Privacy Policy

Verge Counselling Services | Effective July 2026 | Version 2.0

Who we are

Verge Counselling Services ('we', 'us', 'our') provides counselling and NDIS specialist behaviour support services, based in Toowoomba, Queensland. We are a registered NDIS provider and our lead clinician is a member of the Psychotherapy and Counselling Federation of Australia (PACFA).

This policy explains how we collect, use, disclose and protect personal information, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme, and the NDIS Quality and Safeguarding Framework. A copy of our full internal privacy and confidentiality policy and procedures, including an easy-read version, is available on request.

What information we collect

The kind of information we collect depends on how you work with us.

If you contact us or use our website, we may collect your name, email address and phone number so we can respond to you and arrange appointments.

If you receive counselling or behaviour support services from us, we also collect sensitive information, including health information. This may include information about your disability, health conditions, medications, behaviour and behaviour support needs, NDIS plan and goals, personal history, family and living circumstances, and other information needed to provide safe, high-quality services. We may also hold information about people in your support network, such as family members, guardians, supporters and other providers.

If you work with us or apply to, we collect information relevant to employment or contracting, such as qualifications, screening checks and payment details.

We only collect information that is reasonably necessary to provide our services and meet our legal obligations.

How we collect it

We collect information directly from you wherever possible — through our website, phone calls, email, referral and intake forms, and in-person sessions. With your consent, or where the law allows, we may also collect information from others involved in your support, such as your family, guardian or nominee, support coordinator, other health and support providers, the NDIA, or the NDIS Quality and Safeguards Commission.

Why we collect it

We collect and use personal information to:

respond to your enquiries and provide information about our services

schedule and confirm appointments

provide counselling and behaviour support services, including assessment, planning and review

meet our duty of care and keep people safe

make appropriate referrals

meet our obligations as a registered NDIS provider, including quality, safeguarding and reporting requirements

carry out business activities that support our services, such as billing and record keeping.

Your consent and your choices

We ask for your consent before collecting sensitive information, and we explain what we are collecting and why at or before the time we collect it. You have the right to decline consent or to withdraw it, and to choose not to provide personal details — though in some cases this may limit the services we can safely provide, and we will discuss this with you.

Where lawful and practicable, you may deal with us anonymously or using a pseudonym — for example, when making a general enquiry about our services.

Images or video footage of participants will not be used without consent. Participants may also choose whether to be involved in external NDIS audits.

Use and disclosure

We use and disclose personal information only for the purposes described above, or as otherwise permitted or required by law. Your information may be shared with:

our practitioners and workers directly involved in providing services to you

with your consent, others involved in your supports — such as family, guardians, nominees, support coordinators and implementing providers

third-party service providers who help us deliver our services, such as our secure email, document and practice-management platforms

the NDIS Quality and Safeguards Commission and other government authorities or regulatory bodies, where required — for example, reportable incident notifications and behaviour support reporting obligations

Queensland authorities where reporting or information sharing is required or authorised by law, including mandatory reporting of assault, abuse or neglect, information sharing permitted under Queensland's domestic and family violence information-sharing provisions, and circumstances where a court or tribunal order applies.

Where we report to government funding bodies, the information provided is non-identifiable and relates to matters such as services and support hours provided, age, disability, language and nationality.

We will never sell, trade or rent your personal information, and we do not disclose it to third parties for marketing purposes.

How we hold and protect your information

We take reasonable steps to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure. Our records are held in secure, access-controlled systems, including the Microsoft 365 platform with multi-factor authentication, and any physical records are kept in locked storage with access restricted to authorised personnel. Information is accessible only to workers who need it to provide your services.

Overseas disclosure

We do not disclose personal information to overseas recipients. Our records are held on secure platforms that store data in Australian data centres. Where a platform provider processes limited technical data outside Australia as part of operating its service, this occurs under contractual arrangements consistent with the Australian Privacy Principles, and does not involve disclosure of your information by us.

How long we keep your information

We retain personal information for as long as needed to provide services and meet our legal and regulatory obligations. Clinical and NDIS records are generally kept for a minimum of seven years from the last entry, or, for children and young people, until they turn 25. Information that is no longer required is securely destroyed or de-identified.

Access and correction

You have the right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date or incomplete. To make a request, contact us using the details below. We will respond within a reasonable period and, if we cannot grant a request, we will explain why in writing.

Data breaches

We take steps to reduce the likelihood of a data breach, including storing information securely and limiting access to relevant workers. If we know or suspect that your personal information has been accessed by unauthorised parties and this is likely to cause you serious harm, we will take steps to reduce the chance of harm, notify you, and, where required, notify the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

Complaints

If you have a concern about how we have handled your personal information, please contact us first using the details below. We treat privacy concerns seriously, will acknowledge your complaint promptly, investigate it, and respond to you with an outcome.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992. NDIS participants can also contact the NDIS Quality and Safeguards Commission at www.ndiscommission.gov.au or 1800 035 544.

Our website

Our website is hosted on Squarespace, which may collect standard analytics information such as browser type and pages visited. This information is not used to personally identify you.

Changes to this policy

We review this policy regularly and may update it to reflect changes in our practices or the law. The current version will always be published on this page with its effective date.

Contact us

Lachlan Savill

Verge Counselling Services

Email: lachlan@vergecs.org

Effective July 2026. This policy replaces the version dated August 2023 and is maintained consistently with our internal Privacy and Confidentiality Policy.