privacy policy & Terms and Conditions
- Home
- privacy policy & Terms and Conditions
3/09/2026
01 Purpose
1.1 Rebuild Family Services (“we”, “us”, “the organisation”) provides supervised contact, supported changeover and related family support services. We are entrusted with highly sensitive information about children, parents, carers and families at what is often a difficult and vulnerable time, and we take our privacy obligations seriously.
1.2 This policy explains what personal and health information we collect, why we collect it, how we use, store, share and protect it, and how an individual can access or correct their information or raise a privacy concern.
1.3 This policy should be read together with our Informed Consent and Service Agreement, Cultural Safety Policy, Safe Service Environment Policy and other applicable procedures.
02 Scope
2.1 This policy applies to all personal and health information handled by Rebuild Family Services, in any format — electronic, paper, audio or visual.
2.2 It applies to Board members, employees, contractors, volunteers, students and anyone else acting on behalf of the organisation.
2.3 It applies to information we hold about clients, children and young people, parents and carers, referrers, personnel, job applicants and other stakeholders.
03 Our legal obligations
3.1 We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Health Records Act 2001 (Vic), the Child Wellbeing and Safety Act 2005 (Vic) and the Victorian Child Safe Standards, the Family Law Act 1975 (Cth) and applicable court rules, and other laws governing mandatory reporting, family violence information-sharing and record-keeping.
3.2 Where an exemption from the Privacy Act may apply to a particular activity, we will still apply the Australian Privacy Principles as our minimum standard so far as reasonably practicable.
3.3 Nothing in this policy limits our obligation to disclose information where required or authorised by law, a court or tribunal order, or child protection legislation.
04 Information we collect
Depending on the service, we may collect:
- identity and contact details, including name, date of birth, address, phone and email;
- family relationship information, parental responsibility, court orders, parenting plans and intervention orders;
- risk and safety information, including any history of family violence, abuse, neglect or child protection involvement;
- health, disability, developmental and behavioural information relevant to safe service delivery;
- cultural, linguistic and Aboriginal or Torres Strait Islander identity information, where relevant and voluntarily provided;
- session records, observations, incident reports, complaints and correspondence;
- photographs, audio or video recordings, only where specifically authorised;
- billing and payment details;
- recruitment and workforce information, including Working with Children Check and police check status; and
- website and technical data such as IP address and browser information.
05 How we collect information
5.1 We usually collect information directly from the individual through intake forms, interviews, service agreements and sessions.
5.2 We may also collect information from a parent, carer, court, lawyer, Victoria Police, child protection authority, school, health practitioner or other referrer where lawful and reasonably necessary for our functions.
5.3 Where reasonable and safe to do so, we will let the individual know when information has been collected from someone else and why.
06 How we use and disclose information
6.1 We use and disclose information to:
- assess referrals and plan, deliver and review our services safely;
- communicate with children, parents, carers, referrers and authorised professionals;
- protect children and others, make mandatory reports and respond to safety concerns;
- prepare factual reports requested under a service agreement or by a court;
- respond to subpoenas, court orders and legal or regulatory requirements;
- manage payments, insurance, and our personnel and operations; and
- improve the quality and safety of our services.
6.2 We only use and disclose information for the purpose it was collected, a purpose the individual would reasonably expect, with consent, or as otherwise required or authorised by law. We do not sell personal information.
6.3 We may disclose information to Victoria Police, child protection authorities, courts and tribunals, health and support services, our insurers and professional advisers, and secure technology or payment providers who help us deliver our services — always limited to what is reasonably necessary.
07 Children and young people
7.1 Children have privacy interests of their own. We handle information about a child in a way that supports their safety, best interests, dignity and evolving capacity to make decisions.
7.2 A parent’s request for a child’s information is not automatically granted. We will consider parental responsibility, any court orders, the child’s views and any risk of harm before responding.
7.3 We will explain our privacy practices to children in an age-appropriate way where practicable.
08 Child safety, family violence and emergencies
8.1 Privacy does not prevent us from acting where disclosure is required or authorised to protect a child or another person, respond to a serious threat, obtain emergency assistance, or comply with a mandatory reporting or information-sharing obligation.
8.2 Any such disclosure is limited to what is reasonably necessary and, where practicable, made through secure channels and documented.
09 Storage and security
9.1 We hold information in secure electronic case-management and record-keeping systems, and in locked storage for paper files.
9.2 We use reasonable safeguards including role-based access, password and multi-factor protection, staff confidentiality obligations and training, and secure disposal of records no longer required.
9.3 No method of storage or transmission is completely secure, and we continue to review and improve our safeguards.
10 Overseas disclosure
10.1 Some of our technology providers may store information outside Australia.
10.2 Where information is disclosed overseas, we take reasonable steps required by law to protect it and to assess the security and reliability of the recipient.
11 Retention and disposal
11.1 We retain information only for as long as required for service delivery, legal, safeguarding and insurance purposes, in accordance with our records-retention schedule.
11.2 Information will not be destroyed while subject to a current legal hold, court order or investigation. When no longer required, information is securely destroyed or de-identified.
12 Access and correction
12.1 An individual may ask to access or correct personal or health information we hold about them by contacting the Privacy Officer in writing and verifying their identity.
12.2 We will respond within a reasonable period. Access may be limited or refused where permitted by law — for example, where it would pose a safety risk, unreasonably affect another person’s privacy, or prejudice a legal proceeding. We will give written reasons where access or correction is refused.
13 Data breaches
13.1 Any suspected loss, unauthorised access or disclosure of information must be reported immediately to the Privacy Officer.
13.2 We will take prompt steps to contain and assess the incident, and will notify affected individuals and the relevant regulator where required under the Notifiable Data Breaches scheme.
14 Privacy complaints
14.1 A person may raise a privacy concern or complaint with the Privacy Officer at any time. We will acknowledge, investigate and respond within a reasonable period.
14.2 If a person is not satisfied with our response, they may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au) or, for health information, the Victorian Health Complaints Commissioner (hcc.vic.gov.au).
15 Privacy contact details
Privacy Officer:
16 Review of this policy
16.1 This policy is reviewed at least annually and following any legislative change, serious privacy incident, or material change to our services or systems.
16.2 The current version of this policy is available on our website and on request in an accessible format.