Privacy Policy

Henari Support Services Pty Ltd (ABN 62 695 381 027)

Effective date: 15 October 2026

This policy explains how Henari Support Services (“Henari”, “we”, “us”, “our”) collects, uses, stores and shares personal information. It covers people who visit our website, people who contact us, the participants we support and their families, carers and representatives, and people who apply to work with us.

If you would like this policy in another format, such as large print or a printed copy, or would like it explained to you over the phone, please contact us. You can also ask a family member, advocate or interpreter to help you. It is free.

1. Who we are

Henari Support Services Pty Ltd is a disability support provider based in Townsville, Queensland.

2. The laws we follow

Because we provide disability supports and handle information about people’s health and disability, we are treated as a health service provider under the Privacy Act 1988 (Cth). This means we must follow the Australian Privacy Principles (APPs), whatever the size of our business.

As an NDIS provider, we also follow the NDIS Code of Conduct, which says providers must respect the privacy of people with disability. We use the NDIS Practice Standards on Privacy and dignity and Information management to guide how we work. These say each participant should understand and agree to what information is collected and why, know how it is stored and used, know when it may be shared, and be able to access or correct it and change or withdraw their consent.

Queensland: Queensland does not have a separate health records law for private organisations, so the Privacy Act is the main privacy law that applies to us. Queensland’s Information Privacy Act 2009 (Qld) and its Queensland Privacy Principles apply to Queensland government agencies. If we deliver a service under a contract with a Queensland government agency, that contract may also require us to follow those principles.

3. What personal information we collect

“Personal information” is information that identifies you or could reasonably identify you. We only collect what we need.

Website visitors

  • technical information such as your IP address, browser and device type, pages viewed, how you arrived at our site and your approximate location (city or region), collected through cookies and similar tools (see section 7)
  • the address or suburb you type into our transport price estimator

People who contact us or make an enquiry

Depending on the form or how you contact us:

  • your name, email address and phone number
  • whether you are enquiring for yourself or someone else
  • your message or subject
  • van hire booking dates and requirements
  • transport journey or hire details (such as pick-up and drop-off addresses), accessibility requirements and the estimate you were given
  • your budget, for lawn and yard quotes
  • whether you have ticked “Sign up for news and updates”

Participants, families, carers and representatives

When you start receiving supports, or are thinking about it, we may collect:

  • name, date of birth, address, contact details and emergency contacts
  • details of your nominee, guardian, carer or other representative
  • your NDIS number, plan details and how your plan is managed, so we can deliver and claim for supports
  • health and disability information, such as your support needs, medical conditions, medications, communication and behaviour support needs, and mobility and accessibility needs
  • your goals, preferences, routines, and any cultural or religious needs you choose to share
  • service agreements, support schedules, progress notes, incident reports, feedback and complaints
  • invoicing and payment details
  • when a support worker clocks in or out of a shift, the location recorded by our rostering app

Job applicants, workers and contractors

  • name, contact details, the role you are interested in and your message
  • your resume, qualifications, work history and referees
  • screening checks required for the role, such as an NDIS Worker Screening Check, and right-to-work information
  • any health or other information you choose to give us, or that is needed to make reasonable adjustments

4. How we collect information

We collect information:

  • directly from you, through our website forms, by phone, by email, in person, and through service agreements and intake forms
  • from people you authorise, such as a family member, nominee, guardian, support coordinator, plan manager, health professional or other provider
  • automatically, when you use our website (see section 7)

If someone gives us information about you (for example, a family member making an enquiry for you), we will let you know when it is reasonable to do so. If you give us information about another person, please make sure they know and agree.

Please keep website forms brief

Our website forms are for first contact only. Please don’t include medical reports, diagnoses, NDIS numbers, Medicare or bank details, or other sensitive information in a website form, and never send documents through the website. If you need to give us sensitive information or documents, please contact us by phone on 0437 496 326 or by email at first, and we will arrange a secure way to receive them.

5. Why we collect and use information

We use personal information to:

  • reply to your enquiry, give quotes and estimates, and take bookings for transport, van hire, lawn and yard services and supports
  • plan, deliver, review and improve the supports we provide, in the way you prefer
  • roster support workers and match them to shifts
  • keep participants and workers safe, including managing risks, incidents and emergencies
  • prepare service agreements and invoices, and make NDIS claims
  • manage feedback and complaints
  • assess job applications and manage our workforce
  • send news and updates, but only if you have ticked the “Sign up for news and updates” box (see below)
  • understand how people use our website so we can improve it
  • meet our legal, insurance and NDIS obligations

We do not sell or rent personal information.

News and updates: some of our website forms include an optional “Sign up for news and updates” box. It is not ticked unless you tick it. If you tick it, your email address is added to our mailing list in Squarespace. You can unsubscribe at any time using the link in any email we send, or by contacting us. Whether or not you tick the box, your form submission (including your name and email address) is stored in our Squarespace account so we can reply to you.

Health and disability information is “sensitive information” under the Privacy Act. It gets extra protection. We will only collect it:

  • with your consent, and only when we need it to provide or plan your supports, or to assess a job application
  • or when the law allows or requires it (for example, to lessen or prevent a serious threat to someone’s life, health or safety)

Your consent: we will explain what we are collecting and why, in the way that works best for you. You can ask questions, choose what you share, and change or withdraw your consent at any time by contacting us. If you withdraw consent, we will explain how this might affect the supports we can provide.

Decision-making support: if a participant is under 18, or needs support to make decisions, we work with the person and their parent, guardian, nominee or other authorised representative, and we still involve the person as much as possible.

7. Cookies, analytics and how to opt out

Cookies are small files saved by your browser. Our website uses:

  • Essential cookies set by Squarespace, our website platform, to make the site and its forms work securely (the crumb cookie).
  • Analytics cookies from Google Analytics 4 (_ga, _ga_46Y36GCHC9) and Squarespace analytics (ss_cvr, ss_cvt). These tell us which pages are visited, roughly where visitors are, what device they use and how they found us. We look at this as summary reports to improve the site. Google Analytics 4 does not log or store IP addresses.

Our website does not currently show a cookie banner, so these analytics cookies are set when you first visit. You can stop or remove them using the choices below.

Choices that work:

  • Browser settings: you can block or delete cookies in your browser. The site will still work, though some features may not.
  • Google Analytics opt-out: you can install Google’s opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

Other services on our site (these don’t use our analytics cookies, but do receive your IP address and browser details):

  • Google Fonts, which loads the typefaces on every page. Google says it does not set cookies or use this to profile you.
  • Google reCAPTCHA, which loads on pages with a form and checks that submissions come from a person, not a spam program. To do this it looks at technical and usage information. It can stop a submission it thinks is automated.
  • Google Maps, which shows our location on our Contact page.
  • Accessibility settings widget: your choices (such as contrast or text size) are saved only in your own browser so they stay the same between pages. They are not sent to us.

Google explains how it uses information from sites like ours at https://policies.google.com/technologies/partner-sites.

8. Interactive tools that work on your device

Some of our tools run entirely in your web browser. They are delivered from GitHub Pages, a hosting service run by GitHub, Inc. (United States).

  • How I Like to Be Supported (profile builder) and the Australian Wildlife Memory Game work on your device. What you type or choose in them is not sent to Henari and is not saved by us.
  • When the tools load, GitHub records your IP address for security purposes, as it does for any GitHub Pages site.
  • The profile builder lets you download your profile as a file. This file can contain sensitive information about your health, disability and support needs. It is saved only where you choose. If you use a shared computer, or your downloads folder syncs to the cloud, other people may be able to open it. Please keep it somewhere private, and delete it when you no longer need it. We only see your profile if you choose to share it with us.

Transport price estimator: when you type an address, it is sent to Geoapify, an address lookup and routing service, to suggest matching addresses and work out the driving distance. Geoapify is run by KEPTAGO LTD (Cyprus) and hosts its services in European Union data centres (Germany and Finland), with network delivery through Cloudflare. Please enter only an address or suburb. Your estimate is sent to us only if you then submit the enquiry form.

9. Who we share information with

We only use and share personal information for the purpose we collected it for, or a directly related purpose you would reasonably expect, with your consent, or where the law requires or authorises it. We share only what is needed.

Service providers who help us run our business. We use cloud-based business systems to run our services, under their confidentiality and security terms. These include:

  • ShiftCare, for client management, rostering, notes and invoicing
  • Squarespace, for our website and forms, including the contact list and mailing list created when you submit a form
  • Google Workspace, for business email
  • Google Analytics, Google reCAPTCHA, Google Maps and Google Fonts on our website
  • Geoapify, for address lookup in our transport price estimator
  • GitHub Pages, for hosting our interactive tools

People and organisations involved in your supports. With your consent, or where it is directly related to the supports you receive and you would reasonably expect it, we may share information with people such as your nominee, guardian or other authorised representative, your plan manager or support coordinator, or health professionals and other providers involved in your care.

When the law requires or authorises it. We may share information without your consent where the law requires or authorises it. For example:

  • to government agencies and regulators, such as the National Disability Insurance Agency (NDIA) and the NDIS Quality and Safeguards Commission
  • to police, courts or tribunals, for example under a warrant, subpoena or court order
  • where it is needed to lessen or prevent a serious threat to someone’s life, health or safety

10. Overseas disclosure

Some of our service providers store or process information outside Australia:

Provider What it does for us Where information may be held
Squarespace Website, forms, contact and mailing lists United States and other countries where Squarespace or its sub-processors operate
Google Business email, Analytics, reCAPTCHA, Maps, Fonts United States and other countries where Google operates
Geoapify (KEPTAGO LTD) Address lookup and distance European Union (Germany and Finland); network delivery via Cloudflare, including the United States
GitHub, Inc. Hosting for interactive tools (technical data only) United States and other countries

ShiftCare states that it stores Australian customers’ data in Australia (Amazon Web Services, Sydney).

We choose established providers and take reasonable steps to make sure they protect personal information. Their own privacy policies also apply:

11. Software that assists with decisions

We use software that helps us with some tasks. These tools may use personal information to make suggestions, scores or checks:

  • Rostering: our rostering system (ShiftCare) can suggest and rank which support workers suit a shift. It uses information such as workers’ skills, qualifications, availability, compliance status and location, together with participants’ support needs and preferences.
  • Spam filtering: Google reCAPTCHA checks website form submissions using technical and usage information. It may automatically block a submission it judges to come from a spam program rather than a person.
  • Recruitment: when we consider job applications, we may use software that compares the information in an application or resume with the job requirements.

If you have questions about whether or how any of these tools were used in a decision about you, please contact our Privacy Officer (see section 19). We will respond to your questions.

12. How we keep information secure

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, changes or disclosure. These include:

  • giving access only to people who need it for their role
  • using secure, password-protected business systems and accounts
  • storing paper records securely

No website or email system is completely secure. This is one reason we ask you not to send sensitive information through website forms.

13. How long we keep information

We keep personal information for as long as the law requires, then securely destroy or de-identify it.

14. Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete. You can ask in any way that suits you: by phone, email, letter or in person.

  • We may need to check your identity, or your authority to act for someone else.
  • It is free. There is no charge to ask, and no charge to receive your information.
  • We aim to respond within 30 days. If we need longer, we will tell you why and when to expect our reply.
  • If we can’t give you access or make a correction, we will tell you why in writing, and explain how to complain. If we don’t agree to a correction, you can ask us to attach a statement to your record.

15. Anonymity and pseudonyms

You can browse our website without telling us who you are. You can also ask general questions, for example about our services or prices, without giving your name or by using a different name.

To provide supports, take a booking, make an NDIS claim or consider a job application, we need to know who you are.

16. Complaints

If you are worried about how we have handled your personal information, please tell us first. You can contact us by phone, email or post (see section 19), or use our feedback and complaints process at https://www.henarisupport.com/participant-rights-feedback-complaints. You can ask an advocate or support person to help you.

We will take your complaint seriously and keep it confidential, and you will not be treated unfairly for complaining. We aim to respond within 30 days.

If you are not happy with our response, or we haven’t responded within 30 days, you can contact:

Office of the Australian Information Commissioner (OAIC): for privacy complaints - Online: https://www.oaic.gov.au/privacy/privacy-complaints - Phone: 1300 363 992 - Post: GPO Box 5288, Sydney NSW 2001 - The OAIC needs complaints in writing.

NDIS Quality and Safeguards Commission: for concerns about an NDIS provider or worker, including privacy - Online: https://www.ndiscommission.gov.au/participants/complaints - Phone: 1800 035 544 (free call from landlines) or TTY 133 677. Interpreters can be arranged.

17. Data breaches

If personal information we hold is lost, or accessed or disclosed without permission, we will act quickly to contain the breach and assess the risk. If the breach is likely to cause serious harm, we will notify the people affected and the OAIC, as required by the Notifiable Data Breaches scheme under the Privacy Act. We will also tell you what steps you can take to protect yourself.

18. Changes to this policy

We may update this policy when our services, systems or the law change. The current version will always be on this page, with the effective date at the top.

19. Contact us

For privacy questions, requests or complaints:

Privacy Officer, Henari Support Services Shop 5, 206 Ross River Road, Aitkenvale QLD 4814 Phone: 0437 496 326 Email:

If you need an interpreter, call the Translating and Interpreting Service (TIS National) on 131 450 and ask them to call us. If you are deaf, or have a hearing or speech impairment, you can contact us through the National Relay Service.