Privacy Policy
Last updated: 4 August 2026
AtlaCare Community Supports Pty Ltd respects your privacy and is committed to handling personal information carefully, respectfully, and in accordance with applicable privacy obligations.
This Privacy Policy explains how AtlaCare collects, uses, stores, and discloses personal information.
1. About AtlaCare
This Privacy Policy applies to AtlaCare Community Supports Pty Ltd and the AtlaCare website.
AtlaCare provides support coordination and related support services. In providing these services, AtlaCare may collect personal information about participants, referrers, families, nominees, providers, and other people involved in a participant’s supports.
2. Applicable privacy and information-handling framework
AtlaCare handles personal information, sensitive information and health information in accordance with the privacy and disability-service obligations that apply to its activities. These include the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic), the Health Privacy Principles and the NDIS Code of Conduct.
AtlaCare recognises that information about a person’s disability, physical or mental health, support needs, use of health or disability services and related personal circumstances may be health information or sensitive information.
AtlaCare will only collect, use, retain and disclose information where it is reasonably necessary for its services or operations and where consent, another lawful basis or a legal requirement permits it. This Privacy Policy should be read together with AtlaCare’s Participant Privacy, Consent & Information-Sharing Form.
The Privacy Policy explains
AtlaCare’s general information-handling practices. The participant form records each participant’s current consent, information-sharing permissions, communication preferences, restrictions and withdrawal decisions.
3. What personal information we may collect
AtlaCare may collect personal information including:
• name
• contact details, including phone number, email address, and suburb
• referral information
• NDIS-related information
• information about support needs, goals, services, and providers
• information provided through website forms, emails, phone calls, meetings, or documents
• information about a person’s representative, nominee, family member, carer, or support team
• information needed for administration, billing, service delivery, and record keeping
AtlaCare may also collect sensitive information where it is relevant to providing support. This may include information about disability, health, support needs, behaviour support, personal circumstances, or other sensitive matters.
4. How we collect personal information
AtlaCare may collect personal information when:
• you submit a contact form or referral form
• you contact AtlaCare by phone, email, website, or other communication method
• you provide information during intake, onboarding, meetings, or service delivery
• a participant, family member, nominee, provider, professional, or support person provides information to AtlaCare
• information is provided in documents such as NDIS plans, reports, service agreements, consent forms, invoices, or other records
Where possible, AtlaCare collects information directly from the person the information relates to. In some cases, information may be collected from another person, such as a family member, nominee, provider, or referrer.
5. Consent
AtlaCare will only collect sensitive information where it is reasonably necessary for our services and where consent has been provided, unless another lawful basis applies.
If you provide information about another person, you should have their permission to do so.
For referral forms, AtlaCare asks referrers to confirm that they have permission to submit the referral and for AtlaCare to contact them about it.
6. Why we collect personal information
AtlaCare may collect and use personal information to:
• respond to enquiries
• review and follow up referrals
• provide support coordination and related services
• understand a participant’s goals, needs, preferences, and supports
• communicate with participants, representatives, providers, and support teams
• prepare service agreements, records, invoices, and service-related documents
• coordinate supports and assist with service navigation
• meet legal, regulatory, insurance, accounting, and administrative obligations
• improve AtlaCare’s services and internal processes
7. How we use and disclose personal information
AtlaCare may use or disclose personal information for the purpose it was collected, or for a related purpose that would reasonably be expected.
AtlaCare may share relevant information with:
• the participant
• the participant’s nominee, guardian, family member, carer, or authorised representative
• NDIS providers and support services
• allied health professionals or other professionals involved in the participant’s supports
• plan managers, support coordinators, or service providers
• government, regulatory, legal, or professional bodies where required or permitted by law
• technology, administration, accounting, or business service providers who help AtlaCare operate
AtlaCare will only share information where it is necessary, appropriate, authorised, or required by law.
8. Website forms and email
When you submit a form through the AtlaCare website, the information you provide may be stored in AtlaCare’s website platform and sent to AtlaCare by email or other business systems.
AtlaCare uses this information to respond to your enquiry, review a referral, and contact you about next steps.
Please do not submit unnecessary sensitive information through the website form. If more detailed information is needed, AtlaCare can discuss the safest way to provide it.
9. Storage and security
AtlaCare takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.
Personal information may be stored in electronic systems, email accounts, business software, documents, and secure records used by AtlaCare.
AtlaCare aims to limit access to personal information to people who need it for service delivery, administration, compliance, or business purposes.
Confidentiality Personal and sensitive information held by AtlaCare is confidential. AtlaCare limits access to directors, workers, contractors and service providers who reasonably require the information to perform authorised service-delivery, administration, governance, compliance or professional-support functions.
People who access participant information must only use or disclose it for an authorised purpose and must protect it from inappropriate discussion, access, copying, alteration, loss or disclosure.
AtlaCare will take reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information and the systems in which it is held. These safeguards may include access restrictions, identity verification, secure accounts and devices, restricted physical storage, secure document sharing and appropriate disposal processes.
Where AtlaCare uses an external technology, accounting, legal, insurance, audit or administration provider, AtlaCare will take reasonable steps to select reputable providers and limit the information made available to what is reasonably necessary.
Confidentiality obligations continue after a worker or contractor stops working with AtlaCare and after a participant’s services end.
10. Overseas storage, processing and service providers
AtlaCare provides services within Australia and does not ordinarily send participant information overseas for the purpose of delivering Support Coordination.
AtlaCare uses cloud-based technology and business service providers for website hosting and forms, email, document storage, accounting, communications, administration, security and technical support.
Some providers, their related companies, support personnel, data centres or subcontractors may be located outside Australia. Depending on the service and information involved, overseas recipients are currently likely to be located in:
• Israel;
• Ireland;
• New Zealand; and
• the United States of America.
AtlaCare’s primary Microsoft 365 customer content, including SharePoint, OneDrive and Exchange Online content, is expected to be stored at rest within Australia where AtlaCare’s Microsoft tenant is provisioned in Australia. However, some limited technical, identity, security, support or service-generated information may be processed through globally operated systems.
AtlaCare takes reasonable steps to use reputable service providers, review relevant privacy and security arrangements, restrict the information provided to what is reasonably necessary and protect personal information from unauthorised access, use or disclosure.
The locations used by service providers may change. AtlaCare will review this section when its technology providers or information-handling arrangements materially change. Participants may contact AtlaCare for further information about the systems used to handle their information.
11. Accessing or correcting your personal information
You may ask AtlaCare for access to personal or health information held about you. You may also ask AtlaCare to correct information you believe is inaccurate, incomplete, out of date, misleading or no longer relevant.
Requests can be made using the contact details at the end of this policy. AtlaCare may ask you to put the request in writing, describe the information requested and provide reasonable evidence of identity or authority before information is released or changed.
AtlaCare will respond within a reasonable period and will take reasonable steps to provide access in the form requested where it is lawful and practicable to do so.
AtlaCare will not charge a fee for requesting a correction. Where a fee for providing access is permitted by law, AtlaCare will explain the likely fee before proceeding.
In some circumstances, AtlaCare may be legally permitted or required to refuse access, restrict access or decline to alter a record. If this occurs, AtlaCare will generally provide written reasons, explain available complaint options and, where appropriate, record a statement explaining the correction requested.
AtlaCare may need to retain an original record and add a correction or supplementary note rather than deleting or rewriting the original information.
12. Keeping information
AtlaCare keeps personal information for as long as needed for service delivery, legal, regulatory, insurance, accounting, and record keeping purposes.
When information is no longer required, AtlaCare will take reasonable steps to securely destroy or de-identify it where appropriate.
13. Privacy complaints or concerns
If you have a privacy concern, believe your information has been handled inappropriately, or are dissatisfied with an access or correction decision, you may make a complaint to AtlaCare.
You can contact:
AtlaCare Community Supports Pty Ltd
Email: hello@atlacare.com.au
Phone: 0410 239 006
You may make the complaint verbally or in writing and may involve a family member, nominee, advocate, interpreter, support person or other trusted person.
AtlaCare will:
• acknowledge the complaint within 2 business days;
• explain the complaint process and any information required;
• assess any immediate privacy, safety or safeguarding risks;
• handle the complaint fairly, respectfully and as confidentially as reasonably possible;
• aim to provide a response or outcome within 10 business days; and
• tell you if more time is required, why it is required and when a further response is expected.
Making a privacy complaint will not affect your right to receive services and you will not be treated unfairly because you raised a concern.
Where appropriate, AtlaCare may respond by providing an explanation or apology, correcting information, providing access, changing an information-handling practice, strengthening safeguards, addressing worker conduct or taking another reasonable corrective action.
If you are dissatisfied with AtlaCare’s response, you may contact an external body. Depending on the nature of the concern, options may include:
• the Office of the Australian Information Commissioner on 1300 363 992;
• the Victorian Health Complaints Commissioner on 1300 582 113; or
• the NDIS Quality and Safeguards Commission on 1800 035 544.
An external body may ask whether you first gave AtlaCare a reasonable opportunity to address the concern. You may contact an external body directly where you believe that is necessary or appropriate.
14. Review and changes to this Privacy Policy
AtlaCare will review this Privacy Policy at least annually and earlier where there is:
• a material change to AtlaCare’s services, information systems or storage arrangements;
• a new technology or external service provider;
• a significant privacy incident, complaint or identified risk;
• a change to applicable privacy, health-records or NDIS requirements; or
• another change that materially affects how personal information is handled.
The current approved version will be made available free of charge through AtlaCare’s website and on request.
Where a material change directly affects current participants, AtlaCare will take reasonable steps to notify affected participants or explain the change during service delivery.
Superseded versions will be retained as controlled organisational records.
15. Contact
For privacy questions, requests, or complaints, contact:
AtlaCare Community Supports Pty Ltd
Email: hello@atlacare.com.au
Phone: 0410 239 006
Location: Melbourne, Victoria