Privacy Policy

About this policy

Synergy Disability Support Services Pty Ltd (ABN 20 669 007 238). Synergy provides disability support across the Coffs Coast, Bellingen and the Nambucca Valley, NSW. We respect your privacy and handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) and the NDIS Practice Standards.

This policy explains what we collect, why, how we keep it safe, and how you can see or correct it. It applies to participants and their families, carers and nominees, job applicants and staff, and anyone who contacts us or visits synergydss.au.

What we collect and how

We only collect what we need to provide supports, run our business and meet our legal obligations.

  • Participants: name, contact details, date of birth, NDIS number and plan details, emergency contacts, and information about your health, disability, goals and support needs. Health and disability information is sensitive information, and we collect it only with your consent or where the law allows.

  • Families, carers, nominees and professionals: names, contact details and your relationship to the participant.

  • Job applicants and staff: your CV, qualifications, references, NDIS Worker Screening and Working With Children Check details, and employment and payroll records.

  • Website and social media: what you type into our contact or feedback forms (name, email, message), and messages or comments you send us on Facebook or Instagram.

We collect information directly from you wherever we can, by phone, email, forms, and in person. With your consent, we may also receive it from your plan manager, support coordinator, the NDIA, or health professionals involved in your support.

You can contact us anonymously or under a pseudonym for general enquiries. We need to identify you before we can provide supports.

How we use and share it

We use personal information to:

  • plan, deliver, coordinate and review your supports

  • keep you and our workers safe, including managing risks, incidents and emergencies

  • claim payment for supports and keep accurate financial records

  • recruit, screen, train and pay our staff

  • reply to enquiries and feedback, and handle complaints

  • meet our legal, NDIS and audit obligations

We only share your information when we need to, and only what is needed:

  • with your consent, to other providers, health professionals, support coordinators and plan managers involved in your support

  • with the NDIA and the NDIS Quality and Safeguards Commission, as the law requires

  • with service providers who help us run the business, under confidentiality obligations. Participant records are kept in Microsoft 365, ShiftCare (rostering and support records) and Xero (billing), with most detail held in Microsoft 365 and only basic details such as names and NDIS numbers in ShiftCare and Xero. Our website forms and social media messages are handled by Squarespace, Google and Meta

  • where the law requires or allows it, for example to prevent a serious threat to someone's life, health or safety

We never sell personal information. We never use a participant's name, photo or story in our marketing or social media without their written consent.

Overseas services. Some of these providers may store information on servers outside Australia, including in the United States. We choose reputable providers and take reasonable steps to make sure they protect it in line with Australian privacy law.

Keeping it safe, and your rights

Security. We store information in secure, password-protected systems with access limited to the staff who need it, and we keep paper records locked away. We keep records for as long as the law requires: generally at least 7 years after your last support with us, and longer for children. After that we destroy or de-identify them securely. If a data breach is likely to cause someone serious harm, we will notify them and the Office of the Australian Information Commissioner as the law requires.

Access and correction. You can ask to see the information we hold about you, or ask us to correct it. We will respond within 30 days. If we can't give you access, for example because it would affect someone else's privacy, we will tell you why in writing.

Questions and complaints. Contact our Privacy Officer, Emma Munro:

We aim to resolve privacy complaints within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner, the NSW Information and Privacy Commission about health information, or the NDIS Quality and Safeguards Commission.

We may update this policy from time to time. The current version is always on our website. Last updated October 2026.