handled your information, please tell us. You can contact us in any way that suits you, have a support person or advocate help you, or ask to stay anonymous.

All privacy complaints will be treated seriously, dealt with as quickly as possible, and handled confidentially and fairly. Making a complaint will not affect your services or your agreement with us.

Please contact our Privacy Officer or Complaints Manager (see section 15). We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days. We will keep you updated and tell you the outcome in writing.

If you are not happy with our response, you can contact the Office of the Australian Information Commissioner on 1300 363 992 or at oaic.gov.au. For health information handled in NSW, you can contact the Information and Privacy Commission NSW on 1800 472 679, by email at ipcinfo@ipc.nsw.gov.au, or at ipc.nsw.gov.au. For NDIS supports, you can contact the NDIS Quality and Safeguards Commission on 1800 035 544 or at ndiscommission.gov.au.

Since 10 June 2025, people can also take court action for a serious invasion of their privacy under the Privacy Act.

15. Contact us

Privacy Officer: Herbert Bergmann, herbert.b@bvhc.com.au

Complaints Manager: Don Evangelista, complaintsfeedback@bvhc.com.au, 0414 487 730

General enquiries: admin@bvhc.com.au

Occupational therapy: ot@bvhc.com.au

Support coordination: coordination@bvhc.com.au

Queensland office: 1/888 Brunswick Street, New Farm QLD 4005

NSW office: 3 Amy Close, Wyong NSW 2259

If you need an interpreter, call TIS National on 131 450. If you are deaf, or have a hearing or speech impairment, you can use the National Relay Service.

16. Changes to this policy

We review this policy at least every year, and whenever the law or our practices change, for example if we start using new technology. The latest version is always at bvhc.com.au/privacy. If a change significantly affects how we handle your information, we will tell participants directly.

Employee and volunteer records

Records about current and former employees that are directly related to their employment are generally covered by workplace laws, not the Privacy Act. We still keep them secure and confidential. The Privacy Act applies to volunteer and job applicant records, and to employee information used for any purpose not related to employment.