Privacy policy

Last updated: 1 October 2026

Magna Carta Care Pty Ltd (ABN 85 694 286 890) ("Magna Carta Care", "we", "us") provides participant-driven NDIS supports. We believe the participant is the authority over their care and their life, and that includes their personal information. This policy explains what we collect, why, who sees it, and the choices you have.

In short

We only collect information we need to plan and deliver your supports, and we explain why when we ask.
We ask for your consent, and you can change your mind.
We never share your story, photo, video or Achievement Board outside Magna Carta Care unless you say yes, each time.
We share information with others only when you agree, when it is needed to deliver or fund your supports, or when the law requires it.
You can ask to see or correct your information at any time.
If you are unhappy with how we have handled your information, tell us and we will fix it.

Who this policy covers

This policy applies to visitors to magnacartacare.com.au, people who send us an enquiry or referral, NDIS participants and their families, nominees and supporters, and the support coordinators, plan managers and health professionals we work with. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the NDIS Code of Conduct and the NDIS Practice Standards, including the standards on privacy and dignity and on information management. Information about our workers and job applicants is handled separately under our HR policies.

What we collect

When you use our website or contact us: your name, email address, phone number (if you give it), whether you are a participant, family member, support coordinator or other professional, your suburb or region (if you give it), and what you tell us in your message. Please do not put medical details in the enquiry form. We will ask for what we need when we speak with you.

If you become a participant:

your identity and contact details, and those of your nominated representative, family or supporters
your NDIS number, plan details, goals and funding arrangements, and who manages your plan
information from intake and assessment, including your disability, health and support needs, communication needs, and cultural and language preferences
your support plan, risk assessments, service agreement and your personal Achievement Board
records of the supports we deliver, such as rosters, shift notes and progress notes
records of feedback, complaints, incidents and any changes to your supports
your consent records, including what you have agreed to share and with whom

Some of this is sensitive information under the Privacy Act, such as health and disability information. We only collect it with your consent, or where the law permits or requires it, and only when it is reasonably necessary for your supports.

How we collect it

We collect information directly from you and the people you choose to involve. With your consent, we may also collect it from your support coordinator, plan manager, allied health professionals, other providers or the NDIA. If someone refers you to us, we ask them to confirm you know about the referral. You can choose to deal with us through a nominated representative, and we record that on a Representative Nomination Form.

Why we use it

to respond to your enquiry or referral and work out whether we are the right fit and have capacity
to plan and deliver supports built around your goals, and to roster workers who suit you
to keep you and our workers safe, including risk assessment and incident management
to claim payment for supports from the NDIA, your plan manager or you, as your plan allows
to review and improve our services, handle feedback and complaints, and meet audit and quality requirements
to meet our legal and regulatory obligations as an NDIS provider

We use your information for the purpose we collected it, or a closely related purpose you would reasonably expect. We do not sell personal information.

Your consent and choices

We record your consent on our Privacy Consent Form. If you have a nominated representative, we also involve them as you direct. You can withdraw or change your consent at any time by telling us. Saying no to an optional use of your information, such as sharing your story, never affects the supports you receive.

Achievement Boards, photos, stories and video

Your Achievement Board belongs to you. We keep it within Magna Carta Care and your support team. We will not use your name, photo, video, story or board outside Magna Carta Care, for example on our website, social media or pamphlets, unless you have given us written consent for that specific use. We check again before each new use, and you can withdraw your consent at any time. Where we use a family's words or a participant's story, it is with their written consent.

Who we may share information with

People you ask us to involve, such as your support coordinator, plan manager, nominated representative, family or allied health professionals.
The NDIA and payment systems, so that supports can be claimed and funded.
The NDIS Quality and Safeguards Commission, for example where we must notify a reportable incident or respond to a complaint, and quality auditors who review our records as part of our audits, under confidentiality.
Emergency services, police or child protection authorities, where someone is at serious risk of harm or the law requires or permits disclosure.
Service providers that host our website and email, store our records, run our rostering and training systems, and provide our accounting services. They may only use information to provide their services to us.

We do not share your information with anyone else without your consent unless the law requires it.

Keeping your information safe

We keep records in access-controlled systems, organised so that only the people who need to see your information can. We use multi-factor authentication where available. All workers must have a current NDIS Worker Screening Check and receive privacy and confidentiality training before working with participants. Please avoid sending sensitive information by email or through the website form.

If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner as required, and notify the NDIS Commission where the breach is also a reportable incident.

Storage, overseas providers and retention

Some of our service providers store or process information outside Australia. Where that happens, we take reasonable steps to make sure your information is protected in line with the Australian Privacy Principles. We keep records for as long as we need them to deliver your supports and as long as the law requires, then securely destroy or de-identify them.

Our website

Our website is hosted by Shopify, which uses cookies and similar technologies to make the site work and to collect device, browser, IP address and usage information, such as which pages are visited. If you play a video on our site, it is provided by YouTube, which may also set cookies once you press play. We do not use the website to collect health information.

Children and young people

When we support a participant under 18, we work with their parent or guardian and listen to the young person's own views and wishes about their information.

Seeing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. Contact us using the details below. We may need to confirm your identity first, and we aim to respond within 30 days. If we cannot give you access or make a correction, we will explain why in writing.

Questions and complaints

If you have a question or are unhappy with how we have handled your information, please tell us first at info@magnacartacare.com.au or on 0494 572 486. We acknowledge every complaint within one business day and keep you informed until it is resolved. You can use an independent advocate to help you at any time.

If you are not satisfied with our response, you can contact:

the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) about privacy
the NDIS Quality and Safeguards Commission (ndiscommission.gov.au, 1800 035 544) about the quality and safety of NDIS supports

Other formats and changes to this policy

If you would like this policy in another format, such as Easy Read, large print or another language, ask us and we will help. We may update this policy from time to time. The current version is always on this page, with the date it was last updated.

Contact us

Magna Carta Care Pty Ltd
Unit 2, 290 Boundary Street, Spring Hill QLD 4000
Phone: 0494 572 486
Email: info@magnacartacare.com.au