.png)
.png)
YOUR INFO. YOUR BUSINESS!
Your privacy matters
At The Neurospicy Support Coordinator, your privacy, dignity, choice and control matter.
The Neurospicy Support Coordinator provides NDIS Support Coordination and also works with providers through partnerships, business development, networking, subcontracting and consulting.
This Privacy Policy explains what information I may collect, why I collect it, how I use and store it, and when it may be shared.
The Neurospicy Support Coordinator
Last updated: September 2026
Privacy Policy
🌶️ About The Neurospicy SC: The Neurospicy Support Coordinator operates as an unregistered NDIS provider providing Support Coordination services. As an unregistered Support Coordinator, I can provide NDIS-funded Support Coordination to participants whose relevant funding is self-managed or plan-managed. I cannot provide NDIS-funded Support Coordination from NDIA-managed funding. Although I am not registered with the NDIS Quality and Safeguards Commission, the NDIS Code of Conduct applies to registered and unregistered NDIS providers and workers. I am committed to providing services that respect your rights, privacy, dignity, independence, informed choice and control. The Neurospicy Support Coordinator provides NDIS Support Coordination and also works with providers through partnerships, business development, networking, subcontracting and consulting. This Privacy Policy explains what information I may collect, why I collect it, how I use and store it, and when it may be shared.
🌈 What information might I collect? Depending on how you interact with me, I may collect information such as: ~ Your name, contact details and preferred way of communicating. ~ NDIS participant and plan information. ~ Details about your goals, supports, providers and support network. ~ Information relevant to providing Support Coordination. ~ Referral and enquiry information. ~ Communication, case notes and service records. ~ Billing and payment information. ~ Provider, organisation and professional contact information. ~ Information you voluntarily provide through forms, email, phone, meetings or other communication. I only aim to collect information that is reasonably necessary for providing my services, managing our working relationship or operating the business.
💌 How do I collect information? Your privacy matters, and your information isn’t just floating around the internet living its best life. The Neurospicy Support Coordinator uses Astalty, a secure NDIS-focused platform, to manage participant information, case notes, documents, service agreements, funding information and other records required to provide supports. Information stored within Astalty is hosted within Australia using secure cloud infrastructure. Astalty is ISO 27001 certified and uses security measures including encryption, access controls and audit logging to help protect the information stored within the platform. Access to your information is limited to people who genuinely need it to provide or manage your supports. I may also need to securely store or use information through other systems where required for things like email, invoicing, accounting, referrals or communication. I only collect and use information that is reasonably necessary to provide my services and run the business. I won’t share your personal information with another provider, organisation or person without your consent unless: ~ It is necessary to provide an agreed service; ~ I am required or authorised to do so by law; ~ There is a serious risk to your safety or someone else’s safety; or ~ Another legal or safeguarding obligation applies. Where possible, I’ll be transparent with you about what information is being collected, why I need it and who it may need to be shared with. You can also ask to access or correct the personal information I hold about you. Because privacy should be human too, clear, respectful and no weird fine-print energy. 🌶️
🧠 Why do I collect your information? Your information may be used to: ~ Respond to enquiries and referrals. ~ Provide and coordinate supports. ~ Communicate with you and people you have authorised. ~ Connect and collaborate with providers and other stakeholders. ~ Maintain appropriate records and case notes. ~ Manage service agreements, bookings and billing. ~ Deliver provider partnerships, consulting or business development services. ~ Meet legal, regulatory, insurance and record-keeping obligations. ~ Improve how my services operate. In simple terms: if I don't need it, I don't want to collect it.
🌏 Third-party platforms Running a small business requires a few digital helpers. I may use reputable third-party platforms for things like website hosting, forms, email, document management, case management, invoicing, accounting, scheduling, video meetings and other business functions. These providers may process information on my behalf and have their own privacy policies and security practices. I review the systems I use and aim to choose services that provide appropriate privacy and security protections for the type of information being handled.
🤝 Consent & sharing your information Where relevant and appropriate, information may be shared with: ~ People or organisations you have consented for me to communicate with. ~ NDIS providers and members of your support network. ~ Plan managers or other parties involved in managing your NDIS supports. ~ The NDIA or NDIS Quality and Safeguards Commission where appropriate or required. ~ Professional advisers or service providers necessary to operate the business. ~ Government, regulatory or legal authorities where I am required or authorised by law to provide information. Where possible, I will involve you in decisions about who your information is shared with and why.
💻 Website, forms & online enquiries If you contact me through my website, complete a referral or enquiry form, or otherwise provide information online, the information you submit may be processed through the digital platforms I use to operate the website and business. Please only include information that is relevant to your enquiry or referral. My website or third-party services may also collect basic technical information, such as browser, device or website usage information, including through cookies or analytics tools.
🗂️How long is information kept? Information is kept only for as long as reasonably necessary to provide services and meet applicable legal, regulatory, insurance, financial and record-keeping requirements. When information is no longer required, I take reasonable steps to securely delete, destroy or de-identify it where appropriate.
✏️ Can you access or correct your information? Absolutely! You can ask to access personal information I hold about you or request that information be corrected if something is inaccurate, incomplete or out of date. There may be limited circumstances where I cannot provide access to certain information, including where legal restrictions apply. If that happens, I will explain why where I am able to.
🚨 What happens if something goes wrong? If I become aware of a privacy or data security incident, I will assess what has happened and take appropriate steps to contain and respond to it. Where required, affected people and relevant authorities will be notified in accordance with applicable privacy and data breach requirements.
✨ The short version✨
Your information deserves to be treated with respect.
I collect what I reasonably need, protect it as best I can, don't sell it, and don't share it without a legitimate reason.
Human-first support includes respecting your privacy, choice and control. 🌶️
💬 Privacy concerns or complaints
If you're concerned about how I've handled your information, please tell me!
You won't be treated differently or disadvantaged because you raise a concern or make a complaint.
I'll listen to your concern, take it seriously and work with you to understand and respond to it.
You may also have the right to make a complaint to an external body, including the NDIS Quality and Safeguards Commission about an NDIS provider or worker. The Commission accepts complaints concerning both registered and unregistered NDIS providers.
Depending on the nature of a privacy matter and whether the Privacy Act applies, the Office of the Australian Information Commissioner (OAIC) may also be relevant.