Back to home
Last updated 17 August 2026 Legal

Privacy Policy

Behaviour support means trusting us with personal things — health history, family life, the hard days. This page explains, in plain language, what information we collect, why, who sees it, and how we look after it.

Who we are

Social Skills Connect (ABN 52 819 393 003) is a behaviour support practice in Bayside Melbourne, led by Katherine Van Eede, an NDIS Registered Behaviour Support Practitioner. We work with participants, families, schools and care teams, using the DIR®/Floortime™ model.

When we say “we” or “us”, we mean Social Skills Connect. When we say “you”, we mean anyone whose information we hold — participants, parents and carers, nominees, support coordinators, plan managers, referrers, other providers, and people who visit this website.

The rules we work under

Because we provide a health service and handle health information, a few laws and standards apply to us:

  • the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the Notifiable Data Breaches scheme;
  • the Health Records Act 2001 (Vic);
  • the NDIS Act 2013 (Cth) and the NDIS Rules that cover practice standards, restrictive practices and behaviour support, and incident reporting;
  • the NDIS Practice Standards and NDIS Code of Conduct, overseen by the NDIS Quality and Safeguards Commission; and
  • Victoria’s Child Safe Standards and mandatory reporting laws.

What we collect

It depends on how you work with us, but it usually includes:

Contact details

  • your name, date of birth, address, phone and email;
  • details for parents, guardians, carers, nominees and emergency contacts;
  • details for your support coordinator, plan manager, school and other providers.

NDIS details

  • NDIS number, plan dates and the funded supports that relate to our work;
  • how the plan is managed (self, plan-managed or NDIA-managed) and where to send Tax Invoices;
  • service agreements, consent forms and any letters to or from the NDIA or NDIS Commission.

Health, disability and behaviour support information

This is what the law calls “sensitive information”, and we treat it that way. It can include:

  • diagnoses, medical history, medications, and reports from doctors, allied health and schools;
  • information about behaviours of concern — what happens, when, and what tends to be going on around it;
  • functional behaviour assessments, behaviour support plans, observation notes, data, progress notes and reviews;
  • information about any restrictive practices that are proposed, authorised or used, and how they are monitored;
  • incident reports and safeguarding information;
  • culture, language, family and communication preferences that help us support you well.

Website visits

  • if you fill in the contact form: your name, phone (optional), email, the service you are asking about, and your message;
  • basic server logs (IP address, browser and time) so we can keep the site secure. There are no advertising trackers or analytics cookies on this site;
  • the site loads its fonts from Google Fonts, so Google may see your IP address when the page loads. Google’s privacy policy is here.

How we collect it

Mostly from you, or from a parent, guardian, nominee or someone you have authorised. With your consent, or where the law allows, we may also collect information from:

  • the NDIA, your plan manager or support coordinator;
  • schools, day programs, accommodation and other providers who support you;
  • doctors, allied health professionals and previous behaviour support practitioners;
  • whoever referred you to us.

You are welcome to make a general enquiry without giving your name. We do need to know who you are before we can deliver NDIS-funded support, though.

Why we collect it

We use your information to:

  • understand needs and provide safe, useful behaviour support;
  • write, put in place, monitor and review functional behaviour assessments and behaviour support plans;
  • work with the family, school and other providers who put a plan into practice;
  • meet our obligations as an NDIS registered provider — including lodging plans that contain regulated restrictive practices with the NDIS Commission, helping implementing providers report on restrictive practice use, and reporting reportable incidents;
  • claim through the NDIS, issue Tax Invoices and keep proper business records;
  • meet supervision, quality, audit and practitioner registration requirements;
  • answer your questions, feedback and complaints; and
  • do what the law requires.

We only use sensitive information for the reason we collected it, something closely related that you would expect, or something you have agreed to — unless the law says otherwise.

Who we share it with

Only where it is needed to support you, where you have agreed, or where the law requires it. That can mean:

  • Your support team — parents, guardians, carers, nominees, support coordinators, plan managers, schools and other providers, in line with the consent you have given;
  • Implementing providers — the people and organisations responsible for using a behaviour support plan day to day;
  • The NDIS Commission — as the NDIS Rules require, including lodging plans that contain regulated restrictive practices, restrictive practice reporting and reportable incidents;
  • The NDIA — for payments and, where relevant, plan reviews;
  • Victorian authorities — including the Senior Practitioner where restrictive practices need authorisation, and child protection or police where we have a mandatory reporting or duty of care obligation;
  • Supervisors and auditors — for clinical supervision, quality checks and NDIS registration audits, with identifying details kept to a minimum;
  • The services that help us run the practice — secure cloud storage, email, practice management, accounting and website hosting, all bound by confidentiality; and
  • Courts, tribunals or regulators where the law requires it.

We never sell personal information, and we do not use it for marketing.

Information held overseas

Some of the technology we use — email delivery and website hosting, for example — may store data on servers outside Australia, including in the United States. Where that happens we do what we reasonably can to make sure those providers protect your information to the standard Australian law expects. Clinical records are kept in Australia wherever we can.

Consent

We ask for your informed consent before collecting sensitive information and before sharing information with your support team. Where a participant is a child, or an adult who needs help with decisions, we work with parents, guardians, nominees or decision-supporters — and we always respect the participant’s own wishes and their right to be part of decisions about their information.

You can change your mind and limit or withdraw consent at any time. Just tell us. In some cases it may change what we are able to do, and we will talk that through with you. It does not change the things we are legally required to report.

How we look after it

We take reasonable steps to keep your information safe from misuse, loss and unauthorised access. In practice that means:

  • clinical records live in access-controlled, encrypted cloud systems with multi-factor authentication;
  • we keep as little on paper as possible, and lock away what we do keep;
  • reports and plans are shared through secure email and file sharing;
  • our devices are password-protected and encrypted;
  • only people who need your information to support you can see it; and
  • this website has rate limits and security controls in place.

How long we keep records

As an NDIS registered provider we keep participant records for at least seven years after the record is made or the service ends. Where a participant is under 18, Victorian law means we keep records until they turn 25. After that, records are securely destroyed or de-identified.

If something goes wrong

If a data breach happens that is likely to cause serious harm, we will let the affected people know, notify the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and notify the NDIS Commission where required.

Seeing and correcting your information

You can ask to see the personal and health information we hold about you, and ask us to fix anything that is wrong, out of date or incomplete. Contact us using the details below and we will get back to you within 30 days. In a small number of situations the law lets us refuse or limit access — for example, where it would put someone’s safety at risk or unreasonably affect another person’s privacy. If that happens, we will tell you why in writing and how you can complain.

If you move to a new provider, we are happy to pass on copies of assessments and behaviour support plans at your request.

Complaints

If you have a concern about how we have handled your information, please talk to us first. We take it seriously and will get back to you, usually within 30 days.

If you are not happy with our response, you can contact:

  • Office of the Australian Information Commissioner (OAIC) — oaic.gov.au · 1300 363 992
  • Health Complaints Commissioner (Victoria) — hcc.vic.gov.au · 1300 582 113
  • NDIS Quality and Safeguards Commission — ndiscommission.gov.au · 1800 035 544

You can complain anonymously, and complaining will never affect the support you receive from us.

Changes to this policy

We update this page when our practice or the law changes. The current version is always here, with the date it was last updated at the top.

Contact us

Katherine Van Eede
Social Skills Connect
Phone: 0402 413 847
Email: katherine@socialskillsconnect.com.au
Bayside Melbourne, Victoria

Read our Terms of Use →