Privacy Policy

Rahma Care Services Pty Ltd
ABN 14 697 087 951
Last updated: 11 August 2026

1. Our commitment to your privacy

Rahma Care Services Pty Ltd (Rahma Care, we, us or our) respects the privacy and dignity of the people we support, their families and representatives, professional referrers, workers and other people who interact with us.

This Privacy Policy explains the kinds of personal information we collect and hold, how we collect and use it, when it may be shared, how it is stored and protected, and how you can access or correct your information or make a privacy complaint.

Rahma Care handles personal and health information in accordance with applicable Australian privacy requirements, including the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Health Records Act 2001 (Vic), where applicable. Rahma Care and its workers also have obligations under the NDIS Code of Conduct, including respecting the privacy of people with disability.

2. What information we may collect

The information we collect depends on why you are dealing with Rahma Care and the support or service involved.

We may collect information such as:

• your name, date of birth, address and contact details
• your NDIS participant number and relevant funding information
• information about the supports you are seeking or receiving
• disability, diagnosis and relevant health information
• allergies and medication information where relevant to support
• communication needs and preferences
• cultural and language preferences
• routines, interests, goals and support preferences
• information relevant to worker matching
• relevant safety information and risk considerations
• information about substance use, justice-system involvement or other personal circumstances where this is relevant to the support being requested or provided
• details of family members, nominees, guardians, advocates or other people you have authorised to be involved
• service agreements, support plans and other service documentation
• progress notes and records of supports provided
• incident, complaint and feedback information
• correspondence and communication records
• billing, payment and NDIS funding information
• photographs, video or other recorded material where appropriate consent has been obtained.

Some of this information may be sensitive information, including health information or information about disability, racial or ethnic origin, religious beliefs or criminal history. We take particular care when handling sensitive information and only seek information that is reasonably necessary for our functions or activities, or where collection is otherwise permitted or required by law.

3. How we collect information

Where practical, we collect personal information directly from the person it relates to.

We may also receive information from an authorised family member, nominee, guardian or representative, a Support Coordinator, allied health professional, plan manager, another service provider, the NDIA, the NDIS Quality and Safeguards Commission, or another person or organisation involved in the participant's supports where appropriate and authorised.

Information may be collected through:

• our website
• enquiry and referral forms
• telephone calls and email
• meetings and conversations
• intake and consent documentation
• service agreements
• ShiftCare
• information and records created while providing supports.

Where information about a person is provided to us by somebody else, we take reasonable steps, where required, to ensure that the person or their authorised representative is aware of the collection and how the information will be handled.

4. Why we collect, hold, use and disclose information

We may collect, hold, use and disclose personal information to:

• respond to enquiries and referrals
• understand the support a participant is seeking
• assess whether Rahma Care can appropriately provide the requested support
• communicate with participants and people they have authorised us to involve
• arrange, plan, coordinate and provide NDIS supports
• match workers with participants
• maintain progress notes and service records
• respond when support needs or circumstances change
• manage safety, risks and incidents
• respond to feedback or complaints
• prepare invoices and manage payments
• communicate with plan managers and other authorised parties
• meet legal, regulatory, insurance and NDIS-related obligations
• maintain, review and improve our services
• operate, administer and protect our business systems and website.

We will not use or disclose personal information for an unrelated purpose unless the person has consented or the use or disclosure is otherwise permitted or required by law.

5. Sensitive and health information

Rahma Care may handle sensitive information about disability, psychosocial disability, diagnoses, medical conditions, allergies, medication, substance use, safety considerations, cultural background or involvement with the justice system where it is relevant to the support being requested or provided.

We aim to collect only information that has a genuine connection to understanding the support being requested, providing support safely and appropriately, making a suitable worker match, responding to the participant's circumstances and preferences, or meeting our legal obligations.

Where consent is required for the collection, use or disclosure of sensitive information, we will seek appropriate consent from the participant or their authorised representative.

6. Consent and participant choice

Where Rahma Care relies on consent to collect, use or share information, participants or their authorised representatives can ask questions about that consent and can ask to change or withdraw it.

Participants can tell us who they want involved in communication about their support. We do not assume that family members, Support Coordinators, allied health professionals or other people can receive participant information simply because they are involved in the participant's life or supports.

There may be circumstances where information can or must be used or disclosed without consent because this is required or authorised by law.

If changing or withdrawing consent affects our ability to provide a particular support safely or lawfully, we will explain this. Withdrawing consent does not require Rahma Care to destroy information that we are legally required to retain.

7. Anonymity and pseudonyms

Where lawful and practical, you may make a general enquiry without identifying yourself or may use a pseudonym. However, Rahma Care may need to know your identity, or the identity of a participant, where this is necessary to respond properly to a referral, enter into a service agreement, provide supports, process NDIS-related payments, meet safety requirements or comply with legal obligations.

8. Who we may share information with

Depending on the circumstances, the participant's consent and applicable law, relevant information may be shared with:

• Rahma Care workers who require the information to perform their role
• people the participant has authorised us to communicate with
• nominees, guardians or advocates
• Support Coordinators
• plan managers
• allied health professionals
• other providers involved in the participant's support
• interpreters
• the NDIA
• the NDIS Quality and Safeguards Commission
• relevant government or regulatory authorities
• insurers, legal advisers or professional advisers
• technology and business service providers used to operate Rahma Care.

We aim to disclose only information that is relevant to the purpose for which it is being shared. Information may also be disclosed without consent where the disclosure is required or authorised by law.

9. Technology providers and where information is handled

Rahma Care uses selected technology providers to operate its services and manage information.

ShiftCare

Rahma Care uses ShiftCare to manage participant and service information, including participant records, support documentation, progress notes and other care-related records.

As at the date of this policy, ShiftCare advises that care-related customer data for Australian customers is stored in Australia. ShiftCare also advises that limited operational user identity information, such as staff user IDs, names, business email addresses and authentication information, may be processed by overseas service providers, including in the United States, for authentication, login, identity management, security and account-access purposes.

Microsoft 365, Outlook and GoDaddy

Rahma Care uses Microsoft 365 Outlook, supplied through GoDaddy, for business email and related communications. Emails may contain personal information where this is necessary for communication about a referral, participant or service.

Microsoft 365 data locations depend on the relevant tenant and service configuration. GoDaddy operates internationally and advises that personal information it handles may be transferred from Australia to other jurisdictions, including the United States.

Wix

Rahma Care's public website is hosted through Wix. Information submitted through Wix website forms may be processed or stored using Wix systems.

As at the date of this policy, Wix advises that website visitors' personal information may be stored in data centres located in the United States of America, Ireland, South Korea, Taiwan and Israel, and that other jurisdictions may be used where necessary for the delivery of its services or as required by law.

For this reason, visitors should avoid providing unnecessary health or other sensitive participant information through Rahma Care's general website enquiry form. Professional participant information should be provided through the dedicated referral process where requested.

10. Overseas handling of personal information

Some technology providers used by Rahma Care operate internationally. Personal information may therefore be processed, stored or, depending on the arrangement, disclosed outside Australia.

Known overseas locations associated with the systems described above include the United States, Ireland, South Korea, Taiwan and Israel. Other jurisdictions may also be involved where a service provider changes its infrastructure or where this is necessary to provide the relevant service.

Where Rahma Care discloses personal information to an overseas recipient, we take reasonable steps required in the circumstances to ensure that the information is handled consistently with applicable Australian privacy requirements.

We review our technology arrangements and will update this Privacy Policy where there is a material change to the way personal information is handled.

11. Website cookies and analytics

Our website may use cookies and similar technologies to operate and secure the website, provide website functionality, remember preferences and understand website traffic or performance.

Some cookies are necessary for the website to function. Other cookies or analytics tools may depend on the features and integrations enabled on the website. Where applicable, visitors may be given options to manage non-essential cookies through website privacy or cookie settings.

12. How we protect information

Rahma Care takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Our safeguards may include secure cloud-based systems, individual user accounts, authentication controls, role-based access, restrictions on worker access, secure devices, confidentiality requirements, secure information-handling practices and staff training.

We do not publish detailed technical security arrangements because doing so may reduce the effectiveness of those safeguards.

13. Participant records and progress notes

Rahma Care keeps records of the supports it provides. These may include progress notes, support plans, communication records, incident information and other information relevant to the participant's supports.

We expect participant records to be accurate, relevant and respectful. Participant records and progress notes are managed through authorised systems such as ShiftCare rather than being kept as informal records on workers' personal devices.

14. How long we keep information

Rahma Care keeps personal information for as long as it is reasonably required for service delivery and to meet applicable legal, regulatory, insurance and record-keeping obligations.

Where the retention requirements applying to a Victorian health service provider apply, health information generally must be retained for at least seven years after the person was last provided with a health service. Where the person was last provided with a health service while under 18 years of age, the information must be retained until the person reaches 25 years of age.

Some information may need to be kept for longer where another legal, regulatory, insurance, complaint, investigation or other legitimate requirement applies.

When information is no longer required and may lawfully be destroyed, it will be securely destroyed or permanently de-identified where appropriate.

15. Accessing your information

You may ask Rahma Care for access to personal information we hold about you.

We may need to confirm your identity before releasing personal information. There are limited circumstances under privacy law where access may be restricted or refused. Where required, we will explain the reason.

To request access, contact:

Privacy Officer
Rahma Care Services Pty Ltd
8 Timbertop Court
Mooroolbark VIC 3138
Phone: 0403 640 966
Email: info@rahmacare.com.au

16. Correcting your information

If you believe information Rahma Care holds about you is inaccurate, incomplete or out of date, you can ask us to correct it.

We will consider the request and take appropriate steps in accordance with applicable privacy requirements. If we do not agree to a requested correction, we will explain the position where required and advise you of available complaint options.

17. Privacy incidents and data breaches

If Rahma Care becomes aware that personal information may have been lost, accessed or disclosed without authorisation, we will assess what has happened and take appropriate steps to contain and respond to the incident.

Where a data breach meets the requirements of the Commonwealth Notifiable Data Breaches scheme, Rahma Care will comply with applicable notification requirements, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

Other reporting or notification requirements may also apply depending on the circumstances.

18. Direct marketing

Rahma Care may occasionally communicate with people about its services where this is permitted by law.

You can ask us to stop sending marketing communications at any time. Information provided for participant support will not be treated as permission for unrelated marketing simply because Rahma Care holds the person's contact information.

19. Automated decision-making

Rahma Care does not currently use automated systems to make final decisions about whether or how a participant receives support.

Decisions affecting participants are made by authorised people exercising human judgement. If Rahma Care introduces technology that makes, or substantially assists with making, decisions that could significantly affect a person's rights or interests, we will review and update this Privacy Policy as required.

20. Making a privacy complaint

If you have a concern about how Rahma Care has collected, held, used, disclosed or protected your personal information, please contact:

Privacy Officer

Rahma Care Services Pty Ltd
8 Timbertop Court
Mooroolbark VIC 3138
Phone: 0403 640 966
Email: info@rahmacare.com.au

We will acknowledge your privacy complaint, review the circumstances and investigate the matter where required.

We aim to provide a response within 30 days. If we need additional time, we will let you know why and provide an updated timeframe. Our response will explain the outcome of our review and any action we propose to take.

If you are not satisfied with our response, you may also be able to contact:

• the Office of the Australian Information Commissioner
• the Victorian Health Complaints Commissioner
• the NDIS Quality and Safeguards Commission, where the issue relates to NDIS supports or provider conduct.

21. Contact us about privacy

For privacy questions, access or correction requests, consent questions or privacy complaints:

Privacy Officer
Rahma Care Services Pty Ltd
ABN 14 697 087 951
8 Timbertop Court
Mooroolbark VIC 3138
Phone: 0403 640 966
Email: info@rahmacare.com.au

22. Changes to this Privacy Policy

Rahma Care may update this Privacy Policy when our services, technology systems, legal obligations or information-handling practices change.

The current version will be made available on our website and will display the date it was last updated.