Privacy Policy

Last updated: 17 August 2026

Elara Support (“Elara Support”, “we”, “us”, “our”) provides Day Options supports for NDIS participants. We are committed to protecting the privacy, dignity and rights of the people we support, their nominees, guardians and families, our workers and contractors, and visitors to our website. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we meet our obligations under the NDIS Code of Conduct and, where applicable, the NDIS Practice Standards.

1. Who this policy covers

This policy covers:

• NDIS participants (including prospective participants) attending our Day Options program, their nominees, guardians and families,
• Support coordinators, plan managers, allied health partners, referrers and other stakeholders,
• Our employees, contractors, job applicants and volunteers, and
• Visitors to our website and people who make enquiries with us.

To enable us to provide our Day Options services, you must provide personal information that is accurate, complete and up to date, and must promptly notify us of any changes to your contact details, NDIS plan details, funding arrangements, nominee or guardian status, health information relevant to your support, or other material information. You must also ensure that any information you provide about another person (such as a nominee, guardian, carer or emergency contact) is accurate and that you are authorised to provide it. If information you provide is inaccurate, incomplete or out of date, this may affect our ability to deliver our services or may result in delays. We may take reasonable steps to verify information where necessary to meet our legal and regulatory obligations.

2. The kinds of information we collect

Depending on your interaction with us, we may collect:

• Identity and contact information: name, date of birth, address, phone, email, emergency contacts, and authorised representatives or guardians.
• NDIS and service information: NDIS number, plan details, goals, session bookings and attendance, support notes, incident and complaint records, and behaviour support information relevant to safe participation in group activities.
• Health information (sensitive): relevant diagnoses, medications, allergies, mobility and communication needs, disability status, and other support needs relevant to safely delivering the Day Options program.
• Transport information: pick-up and drop-off addresses, route details, and any equipment or support needs relevant to transporting you safely.
• Photos and videos: images and recordings taken during Day Options activities, outings and events, where consent has been given (see section 5).
• Employment or contractor details: resume, qualifications, right-to-work, clearances and payroll/compliance records.
• Website and analytics information: IP address, device or browser details, pages viewed, form submissions, and cookies or similar tools.

We collect only what is reasonably necessary for our functions as an NDIS Day Options provider, consistent with the APPs. We do not adopt, use or disclose government-related identifiers (such as tax file numbers, Medicare numbers or NDIS participant numbers) as our own identifiers for individuals, unless the adoption, use or disclosure is required or authorised by law, is necessary for us to fulfil our functions, or the individual has consented.

If you choose not to provide personal information that we reasonably require to deliver our services, we may be unable to provide some or all of our services. Where collection of personal information is required or authorised by law and you do not provide it, we may be unable to comply with applicable legal requirements.

3. How we collect information

• Directly from you (in person, by phone, by email, via forms, or via our website).
• From third parties with proper authority (e.g., nominees, guardians, family members, support coordinators, plan managers, health professionals, previous providers), with your consent or where authorised or required by law.
• Automatically via our website, including analytics and cookies.

4. Why we collect and use information

We collect, use and disclose personal information only where reasonably necessary to perform our functions as a Day Options provider, including to:

• Deliver, coordinate and improve Day Options supports and group activities,
• Plan and safely run community outings and group activities,
• Arrange and manage transport to and from the program,
• Take and use photos or videos of activities, outings and events, only as consented (see section 5),
• Manage bookings, attendance and NDIA claims,
• Develop and review support plans,
• Ensure safety, supervision and duty of care during activities and outings,
• Operate and secure our systems and website, and
• Meet our obligations under the NDIS Code of Conduct, applicable NDIS Practice Standards, and other relevant laws.

We do not use your personal information for direct marketing without your consent, and we do not sell personal information.

5. Consent

We seek your voluntary, informed and specific consent before collecting, using or disclosing personal information, unless another lawful basis applies (for example, where necessary to protect health or safety, or where required by law).

• Photos and videos: we only take and use photos or videos of participants during activities, outings or events where consent has been given, as set out in our Participant Consent Form. You choose whether this is for internal use only, external use (such as our website or brochures), or community awareness and promotional purposes, and you may withdraw this consent at any time.
• Transport: by using our transport service, you consent to us collecting the information (such as pick-up and drop-off address and any relevant support needs) necessary to transport you safely.
• Group and community outings: information relevant to your safe participation may be shared with venues, activity providers or transport operators involved in delivering the outing, as set out in section 6.

Where a participant has a nominee, guardian or other authorised representative, we will work with that person consistent with the participant’s rights and applicable supported decision-making principles, maximising the participant’s own choice and control wherever possible.

6. Disclosures we may make

We may share personal information with (as relevant):

• The NDIA and the NDIS Quality and Safeguards Commission,
• Other NDIS providers involved in your support,
• Support coordinators, plan managers, allied health and medical professionals involved in your care,
• Transport and venue operators, where necessary to safely deliver an outing or activity,
• IT/hosting, website, analytics and cyber-security service providers who support our systems,
• Auditors, insurers, professional advisers and regulators,
• Others you authorise (e.g., nominees, guardians, family members, carers), and
• Payment processors.

We disclose only what is necessary and take reasonable steps to ensure appropriate safeguards are in place, consistent with the APPs and NDIS obligations. We do not sell personal information.

7. Overseas disclosure

Some trusted technology, hosting or analytics providers we use may store information in Australia and/or overseas. Where this occurs, we take reasonable steps to ensure overseas recipients handle personal information in a way that is substantially similar to the APPs.

8. Our website and cookies

We use cookies and similar technologies on our website to operate the site, remember preferences, measure traffic and improve content. You can control cookies through your browser settings; blocking some cookies may affect site functionality. We may use trusted third-party analytics, hosting or spam-protection tools that process limited personal information under their own privacy terms.

9. Data security and retention

We use technical, physical and administrative safeguards to protect personal information against loss, misuse, interference, or unauthorised access, modification or disclosure. These safeguards include secure systems, access controls and staff training. We retain records for the periods required by law and our retention schedule, then securely destroy or de-identify them.

10. Your rights

• Anonymity or pseudonymity: where lawful and practicable (e.g., general enquiries), you may interact with us anonymously or using a pseudonym.
• Access and correction: you may request access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date or incomplete.
• Withdraw consent: you may withdraw consent (including for photos or videos) at any time, as set out in section 5.
• Cookies: you can manage cookies and browser permissions at any time through your browser settings.

To exercise these rights, please contact us using the details in section 15. We will respond within a reasonable timeframe.

11. Data breaches

If a data breach is likely to cause serious harm, we will promptly assess and, where an eligible data breach is confirmed, notify affected individuals and the Office of the Australian Information Commissioner (OAIC), as required under the Notifiable Data Breaches (NDB) scheme.

12. Children, supported decision-making and guardians

Where a participant has a nominee, guardian or other authorised representative, we will work with that person consistent with the participant’s rights, consent and applicable laws, including behaviour support arrangements where relevant.

13. South Australia-specific disclosures

• Mandatory reporting (children) - South Australia: we may disclose personal information to the SA Department for Child Protection where we form a reasonable suspicion a child or young person is, or may be, at risk of harm, consistent with the Children and Young People (Safety) Act 2017. Staff who are mandated reporters must report to the Child Abuse Report Line (CARL 13 14 78) and escalate internally.
• Adult safeguarding - South Australia: where we reasonably believe an adult is at risk of abuse or neglect, we may contact the Adult Safeguarding Unit (ASU) for advice or to make a report (1800 372 310), in line with SA safeguarding processes.

14. Complaints and feedback

If you wish to access your personal information, correct an inaccuracy, or if you have a privacy concern or wish to make a complaint, please contact us first using the details below. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) or the NDIS Quality and Safeguards Commission.

15. How to contact us

Elara Support
Affinity Care Group Australia Pty Ltd trading as Elara Support
Unit 4/3 Park Way, Mawson Lakes SA 5095
Phone: 1300 413 663
Email and privacy enquiries: friendsgroup@elarasupport.com.au
Website: elarasupport.com.au

16. Changes to this policy

We may update this Privacy Policy to reflect changes to our practices or the law. The latest version will always be available on our website and will show the “Last updated” date above. Where changes are significant, we will take reasonable steps to notify participants and their representatives.