Privacy Policy

Goodrose, Making the complex easy
Renewed Paths Pty Ltd trading as Goodrose | ABN 33 674 731 572
Registered NDIS provider (NDIS provider number 4053371730)
Website: goodrose.com.au | Email: hello@goodrose.com.au | Phone: 0474 267 679

Last updated: 18 October 2026

1. About this policy

Renewed Paths Pty Ltd (ABN 33 674 731 572) trading as Goodrose ("Goodrose", "we", "us", "our") provides Support Coordination, Psychosocial Recovery Coaching, counselling and one-on-one capacity-building programs to NDIS participants. We work in person and via telehealth across Queensland and Tasmania.

Privacy matters to us. The people we support often share very personal things about their health, disability, family and lives, so we treat that information with care and respect.

This policy explains, in plain English, what personal information we collect, why we collect it, how we keep it safe, who we share it with, and how you can access it, correct it or make a complaint.

You can find a link to this policy, and to our Website Terms of Use, in the footer of our home page.

It applies to everyone whose information we handle: participants, family members, carers, guardians and nominees, referrers (such as Local Area Coordinators, planners, health professionals and hospital discharge teams), other providers, people who contact us, and visitors to our website.

2. The laws and standards we follow

We handle personal information in line with:

the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we provide health and disability services and hold health information, the Privacy Act applies to us whatever our size
the National Disability Insurance Scheme Act 2013 (Cth) and its rules, including the NDIS Practice Standards (which require providers to respect each participant's privacy and dignity and to manage information well) and the NDIS Code of Conduct (which requires us to respect the privacy of the people we support)
in Queensland and Tasmania, any state privacy, health records or child protection laws that apply to our work.

If a law asks more of us than this policy does, we follow the law.

3. What personal information we collect

"Personal information" is information or an opinion that identifies you, or could reasonably identify you. Some of it is "sensitive information", which the law protects more strongly. This includes health information, information about disability, and information about racial or ethnic origin.

We only collect what we reasonably need to provide our services. Depending on how you deal with us, this may include:

Contact and identity details

name, phone number, email address, suburb or town, and state
your role (for example participant, family member, guardian, nominee or professional), and your organisation and relationship to the participant if you are a referrer
who we should contact first, and preferred ways to communicate

NDIS and plan information

NDIS number
plan start and end dates, how the plan is managed (NDIA-managed, plan-managed or self-managed), funded supports and budgets, and service agreements
information about other providers, plan managers, nominees and supports

Health, disability and wellbeing information (sensitive information)

diagnosed disabilities and health conditions, including mental health and psychosocial disability
goals, current supports, risks, communication or access needs, and how urgent support is (for example hospital discharge or housing risk)
case notes, assessments, reports, progress notes and correspondence created while we support you
cultural background, if you choose to tell us so we can provide culturally safe support

Information from our website

what you type into our referral form or consultation booking form. The referral form asks for health and disability information (see section 4)
website analytics: pages visited, time on the site, the site you came from, device and browser type, approximate location (city or region), and IP address
cookies and similar technologies (see section 6)

Other information

emails, messages, call notes, and feedback or complaints you send us
payment and invoicing details for plan managers or self-managed participants
telehealth session details

### Dealing with us without giving your name

You can ask general questions without telling us who you are, or by using a different name, for example by phone or email. To provide NDIS services, make referrals or claim funding, we do need to know who you are.

### Information we did not ask for

If we receive personal information we did not ask for and do not need, we will destroy or de-identify it as soon as practical, where the law allows.

4. How we collect information

Wherever we can, we collect information directly from you: in conversations, at your free 30-minute consultation, in sessions, by phone, by email, and through our website forms.

Sometimes we collect information from other people, with your consent or where the law allows. This includes:

a referrer who fills in our referral form for you. Before sending a referral, the referrer must confirm that the participant (or their nominee or guardian) knows about the referral and agrees to Goodrose contacting them and storing the information.
your family, carers, guardian or nominee
the National Disability Insurance Agency (NDIA), your Local Area Coordinator, planner or plan manager
health professionals, hospitals, and other providers involved in your care.

If we receive information about you from someone else, we will let you know when we first contact you.

5. Why we collect and use your information

We collect, hold and use personal information to:

respond to enquiries, referrals and requests for a free consultation
work out whether our services are right for you, and take you through intake
provide Support Coordination, Psychosocial Recovery Coaching, counselling and capacity-building programs, including planning, connecting you with supports and providers, and preparing reports and plan reviews
talk with the NDIA, your plan manager and other providers about your supports, with your consent
make and manage service agreements, invoices and NDIS claims
keep you and others safe, including managing risk and incidents
meet our legal and NDIS obligations, including the NDIS Practice Standards, audits, worker screening, incident reporting and record keeping
handle feedback and complaints, and improve the quality of our services
understand how people use our website so we can improve it.

We do not sell personal information. We do not use your health or disability information for marketing.

Marketing: we do not send marketing messages or newsletters. We will never add you to a marketing list without your consent.

6. Website, analytics and cookies

Our website is built and hosted on Wix (Wix.com Ltd).

Cookies are small files stored by your browser. Our website and Wix (including Wix Analytics) use cookies and similar technologies to:

make the site work (for example to load pages securely and remember your cookie choices)
measure how the site is used (for example visitor numbers and popular pages).

We use Wix Analytics to understand how people use our site. It mostly reports information in combined (aggregate) form, and we do not use it to identify you. We do not use any other analytics, advertising or social media tracking tools on our website.

You can block or delete cookies in your browser settings. If you block essential cookies, parts of the site may not work properly.

Website forms: information you enter into our referral or booking forms is sent to Goodrose through Wix and email. Please only include the information the form asks for. If you are worried about sending sensitive details online, call us on 0474 267 679 instead.

7. Consent

We will ask for your consent before we collect sensitive information (such as health and disability information) and before we share your information with others, unless the law allows or requires us to act without it.

Consent can be given in writing, verbally (we will note it on your file), or through a nominee, guardian or other authorised representative.
We explain what we are asking consent for in a way that works for you, including Easy Read or the help of an interpreter or support person if you need it.
You can withdraw or change your consent at any time by telling us. This won't affect anything we have already done with your consent. If you withdraw consent, it may affect what we can do for you, and we will explain how.

8. How we store and protect your information

We store information electronically in secure, password-protected systems, including our email and Wix (for website forms). We store any paper records securely and destroy them securely when no longer needed.

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

limiting access to staff who need it for their role
we meet the worker screening requirements of the NDIS.

No system is completely secure, especially information sent over the internet. We work hard to keep risks low.

9. When we share your information

We only share your personal information:

with your consent, for example with the NDIA, your plan manager, Local Area Coordinator, health professionals, or providers we are connecting you with
where the law requires or allows it, for example:

- giving the NDIA information needed to manage your plan and claims, as required under the NDIS Act and our provider obligations
- reporting incidents, or giving information to the NDIS Quality and Safeguards Commission, as required
- meeting child protection or other mandatory reporting obligations in Queensland or Tasmania
- responding to a court order, subpoena or other lawful request
- where we reasonably believe sharing is needed to lessen or prevent a serious threat to someone's life, health or safety, or to public health or safety

with service providers who help us run our business, such as IT, website, email, cloud storage, accounting and auditors. They may only use the information to provide that service, and must keep it confidential.

We share only what is needed for the purpose.

10. Overseas storage and disclosure

Some of the service providers we use, such as website hosting and email providers, may store or process information outside Australia.

When we use these providers, we take reasonable steps to make sure they protect personal information in a way that is consistent with the Australian Privacy Principles, for example by choosing reputable providers with strong security and privacy commitments.

11. Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong, out of date, incomplete or misleading.

Contact us at hello@goodrose.com.au or 0474 267 679. A nominee, guardian or other authorised representative can also ask for you.
We will need to confirm your identity first.
We will respond within a reasonable time.
In limited cases the law allows us to refuse access, for example where giving access would pose a serious threat to someone's life, health or safety, or would unreasonably affect someone else's privacy. If we refuse, we will explain why in writing and tell you how to complain.
If we don't agree to make a correction, you can ask us to attach a statement to your record saying you believe it is wrong.

12. Children, young people and guardians

We support children and young people under 18 as well as adults. When we work with a child or young person:

Consent from a parent or guardian: we ask a parent, legal guardian or other person with legal authority (such as a child representative recognised by the NDIA) to consent before we collect, use or share the child's personal information, unless the law allows or requires otherwise.
Involving the young person: we explain things in a way that suits their age and understanding, ask for their views, and involve them in decisions about their information as much as they are able. As young people grow older and more mature, we give their wishes more weight. Where a young person is able to make their own decisions about their information, we will respect that, while still meeting our legal and safety duties.
Sharing with parents and guardians: we usually share information about a child with their parent or guardian. If sharing could put the child at risk, or a mature young person asks us not to, we will think carefully about their safety and wishes and what the law requires before sharing.
Keeping children safe: we follow child safety and mandatory reporting laws in Queensland and Tasmania. This means we may share information with child protection authorities or police without consent if we are worried about a child's safety. We meet the worker screening requirements of the NDIS.

For adults who need help to make decisions, we work with their nominee, guardian or other authorised representative. We still involve the person as much as possible and respect their views, privacy and dignity (supported decision-making).

Our website is not designed for children to use on their own. Please ask a parent or guardian to send a referral or booking request for a person under 18.

13. Data breaches

A data breach is when personal information is lost, or accessed or disclosed without permission.

If we suspect a data breach, we will act quickly to contain it and assess the risk. If the breach is likely to cause serious harm to anyone (an "eligible data breach" under the Notifiable Data Breaches scheme), we will:

notify the people affected as soon as practical, and explain what happened and what they can do
notify the Office of the Australian Information Commissioner (OAIC)
report to the NDIS Quality and Safeguards Commission or other bodies where required
review what happened and take steps to stop it happening again.

14. How long we keep information

We keep records only for as long as we need them, or as long as the law requires.

Participant records are generally kept for at least 7 years, in line with NDIS record-keeping requirements.

When we no longer need information, we securely destroy it or de-identify it.

15. Complaints and feedback

If you have a concern about how we have handled your personal information, please tell us. We want to put things right.

Contact us first. Email hello@goodrose.com.au or call 0474 267 679, or see our Complaints & Feedback form (linked in the website footer). You can complain anonymously, and a support person or advocate can help you.
We will acknowledge and respond to your complaint promptly. We will keep you updated, and making a complaint will not affect your services.
If you are not satisfied with our response, you can contact:
- Office of the Australian Information Commissioner (OAIC): oaic.gov.au | 1300 363 992 (about privacy)
- NDIS Quality and Safeguards Commission: ndiscommission.gov.au | 1800 035 544 (about NDIS supports and services, including privacy)

If you need an interpreter, call the Translating and Interpreting Service on 131 450. If you are deaf or have a hearing or speech impairment, you can contact us through the National Relay Service (accesshub.gov.au).

16. Changes to this policy

We may update this policy from time to time, for example when the law or our services change. The latest version will always be on our website, with the date it was last updated. If we make important changes, we will tell current participants.

17. Contact us

The Goodrose team
Renewed Paths Pty Ltd trading as Goodrose | ABN 33 674 731 572
Email: hello@goodrose.com.au
Phone: 0474 267 679
Website: goodrose.com.au

You can ask for a free printed copy of this policy, or a copy in another format (such as Easy Read or large print).

Goodrose is not a crisis service. If you or someone else is in immediate danger, call 000. For 24/7 crisis support, call Lifeline on 13 11 14.