Privacy policy

SolDirectory privacy policy

2.1 About this policy

SolDirectory is an online directory and referral service that helps people find disability and aged care providers. It is operated by Sol Business Consultant Pty Ltd (ABN 20 662 022 522) of 97 John St, Glenroy VIC 3046 (“we”, “us”, “our”).

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to everyone whose information we handle through SolDirectory: participants, families, carers, nominees and guardians; support coordinators and plan managers; providers and independent workers; and visitors to our website.

Because we collect sensitive information and provide access to personal information as part of our service, we comply with the APPs regardless of our turnover.

2.2 The kinds of personal information we collect and hold

When you send a request (Get matched):

• your name, email address and, if you choose, phone number
• the suburb or postcode where support is needed
• who the support is for (yourself, a family member or friend, or a client)
• the support you need, your funding type (for example NDIS, aged care, DVA or private) and how an NDIS plan is managed
• when you’d like support to start and approximately how many hours a week
• preferences you choose to share, such as language, worker gender or cultural needs
• anything you add in the free-text field

Some of this is sensitive information under the Privacy Act, because it can reveal information about a person’s health or disability.

If you’re a support coordinator or plan manager: your name, organisation, role, email and phone number, and the requests you send on behalf of participants.

If you’re a provider: the names, roles, email addresses and phone numbers of your staff who use SolDirectory; your business details including ABN and registration details; service areas and capacity; billing contact details; and any documents you upload.

If you’re an independent worker: your name, contact details, suburb, the supports you offer, availability, languages, indicative rate, experience, ABN (if you have one), and the checks you declare, such as an NDIS Worker Screening Check, Working with Children Check, first aid certificate or insurance, including expiry dates and the evidence you upload.

When you contact us: your name, contact details and what you tell us.

When you pay: billing name and address. Card details are collected and stored by our payment processor, Stripe, not by us.

When you use our website: your IP address, device and browser type, pages visited, and the date and time of your visit, collected through cookies and similar technologies (see our cookie notice).

From public registers: business names, registration details, registration groups and locations published on the NDIS Quality and Safeguards Commission’s NDIS Provider Register and on My Aged Care. Where a sole trader is registered under their own name, that name appears in our listings.

We don’t collect government identifiers such as Medicare or NDIS numbers, and we don’t adopt any government identifier as our own identifier for you.

2.3 How we collect personal information

We collect personal information:

• directly from you, through our forms, accounts, emails and phone calls
• from someone acting for you, such as a family member, nominee, guardian or support coordinator who confirms they have your permission or authority
• from public registers (the NDIS Provider Register and My Aged Care)
• automatically, when you use our website

If we receive personal information we didn’t ask for and couldn’t have collected under this policy, we’ll destroy or de-identify it as soon as practicable, where lawful and reasonable to do so.

2.4 Anonymity and pseudonymity

You can search the directory and read our guides without telling us who you are. To send a request, we need a name and a way for providers to contact you; you can use a first name only if you prefer.

2.5 Why we collect, hold, use and disclose personal information

We use personal information to:

• match your request with suitable providers and let up to 3 of them contact you
• let you track, close or delete your request, and ask whether you found support
• create and manage accounts for coordinators, providers and workers
• verify providers and workers, including checking ABNs and register information
• keep listings accurate, including importing public register updates
• process subscriptions and payments, and issue tax invoices
• answer enquiries, handle complaints and respond to privacy requests
• send you service messages about your request or account
• send you updates and guides, if you’ve asked us to
• keep our service secure, prevent misuse and investigate breaches of our terms
• improve our service, using de-identified information where possible
• meet our legal obligations

We collect sensitive information only with your consent, or where the law otherwise allows it. We use and disclose personal information only for the purpose we collected it, a related purpose you’d reasonably expect (or, for sensitive information, a directly related purpose), with your consent, or where the law requires or permits it.

2.6 Who we disclose personal information to

Providers. When you send a request:

• up to 10 matched providers receive a summary: the support, suburb, funding type, timing and hours. It doesn’t include your name or contact details.
• up to 3 of those providers can choose to see your name, email, phone and free-text details, so they can contact you about your request.

Every provider agrees in our provider agreement to use these details only to respond to your request, not to use them for marketing, not to pass them to anyone else, and to handle them in line with the Privacy Act. You can see which providers viewed your details in your request tracker.

Organisations contacting workers. An independent worker’s contact details are shared with an organisation only after the worker accepts that organisation’s contact request.

Service providers. We use other businesses to run SolDirectory: cloud hosting and database storage, email delivery, SMS delivery, address search and mapping, website analytics, and payment processing (Stripe). They handle personal information only to provide their services to us and must protect it.

Others. We may disclose personal information where you consent, to a person you’ve authorised to act for you, to our professional advisers (such as lawyers and accountants) under a duty of confidentiality, where required or authorised by law (for example, to a court, regulator or law enforcement agency), or where we reasonably believe it’s necessary to lessen or prevent a serious threat to someone’s life, health or safety.

We don’t sell personal information. Providers pay us a subscription that includes access to requests matching their services, within the limits above. They can’t buy personal information outside that process, and we never sell or rent lists of participants, families, coordinators or workers.

2.7 Disclosure overseas

We use some service providers that may handle personal information outside Australia. They include the services we use for address search and mapping and for text messages. We take reasonable steps to make sure they handle personal information consistently with the Australian Privacy Principles. Our current list of service providers and where they operate is available on request.

Card payments are collected directly by our payment processor, Stripe, under Stripe’s own privacy policy. We don’t store card details.

2.8 Automated matching

We use a computer program to decide which providers receive a summary of your request. The program uses these kinds of personal information: the support you need, your suburb, your funding type and plan management type, and your timing. It compares them with providers’ supports, service areas, accepted funding, registration status and whether they’ve confirmed capacity this week.

The program decides, without a person being involved, which providers are notified of your request. It doesn’t decide whether you receive support, or which provider you choose; you make that decision. We don’t use your personal information to rank providers. You can ask us for a person to review how your request was matched by contacting our privacy officer.

2.9 Direct marketing

We send marketing emails, such as updates and guides, only if you’ve opted in, or where the Spam Act 2003 (Cth) otherwise allows it (for example, to a business email address that has been conspicuously published, about matters relevant to that business). Every marketing email identifies us and includes a working unsubscribe link, and we act on unsubscribe requests within 5 business days. Opting out of marketing doesn’t stop service messages about your request or account. We never use the details in a participant’s request to market to them, and we never disclose personal information to others for their direct marketing.

2.10 How we hold and protect personal information

We hold personal information electronically in secure cloud systems. We protect it by:

• encrypting it in transit and at rest
• limiting staff access according to their role, and logging who views contact details
• keeping software up to date and monitoring for unusual activity
• requiring our service providers to protect it
• training staff on privacy and confidentiality

When we no longer need personal information for any purpose permitted by law, we take reasonable steps to destroy or de-identify it.

2.11 How long we keep it

You can ask us to delete your information sooner (see section 2.12).

2.12 Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it’s inaccurate, out of date, incomplete, irrelevant or misleading. You can also ask us to delete it.

How to ask. Email directory@solbusinessconsultant.com.au with “Privacy request” in the subject line and say whether you want access, a correction or deletion. Or phone 0460 003 494, or write to our Privacy Officer at 97 John St, Glenroy VIC 3046. We may need to confirm your identity first.

Who to contact. Our Privacy Officer, Safdar Hussain. Full contact details are in section 2.15.

When we’ll reply. We’ll respond within 30 days. We don’t charge for a request. If we refuse access or correction, we’ll tell you why in writing (unless that would be unreasonable) and how to complain. If we refuse a correction, you can ask us to attach a statement to your information saying you believe it’s incorrect.

You can also close a request and see who viewed your details at any time from your request tracker.

2.13 Keeping information accurate

We take reasonable steps to keep personal information accurate, up to date and complete. Providers confirm their capacity weekly, register data is refreshed regularly, and you can update your own details at any time.

2.14 Data breaches

If we have reasonable grounds to believe an eligible data breach has happened (one likely to cause serious harm), we’ll notify the people affected and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and tell you what steps to take.

2.15 Questions and complaints

Contact our privacy officer:

• Safdar Hussain, Privacy Officer, SolDirectory
• Email: directory@solbusinessconsultant.com.au
• Phone: 0460 003 494
• Post: 97 John St, Glenroy VIC 3046

We’ll acknowledge a complaint within 2 business days and aim to resolve it within 30 days. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

2.16 Children and people who need support to decide

If the person needing support is under 18, or needs support to make decisions, a parent, guardian, nominee or other authorised representative should send the request and manage their information on their behalf.

2.17 Changes to this policy

We’ll update this policy when our practices change, and post the new version here with its date. If a change significantly affects how we handle your information, we’ll tell account holders by email.

Contact

Sol Business Consultant Pty Ltd (ABN 20 662 022 522), 97 John St, Glenroy VIC 3046. Email directory@solbusinessconsultant.com.au. Phone 0460 003 494 (Monday to Friday, 8am to 5.30pm Melbourne time).