Privacy Policy, Terms of Use & Disclaimer

1. About this Privacy Policy

R2R Nova (“we”, “us”, “our”) provides disability supports and services in Melbourne, Victoria. Our services follow the Recover, Rebuild, Reconnect model and are designed for people with disability, including participants of the National Disability Insurance Scheme (NDIS). Our NDIS registration is in progress.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information. It covers information collected through our website (www.r2rnova.com) and information collected when you contact us, make a referral, or receive our services.

We take privacy seriously. Because we provide health services and hold health information, the Privacy Act 1988 applies to us in full. The small business exemption does not apply to health service providers, so we comply with all Australian Privacy Principles regardless of our size.

2. The laws and standards we follow

This policy is written to comply with:

• Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs), which set the national rules for handling personal information.
• Privacy and Other Legislation Amendment Act 2024 (Cth), which strengthened privacy protections, including a new statutory right of action for serious invasions of privacy (in force since 10 June 2025) and new transparency rules for automated decision making.
• Health Records Act 2001 (Vic) and the Health Privacy Principles (HPPs), which apply to health information handled in Victoria. This Act applies to us with no small business exemption.
• National Disability Insurance Scheme Act 2013 (Cth), the NDIS Code of Conduct, and the NDIS Practice Standards, which require us to respect the privacy and dignity of people with disability.
• The Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, which requires us to notify you and the regulator about serious data breaches.

3. What information we collect

3.1 Personal information
When you use our contact or enquiry forms, call us, or email us, we may collect:

• Your name, phone number, and email address.
• Your suburb or address, if you provide it.
• The details of your enquiry or message.

3.2 Sensitive and health information
When you or someone else submits a referral form, or when you become a participant, we may collect sensitive information. This can include:

• Health information, such as diagnoses, medications, clinical history, and support needs.
• Disability information and NDIS details, such as your NDIS number, plan dates, funded supports, and plan management type.
• Information about your carers, family, nominee, guardian, or support coordinator.

Sensitive information has extra protection under the law. We only collect it with your consent, or as permitted or required by law.

3.3 Information collected through our website
When you visit www.r2rnova.com, we and our analytics tools may automatically collect:

• Your device type, browser type, and operating system.
• Your IP address and general location (such as city level).
• The pages you visit, how long you stay, and how you found our site.
• Cookies and similar tracking technologies. See section 8 for details.

4. How we collect your information

We collect information:

• Directly from you, when you fill in a form on our website, call us, email hello@r2rnova.com, or speak with our team.
• From someone acting for you or referring you, such as a family member, carer, guardian, support coordinator, GP, or another provider, when they make a referral. We take reasonable steps to make sure you know your information has been collected and why.
• From government agencies, such as the National Disability Insurance Agency (NDIA) or the NDIS Quality and Safeguards Commission, where the law allows.
• Automatically, through cookies and analytics when you browse our website.

Where it is practical and lawful, you can deal with us anonymously or use a pseudonym, for example when making a general enquiry. This is not possible when we deliver funded supports, because we must identify participants correctly.

5. Why we collect and use your information

We collect, hold, and use your information to:

• Respond to your enquiries and process referrals.
• Assess whether our services suit your needs and plan your supports.
• Deliver safe, high quality supports and keep accurate clinical and service records.
• Manage service agreements, billing, and NDIS claims.
• Meet our legal and regulatory obligations, including obligations to the NDIS Quality and Safeguards Commission and the NDIA.
• Improve our website and services, using analytics data.
• Manage safety, quality, complaints, and incidents.

We do not use or share your information for any other purpose unless you consent, you would reasonably expect it, or the law requires or permits it. We never sell your personal information.

6. Your consent

We ask for your consent before we collect sensitive or health information, and before we share your information with other services. We explain what will be collected and why, in language and formats you can understand, in line with the NDIS Practice Standards.

You can withdraw your consent at any time by contacting us. Withdrawing consent does not affect anything we did while your consent was in place. In limited situations the law lets us act without consent, for example to prevent a serious threat to life, health, or safety, or where we must report by law.

7. How we store and protect your information

Your information is stored in Australia. We use Australian hosted systems for our website forms, participant records, and business records.

We protect your information with:

• Password protection, multi factor authentication, and role-based access, so only staff who need your information can see it.
• Secure, encrypted systems for storing participant and health records.
• Staff confidentiality agreements and privacy training.
• Physical security at our premises for any paper records.

R2R Nova shares premises and some administrative staff with R2R Health under a documented shared services arrangement. R2R Nova records are kept separate from R2R Health records, and access is limited to authorised R2R Nova personnel.

7.1 How long we keep your information
We keep health records as required by the Health Records Act 2001 (Vic): for adults, at least 7 years after the last service; for children, until the person turns 25. When information is no longer needed and the law allows, we securely destroy or de-identify it.

8. Cookies and website analytics

Our website uses cookies and analytics tools to understand how visitors use the site and to improve it. Analytics data is collected in an aggregated form and does not identify you personally.

You can control cookies through your browser settings, including blocking or deleting them. Some parts of the website may not work as well if you block cookies. If our analytics provider processes any data outside Australia, that data is limited to de-identified website usage data, not your personal or health records.

9. Who we share your information with

We may share your information with:

• Government agencies, such as the NDIA and the NDIS Quality and Safeguards Commission, where required for your NDIS plan, claims, audits, or reportable incidents.
• Other providers involved in your care, such as your GP, allied health providers, or support coordinator, with your consent.
• Your family, carer, guardian, or nominee, if you have appointed them or you consent.
• Our professional service providers, such as our IT, accounting, and auditing providers, under strict confidentiality obligations and only for the services they perform for us.
• Anyone we are required by law to share with, for example under a court order, mandatory reporting duties, or public health requirements.

We do not disclose your personal information to overseas recipients. Your records are held in Australia.

10. Automated decision making

We do not use computer programs to make automated decisions that significantly affect your rights or interests. All decisions about your services are made by people. If this ever changes, we will update this policy and explain what information is used and how, as required by the Privacy Act.

11. Data breaches

If a data breach happens that is likely to cause you serious harm, we will follow the Notifiable Data Breaches scheme. This means we will investigate quickly, take steps to contain the breach and reduce harm, notify you and tell you what you can do, and notify the Office of the Australian Information Commissioner (OAIC).

12. Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong, out of date, or incomplete.

To make a request, contact us using the details in section 14. We will respond within 30 days. We do not charge a fee for making a request. A small fee may apply for providing copies of health records, as allowed under the Health Records Act 2001 (Vic). If we refuse access or correction, we will explain why in writing and tell you how to complain.

13. Privacy complaints

If you believe we have mishandled your information, please contact us first. Contact our Privacy Officer (the Managing Director) at hello@r2rnova.com. We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to:

• Office of the Australian Information Commissioner (OAIC). Phone 1300 363 992 or visit www.oaic.gov.au. The OAIC handles complaints under the Privacy Act 1988.
• Health Complaints Commissioner (Victoria). Phone 1300 582 113 or visit hcc.vic.gov.au. The Commissioner handles complaints about health information under the Health Records Act 2001 (Vic).
• NDIS Quality and Safeguards Commission. Phone 1800 035 544 or visit www.ndiscommission.gov.au, for concerns about the quality or safety of NDIS supports.

14. Contact us

15. Changes to this policy

We review this policy at least once a year, and sooner if the law or our practices change. The current version is always available on our website. The effective date at the top of this policy shows when it was last updated.