1. Who we are and what this policy covers

Lumora Holistic Support Services, trading as Lumora Independent Support Services ("Lumora", "we", "us" or "our"), provides independent disability support services in Greater Geelong. This policy explains how we collect, hold, use, disclose, secure, access, and correct personal information relating to participants, representatives, workers, service providers, and people who contact us.

2. Information we may collect

We only collect information that is reasonably necessary for our work. Depending on your relationship with Lumora, this may include:

• contact and identity details, including your name, address, phone number, email address, date of birth, and preferred communication method;
• details of nominees, guardians, advocates, emergency contacts, support coordinators, and plan managers;
• NDIS details, plan-management arrangements, participant goals, service preferences, and service-agreement information;
• sensitive and health information needed to provide safe support, such as disability, health conditions, communication needs, mobility, medication, allergies, behaviour support information, and relevant risks;
• support notes, schedules, consent records, incidents, feedback, complaints, and communications;
• billing, payment, travel, and transaction records; and
• limited technical information created when you use our website, such as IP address, browser type, and security or server logs collected by our website host.

3. How we collect information

We usually collect information directly from you. With your consent, authority, or where the law permits, we may also receive information from a nominee, guardian, advocate, family member, support coordinator, plan manager, health professional, another service provider, the NDIA, or the NDIS Commission. Where practicable, you may make a general enquiry anonymously or using a pseudonym; however, we may need to identify you before arranging or delivering services.

4. Why we collect, use, and hold information

We use information to respond to enquiries; assess whether our services are suitable; plan and deliver safe, person-centred supports; communicate with you and people you authorise; schedule services; prepare service agreements; invoice and manage payments; manage risks, incidents, complaints, and emergencies; maintain insurance and business records; meet legal and regulatory obligations; and improve the quality and safety of our services. We do not sell personal information or share it for third-party advertising.

5. When we may disclose information

We may disclose only the information reasonably necessary to:

• people you authorise, including a nominee, guardian, advocate, family member, support coordinator, plan manager, or another provider;
• the NDIA, NDIS Commission, government bodies, emergency services, law-enforcement agencies, or courts where required or authorised by law, or where necessary to address a serious threat;
• our insurer, accountant, legal adviser, or other professional adviser where reasonably necessary; and
• trusted technology, cloud storage, email, administration, and records-management providers that help us operate securely.

We seek consent before using or disclosing sensitive information unless an exception under Australian law applies.

6. Overseas processing and storage

Some website, email, information-technology, or cloud service providers may process or store information outside Australia, including in the United States. Where a disclosure to an overseas recipient is likely and the Australian Privacy Principles apply, we take reasonable steps to protect the information and to ensure it is handled consistently with Australian privacy requirements.

7. Security and retention

We take reasonable physical, technical, and organisational steps to protect information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures may include access controls, secure devices and accounts, strong authentication, secure storage, and limiting access to people who need the information. We retain information only for as long as it is needed for service delivery and applicable legal, regulatory, insurance, and record-keeping requirements, then securely destroy or de-identify it where lawful and practicable.

8. Data breaches

We assess and respond to suspected data breaches promptly. Where the Notifiable Data Breaches scheme applies and a breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

9. Access and correction

You may ask to access personal information we hold about you or request a correction if it is inaccurate, out of date, incomplete, irrelevant, or misleading. Contact our Privacy Officer using the details below. We may need to verify your identity. We aim to respond within a reasonable period, generally within 30 days. If access or correction cannot be provided, we will explain the reason where the law allows.

10. Privacy questions and complaints

Contact the Privacy Officer by email at info@lumora.net.au or phone 0401 445 381. Postal correspondence details are available on request. Please describe your concern and include your preferred contact method. We will acknowledge a privacy complaint promptly, investigate it fairly and confidentially, and aim to provide an outcome within 30 days. If you are not satisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner on 1300 363 992.

11. Policy updates and accessible copies

We may update this policy when our practices or legal obligations change. The current version will be published on this website with its update date. You may request this policy in another accessible format by contacting us.

How to contact us

You can speak directly with Walter, email info@lumora.net.au, or phone 0401 445 381. You may complain anonymously where practicable, and you may ask a family member, friend, advocate, interpreter, or other support person to help you. Tell us if you need information in an accessible format.

What to include

Tell us what happened, when it happened, who was involved, how it affected you, and what outcome you would like. Share only the information you feel comfortable providing. If there is an immediate danger or medical emergency, call 000.

What we will do

• listen respectfully and make sure you feel safe to raise the issue;
• acknowledge your complaint as soon as practicable, usually within two business days;
• record and assess the concern, respond immediately to any safety risk, and investigate fairly;
• protect your privacy and share information only where needed to resolve the matter or meet a legal obligation;
• keep you informed and aim to provide a clear outcome within 20 business days, or explain why more time is needed; and
• explain any action taken and how you can seek an external review.

Independent complaint options

You may contact the NDIS Quality and Safeguards Commission at any time, even if you have not complained to Lumora first. Call 1800 035 544 (free call from landlines), use the National Relay Service on 133 677, or make a complaint online. You may also seek help from an independent disability advocate.