Privacy & your care

1. Information we collect

We collect information relevant to assessing a referral and providing support: client and representative contact details, date of birth, NDIS number, plan dates and funding management, goals, the reason for referral and relevant reports or a current plan that you choose to provide. Coordinator, plan manager and referrer details help us coordinate support and billing.

We receive information directly from you or, with appropriate authority and consent, from your representative, referrer or support team. Please provide only information relevant to the referral. If you do not wish to provide information, contact us to discuss alternatives; we may be unable to assess or arrange a service without essential details.

2. Consent and choice

The person submitting a referral must confirm they have the participant’s consent or appropriate authority to share their personal and health information. We clarify consent and representative authority where necessary. You can ask questions, set limits on sharing or withdraw consent for future optional disclosures by contacting us. Withdrawal does not undo lawful previous use or remove required records.

Where legally permitted, we may handle information without consent, for example to comply with law or respond to a serious threat to health or safety.

3. How information is used and shared

We use relevant information to review referrals, contact you, plan and deliver therapy, prepare agreed OT or Speech Pathology assessments and reports, manage appointments and billing, and respond to feedback. Referrals are not used to sign you up for marketing.

Information may be shared with authorised QM Care team members and treating professionals who need it for your care; your authorised representative or support team where you consent; a plan manager for agreed billing; and service providers needed to operate our email and website. We may disclose information where required or authorised by law. An NDIS number or referral alone does not authorise unrestricted sharing with the NDIA, family, schools or other providers.

4. Website referral delivery and storage

When you submit the website form, it is processed on the application server and emailed to qmcarevictoria@gmail.com. A QMC-branded referral PDF is generated in memory, and uploaded plans and relevant medical documents are sent as separate email attachments. On the hosted service, the email contents, generated PDF and supporting documents are temporarily held in a separate encrypted delivery queue outside the public website folders. Successful delivery removes the queued contents. Undelivered contents are deleted after a maximum of 24 hours. Failed or uncertain delivery is flagged to authorised administrators. Anonymous analytics and website-content backups do not contain referral answers or medical documents. The local preview currently sends directly without this hosted queue.

The email and its attachments remain in QM Care’s Google email account until managed under our record-retention procedures. Clinical records kept during service delivery are separate from website analytics. Contact us if you need details about the record system used for your care or would like to arrange a different way to provide a document.

Our policy is to limit access to authorised people with a genuine service need, use protected accounts and secure transfer, and review access when roles change. Email is not an end-to-end encrypted clinical portal. Google and a future hosting provider may process information outside Australia; we do not promise that all data stays in Australia. No internet system can be guaranteed completely secure.

5. How long information is kept

Health records are retained for the periods required by applicable law and professional obligations. Victorian private health providers generally retain adult health records for at least seven years after the last service; records collected during childhood are generally retained until age 25 or seven years after the last service, whichever is later, with longer retention where another requirement applies. Information is securely destroyed or de-identified when no longer needed and lawful to do so. A deletion request cannot override a legal retention obligation.

Learn more from the Victorian Health Complaints Commissioner.

6. Website analytics

Our own analytics use a randomly generated browser identifier to estimate visits, referring domains, pages viewed, device category and referral-link clicks. The identifier is stored in your browser’s local storage. We do not include names, NDIS numbers, medical information, form answers or IP addresses in this analytics dataset. Visit events are retained for 90 days; the email-delivery log contains only a timestamp, tracking reference, status and attachment count.

Your connection necessarily provides technical information to the hosting or network service. Such providers may have their own operational logs. Our tracking honours a browser’s Do Not Track setting, and you can clear the identifier in your browser’s site data. We do not use advertising trackers in the supplied website.

7. Access, correction and representatives

You may ask to access or correct information we hold about you, or request transfer to another provider. We verify identity and representative authority before releasing records, respond within applicable timeframes, and explain any lawful restriction or permitted access charge. You can ask us to explain information in plain language and request communication support. If a correction cannot be made, you can ask for a statement of your concern to be included with the record.

8. Privacy questions and complaints

Contact QM Care on 0433 996 736 or qmcarevictoria@gmail.com. Please describe your concern and preferred contact method without emailing unnecessary sensitive documents.

You may involve an advocate or authorised representative. A complaint will not disadvantage your access to support. We will discuss the concern and next steps with you. For independent assistance, contact the Victorian Health Complaints Commissioner, the Office of the Australian Information Commissioner, or the NDIS Quality and Safeguards Commission, as appropriate.

9. Changes to this policy

We update this page when website processing or service arrangements change. The date above identifies the current version. Contact us for clarification before providing information if you have concerns.