How we handle your information.

What we collect

• Referrals: the participant's name, age, support needs, behaviour support plans and related details. Disability and health information is treated as sensitive information under the law, and we treat it that way too.
• Enquiries and feedback: your name, contact details and message.
• Job applications: your contact details, suburb, work history, certificates, resume, availability, and your answers to our screening questions. If we interview you we also keep our assessment notes, and if we make you an offer we keep records of your reference calls (including your referees' names and contact details), evidence of your right to work, the details of the identity documents we sight, your check numbers and expiry dates, and the outcome of the pre-employment functional assessment. Some of this is sensitive information under the Privacy Act, including criminal history, health information from the assessment, and anything you choose to tell us about an adjustment you would need. We collect it because the NDIS Practice Standards require us to screen everyone who works with participants, we use it to assess your application and to meet those obligations, and we keep it to the access rules in this policy. Anything you tell us about an adjustment is treated separately: only our two directors read it, it is never used to screen an application, and if we do not take your application further we delete it at that point rather than keeping it.
• Contact records: emails and call records when you contact us directly.

How we collect it

Forms on this website are delivered to us as secure email. We do not use form services that keep a copy of your information on their own servers. Connections to this site are encrypted, and we use a privacy-preserving check to block spam rather than tracking-based tools.

The services that carry this for us: the website is hosted and protected by Cloudflare, form submissions are emailed to us through Amazon Web Services in Sydney, and they arrive in our Google Workspace mailbox. If you use the dictionary feature in our accessibility tools, the word you select is sent to a free dictionary service (dictionaryapi.dev) so it can return the definition. Nothing else about you is sent with it.

Information going overseas. Some of those providers are based outside Australia, or may store or route information outside Australia — Cloudflare and Google are United States companies, and dictionaryapi.dev is a United States service. Where that happens we take reasonable steps to make sure your information is handled to the standard the Australian Privacy Principles require. Amazon Web Services stores our form email in its Sydney region.

If we offer you a job, we share what is needed with the Office of the Children's Guardian and the NDIS Commission to verify your checks, with the Department of Home Affairs to confirm your right to work, and with the physiotherapist or doctor who carries out your functional assessment. We also take advice from Peninsula, our outsourced HR and workplace relations advisers, when a decision about a worker is difficult. We ask for your written consent before each of these.

Why we collect it

To respond to your referral or enquiry, work out whether we are the right provider for a participant, deliver and improve supports, assess job applications, and meet our obligations as a registered NDIS provider.

Consent and sensitive information

Please only share information you have the authority to share. Our referral form asks you to confirm this before you send it. By submitting a form, you consent to us collecting and using that information to respond to you. If you apply for a job, that includes the sensitive information in your application, which we use only to assess your suitability and to meet our screening obligations. You can withdraw consent at any time by contacting us.

How we store and protect it

Your information is held in our secure business systems, including our client management system and business email. These run on enterprise-grade platforms with security commitments that meet Australian privacy standards. Access is limited to our directors and the staff who need it to support you. We keep records for the periods required of NDIS providers, then destroy them securely.

If you apply for a job and we do not take it further, we keep your application for 12 months from the day you applied, in case a suitable role comes up, and then delete it. That covers your application form, your resume and anything you uploaded, our record of your application, and any phone screen, interview or reference notes we made. Ask us at any point and we will delete it sooner. Anything you told us about an adjustment you would need, or about your health, is deleted as soon as we decide not to take your application further, rather than kept for the 12 months with the rest.

When we share it

We never sell your information. We share it only with your consent, for example with a participant's allied health team, or where the law requires it, for example reporting obligations to the NDIS Commission. If you apply for a job with us and consent to the checks, we share what those checks need with the NDIS Worker Screening and Working With Children Check providers.

Cookies and analytics

This site does not use advertising cookies. Our analytics count visits without identifying who you are. If you adjust the accessibility settings on this site, your preferences are saved in your own browser and are never sent to us.

Access, corrections and complaints

You can ask to see the information we hold about you, ask us to correct it, or raise a privacy concern by emailing hello@cosmiccare.com.au or calling 0493 596 161 (Monday to Friday, 10am to 4pm). If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

If we change how we handle your information, we will update this page and the date at the top.