Privacy Policy

Purpose and Scope

Oasis Living Solutions is committed to protecting the privacy, dignity and confidentiality of everyone involved in our services.

This policy applies to all participants and clients, regardless of their age, funding source or service arrangement. This includes people receiving NDIS supports, aged care services, privately funded services, publicly funded services and other community or health supports.

It also applies to staff, management, contractors, students, volunteers, families, representatives and agencies working with Oasis Living Solutions.

For this policy, “participant” means any person receiving services from Oasis Living Solutions, including clients and aged care recipients.

Our Commitment

Oasis Living Solutions will:

Respect each person’s dignity, personal boundaries, cultural identity and communication preferences.
Explain what personal information we collect, why it is needed and how it will be used.
Collect only information reasonably necessary for our services, employment responsibilities or legal obligations.
Protect personal and sensitive information against misuse, loss and unauthorised access or disclosure.
Support people to access their information, request corrections and raise privacy concerns.
Manage information in accordance with applicable Australian privacy, health records, aged care, disability services and other relevant requirements, including the Australian Privacy Principles where applicable.

Communication and Informed Consent

Privacy and confidentiality information will be explained in language and formats each person can understand. Depending on individual needs, this may include Easy Read documents, interpreters, translated materials, communication aids or support from a person of their choice.

Before collecting information, we will explain:

What information is required and why.
How it will be used and stored.
Who may access it or receive it.
Whether providing it is voluntary or required.
Any likely consequences of choosing not to provide it.
How the person can access their information or raise a concern.

Consent will be informed, voluntary and specific to the purpose. Consent will be obtained where required, particularly when collecting sensitive information or sharing information beyond its authorised purpose.

Participants will be supported to make their own decisions wherever possible. Where another person provides consent, staff must verify that person’s authority and the scope of their decision-making role. Being a family member, advocate or emergency contact does not automatically authorise access to personal information.

Participants may withdraw consent for future collection, use or disclosure, subject to applicable legal requirements. Any effect on service delivery will be explained respectfully.

Collection of Personal Information

Information collected may include:

Personal and contact details.
Emergency contacts and authorised representatives.
Health conditions, diagnoses, medications and care requirements.
Assessments, support plans, progress notes and incident records.
Cultural, language and communication preferences.
Funding, billing and payment information.
Information necessary to provide safe and appropriate services.

Where reasonable and practicable, information will be collected directly from the person. Information obtained from another source must have an appropriate consent or other lawful basis.

Photographs, Audio and Video Recordings

Written consent must be obtained before taking or using identifiable photographs, audio recordings or video recordings, unless another lawful basis applies.

Consent must clearly identify the purpose, intended audience and proposed use. Consent for care documentation does not automatically permit use in advertising, publications, training or social media.

Refusing consent for promotional material will not affect access to services.

Privacy and Dignity During Services

Personal care, assessments, interviews and sensitive discussions must be conducted in a manner that protects the person’s privacy and dignity.

Staff must:

Seek permission before entering private spaces or providing personal care.
Use private settings for confidential discussions.
Respect preferences about who is present.
Maintain appropriate covering and privacy during personal care.
Avoid discussing personal information in public areas or where others may overhear.
Respect personal belongings, correspondence and records.

Use and Disclosure of Information

Personal information will only be used or disclosed for the purpose for which it was collected, an appropriately related purpose permitted by law, with valid consent, or where otherwise required or authorised by law.

Information may need to be shared with authorised health professionals, service providers, funding bodies, government agencies or regulators. Staff must confirm the recipient’s identity, authority and reason for requesting the information before disclosure.

Only the minimum information necessary for the authorised purpose will be shared.

Information may be disclosed without consent where legally permitted or required, including certain emergencies, mandatory reporting obligations, court orders or regulatory requirements. The reason and information disclosed must be documented.

Family members and other representatives will only receive information consistent with the participant’s consent, their verified legal authority or another lawful basis.

Telephone and Electronic Communication

Staff must verify identity and authority before discussing personal information by telephone, email or other electronic means. Where verification is not possible, information must not be disclosed.

Staff must check recipient details before sending information and use approved communication systems. Personal information must not be shared through personal email accounts, unapproved messaging services or personal social media.

Staff Privacy and Confidentiality

Oasis Living Solutions collects information necessary to manage employment and engagement arrangements. This may include:

Contact and emergency contact details.
Employment contracts, résumés and qualifications.
Tax, banking, payroll and superannuation details.
Screening checks, registrations and training records.
Relevant health information, workplace adjustments and leave records.
Performance and employment-related records.

Access is limited to authorised personnel who require the information for their duties. Staff information may be shared with authorised payroll, superannuation, insurance and other service providers where necessary and lawful.

Health information will be handled confidentially and accessed only where necessary for an authorised purpose.

Staff may request access to, or correction of, their information, subject to applicable requirements.

Access and Correction

Participants and staff may request access to their personal information or ask for inaccurate, incomplete or outdated information to be corrected.

Requests may be made to the Director or a designated manager. Assistance will be provided where a person needs support to make a request.

Identity and authority will be verified before records are released. Requests will be addressed within applicable legal timeframes. If access or correction is refused, the reason and available complaint options will be explained, unless the law prevents this.

Reasonable steps will be taken to keep information accurate, complete, relevant and up to date.

Record Storage, Security and Disposal

Hard copy records must be stored securely, including in locked cabinets when not in use. Electronic records must be kept in approved systems with appropriate passwords, access controls and other security measures.

Access will be based on work responsibilities and limited to authorised personnel. Staff must protect passwords, secure unattended devices and prevent unauthorised viewing or copying.

Records kept in a participant’s home must be stored discreetly and securely, taking account of the person’s preferences and care needs.

Records will be retained for applicable legal, contractual and operational periods. When no longer required, they will be securely destroyed or de-identified, where lawful.

Privacy Incidents and Data Breaches

Suspected loss, unauthorised access, incorrect disclosure or other privacy breaches must be reported immediately to management.

Management will take prompt steps to contain the incident, assess its impact, protect affected people and prevent recurrence. Affected individuals and relevant authorities will be notified where required.

Responsibilities and Complaints

All staff, management, contractors, students and volunteers must follow this policy. Confidentiality obligations continue after their involvement with Oasis Living Solutions ends.

The Director is responsible for overseeing privacy practices, managing privacy complaints and ensuring publications, website content and other communications protect personal information.

Anyone may raise a privacy concern without fear of disadvantage or retaliation. Concerns may be raised with the Director or a designated manager and will be handled respectfully, confidentially and promptly.

People will be supported to access an advocate or make a complaint to the relevant external privacy, aged care, disability or other complaints body.

Training

Relevant personnel will receive privacy and confidentiality training during induction and before accessing personal information.

Refresher training and guidance will be provided as needed. Understanding and compliance will be monitored through supervision, performance reviews, audits and incident reviews.

Monitoring and Review

This policy will be reviewed at least annually, or earlier following changes to legislation, service arrangements, identified risks or privacy incidents.

Reviews will consider participant and staff feedback, complaints, audit findings and opportunities to improve privacy, dignity and confidentiality across all Oasis Living Solutions services.