Privacy Policy

Last updated: 3 September 2026

Flourish & Co (ABN: 72 701 920 158) ("we", "us", "our") provides person-centred in-home support, including meal preparation and domestic assistance, to the people we support (PWS) in Mackay and surrounding areas. This policy explains how we collect, hold, use and disclose personal information, in line with the 13 Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

As a provider of care and support services, Flourish & Co is covered by the Privacy Act regardless of business size — the small business exemption that applies to some businesses under $3 million turnover does not extend to health and care service providers. Where we deliver supports funded through the NDIS, we also handle personal information in line with the NDIS Practice Standards, which require participant information to be accurate, current, kept confidential, and used only with informed consent.

The kinds of personal information we collect and hold

Contact details — name, email address, phone number, and the content of any message, submitted through our website contact form or given to us directly.
Support and health-related information about the people we support — including care needs, routines, preferences, medical or health information relevant to safe support (for example, allergies, mobility needs or medication reminders), and emergency contacts. This is sensitive information under the Privacy Act and we handle it with extra care.
Representative and guardian details, where a person we support is assisted by a family member, guardian, or authorised representative.
Staff and rostering records — shift logs, hours worked, kilometres travelled, and communication notes used to coordinate support between workers.

We only collect information that is reasonably necessary for delivering and coordinating our services, meeting our legal obligations, or responding to an enquiry.

How we collect personal information

Most personal information is collected directly from the person we support, their representative, or our staff — for example, through the website contact form, over the phone, in person during service planning, or through our internal staff app used to log shifts and support notes. We do not collect personal information from other sources (such as data brokers or public registers).

How we hold and protect personal information

Personal and support information is stored electronically using access-controlled systems, and only accessible to staff who need it to coordinate or deliver support. We take reasonable technical and organisational steps to protect information from misuse, interference, loss, and unauthorised access, use or disclosure — including restricting staff logins, limiting access to information on a need-to-know basis, and reviewing who has access as staff roles change.

Purposes for collecting, holding, using and disclosing information

To plan, coordinate and deliver person-centred support, meal preparation and domestic assistance.
To respond to enquiries made through our website or directly.
To maintain accurate records for continuity of care between support workers.
To meet our legal, insurance, work health and safety, and (where applicable) NDIS regulatory obligations.

We do not sell personal information, and we do not use it for unrelated marketing purposes without consent.

Disclosure of information, including overseas

We do not share personal information with third parties except: with a person's other care providers or representatives, at their direction or with their consent; where required or authorised by law; or where necessary to protect someone's safety in an emergency. We do not disclose personal information to overseas recipients. If this changes — for example, if we adopt a cloud service that stores data overseas — we will update this policy to name the likely countries involved before doing so.

Access to and correction of your information

You, or your authorised representative, have the right to ask us for access to the personal information we hold about you, and to ask us to correct it if it is wrong. To make a request, contact us using the details below — we may ask you to confirm your identity first. There's no set form to follow; a phone call, email or written request all work. We'll respond within a reasonable time and won't charge for lodging a request.

Supporting vulnerable people and third-party access

Some of the people we support may have a guardian, family member or other representative who is authorised to access information or make decisions on their behalf. Where this applies, we rely on the authority given by the person (where they are able to provide it), a legal guardianship or power of attorney arrangement, or NDIS plan nominee arrangements, and we keep a record of who is authorised to act for each person we support.

How to make a complaint

If you believe we have breached the Australian Privacy Principles, you can complain to us first:

Email admin@flourishandco.com.au, or call us, with details of your concern.
We will acknowledge your complaint, investigate it, and aim to respond within 30 days.

If you're not satisfied with our response, or we haven't responded within 30 days, you can take your complaint further:

Office of the Australian Information Commissioner (OAIC) — for privacy complaints generally. Phone 1300 363 992, or lodge a complaint at oaic.gov.au.
NDIS Quality and Safeguards Commission — if your concern relates to NDIS-funded supports. Phone 1800 035 544, or report online at ndiscommission.gov.au.

Website contact form

If you use the contact form on this website, the details you provide are sent directly to us for the purpose of responding to your enquiry. This website does not use tracking cookies or third-party advertising trackers.

Changes to this policy

We may update this policy from time to time as our services or obligations change. Any changes will be posted on this page with an updated "Last updated" date, and — where a change is significant — we'll take reasonable steps to let current clients and staff know directly.

Contact us

For any privacy-related question, access/correction request, or complaint, contact us at admin@flourishandco.com.au.

This policy is built around the Australian Privacy Principles (APP 1.3–1.4) content requirements set by the Office of the Australian Information Commissioner, and reflects the privacy obligations set out in the NDIS Practice Standards for providers of NDIS-funded supports. It's still worth having a solicitor or NDIS compliance advisor review it against your specific registration status and the exact supports you deliver before treating it as final — particularly whether any additional state-based health-records law applies to the records you keep.