PRIVACY AND DIGNITY POLICY AND PROCEDURE

Purpose

The LYFIT Privacy Policy outlines how we collect, use, and protect your personal information in accordance with Australian Privacy Principles. We value your privacy and remain committed to safeguarding your data across all NDIS and Aged Care services.

Scope

This policy applies to all Staff.

LYFIT Privacy Policy Overview

The LYFIT Privacy Policy outlines how we handle, store, and protect your personal information under Australian Privacy Principles

Data Collection and Privacy Commitment

LYFIT actively protects and upholds every stakeholder’s right to privacy and dignity. Moreover, our team consistently extends this commitment to participants, staff, management, and agency representatives we work with. Furthermore, we maintain strict privacy standards across all operations, thereby reinforcing trust and accountability.

Handling and Storage of Personal Information

LYFIT protects participants’ privacy and dignity while collecting, storing, and handling their personal and service information.

Staff Responsibilities and Confidentiality

LYFIT protects participants’ privacy and dignity while collecting, storing, and handling their personal and service information.

Compliance with NDIS and Australian Privacy Principles

LYFIT  is subject to NDIS (Quality and Safeguards) Commission rules and regulations. LYFIT  will follow the guidelines of the Australian Privacy Principles in its information management practices.

Participant Rights and Information Access

LYFIT ensures that each participant understands and agrees to the collection of their personal information. We inform participants of the reasons for collecting this information and obtain their consent to record it in audio and/or visual format.

Privacy Communication and Understanding

To support clear understanding, LYFIT advises each participant of privacy policies using the language, mode of communication, and terms the participant is most likely to understand. LYFIT also provides Easy Read documents to all participants.

LYFIT  will ensure that:

• It meets its legal and ethical obligations as an employer and service provider in relation to protecting the privacy of participants and organisational personnel.
• The participants are provided with information about their rights regarding privacy and confidentiality.
• Additionally, we ensure respectful communication at all times, therefore maintaining trust and furthermore safeguarding dignity throughout every interaction indeed.
• All staff, management, and volunteers understand and meet these obligations.
• LYFIT advises participants of its confidentiality policies using language, communication methods, and terms they can easily understand. We locate interpreters when needed and provide accessible materials to ensure clarity.

This policy conforms to the Federal Privacy Act (1988) and the Australian Privacy Principles, which govern the collection, use and storage of personal information.

This policy will apply to all records, including both hard copy and electronic formats, that is, those containing personal information about individuals. Moreover, it extends to interviews or discussions of a sensitive personal nature. LYFIT carefully manages all data and protects it under strict privacy guidelines. Furthermore, these measures ensure privacy throughout every process indeed

LYFIT Privacy Procedures and Practices

Dealing with personal information

Our procedures under the LYFIT Privacy Policy guide how we collect, use, and share information responsibly.

LYFIT develops all procedures under the Privacy Policy to ensure compliance with the Australian Privacy Principles and NDIS standards.

In dealing with personal information, LYFIT  staff will:

• LYFIT ensures privacy for participants, staff, and management during interviews or when discussing personal or sensitive matters.
• Only collect and store personal information that is necessary for the functioning of the organisation and its activities.
• Use fair and lawful ways to collect personal information.
• Collect personal information only with consent from the individual.
• LYFIT clearly informs people about what personal information it holds, why it keeps it, how it collects, uses, and discloses it, and who has access to it.
• Ensure that personal information collected or disclosed is accurate, complete, and up-to-date, and provide access to the individual to review information or correct wrong information about themselves.
• Take reasonable steps to protect all personal information from misuse and loss and from unauthorised access, modification or disclosure.
• Destroy or permanently de-identify personal information no longer needed and/or after legal requirements for retaining documents have expired.
• LYFIT informs participants whenever any recordings occur in audio or visual format. The organisation obtains written consent from participants before including them in any recording.
• LYFIT informs participants whenever any recordings occur in audio and/or visual format. The organisation obtains written consent from each participant before including them in any recording.

Participant Records

Participant records will remain confidential and accessed only by staff involved in their care. LYFIT shares information with others only when the participant or their representative provides consent. The organisation maintains a written agreement granting permission for any recordings in the participant’s file.

LYFIT keeps all hard copy participant records securely locked in a filing cabinet within the office space.

Responsibilities for Managing Privacy

All staff is responsible for the management of personal information to which they have access. Director is responsible for the content in LYFIT  publications, communications and on the website and must ensure the following:

• LYFIT obtains appropriate consent before including any personal information about an individual, including its own personnel, in accordance with the Consent Policy and Procedure.
• Information being provided by other agencies or external individuals conforms to privacy principles
• That the website contains a Privacy Statement that makes clear the conditions of any collection of personal information from the public through their visit to the website.

The Director is responsible for safeguarding personal information relating to LYFIT ‘s staff, management and contractors. The Director will be responsible for:

• Ensuring that all Staff is familiar with the Privacy Policy and administrative procedures for handling personal information.
• Ensuring that participants and other relevant individuals are provided with information about their rights regarding privacy and dignity.
• Handling any queries or complaints about a privacy issue.

Privacy Information for Participants

During the first interview, LYFIT clearly informs participants about the information collected, how their privacy is protected, and their rights regarding this data. Information sharing is part of our legislative requirements. Participants must give consent to any information sharing between our organisation and government bodies. LYFIT offers participants the choice to opt out of any NDIS information sharing during audits.

Privacy for Interviews and Personal Discussions

To ensure privacy for participants or Staff when discussing sensitive or personal matters, LYFIT  will only collect personal information which is necessary for the provision of supports and services and which:

• Is given voluntarily; and
• Will be stored securely on the LYFIT  database.

LYFIT protects all personal records from loss, unauthorised access, modification, or disclosure. When sharing information with another party for service delivery, LYFIT takes all reasonable steps to prevent misuse. The organisation does not disclose personal information to any third party without consent unless the law requires or authorises it.

Confidentially Policy and Procedure under LYFIT Privacy Policy

We follow strict confidentiality procedures outlined in the LYFIT Privacy Policy to protect participant privacy and sensitive data.

The purpose of this policy and procedure is to ensure LYFIT  upholds each participant’s individuality, dignity and privacy. The policy sets out LYFIT ’s responsibilities relating to the collection and protection of participant’s information.

Definition

Health information – Any information or an opinion about the physical, mental or psychological health or ability (at any time) of an individual.

Personal information includes recorded details or opinions (including images), whether true or not, about a living individual whose identity can be reasonably identified.

Sensitive information – details or opinions about an individual’s background, beliefs, affiliations, sexual preferences, or criminal record.

Privacy Policy – Data Collection and Storage

Privacy and confidentiality of participant’s information are of paramount importance to LYFIT .

To ensure effective service delivery, LYFIT collects only the information necessary for participant support.

The organisation then uses this information solely for its intended purpose and ensures it remains securely protected.

In addition, all data collection, use, and disclosure follow relevant state and federal privacy legislation to maintain compliance.

Data Collection and Storage

• LYFIT  will keep participants informed of their rights.
• LYFIT  will ensure participant and or their authorised representative has access to participant personal information.
• LYFIT  will keep participant information secure.
• LYFIT protects computers and laptops with user access credentials.
• LYFIT  will not release information related to participants to other individuals or services without the consent of the participant or their representative.
• LYFIT  will respect participant’s right to withdraw from consent at any time.
• LYFIT  will collect, use and disclose information in accordance with relevant state and Federal privacy legislation.
• All staff are responsible for upholding Company’s privacy and confidentiality responsibilities.
• Management will make arrangements for participants with special needs to assist with protecting their privacy and dignity.
• LYFIT  will give due consideration to individuals and groups with special needs when upholding their privacy, dignity and confidentiality.
• LYFIT  will capture participant information the privacy of their home or in our office and ensure that it is in an area that prevents other people from hearing their personal details.
• LYFIT respects each participant’s privacy and provides assistance in a dignified, appropriate manner during social outings or in their home.
• Staff will ensure time and space for participant privacy, respecting and encouraging participant independence.
• LYFIT respects each individual’s choice regarding clothing and grooming, considering factors such as weather to ensure comfort in both cold and hot conditions.
• Employees will show respect for the participant’s home and participant belongings.
• Company will collect, use and disclose information in accordance with relevant state and Federal privacy legislation.
• LYFIT does not collect or release participant information to other individuals or services without informed consent from the participant or their representative. However, in exceptional circumstances such as when required by legislation or during life-threatening emergencies LYFIT may share the necessary information.
• LYFIT keeps clinical records locked securely in a filing cabinet when not in use at the office. If a home file exists, the organisation stores it discreetly and privately in the participant’s home as requested.
• Company will not provide participant information over the phone as it is difficult to determine the identity of the caller(s).
• LYFIT acts on improvements identified through staff and participant feedback and includes them in the company’s Continuous Improvement Plan.
• Company will monitor staff knowledge and application of confidentiality and privacy principles on-the-job and through yearly Performance Reviews.
• Company will provide additional on-the-job and formal training to staff where required.

Staff Privacy and Confidentiality

LYFIT actively collects staff information, including but not limited to tax declaration forms, employment or engagement contracts, personal and emergency contact details, medical information, Police and Working with Children Check records, qualifications, First Aid, CPR, and Anaphylaxis certificates, medical history, resumes, payroll information, and superannuation details.

This information may be accessed the Management Team.

Moreover have the right to request access to personal information LYFIT  holds about them, without providing a reason for requesting access; access this information; and make corrections if they consider the information is not accurate, complete or up to date.

If an individual requests access to or the correction of personal information, within a service benchmark of 2 working days (and no more than 45 days after receiving the request), staff will provide access, or reasons for the denial of access; correct the personal information, or provide reasons for the refusal to correct the personal information; or provide reasons for the delay in responding to the request for access to or correction of personal information.

LYFIT discloses staff personal and health information only for medical treatment or emergencies, with the staff member’s written consent, or when required by Commonwealth law to meet legislative obligations such as mandatory reporting

Monitoring and Review of LYFIT Privacy Policy

LYFIT  Management Team will review this policy and procedure at least annually. This process will include a review and evaluation of current practices and service delivery types, contemporary policy and practice in this clinical area, the Incident Register and will incorporate staff, participant and another stakeholder feedback. LYFIT uses feedback from service users, staff suggestions, and best practice developments to update and improve this policy.

We conduct regular audits as part of the LYFIT Privacy Policy review process to maintain accuracy and accountability.

We regularly review and update the LYFIT Privacy Policy to meet current legislative and NDIS compliance standards

LYFIT uses its Continuous Improvement Plan to record and monitor the progress of identified improvements and, where relevant, to inform service planning and delivery processes.

Data Breach and Personal Information

Purpose

The LYFIT Privacy Policy explains how we respond to data breaches and manage information to prevent unauthorised access.

LYFIT meets legislative compliance requirements as a mandatory reporter by notifying the Office of the Australian Information Commissioner (OAIC) and any individuals potentially affected by a data breach. The organisation promptly informs relevant authorities of any breach, takes steps to limit and reduce risks, and continuously improves the maintenance of data held by the organisation.

Scope

All staff maintain the confidentiality of all data related to participants and other team members. This policy relates to all personal data regarding both participants and team members.

Definition

Terminology	Description
Data breach (Eligible Data Breach)	Unauthorised access to or unauthorised disclosure of personal information or personal information is lost in circumstances where unauthorised access to, or unauthorized disclosure of the information is likely to occur.
Likely (likely to result in serious harm)	To be interpreted to mean more probable than not
Reasonable person	A person in LYFIT  who is properly informed, based on information immediately available or following reasonable enquiries, or an assessment of the data breach.   OAIC’s guidance states that the reasonable person is not to be taken from the perspective of an individual whose personal information was part of the data breach or any other person, and, generally, entities are not expected to make external enquiries about the circumstances of each individual whose information is involved in the breach.
Likely to result in serious harm	An assessment as to whether an individual is likely to suffer ‘serious harm’ because of an eligible data breach depends on, among many other relevant matters: the kind and sensitivity of the information subject to the breachwhether the information is protected and the likelihood of overcoming that protectionif a security technology or methodology is used in relation to the information to make it unintelligible or meaningless to persons not authorised to obtain it – the information or knowledge required to circumvent the security technology or methodologythe persons, or the kinds of persons, who have obtained, or could obtain, the informationthe nature of the harm that may result from the data breach.
Potential forms of serious harm	Could include physical, psychological, emotional, economic and financial harm, as well as harm to reputation.
Remedial action	There are a number of exceptions to the notification obligation, including importantly where an entity is able to take effective remedial action to prevent unauthorised access to, or disclosure of, information when it is lost or to prevent any serious harm resulting from the data breach. Where such remedial action is taken by an entity, an eligible data breach will not be taken to have occurred, and therefore an entity will not be required to notify affected individuals or the OAIC
Suspicion of an eligible data breach	If LYFIT  merely suspectsthat an eligible data breach has occurred, but there are no reasonable grounds to conclude that the relevant circumstances amount to an eligible data breach, the entity must undertake a “reasonable and expeditious assessment” of whether there are in fact reasonable grounds to believe that an eligible data breach has occurred
Assessment time frame	Within 30 days after the day, it became aware of the grounds that caused it to suspect an eligible data breach.
Personal Information	Personal information includes a broad range of information, or an opinion, that could identify an individual. What is personal information will vary, depending on whether a person can be identified or is identifiable in the circumstances. For example, personal information may include: an individual’s name, signature, address, phone number or date of birthsensitive informationcredit informationstaff member record informationphotographsinternet protocol (IP) addressesvoiceprint and facial recognition biometrics (because they collect characteristics that make an individual’s voice or face unique)location information from a mobile device (because it can reveal user activity patterns and habits)

Policy on Protecting Participant Privacy

LYFIT  views data breaches as having serious consequences, so the organisation must have robust systems and procedures in place to identify and respond effectively.

LYFIT  will delegate relevant staff members with the knowledge and skills required to become a Response Team member.

Staff immediately inform the Director or their delegate about any potential or suspected data breach. Within forty-eight (48) hours, the Director is to complete a Data Breach Process Form and ensure that, as a regulated entity, they notify the particular individuals and the Commissioner about eligible data breaches as soon as practicable (no later than thirty (30) days after becoming aware of the breach or suspected breach).

When a staff member identifies reasonable grounds for believing an eligible data breach has occurred, LYFIT promptly notifies any individuals at risk and the Office of the Australian Information Commissioner (OAIC).

LYFIT  will undertake the following when an eligible data breach has occurred:

1. Prepare a statement that, at a minimum, contains:
   1. LYFIT  contact details:
      1. If relevant, the identity and contact details of any entity that jointly or simultaneously holds the same information, in respect of which the eligible data breach has occurred, e.g., due to outsourcing, joint venture or shared services arrangements. If the statement includes this information, the other entity does not need to report the eligible data breach separately.
   2. A description of the data breach.
   3. The kinds of information concerned.
   4. The entity recommends steps individuals can take to reduce any harm that may result from the breach. While LYFIT makes reasonable efforts to identify and include these recommendations, it is not required to list every possible action following a breach.
2. Provide a copy of the prepared statement to the OAIC using online Notifiable Data Breach Form.
3. LYFIT will take reasonable steps to notify affected individuals of the statement’s contents. Notification may occur by email, phone, or post. If direct contact isn’t practicable, LYFIT will publish the statement on its website and make it publicly available.

Personal Data Securely

Stage 1. Assess and determine the potential impact

• Once notified of the potential data breach, the Director must consider whether a privacy data breach has (or is likely to have) occurred and then make a preliminary judgement as to its possible severity. Staff should seek advice from appropriate managers on how to manage the data breach.
• Criteria for determining whether a privacy data breach has occurred:
  • Is personal information involved?
  • Is the personal information of a sensitive nature?
  • Has someone accessed, disclosed, or lost personal information without authorisation in circumstances where access to that information is likely to occur?
• Criteria for determining the severity of the breach:
  • Type and extent of personal information involved.
  • The incident has affected a specific number of individuals.
  • If any security measures, such as password protection or encryption, protect the information.
  • Type of person/s who now have access.
  • Whether there is (or could be) a real risk of serious harm to the affected individuals.
  • If there could be media or stakeholder attention due to the breach/suspected breach.
• Section 26WG of the National Data Breach Act defines serious harm as physical, psychological, emotional, economic or financial harm, or harm to reputation.

The Director and relevant staff will take a preliminary view as to whether the breach (or suspected breach) may constitute a Notifiable Data Breach. Accordingly, the Director will decide whether to manage the data breach at the local level or escalate it to the Data Breach Response Team (Response Team), based on the nature and severity of the breach.

Stage 2. Select appropriate data breach management option

 Data breach managed at a local level by managerial Staff

1. The Director will ensure implementation of immediate corrective action if this has not already occurred. Corrective action may include retrieval or recovery of the personal information, ceasing unauthorised access, shutting down or isolating the affected system.
2. A Data Breach Process Report is to be completed within 48 hours of receiving instructions. The report will contain a:
3. description of the breach or suspected breach
4. summary of action taken
5. summary of outcomes from the action taken
6. outline of processes implemented to prevent a repeat situation
7. recommendation outlining why no further action is necessary.
8. The Director will sign-off, confirming that no further action is required.

Data breach managed by the Data Breach Response Team

1. When the Director decides to escalate the data breach to the Response Team, they will convene the team and notify the relevant managerial staff.
2. The Response Team will consist of:
3. Director
4. Human Resource nominee
5. Information Technology nominee
6. Marketing and external relations nominee
7. Other people nominated by the Director.

Primary role of the Data Breach Response Team

There is no single method of responding to a data breach. Staff must handle each incident on a case-by-case basis by assessing the circumstances and associated risks to determine the appropriate course of action.

he Response Team may undertake the following steps, as appropriate:

1. Immediately contain the breach, if this has not already occurred. Corrective action may include retrieval or recovery of the personal information, ceasing unauthorised access, shutting down or isolating the affected system.
2. Evaluate the risks associated with the breach, including collecting and documenting all available evidence of the breach, having regard for the information outlined above.
3. Call upon the expertise of, or consult with, relevant Staff in specific circumstances.
4. Engage independent cybersecurity or a forensic expert, as appropriate.
5. Assess whether serious harm is likely (with reference above and to Section 26WG of the National Data Breach Act).
6. Make a recommendation to the Director whether this breach constitutes an NDB for mandatory reporting to the OAIC, and the practicality of notifying affected individuals.
7. Consider developing a communication or media strategy including the timing, content and method of any announcements to participants, Staff or the media.
8. The Response Team must undertake its assessment within 48 hours of being convened.

For questions or concerns about your personal information, you can contact us as outlined in the LYFIT Privacy Policy.

 Secondary role of the Data Breach Response Team

Once the data breach has been dealt with appropriately, the Response Team should turn its attention to the following steps:

1. Identify lessons learnt and remedial action that can be taken to reduce the likelihood of a recurrence; this may involve a review of policies, processes and refresher training.
2. Prepare a report for submission to senior management.
3. Consider conducting an audit to ensure that necessary outcomes are affected and effective.

 Stage 3. Notify the Office of the Australian Information Commissioner

• Taking into consideration the Response Team’s recommendation, the Director will determine whether there are reasonable grounds to suspect that a Notifiable Data Breach has occurred.
• If there are reasonable grounds, the Director must prepare a prescribed statement and provide a copy to the OAIC as soon as practicable (and no later than 30 days after becoming aware of the breach or suspected breach).

You can request further details about the LYFIT Privacy Policy by contacting our compliance team through our official website.

For more information about privacy regulations and participant rights, visit the official Office of the Australian Information Commissioner (OAIC) website.