Luxaid Privacy Policy

Overview and Purpose

At LuxAid, we are dedicated to safeguarding the privacy of every individual who interacts with our organisation. We uphold all relevant legal standards for protecting personal information.

We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable Australian privacy legislation. These laws regulate how organisations collect, store, handle, use, and disclose personal information, as well as how individuals may access or correct the records held about them.

This Privacy Policy explains how LuxAid manages personal information throughout its lifecycle. It also outlines the procedures for requesting access to, correcting, or managing your personal information.

Scope

This Privacy Policy applies across all LuxAid operations and to every individual who interacts with LuxAid, including:

Participants, clients, and their nominated representatives, guardians, or advocates
Employees, directors, volunteers, and prospective employees
Contractors, suppliers, consultants, and service providers
Healthcare professionals, support coordinators, plan managers, and allied health providers
Corporate partners and community organisations
Members of the public who visit our website, submit an enquiry, make a referral, or engage with our services

By providing personal information to LuxAid, you acknowledge the practices described in this Privacy Policy. Where consent is the basis for collecting or using your information, you may withdraw or modify your consent at any time, subject to legal and service-delivery requirements.

Important: If you choose not to provide requested personal information, LuxAid may be unable to deliver certain supports, process a referral, complete an assessment, respond to an enquiry, meet safety obligations, or provide full access to our services.

Unless otherwise defined in this Privacy Policy, privacy-related terms have the meanings given to them under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. Personal Information

1.1 What Is Personal Information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not.

Examples of personal information collected or managed by LuxAid may include:

Identity and contact information: Full name, residential address, postal address, telephone number, email address, date of birth, gender, emergency contact details, and signatures.
Sensitive information: Racial or ethnic origin, cultural background, religious beliefs, sexual orientation, criminal history, and other information classified as sensitive under Australian privacy law.
Health and disability information: Diagnoses, medical history, medications, allergies, disability support needs, risk assessments, behaviour support information, clinical reports, incident records, and care requirements.
NDIS information: NDIS number, plan details, funding arrangements, service bookings, support categories, goals, support ratios, plan management details, and information relating to the NDIA or NDIS Quality and Safeguards Commission.
Service-delivery information: Intake forms, service agreements, support plans, progress notes, goal-tracking records, attendance information, transport details, assessments, feedback, and communication with stakeholders.
Financial information: Bank account details, invoices, payment records, billing information, plan manager details, and transaction history.
Employment information: Applications, resumes, references, qualifications, employment history, payroll information, training records, performance information, and background-screening results.
Media information: Photographs, audio recordings, videos, testimonials, and other media collected with appropriate consent.
Digital information: IP addresses, browser details, device information, website activity, cookies, enquiry-form information, and electronic communication records.

1.2 Sensitive Information

LuxAid will only collect sensitive information where:

You have provided consent;
The information is reasonably necessary for our functions or activities;
The collection is required or authorised by law;
The collection is necessary to prevent or reduce a serious threat to life, health, or safety; or
Another permitted situation applies under Australian privacy law.

2. Collection, Use, and Disclosure

2.1 Why We Collect Personal Information

LuxAid collects, holds, uses, and discloses personal information that is reasonably necessary to perform our functions and activities.

We may collect personal information for purposes including:

Responding to enquiries and processing referrals;
Assessing eligibility and suitability for services;
Delivering safe, effective, person-centred disability supports;
Developing support plans, risk assessments, transition plans, activity programs, and goal trackers;
Recording attendance, progress, incidents, outcomes, and service-delivery information;
Communicating with participants, families, nominees, guardians, advocates, support coordinators, plan managers, healthcare professionals, and other authorised stakeholders;
Coordinating supports with other providers and professionals;
Processing NDIS claims, invoices, payments, and financial transactions;
Managing transport, community participation, centre-based activities, and appointments;
Recruiting, onboarding, training, and managing workers, contractors, and volunteers;
Meeting quality, safeguarding, reporting, auditing, insurance, and regulatory obligations;
Investigating incidents, complaints, allegations, and potential breaches;
Maintaining and improving our services, systems, website, and organisational operations; and
Complying with applicable laws, court orders, funding requirements, and government directions.

2.2 How We Collect Personal Information

LuxAid collects personal information using fair and lawful methods. Wherever reasonable and practical, we collect personal information directly from you.

Personal information may be collected through:

Intake forms, referral forms, service agreements, consent forms, and assessments;
Telephone calls, emails, meetings, interviews, and face-to-face conversations;
Our website, online forms, social media pages, and digital advertising platforms;
Support delivery, observations, progress notes, incident reports, and feedback;
Employment applications, interviews, onboarding documents, and screening processes;
Invoices, payment records, and NDIS claiming systems; and
Photographs, videos, audio recordings, and security systems where appropriate notice and consent have been provided.

We may also collect information from authorised third parties, including:

Family members, nominees, guardians, advocates, or carers;
Support coordinators, plan managers, recovery coaches, and other NDIS providers;
General practitioners, specialists, allied health professionals, hospitals, and pharmacies;
The NDIA, NDIS Quality and Safeguards Commission, government departments, and regulatory bodies;
Schools, employers, accommodation providers, and community organisations;
Recruitment agencies, referees, screening agencies, and previous employers; and
Publicly available sources where lawful and appropriate.

Where we collect personal information from a third party, we will take reasonable steps to notify you of the collection where required and practical.

2.3 Collection Notices

When collecting personal information, LuxAid will take reasonable steps to inform you of relevant matters, including:

Our identity and contact details;
The purpose for which the information is being collected;
Whether the collection is required or authorised by law;
The consequences of not providing the requested information;
The organisations or types of organisations to which the information may be disclosed;
How you may access or correct your personal information;
How you may make a privacy complaint; and
Whether information is likely to be disclosed to recipients outside Australia.

2.4 Unsolicited Personal Information

If LuxAid receives personal information that it did not request, we will determine whether the information could have been lawfully collected as part of our functions or activities.

If the information is reasonably necessary for our services or operations, we may retain and manage it in accordance with this Privacy Policy.
If the information is not reasonably necessary and we are not legally required to retain it, we will take reasonable steps to securely destroy or permanently de-identify it.

2.5 Use and Disclosure of Personal Information

LuxAid generally uses or discloses personal information for the primary purpose for which it was collected.

We may use or disclose information for another purpose where:

You have provided consent;
The secondary purpose is related to the original purpose and you would reasonably expect the information to be used or disclosed in that way;
The use or disclosure is required or authorised by law;
The information is required by the NDIA, NDIS Quality and Safeguards Commission, another regulator, or a government authority;
The disclosure is necessary to prevent or reduce a serious threat to a person’s life, health, safety, or welfare;
The disclosure is necessary to locate a missing person;
The disclosure is necessary for legal proceedings, investigations, insurance matters, or the establishment, exercise, or defence of a legal claim; or
Another permitted general or health situation applies under Australian privacy law.

2.6 Common Third-Party Disclosures

To deliver services and operate our organisation, LuxAid may disclose relevant personal information to:

Healthcare professionals, general practitioners, specialists, pharmacies, and allied health providers;
Support coordinators, plan managers, recovery coaches, guardians, advocates, and authorised representatives;
The NDIA, NDIS Quality and Safeguards Commission, government departments, regulatory bodies, and emergency services;
Other disability service providers, subcontractors, or community organisations involved in delivering authorised supports;
Suppliers of assistive technology, medical equipment, mobility equipment, and care-related products;
Auditors, legal advisers, insurers, accountants, consultants, and professional advisers;
Financial institutions, payment processors, and billing providers;
IT providers, software providers, cloud-storage providers, cybersecurity providers, and technical-support services;
Recruitment, payroll, training, screening, and workplace-management providers; and
Law-enforcement agencies, courts, tribunals, and authorised investigating bodies where required or permitted by law.

LuxAid will only disclose information that is reasonably necessary for the relevant purpose.

2.7 Overseas Disclosure and Cloud Storage

Some third-party software, cloud-storage, communication, analytics, or technology providers used by LuxAid may store or process information on servers located outside Australia.

Where personal information may be disclosed or stored overseas, LuxAid will take reasonable steps to ensure that the information is handled in accordance with Australian privacy requirements. However, the location of external service providers and their servers may change from time to time.

3. Data Integrity, Security, and Management

3.1 Data Quality

LuxAid takes reasonable steps to ensure that the personal information we collect, use, or disclose is accurate, complete, current, relevant, and not misleading.

We rely on individuals and their authorised representatives to notify us when relevant information changes, including contact details, health conditions, medications, risks, support requirements, NDIS plan information, or emergency contacts.

3.2 Security Measures

LuxAid maintains physical, technical, and administrative safeguards to protect personal information against misuse, interference, loss, unauthorised access, modification, or disclosure.

Security measures may include:

Role-based access controls for electronic records;
Password-protected systems and multi-factor authentication;
Secure cloud-based storage and backup systems;
Encryption and other cybersecurity controls where appropriate;
Locked storage for hardcopy records;
Confidentiality obligations for employees, contractors, and service providers;
Privacy, information-security, and record-management training;
Access monitoring and periodic system reviews;
Secure document disposal and deletion processes; and
Incident and data-breach response procedures.

Although LuxAid takes reasonable precautions, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security against every possible cyberattack, technical failure, or unauthorised action.

3.3 Record Retention and Secure Disposal

LuxAid retains personal information for as long as reasonably required to:

Provide services and manage our relationship with you;
Meet NDIS, funding, auditing, insurance, employment, taxation, and regulatory requirements;
Respond to complaints, incidents, investigations, or legal proceedings; and
Comply with applicable Commonwealth and state record-retention laws.

When personal information is no longer required and there is no legal obligation to retain it, LuxAid will take reasonable steps to securely destroy or permanently de-identify the information.

3.4 Data Breaches

LuxAid maintains procedures for identifying, assessing, containing, investigating, and responding to suspected or confirmed data breaches.

Where a breach is likely to result in serious harm and meets the requirements of the Notifiable Data Breaches Scheme, LuxAid will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

LuxAid may also notify the NDIS Quality and Safeguards Commission, the NDIA, law-enforcement authorities, insurers, or other relevant bodies where required or appropriate.

4. Accessing, Correcting, and Managing Your Information

4.1 Access Requests

You may request access to the personal information LuxAid holds about you.

Access requests should be submitted in writing to the LuxAid Privacy Officer using the contact details below. We may ask you to verify your identity before providing access.

In some circumstances, access may be refused or limited where permitted by law. If access is refused, LuxAid will generally provide written reasons and information about available complaint options.

4.2 Correction Requests

You may request correction of personal information that you believe is inaccurate, incomplete, out of date, irrelevant, or misleading.

LuxAid will take reasonable steps to correct the information where appropriate. If we do not agree to make a requested correction, you may ask us to associate a statement with the record explaining that you believe the information is inaccurate, incomplete, out of date, irrelevant, or misleading.

4.3 Response Time

LuxAid aims to respond to access and correction requests within a reasonable period, generally within 30 calendar days. Complex requests may require additional time.

4.4 Anonymity and Pseudonymity

Where lawful and practical, you may choose to interact with LuxAid anonymously or by using a pseudonym.

However, anonymity or pseudonymity may not be practical where LuxAid must confirm your identity to:

Provide disability supports safely;
Complete an intake or service agreement;
Verify NDIS funding or process claims;
Manage health, medication, behavioural, or safety risks;
Meet legal or regulatory obligations; or
Respond to an access, correction, or complaint request.

4.5 Consent Management

You may amend or withdraw your consent to the collection, use, or disclosure of personal information by contacting LuxAid.

Withdrawal of consent will not affect actions already taken with valid consent. It may also affect LuxAid’s ability to continue providing some services or coordinating supports safely.

5. Direct Marketing

5.1 Marketing Communications

LuxAid may use non-sensitive personal information to communicate with you about:

New or updated disability-support services;
Programs, events, activities, and community initiatives;
Service vacancies or referral opportunities;
Participant, family, or stakeholder information sessions;
Surveys, feedback requests, and service-improvement activities; and
Other information that may reasonably be relevant to your relationship with LuxAid.

LuxAid will only use sensitive information for direct marketing where permitted by law and with appropriate consent.

5.2 Opting Out

You may opt out of marketing communications at any time by:

Using the unsubscribe option included in an electronic communication;
Replying to the communication and asking to be removed;
Calling LuxAid on 0450 000 190; or
Emailing mirza@luxaid.com.au.

Opting out of marketing will not prevent LuxAid from sending essential service-related, safety, billing, legal, or administrative communications.

6. Website Practices and Digital Media

6.1 Website Browsing and Enquiries

You may browse the LuxAid website without actively identifying yourself. However, certain technical information may be automatically collected, including:

IP address;
Browser and device type;
Date and time of access;
Pages visited;
Referral source; and
General website-usage information.

If you submit an enquiry, referral, application, or contact form, LuxAid will collect the information you provide so that we can respond and take the requested action.

6.2 Cookies and Similar Technologies

Our website may use cookies, pixels, web beacons, analytics services, and similar technologies to:

Operate and improve the website;
Remember user preferences;
Understand visitor behaviour and website performance;
Measure the effectiveness of advertising campaigns;
Identify technical issues; and
Improve the relevance of website content.

You may adjust your browser settings to block or delete cookies. Disabling cookies may affect the operation of some website features.

6.3 Online Advertising and Social Media

LuxAid may use third-party platforms, including social media and digital-advertising services, to promote its services and respond to enquiries.

These platforms may collect information in accordance with their own privacy policies. LuxAid does not control how third-party platforms collect, use, store, or disclose information submitted directly through their systems.

You should review the privacy settings and privacy policies of any social media or advertising platform you use.

6.4 External Links

The LuxAid website may contain links to external websites. LuxAid is not responsible for the privacy practices, security, availability, or content of third-party websites.

We encourage you to review the privacy policy of an external website before providing personal information.

7. Photographs, Video, and Audio Recordings

LuxAid may collect photographs, videos, audio recordings, or testimonials for purposes including:

Documenting participation in activities;
Supporting service-delivery and progress records;
Staff training and quality improvement;
Internal communications;
Website, social media, advertising, and promotional materials; and
Community-awareness and stakeholder-engagement activities.

LuxAid will obtain appropriate consent before using identifiable media for promotional or marketing purposes.

You may withdraw media consent by contacting LuxAid. Withdrawal will apply to future use where reasonably practical but may not require LuxAid to recall or remove materials that have already been lawfully printed, published, distributed, or shared.

8. Privacy Complaints

8.1 Making a Complaint

LuxAid takes privacy concerns and complaints seriously. Privacy complaints will be managed confidentially, fairly, and as promptly as reasonably possible.

To lodge a privacy complaint:

Submit your complaint in writing to the LuxAid Privacy Officer using the contact details below.
Include your name, contact details, the nature of the concern, relevant dates, and the outcome you are seeking.
LuxAid will acknowledge the complaint and may contact you for further information.
We will investigate the matter and aim to provide a written response within 30 calendar days.

If additional time is required due to the complexity of the matter, LuxAid will notify you where reasonably practical.

8.2 External Escalation

If you are dissatisfied with LuxAid’s response, you may contact the Office of the Australian Information Commissioner.

Office of the Australian Information Commissioner

Phone: 1300 363 992
Website: www.oaic.gov.au

Where the complaint relates to the delivery of NDIS supports or services, you may also contact the NDIS Quality and Safeguards Commission.

NDIS Quality and Safeguards Commission

Phone: 1800 035 544
Website: www.ndiscommission.gov.au

9. LuxAid Privacy Officer

To submit a privacy enquiry, request access to or correction of your information, withdraw consent, or make a privacy complaint, please contact:

Attention: Privacy Officer
Organisation: LuxAid Pty Ltd
Phone: 0450 000 190
Email: mirza@luxaid.com.au
Street Address: 163B East Wilchard Road, Castlereagh NSW 2749
Postal Address: 163B East Wilchard Road, Castlereagh NSW 2749

10. Changes to This Privacy Policy

LuxAid may review and update this Privacy Policy from time to time to reflect:

Changes to privacy, disability, employment, or other applicable laws;
Changes to NDIS requirements or regulatory guidance;
Changes to our services, systems, technology, or organisational practices; and
Feedback, audit findings, or improvements to our privacy-management processes.

The current version of this Privacy Policy will be published on the LuxAid website at www.luxaid.com.au.

Last updated: July 2026