Privacy and Health Records Policy
How KHC Support collects, uses, stores and protects your personal and health information.
Policy statement
KHC Support (ABN 26 115 937 574) collects, uses, stores and shares participants' personal and health information under the Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs). This applies to every participant, wherever they live. For participants in Victoria, KHC Support also follows the 11 Health Privacy Principles (HPPs) of the Health Records Act 2001 (Vic).
This policy covers all personal, health, disability and mental health information held about participants in any form: paper, electronic, audio or video.
Which laws apply
| Law | Applies to | Why |
|---|---|---|
| Privacy Act 1988 (Cth) | All participants | It applies to all private sector health service providers anywhere in Australia, whatever their size. |
| Health Records Act 2001 (Vic) | Participants in Victoria | It applies regardless of the size of the business and covers health, disability and aged care information. Its definition of a health service includes a disability service. |
| NDIS Code of Conduct | All participants | It applies to everyone delivering NDIS-funded supports and requires respect for participants' privacy. |
Western Australia has no state privacy law for private providers, so participants in WA are protected by the Privacy Act.
Responsible person: Karina Czaplinski (karina@khcsupport.com.au)
How KHC Support protects information
| Area | APP | Victorian HPP | What KHC Support does |
|---|---|---|---|
| Openness | APP 1 | HPP 5 | Gives this policy and the Privacy Statement to every participant, and provides them on request. |
| Anonymity | APP 2 | HPP 8 | Allows anonymity for general enquiries. A name and NDIS number are needed to deliver and invoice supports. |
| Collection | APP 3, 5 | HPP 1 | Collects only information needed to deliver supports, with signed consent, mostly from the participant. Tells participants why it is collected and who it may go to. |
| Use and disclosure | APP 6 | HPP 2 | Shares only with parties ticked on the consent form, and only what they need. Shares without consent only where the law allows, such as a serious threat to life, health or safety. |
| Direct marketing | APP 7 | HPP 2 | Never uses participant information for marketing. |
| Sending information outside the state or overseas | APP 8 | HPP 9 | Uses Astalty, which stores account data, documents and backups in Australia and is ISO 27001 certified. Does not send participant information overseas. Shares interstate only with consent. |
| Identifiers | APP 9 | HPP 7 | Uses the NDIS number only for NDIS purposes, not as an internal client ID. |
| Accuracy | APP 10 | HPP 3 | Updates records when plans, contacts or circumstances change, and reviews them at least every 6 months. |
| Security and retention | APP 11 | HPP 4 | Uses password-protected software with two-factor login, a locked device and no records in personal email. Keeps records for the periods below, then destroys them securely. |
| Access and correction | APP 12, 13 | HPP 6 | Responds to access and correction requests within the timeframes below. |
| Transfer to another provider | APP 12 | HPP 11 | Sends a copy or summary of a participant's records to their new provider when the participant asks. |
Key timeframes (all participants)
| Obligation | Timeframe |
|---|---|
| Respond to an access request | As soon as possible, and within 30 days of receiving it |
| Respond to a correction request | Within 30 days |
| Assess a suspected data breach | As soon as possible, and within 30 days |
| Keep records (adults) | At least 7 years after the last service provided |
| Keep records (last served under 18) | Until the person turns 25, or 7 years after the last service, whichever is later |
The 30-day access timeframe meets the Privacy Act and is shorter than the 45 days allowed in Victoria, so one timeframe applies to everyone. Access requests can be made by phone, email or in writing. KHC Support does not charge a fee for access. Access can be given by viewing the records, a copy, a summary, or an explanation. A record of every request, the response and the date is kept on file.
Our website
Referral form. Referrals made through the website go straight into Astalty, KHC Support's client management system, where they are stored in Australia. The website itself does not keep a copy.
Referrals made by someone else (APP 5, HPP 1). When a family member, support coordinator or other professional makes a referral, KHC Support will contact the participant (or their guardian or nominee) as soon as practicable to tell them:
what information was received and who provided it
why it was collected and how it will be used
that they can choose not to go ahead
If the participant does not wish to proceed, their referral information is deleted unless the law requires it to be kept.
Visiting the website (APP 8). The website is hosted by Cloudflare, which may process visitors' IP addresses and basic technical information on servers outside Australia to deliver and protect the site. The website does not use advertising or analytics cookies. No participant records are stored on the website.
Data breaches
KHC Support follows the Notifiable Data Breaches scheme under the Privacy Act. If personal information is lost, or accessed or shared without permission, Karina Czaplinski will:
act straight away to contain the breach and limit any harm
assess, within 30 days, whether it is likely to cause serious harm to anyone
if it is, notify the affected participants and the Office of the Australian Information Commissioner as soon as practicable
record what happened and what was done, and review how to stop it happening again
Additional protections for Victorian participants
Participants in Victoria have the extra protections of the Health Records Act 2001 (Vic):
Transfer to a new provider (HPP 11): they can ask for their health information to be made available to another health service provider.
If the business closes or is transferred (HPP 10): KHC Support will follow the Health Complaints Commissioner's statutory guidelines. It will notify current and recent participants in advance, transfer records only with consent or tell participants where their records will be held, and keep remaining records securely for the full retention period.
Complaints: they can complain to the Health Complaints Commissioner (see below).
KHC Support applies the same closure and transfer steps to participants in other states as good practice.
Complaints and review
Participants can raise a privacy concern with Karina Czaplinski (karina@khcsupport.com.au) first. If they are not satisfied, they can complain to:
All participants
Office of the Australian Information Commissioner: 1300 363 992, oaic.gov.au
NDIS Quality and Safeguards Commission: 1800 035 544, ndiscommission.gov.au
Participants in Victoria
Health Complaints Commissioner: 1300 582 113, hcc.vic.gov.au
Participants in Western Australia
Health and Disability Services Complaints Office (HaDSCO): 1800 813 583 or (08) 6551 7600, hadsco.wa.gov.au. HaDSCO handles complaints about health, mental health and disability services not funded by the NDIS. Complaints about NDIS-funded supports go to the NDIS Commission.
This policy will be reviewed every 12 months, or sooner if the law changes. Next review: November 2027.
This is a summary for a small business, not legal advice. The full principles are in Schedule 1 of the Privacy Act 1988 (Cth) and Schedule 1 of the Health Records Act 2001 (Vic).