Privacy Policy

Overview

The Scope Group (“Scope”, “we” or "us”) collects, stores, uses and discloses personal information, sensitive information and health information to conduct its business and provide its services. This policy explains how we collect, store, use and disclose your information and how you can access and correct that information. We recognise the importance of respecting and protecting the privacy of individuals and our handling of your information is done in accordance with the Privacy Act 1988 (Cth), National Disability Insurance Scheme Act 2013 (Cth), Health Records Act 2001 (Vic) and Health Records and Information Privacy Act (NSW) (as applicable).

We may change or update our Privacy Policy from time to time. If we do, we will post the amended or updated version on our website. We encourage you to visit our website regularly so that you are familiar with the most recent version. Any updates or changes will apply from the time they are posted on our website.

This policy applies to anyone who provides us with personal information, including our clients and their families, prospective clients sending us enquiries, supporters and workers (subject to any exemptions under relevant laws).

Our approach to privacy

Scope recognises that privacy is a fundamental human right. Scope also recognises that individuals with a disability have a right to exercise control and agency over their personal information in a way that works best for them. Scope is committed to upholding the principles of Indigenous Data Sovereignty in all aspects of data collection, storage, use and governance.

When it comes to handling personal information, we will:

• only collect personal information when it is lawful and necessary to do so and respecting the dignity and autonomy of all individuals whose data we collect,
• use personal information for the purpose for which it was collected (or related purposes where permitted),promptly correct errors as they are identified,
• securely store personal information that we hold,
• respond to privacy complaints in a fair, timely and transparent manner, and
• ensure all workers are aware of their obligations under this policy.

Responsibility

Definitions

1. Information we collect

1.1 How we collect personal information

a. Information you provide us directly. We may ask you for certain information, including personal information, when you interact with us. For example, when you:

• enquire about our services
• receive our services
• participate in Scope projects or research
• apply for a role at Scope
• apply to become a member of support or make a donation
• use the NDIS Planning Tool on our website

Where possible, we collect any required personal information from you directly or from a person who is authorised to represent you. In the case of children, we liaise with their parents or legal guardians rather than with the child directly. We handle the personal information of children with particular care, recognising their vulnerability and the significance of their right to privacy.

Individuals have the option to interact with us anonymously where reasonably possible. For example, if a person contacts us with a general question, they will not be required to provide their name unless it is required to adequately handle the enquiry.

Before you disclose personal information to us about someone else, you should make sure that you are entitled to disclose that information. You should also refer the other person to our privacy policy. If you become aware of any breach or alleged breach of privacy laws concerning the information that you have disclosed to us, you must notify us immediately.

If you don’t provide your personal information to us, we may not be able to provide you with the information, services or supports that you are requesting.

b. Information we receive from other people. Sometimes we collect your personal information from another person, such as a client’s support network, representative, other service providers or from third party government agencies such as the National Disability Insurance Agency. If personal information is collected from a third party and it is unclear if the person has consented to the disclosure of their personal information, we will take reasonable steps to contact the person and ensure that they are aware of the circumstances surrounding the collection and purposes for which their personal information is being collected.

c. Cookies and other technical information. When you access our websites, technical information may be collected about user activities on the website, including via Google Analytics and Hubspot. This may include information such as the type of browser used to access the website, the pages visited, session information and approximate geographical location. We use this information to operate, maintain and improve our websites and online services, understand how people engage with us, respond to enquiries and, where permitted, support marketing and advertising activities.

Our websites may also use ‘cookies’ and similar analytics and tracking technologies to manage and improve your experience on our website. A cookie is a small text file that our website may place on your computer as a tool to remember your preferences or recognise your browser. Cookies and similar technologies may be set by Scope or by third-party providers acting on our behalf. We currently use the following types of cookies on our website:

• Essential cookies: these are necessary for the basic operation of our website and cannot be disabled.
• Analytical cookies: these help us understand how visitors interact with our website by collecting information about pages visited, time spent on the website, and any errors encountered.
• Advertising and targeting cookies: these may be used to recognise visitors or audiences and support advertising, remarketing, profiling and lookalike audience activities on platforms such as Meta, LinkedIn and Google, where you have consented or we are otherwise permitted by law to do so.

Information collected via cookies may be shared with third-party service providers who assist us in operating our website, analysing user activity, managing enquiries and contact records, and conducting permitted marketing and advertising activities. These providers may include HubSpot, Google Analytics, Meta, LinkedIn, Google and other analytics, advertising or technology providers.

Most browsers allow an individual to choose whether to accept cookies or not, and you may manage or disable cookies through your browser settings. The availability of cookie preference management controls may vary across our websites.

The information collected using cookies is not always personal information. However, if that information could identify you, we treat that information as personal information and handle it in accordance with this policy.

1.2 Types of personal information we collect

a. The amount and type of personal information we collect from you depends on your relationship with us.

b. If you are a client that we support, have registered your interest in becoming a client or are connected to a person we support or may support in the future (eg a family member, carer, advocate or nominated representative) we may collect information including:

• name, address, telephone and email contact details
• gender, date of birth and marital status
• information about a clients’ disability and support needs
• health and medical information required to support service delivery
• things that are important to a client, e.g., likes and dislikes
• living arrangements and accommodation needs
• learning and educational needs
• details concerning a clients’ daily life and routine
• details concerning a clients’ employment goals and other life goals
• details concerning a clients’ social and community activities
• a clients’ visual image, via photograph or otherwise
• any other information obtained from a client and/or their support network through the National Disability Insurance Scheme Planning Tool (NDIS Planning Tool)
• Medicare number and other identifiers used by Government agencies or other organisations
• financial information including billing details
• information about the services a client is funded to receive, whether under the National Disability Insurance Scheme or otherwise and the current supports being used

c. If you send us an enquiry, we may collect information including:

• name, telephone and email contact details
• details of the enquiry

d. If you apply for a job or volunteer role, we may collect information including:

• name, address, telephone and email contact details
• gender and date of birth
• health and medical information
• tax file number and other identifiers used by Government agencies or other organisations
• information about qualifications, training and work history
• information from NDIS worker screen, working with children checks (or similar), and information about right to work in Australia

e. If you register for a subscription to a Scope publication, we may collect information including:

• name, address, telephone and email contact details
• other information that you provide to us when interacting with us

f. If you are a member, supporter, donor, corporate partner or are otherwise connected with Scope through fundraising, marketing, training or community access activities, we may collect information including:

• name, address, telephone and email contact details
• gender, date of birth and marital status
• details of the donations, bequests and contributions you have made
• events and activities you have participated in
• renewal and billing information
• other information that you provide to us when interacting with us

g. If you are a visitor to our website, we may collect information including:

• any details you provide to us when sending us an enquiry, registering to be on our mailing list, making a donation or providing choices about marketing communications, SMS, targeted advertising, remarketing or lookalike audience activities
• ‘cookies’ and other technical information through your use of our website (see section 1.1c for more details)

h. If a person does not fall into one of the above categories, we generally do not collect or hold any of their personal information.

2. Unsolicited personal information

a. Sometimes we receive personal information that we did not request or that is additional to the information that we have requested. This is known as unsolicited personal information.

b. If the information is such that we could have lawfully collected it for an allowed purpose (see section 3 below), then we will handle the information in the same way as other personal information.

c. If the information is such that we could not have lawfully collected it, we will destroy, return or de-identify the information as soon as reasonably practicable, provided it is lawful and reasonable to do so.

3. How we use and share your personal information

3.1 Why do we collect your personal information?

a. The purposes for which we collect, hold, use, or disclose your personal information depends on your relationship with us and the type of information being handled.

b. The main purposes for which we collect, hold, use and disclose personal information are set out below. If we collect your personal information for one of the purposes below, we may use or disclose that personal information for any of the other purposes set out below:

Provision of support services

• • providing information about our organisation, services and supports and answering enquiries
  • delivering services, information, advice and assistance to our clients and to their nominated decision-makers and others, including third party service providers involved in a client’s support, care or treatment
  • conducting quality assurance and safeguarding activities including investigations, surveys, research and analysis and resolving complaints
  • complying with laws and regulations and reporting to government agencies.

Education and information

• • providing disability-related resources
  • undertaking policy work
  • inviting a person to participate in research projects and activities.

Fundraising and marketing

• • promoting and advertising our services, events, community activities, research, fundraising appeals and donor activities
  • seeking donations
  • measuring how effective our marketing and fundraising activities are
  • using marketing and advertising platforms, such as HubSpot, Meta, LinkedIn and Google, to create contact segments, custom audiences or similar audiences for fundraising, marketing or advertising activities, where you have consented or we are otherwise permitted by law to do so.

Administration and internal business activities

• • meeting our corporate governance requirements
  • processing payments, salaries or wages, and donations
  • managing our workforce, including employee records
  • carrying out internal functions including administration, training, accounting, audit and information technology
  • complying with laws and regulations
  • receiving feedback and resolving complaints.

c. Where we rely on your consent to collect, use or disclose your personal information, we will seek that consent at the time of collection. Consent will not be assumed because you have provided us with your information. Where we seek consent for different purposes, we will present those choices separately where required by law.

d. Where we collect sensitive information (including health information and information about your disability or support needs), we will seek your express consent - in writing or verbally - before collecting, using or disclosing that information, unless an exception under the Privacy Act applies (for example, where collection is required by law, or is necessary to lessen or prevent a serious threat to life, health or safety).

e. You may withdraw your consent at any time by contacting our Privacy Officer. Withdrawal of consent will not affect anything we have already done in reliance on your consent, but may in some cases affect our ability to continue delivering services to you.

f. We may also collect, hold, use and disclose personal information for other purposes not in the list above which are explained to you at the time of collection, purposes which are required or authorised by or under law or purposes for which you have provided your consent.

3.2 Use of de-identified information

a. We may aggregate or otherwise de-identify data we have collected about you of all personally identifying information. We may use and share that aggregated or anonymised data for quality assurance activities, education, marketing and fundraising activities and to evaluate our services.

3.3 Direct marketing

a. If you have agreed, or if the law allows us to, we may use your personal information — but not sensitive information — to keep you informed about our work and to send you marketing material, supporter and donor communications, and invitations to participate in events and research (“marketing communications”).

b. We may also use your personal information for targeted advertising or remarketing on third-party advertising platforms. We will only do this if you have given us separate, optional consent, or if the law allows us to.

c. If you have agreed to receive marketing communications from us, that consent will continue until you tell us otherwise. Each marketing communication will include a clear and easy way to opt out if you no longer want to receive them.

d. In addition to using the opt-out function, if you no longer want to receive marketing communications from us, you can also contact us directly (details in section 6 below).

3.4 Who do we disclose your information to?

a. We may disclose your personal information to third parties for the purposes listed in the section above. This includes disclosure to:

• related and affiliated companies and organisations including joint venture partners and industry affiliate organisations,
• service providers and suppliers engaged by us or acting on our behalf in relation to our business, including information technology service providers, research agencies, invoice processing service providers, fundraising and marketing agencies, communications service providers and external business advisers (such as recruitment advisers, auditors and lawyers),
• Government and regulatory bodies, including the National Disability Insurance Agency, NDIS Quality and Safeguards Commission, Medicare, the Department of Social Services, the Department of Families, Fairness and Housing and the Australian Taxation Office,
• people acting on your behalf including your nominated representatives, legal guardians, executors, trustees and legal representatives,
• clinicians and other service providers where you have given your consent,
• financial institutions for payment processing, and
• where disclosure is required by law, including to the police, or to the Disability Services Commissioner, or to comply with compulsory notices from courts of law, tribunals or government agencies.

b. We take reasonable steps to make sure that third parties will protect the privacy of your personal information, in accordance with this Privacy Policy. Where a third party (such as IT service provider or supplier) may store or process your personal information overseas, we will make sure they do so consistently with this policy and Australian law. We will not sell your personal information to any third party.

3.5 Use of artificial intelligence

a. We may use artificial intelligence (AI) tools, including Microsoft 365 Copilot, to help us with administration, operations and delivering services. If these tools use personal information, they do so only under our instructions and in line with this policy.

b. Sometimes AI tools may process personal information outside Australia. If this happens, we may treat it as sharing information overseas. Before we do this, we take reasonable steps to make sure the overseas provider protects the information in a way that is consistent with the Australian Privacy Principles. This includes having agreements in place with providers. We remain responsible under the Privacy Act for how your information is handled.

c. We do not permit our AI providers to use your personal information to train their AI models, for advertising, or for their own commercial purposes.

4. How we transfer, store and protect your information

4.1 Will your personal information be transferred overseas?

a. Our technology infrastructure primarily uses cloud infrastructure or servers located within Australia. However, some of the platforms and services we use (including certain Microsoft services and artificial intelligence tools) may store or process your personal information on infrastructure located overseas.

b. We may transfer your personal information to platforms and services located in a country and jurisdiction that does not have the same data protection laws as Australia. Before we do this, we take reasonable steps to make sure the overseas provider protects your information in line with the Australian Privacy Principles. This includes having agreements in place that require them to handle your information to a standard consistent with Australian privacy law. We remain responsible under the Privacy Act for how overseas providers handle your information.

4.2 How do we store your personal information?

a. We take all reasonable steps to ensure that your personal information is securely stored and protected. These steps include password protection for accessing our electronic IT systems, securing paper files in locked cabinets and physical access restrictions to buildings where information is held. In addition, access to your personal information is restricted to those properly authorised to have access. Scope workers must only access and use personal information for a valid work purpose.

b. We store your personal information for as long as it is needed for the purposes for which it was collected and to comply with our legal requirements. Retention periods vary depending on the type of record and the legal obligations that apply (for example, under the National Disability Insurance Scheme, employment law, and the Health Records Act 2001 (Vic) for health records). When personal information is no longer required for any lawful purpose, we aim to securely destroy or de-identify it.

c. We take reasonable steps to:

• ensure that the personal information we collect, use and disclose is accurate, up to date, complete and (in the case of use and disclosure) relevant,
• protect the personal information we hold from misuse, interference and loss and from unauthorised access, modification or disclosure, and
• destroy or permanently de-identify personal information that is no longer needed for any purpose permitted by the Australian Privacy Principles, subject to other legal obligations and retention requirements applicable to us.

d. We take reasonable steps to protect your personal information, but no system is completely risk-free. We cannot guarantee that unauthorised access will never happen.

e. If a data breach affects information we hold, we will follow our Data Breach Response Procedure. If the breach is serious enough to be an “eligible data breach” under the Privacy Act, we will contact you, explain what happened and take steps to reduce any impact on you.

5. Accessing and correcting your personal information

a. You can request access to and correction of the personal information we hold about you by contacting us (details in section 6 below).

b. We may ask an individual to verify their identity before giving access to the personal information or correcting it.

c. We do not typically charge you for access to your personal information.

d. Generally (but subject to our legal obligations), we will provide you with access to your personal information, or take reasonable steps to correct the information, within a reasonable time and in the manner requested by you. However, there may be some circumstances when this is not possible, including where:

• we no longer hold or use the information,
• providing access would have an unreasonable impact on the privacy of others,
• the request is frivolous or vexatious,
• providing access would be unlawful, or
• for any other permitted reason set out in Australian legislation that is applicable to us.

e. If we do not provide you with access to all of your personal information, we will tell you the reason why we have not done so.

6. Contact us

a. Requests for access or correction of your personal information and any other queries relating to privacy can be made to our Privacy Officer:

• via telephone on 1300 472 673, or
• in writing via email on [email protected] or by post to Level 2, 109 Burwood Rd, Hawthorn VIC 3122.

b. If we are unable to resolve your request, you also have the option to report the issue or make a complaint (details in section 7).

7. Privacy Complaints

a. If you have a complaint about how we have collected or handled your personal information, please contact our Privacy Officer (details in section 6). We will ask you to explain the circumstances of the matter you are complaining about and how you believe your privacy has been interfered with.

b. We will complete a review of the complaint and try to resolve it in a fair and reasonable way. At all times, any privacy complaints received will be treated seriously and dealt with promptly. We aim to investigate complaints and provide a response within 30 days of receipt of the complaint. If the matter is more complex and the investigation may take longer, we will write and let you know. You will be informed of the outcome of our review once it has been completed.

c. If you are unhappy with our response, you can refer your complaint to the NDIS Quality and Safeguards Commission, the Office of the Australian Information Commissioner or in some cases the Victorian Health Complaints Commissioner or the New South Wales Health Care Complaints Commission.

Related Legislation and Governance Documents

- Version 7 Effective Date: 27/08/2026 -