ABOUT THIS PRIVACY POLICY

Kinder Caring Home Support Services Pty Ltd (Kinder Caring, we, us or our) respects your privacy and is committed to handling personal information openly, responsibly and securely.

This Privacy Policy explains how we collect, hold, use and disclose personal information and how you may access or correct your information or make a privacy complaint. It applies to our care and support services, workforce activities, websites, applications and other interactions with us.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and applicable health-records, aged-care, disability, employment and other laws. This policy is a general statement of our information-handling practices. We may also provide a privacy collection notice when we collect information in particular circumstances.

WHO THIS PRIVACY POLICY APPLIES TO

This Privacy Policy applies to personal information we hold about individuals, including:

• clients and prospective clients;

• family members, carers, representatives, nominees, advocates and other supporters;

• employees, contractors, volunteers, students, applicants and prospective workers;

• referrers, suppliers, service providers and professional contacts; and

• people who use our websites, applications or other digital services.

PERSONAL INFORMATION WE COLLECT

The kinds of personal information we collect and hold depend on our relationship with you and may include:

• identity and contact information, such as your name, date of birth, address, telephone number and email address;

• information about your communication needs, language, culture, preferences, relationships and living circumstances;

• health, disability, clinical and care information, including diagnoses, medications, allergies, assessments, care or support plans, risks and service notes;

• government, funding and service information, including aged-care, NDIS, Medicare, Department of Veterans' Affairs, icare, TAC, WorkSafe or other relevant identifiers and plan details;

• financial, billing, transaction and payment information;

• information about services requested, arranged or delivered and communications with us;

• feedback, complaints, incidents, investigations and safeguarding information;

• recruitment and workforce information, including qualifications, employment history, licences, screening checks, availability, payroll, performance and training records; and

• technical and usage information from our websites and applications, such as device information, IP address, login and activity information, cookie identifiers and approximate location information where enabled.

Where reasonably necessary, we may also collect sensitive information, including health information, disability information, racial or ethnic origin, religious beliefs, sexual orientation, criminal-record information and professional-association information.

HOW WE COLLECT PERSONAL INFORMATION

We generally collect personal information directly from you, including when you contact us, complete a form, use our website or application, participate in an assessment or survey, apply for work, enter an agreement or receive services.

We may also collect information from:

• a family member, representative, nominee, advocate or person arranging services for you;

• health practitioners, hospitals, referrers and other service providers;

• government agencies, funding bodies, plan managers, insurers and regulators;

• workers, referees, screening bodies and training or professional-registration bodies;

• our contracted service providers and business partners; and

• publicly available sources where collection is lawful and appropriate.

If you provide us with another person's information, you should have authority to do so and, where appropriate, tell that person that their information has been provided to us.

If we receive unsolicited personal information, we will determine whether we could lawfully have collected it. If not, and it is lawful and reasonable to do so, we will destroy or de-identify it.

Where practicable, you may interact with us anonymously or using a pseudonym. We may need to know your identity where required by law or where identification is necessary to provide services, protect safety, process payments or properly respond to your request.

WHY WE COLLECT, HOLD, USE AND DISCLOSE PERSONAL INFORMATION

We collect, hold, use and disclose personal information where reasonably necessary for our functions and activities, including to:

• assess eligibility and needs and plan, arrange, deliver, coordinate, monitor and review care and support services;

• communicate with you and people involved in your care or services;

• protect the health, safety, rights and wellbeing of clients, workers and others, including responding to emergencies;

• administer agreements, accounts, payments, invoices, funding claims and service bookings;

• recruit, engage, roster, train, supervise and manage workers and service providers;

• manage feedback, complaints, incidents, investigations, insurance matters and legal claims;

• meet legal, regulatory, contractual, safeguarding, reporting, audit and accreditation requirements;

• operate, secure and improve our services, systems, websites and applications;

• conduct quality assurance, evaluation, research, planning and service improvement, including through de-identified information where appropriate; and

• provide information about our services where permitted by law and consistent with your communication preferences.

If we cannot collect information that is reasonably necessary, we may be unable to assess your needs, provide or fund services, process an application, meet safety requirements or otherwise deal with your request.

SENSITIVE AND HEALTH INFORMATION

We collect sensitive information only where it is reasonably necessary for our functions or activities and we have consent, or where collection is otherwise required or permitted by law. Health information may also be collected where necessary to provide a health service or in another permitted health situation.

We use and disclose sensitive and health information for the purpose for which it was collected, for a directly related purpose you would reasonably expect, with your consent, or as otherwise required or permitted by law. Access is limited to people who need the information for an authorised purpose.

HOW WE DISCLOSE PERSONAL INFORMATION

Depending on the circumstances, we may disclose personal information to:

• Kinder Caring workers and contractors who require it to perform authorised duties;

• your authorised representatives, nominees, advocates, family members or supporters;

• health practitioners, hospitals, pharmacies and other care or service providers;

• government agencies, funding bodies, plan managers, insurers and claims managers;

• regulators, complaints bodies, screening bodies, police, courts and emergency services where required or permitted;

• technology, cloud-storage, communications, payroll, payment, accounting, audit and other contracted service providers;

• our professional advisers, including lawyers, accountants and insurers; and

• another organisation in connection with an actual or proposed business transaction, subject to appropriate confidentiality and legal requirements.

We do not sell personal information. We require contracted providers to handle information only for authorised purposes and to apply appropriate privacy and security protections.

DIRECT MARKETING

We may send you information about Kinder Caring services where permitted by law. Where required, we will obtain your consent. You may opt out at any time by using the unsubscribe facility in the communication or contacting us. We will action opt-out requests within a reasonable period and will not charge you for opting out.

We will not use sensitive information for direct marketing without your consent.

WEBSITES, APPLICATIONS, COOKIES AND ANALYTICS

Our websites and applications may use cookies and similar technologies to operate services, remember preferences, protect security, understand usage and improve performance. These technologies may collect technical and usage information such as IP address, device and browser information, pages viewed, interactions and approximate location.

We may use third-party analytics and communications services. Information collected through these services is handled in accordance with this Privacy Policy and the providers’ privacy terms. You can manage some cookies through your browser or device settings, although disabling them may affect functionality.

Our websites may contain links to third-party websites or services. We are not responsible for their privacy practices and recommend reviewing their privacy policies.

ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING

We use artificial intelligence (AI) tools within our care-management platform to help our staff find, summarise and draft information, for example searching our policy library or preparing a draft document from a client's records. Personal information, including health information, may be included in the information processed by these tools when a staff member uses them in the course of an authorised task.

The AI models we use are operated by Microsoft (Azure OpenAI) and hosted in Australia. Information processed by these tools is not used to train the models and is not shared with the model developer. Access to the tools requires an authenticated staff login and is limited to the information the staff member is otherwise authorised to see.

We do not use AI or other automated processes to make decisions that have a legal or similarly significant effect on you, such as decisions about eligibility, funding or the services you receive, without human review. We do not use personal information for profiling. AI outputs are reviewed by our staff before they are relied on.

If you have questions about how AI is used in relation to your information, or you would like to understand how a particular decision was made, please contact our Privacy Officer using the details below.

OVERSEAS RECIPIENTS

Some contracted service providers may access or process personal information from outside Australia. Kinder Caring engages some support staff in the Philippines through a contracted provider. They access our Australian-hosted systems under Kinder Caring's policies, procedures and direction and are subject to the same confidentiality obligations and access controls as our Australian staff. Personal information is not stored in the Philippines. Our care-management platform and its database are hosted in Australia. Some technology providers process limited information in the United States, including email, SMS and push-notification delivery and error monitoring, and our accounting provider operates across regions.

Where it is practicable to identify additional countries, we will provide that information in this policy, a relevant privacy collection notice or on request. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with applicable Australian privacy requirements, unless an exception applies.

STORAGE, SECURITY AND RETENTION

We hold personal information in electronic and, where required, physical records, including within approved systems operated by Kinder Caring or contracted service providers.

We take reasonable administrative, physical and technical steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These measures may include role-based access, authentication controls, secure storage and transmission, monitoring, backups, staff training and contractual safeguards.

We retain personal information for as long as reasonably required for the purpose for which it was collected and to meet legal, regulatory, funding, employment, taxation, insurance and recordkeeping requirements. When information is no longer required and it is lawful to do so, we take reasonable steps to securely destroy or de-identify it.

ACCESSING AND CORRECTING YOUR INFORMATION

You may request access to personal information we hold about you or ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact Kinder Caring using the details below. We may need to verify your identity before actioning a request.

We will respond within a reasonable period, usually within 30 days. We do not charge for making a request, but we may charge a reasonable amount for providing access where permitted by law and after notifying you of the likely cost.

In some circumstances, the law permits or requires us to refuse access or correction. If we refuse, we will generally provide written reasons and explain the available complaint mechanisms. If we refuse a correction request, you may ask us to associate a statement with the information noting that you consider it inaccurate, out of date, incomplete, irrelevant or misleading.

PRIVACY AND DATA BREACHES

If you believe personal information may have been lost, accessed, used or disclosed without authority, please contact our Privacy Officer promptly.

We assess and respond to suspected privacy and data breaches in accordance with our legal obligations. Where the Notifiable Data Breaches scheme applies, we will take reasonable steps to complete the assessment within 30 days and notify the Office of the Australian Information Commissioner and affected individuals where an eligible data breach has occurred, unless an exception applies.

PRIVACY COMPLAINTS

If you have a concern or complaint about how we have handled personal information, contact our Privacy Officer. Please provide enough information for us to understand and investigate the matter.

We will acknowledge the complaint promptly, investigate it fairly and aim to provide a response within 30 days. If we need more time, we will explain the reason and provide an updated timeframe.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner. Information about making a complaint is available at www.oaic.gov.au or by calling 1300 363 992. Other complaint avenues may also be available under health, aged-care, disability or other applicable laws.

CONTACT US

For privacy enquiries, complaints, or requests to access or correct personal information, please contact:

Kinder Caring Home Support Services Pty Ltd

Suite W2DB, Level 2, Building 2

75 O’Riordan Street

Alexandria NSW 2015

Phone: 1300 796 675

Email: info@kindercaring.com.au

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our practices, services, systems or legal obligations. The current version will be published on our website and will state when it was last updated. Where appropriate, we will take reasonable steps to communicate material changes.

DEFINITIONS

Australian Privacy Principles or APPs means the principles in Schedule 1 to the Privacy Act 1988 (Cth).

Eligible data breach has the meaning given in the Privacy Act and generally means unauthorised access to, or disclosure of, personal information, or loss of personal information, where the circumstances are likely to result in serious harm to one or more individuals.

Health information has the meaning given in the Privacy Act and applicable health-records legislation.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in material form or not.

Sensitive information has the meaning given in the Privacy Act and includes health information and certain information about an individual's racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and professional or trade-association membership.

Issue 4, September 2026. Next review September 2027.