Privacy Policy

Our Commitment to Your Privacy

Dedicated Plan Management respects your privacy rights and is committed to handling your sensitive personal information with the utmost care. This Privacy Policy explains what information we collect, how we use it, our protection measures, sharing practices, and your rights regarding your personal data, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information We Collect

We gather only information that is reasonably necessary for our NDIS plan management services:

• Personal details: Name, address, contact information, date of birth, gender
• NDIS-related information: Participant number, plan details, budget allocations
• Health/disability information: Details collected with your consent or as required by law
• Financial information: Bank account details, invoices, payment information

2. How We Collect Your Information

Information is collected from:

• Direct communication (in person, phone, email, forms)
• Authorised representatives
• Approved service providers
• National Disability Insurance Scheme (NDIS) when authorised
• Public sources where lawful and relevant

Unsolicited information not required for our services will be destroyed or de-identified.

3. Anonymity and Pseudonymity

Where possible, you may choose not to identify yourself or to use a pseudonym (for example, when making a general enquiry). However, identification is required for NDIS plan management services.

4. Why We Collect and Use Your Information

We use your information to:

• Set up and manage your NDIS plan funding
• Process and pay invoices
• Provide budget reports and spending updates
• Communicate with you and your service providers
• Meet legal and NDIS compliance requirements

5. Direct Marketing

We will not use your personal information for marketing purposes without your consent. You can opt out of any marketing communications at any time by contacting us.

6. Sharing Your Information

We do not sell or rent your personal information. We may disclose your information:

• With your consent
• To service providers delivering your supports
• To your authorised representatives
• To government agencies when legally required
• To contractors under confidentiality agreements, for the purpose of supporting service delivery only

7. Cross-Border Disclosure

Our participant portal is provided by Able Technology Group Pty Ltd (ABN 79 673 407 844), trading as Caresquare, an Australian company based in Sydney, New South Wales. Caresquare maintains its primary data store in Australia. Some of Caresquare’s own service providers may access or process information from outside Australia, including in the European Union and Singapore. Full details are set out in Caresquare’s privacy policy at caresquare.au. Invoices sent to us by email for processing are received on infrastructure located in Australia.

Where reasonably necessary for other aspects of service delivery (for example, accounting and bookkeeping software, email delivery, and file storage), your personal information may be handled by service providers located outside Australia, including in the United States, Japan, the European Union, Singapore, New Zealand and the United Kingdom. In particular, the emails we send are delivered through a third-party email service whose sending infrastructure is located in Japan and whose delivery records and logs are held in the United States. Our website analytics and advertising measurement are provided by Google and by Meta, both based in the United States, and information handled by those services is processed there. In all cases, we take reasonable steps to ensure overseas recipients are bound by comparable privacy protections under their local laws, contractual obligations, or both.

8. Government-Related Identifiers

Government identifiers (such as NDIS participant numbers) are not adopted, used, or disclosed except as required by law or for service delivery verification.

9. Quality of Personal Information

We take reasonable steps to ensure that personal information we collect, use, or disclose is accurate, complete, and up-to-date. We encourage you to notify us of any changes to your information.

10. Protecting Your Information

Our security measures include:

• Password-protected, encrypted databases
• Restricted access on a need-to-know basis
• Staff privacy training
• Secure destruction of outdated information

Our participant portal is provided by Caresquare, and access to it is protected by individual user accounts. Caresquare has confirmed to us that it applies encryption in transit and, where appropriate, at rest, together with access controls and identity management, environment segregation, logging and monitoring, backup and disaster recovery processes, and ongoing security testing, patching and vulnerability management. Before adopting any system that holds participant information, and on an ongoing basis, we assess the provider’s security arrangements and ask them to evidence how data is protected, where it is stored, and how it is backed up. We record the status of that evidence and will not state a security claim on a provider’s behalf that they have not confirmed to us.

11. Retention and Destruction

We retain your personal information only for as long as it is needed for the purposes set out in this policy, or as required by law. Under the National Disability Insurance Scheme Act 2013, as amended by the NDIS Amendment (Securing the NDIS for Future Generations) Act 2026, we must keep records of claims made against your plan for seven years from the date each claim is made. Information that is no longer needed is securely destroyed or de-identified.

12. Data Breach Notification

In the unlikely event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

13. Access and Correction

You have the right to access personal information we hold about you and to request corrections for accuracy and completeness. We aim to respond to all access and correction requests within a reasonable timeframe.

14. Website, Cookies and Analytics

Our web server keeps a standard access log of requests to this site. Each entry records the IP address the request came from, the date and time, the page requested, the response, and the browser identification string. These logs are kept for 14 days and then deleted automatically. We use them to keep the site running, to diagnose faults, and to identify and block automated abuse of our forms.

We use Google Analytics and Google Ads to understand how the site is used and to measure our advertising, and Meta advertising tools for the same purpose. When you submit our sign-up form, a record of that submission is sent to Meta to measure advertising performance. Your name, email address and phone number are converted to a coded form before being sent, rather than sent in readable form.

Cookies are used to improve your browsing experience; disabling them may affect website functionality. You can opt out of Google Analytics using Google’s browser add-on at tools.google.com/dlpage/gaoptout.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our services. The current version will always be available on our website.

16. Contact Us

If you have any questions about this Privacy Policy, wish to access or correct your personal information, or have a privacy concern, please contact us:

We respond to all privacy concerns promptly and follow complaints resolution procedures under the Privacy Act 1988 (Cth).

Privacy complaints to the OAIC

If you are not satisfied with our response to your privacy concern, you may contact the Office of the Australian Information Commissioner (OAIC):