CASSI respects the privacy, dignity and confidentiality of everyone who uses our services, works with us, or engages with us. This Privacy Statement explains how we handle personal information. It summarises CASSI’s full “Privacy, Dignity & Confidentiality Policy”, which is available on request.
Our commitment
CASSI is committed to handling personal information responsibly, transparently and securely, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and consistent with guidance from the Office of the Australian Information Commissioner (OAIC).
What information we collect
We only collect information that is reasonably necessary to provide services, ensure safety and quality, meet legal and funding obligations, and operate our organisation.
This may include:
- Contact details and personal details
- Service needs and support information
- Health or disability-related information (sensitive information) where relevant to services
- Service history and risk/safety information relevant to supports
- Staff/volunteer/contractor information for recruitment, engagement and workforce management (e.g., qualifications, training, referee information, and performance-related information)
How we collect information
Where practical, we collect information directly from you. We may also collect information from others where lawful and appropriate, such as family members, advocates, referees, medical practitioners, referral agencies, service providers, or funding bodies. When collecting personal information, we will take reasonable steps to explain why we are collecting it and how we will use it.
How we use personal information
We use personal information to:
- Assess needs and provide services and supports
- Plan, deliver and review supports
- Maintain safety, quality and incident/complaints management processes
- Meet governance, audit, insurance, legal and funding requirements
- Manage recruitment, employment/engagement and workforce development
Sensitive information is handled with extra care. We only use and disclose sensitive information:
- For the primary purpose it was collected
- For a secondary purpose, directly related to the primary purpose that you would reasonably expect
- With your consent, or where required or authorised by law
Who we may share information with
We only share personal information when lawful and necessary, including:
- With your consent (including via appropriate authority forms where relevant)
- With agreed third-party providers to coordinate or deliver services
- With funding bodies, auditors or regulators where required, often using non-identifying information where possible
- Where required or authorised by law
- Where permitted to prevent or lessen a serious threat to life, health or safety
- Within CASSI, access to personal information is limited to authorised people on a “need-to-know” basis.
Storage and security
CASSI take reasonable steps to protect personal information from misuse, loss and unauthorised access, modification or disclosure. Security measures may include access controls, password protection, staff training, audit trails for electronic systems, and physical security for records. We store information securely at CASSI premises and/or using approved systems and services (including cloud services where appropriate). We retain information only for as long as required for lawful and legitimate purposes, and then securely destroy or de-identify it.
Access and correction
You may request access to personal information we hold about you and request corrections if the information is inaccurate, incomplete, out of date, irrelevant or misleading. Requests are managed within a reasonable time and in line with the APPs and any applicable legal limitations.
Privacy breaches
If we suspect a privacy breach, we will take steps to contain and assess it promptly. Where an “eligible data breach” occurs, we will notify affected individuals and the OAIC as required by law.
Complaints
If you believe CASSI has mishandled your personal information, you can make a complaint through CASSI’s Quality Management System or directly with the CEO. Complaints are handled privately and confidentially, and we aim to respond in writing within a reasonable time. You can also contact the OAIC if you are not satisfied with our response.
How to contact us.
To request access or correction to personal or sensitive information, ask a privacy question, or lodge a complaint:
CEO, CASSI
Phone: (07) 5562 3800
