Privacy Policy | Embrace Education

Last updated: 25/07/2026

1. About this policy

Embrace Education Services respects the privacy, dignity and rights of the children, young people, adults and families who access our services.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal and sensitive information. It also explains how a person may request access to or correction of their information, withdraw or change certain consents, or make a privacy complaint.

Embrace Education Services is operated by:

Legal entity: The Trustee for The Gilchrist Family Trust
Trading name: Embrace Education Services
ABN: 91 593 696 581
Address: 6/512 Swift Street, Albury, NSW, 2640
Email: hello@embraceeducationservices.com.au
Phone: 02 6047 0305

We manage personal information in accordance with applicable privacy and information-handling laws, including:

the Privacy Act 1988 and Australian Privacy Principles;
the Health Records and Information Privacy Act 2002 (NSW) and Health Privacy Principles; and
applicable NDIS legislation, rules, standards and requirements.

2. Who this policy applies to

This policy applies to personal information we collect about:

children, young people and adults who access or may access our services;
parents, carers, guardians and authorised representatives;
family members and emergency contacts;
people involved in a participant’s support team;
people who make an enquiry, referral, complaint or provide feedback;
employees, contractors, students, volunteers and applicants; and
visitors to our website, clinic, programs or events.

In this policy, participant means the person receiving or being considered for services from Embrace Education Services.

3. What information we collect

The information we collect depends on the person’s relationship with Embrace and the services being requested or provided.

It may include:

Personal and contact information

names, preferred names and pronouns;
dates of birth;
addresses;
phone numbers and email addresses;
parent, carer, guardian and representative details;
emergency contacts;
authorised collection information; and
communication preferences.

Health, disability and developmental information

diagnoses, identified needs and assessments underway;
medical conditions, allergies and medications;
disability, developmental and functional information;
communication, sensory, emotional regulation and behavioural support needs;
health, safety, supervision and access requirements;
assessment results, reports and observations;
therapy, education and support plans;
progress notes, session records and support recommendations; and
photographs, video or audio recordings where relevant consent has been provided.

Cultural and identity information

Where relevant and voluntarily provided, we may collect information about:

Aboriginal and Torres Strait Islander identity;
cultural background;
language;
interpreter requirements;
religious or cultural considerations; and
gender identity.

This information is collected to help us provide culturally safe, respectful and responsive services.

Education and support information

school, preschool or childcare details;
year level or education setting;
learning needs and educational adjustments;
information provided by educators;
current practitioners, providers and support-team members; and
goals, strengths, interests and family priorities.

NDIS and payment information

NDIS participant numbers;
plan dates and funding arrangements;
plan manager and support coordinator details;
billing contacts;
invoice and payment information;
service bookings and attendance records; and
information required to prepare Service Agreements and Schedules of Supports.

Payment method information may be collected through our Splose practice management system and processed securely through Stripe. Embrace Education Services does not ordinarily have access to complete card or bank account details.

Website and communication information

We may also collect:

information submitted through website forms;
email, telephone and written correspondence;
appointment enquiries;
feedback and complaints;
website usage information, such as IP address, browser type and pages visited; and
information collected through cookies or similar website technologies.

4. How we collect information

Where practical, we collect information directly from the participant or their parent, carer, guardian or authorised representative.

Information may be collected through:

enquiry and referral forms;
intake and consent forms;
assessments, interviews and observations;
individual and group appointments;
telephone calls, emails and meetings;
Service Agreements and funding documents;
questionnaires and assessment tools;
reports and documents provided to us;
website contact forms;
photographs or recordings where consent has been provided; and
feedback, complaint or incident processes.

With consent, or where otherwise authorised or required by law, we may also collect information from:

schools, preschools and childcare services;
health and allied health practitioners;
support coordinators and plan managers;
other NDIS providers;
family members and authorised representatives;
government agencies; and
referral sources.

We aim to collect only information that is reasonably necessary for our services and business activities. Sensitive information, including health and cultural identity information, is generally collected with consent unless another lawful basis applies.

5. Why we collect and use information

We may collect, hold and use information to:

respond to enquiries and referrals;
create and maintain participant records;
determine whether our services are suitable;
prepare for and conduct intake appointments;
undertake assessments and observations;
plan, provide and review individual and group supports;
understand a participant’s strengths, goals, preferences and support needs;
create individual resources and recommendations;
communicate with participants, families and authorised support-team members;
coordinate services with schools, practitioners and other providers;
manage health, safety and emergency needs;
schedule appointments and maintain attendance records;
prepare reports, letters, session notes and progress updates;
administer NDIS funding, invoicing and payments;
respond to feedback, complaints and incidents;
meet legal, insurance, professional and regulatory obligations;
train and supervise workers and students, where appropriate consent has been obtained;
improve the quality and safety of our services; and
manage our website, systems and general business operations.

6. Children, consent and decision-making

Many Embrace participants are children.

We generally obtain consent from a child’s parent, guardian or another person who has authority to make decisions for the child.

We may ask for information about:

who has parental responsibility or guardianship;
whether decision-making is shared;
whether another person must be consulted; and
who may receive information or make decisions about services.

We also seek to recognise the child’s own preferences, communication and willingness. A child will not be forced to participate in optional photographs, recordings or promotional activities because an adult has provided consent.

As a young person’s capacity and independence develop, we may involve them more directly in privacy and consent decisions.

7. Photographs, video and audio recordings

Embrace uses separate consent choices for different kinds of photographs and recordings.

These may include:

Therapy or assessment documentation

Photographs, videos or audio recordings may be taken to:

document progress;
support assessment or clinical review;
record observations;
create individual resources; or
maintain an accurate service record.

These materials are treated as part of the participant’s confidential record and are not used publicly under therapy or assessment consent.

Group photographs shared with families

During small-group programs, photographs or short recordings may be privately shared with parents or carers of children attending that group.

A participant may appear as the main subject or in the background. Separate consent is obtained for this purpose.

Families receiving group photographs are asked not to publish, forward or share images containing other children. Embrace cannot fully control further use after an image has been received by another family.

Promotional or public media

Separate optional consent is obtained before identifiable photographs, videos or recordings are used for:

social media;
the Embrace website;
printed materials;
presentations; or
promotional purposes.

Declining promotional media consent does not affect access to services.

A person may withdraw promotional consent for future use. We will take reasonable steps to remove digital material under our control where requested, but we may not be able to retrieve printed material or content already copied or shared by others.

8. When we may disclose information

We may disclose information to:

Embrace employees, contractors and practitioners who require it to perform their roles;
parents, guardians and authorised representatives;
people or services authorised by the participant or family;
schools, preschools and childcare services;
health and allied health practitioners;
support coordinators and plan managers;
the National Disability Insurance Agency;
the NDIS Quality and Safeguards Commission;
insurers, auditors, legal advisers and professional consultants;
technology, administration, accounting, payment and record-management providers;
emergency services;
child-protection or law-enforcement authorities; and
courts, tribunals, regulators or government agencies where required or authorised by law.

We aim to share only the information reasonably necessary for the relevant purpose.

We do not sell participant or family information to third parties.

9. Disclosure without consent

There are circumstances in which information may be used or disclosed without consent.

These may include where:

disclosure is required or authorised by law;
there is a serious threat to a person’s life, health or safety;
emergency assistance is required;
child-protection reporting obligations apply;
information is required for an incident-management, complaint, regulatory or legally required reporting process;
a court order, subpoena or other legal requirement applies; or
disclosure is otherwise permitted under applicable privacy laws.

Embrace workers are mandatory reporters under NSW child-protection legislation. Where the legal reporting threshold is met, information may need to be provided to the relevant authority without first obtaining consent.

10. Technology platforms and service providers

Embrace Education Services uses third-party technology and service providers to manage participant records, appointments, forms, communications, invoicing, payments, website functions and general business administration.

We provide these service providers with only the information reasonably necessary for them to perform the relevant function. Information handled directly by a third-party provider is also subject to that provider’s privacy policy and terms.

Splose practice management system

Embrace Education Services uses Splose, operated by Splose Pty Ltd, as its practice management system.

Information held or managed through Splose may include:

participant and family contact details;
intake, consent and service agreement forms;
health, disability, developmental and support information;
appointments and attendance records;
progress notes and service records;
assessment information and reports;
uploaded documents and files;
NDIS, plan management and funding information;
invoices, payments and transaction records;
saved payment method information in masked form; and
communications relating to services.

Splose states that data belonging to Australian users is stored in Australia. Splose also states that information is encrypted during transmission and while stored, and that encrypted backups are maintained through Amazon Web Services data centres.

Splose may use its own employees, contractors and third-party service providers located in Australia and overseas. Splose states that it applies safeguards when transferring personal information outside Australia and requires third-party providers to protect information and use it only for specified purposes.

Access to Embrace Education Services’ Splose workspace is limited to authorised workers. Access may be restricted according to each person’s role and responsibilities.

Stripe payment processing

Embrace Education Services uses Stripe, including through its integration with Splose, to:

collect and securely save payment methods;
process credit and debit card payments;
process direct debit arrangements where available;
process online invoice payments;
manage recurring or agreed payment arrangements;
issue refunds; and
assist with payment security, fraud prevention and disputes.

Payment method information may be entered through a Splose form, invoice payment page, online booking process or another Stripe-hosted payment process.

Depending on the payment method used, Stripe may collect and process information including:

the payer’s name and contact details;
billing information;
card or bank account details;
payment amounts, dates and transaction details;
payment authorisations;
device, browser or IP address information; and
information required for payment security, identity verification, fraud prevention or dispute management.

Payment details entered through Splose are securely processed and stored through Stripe. Saved payment methods appear within the participant’s Splose record in masked form and may be used by authorised Embrace Education Services workers to process agreed payments. Embrace Education Services does not ordinarily have access to complete card or bank account details.

Authorised Embrace Education Services workers may use a saved payment method to process an agreed invoice payment, recurring payment or payment arrangement. Embrace Education Services does not ordinarily have access to the complete card number or bank account number.

Stripe may share relevant transaction information with banks, card networks, payment method providers and other financial or security providers where necessary to authenticate and process payments, prevent fraud, manage disputes or meet legal and regulatory obligations. Stripe operates internationally and may process personal information in Australia and other countries.

Information processed directly by Stripe is also handled in accordance with the Stripe Privacy Policy and Stripe’s applicable payment terms.

Wix website services

The Embrace Education Services website is hosted through Wix.

When a person visits or interacts with our website, Wix and any applications connected to the website may process information such as:

information submitted through a website contact or enquiry form;
name, email address, phone number and other contact details;
IP address;
browser and device information;
website activity and pages viewed; and
cookie and similar technology information.

Our website may use cookies and similar technologies for essential website operation, security, remembering visitor preferences and understanding website performance.

Additional cookies may be placed where the website uses third-party applications, integrations, analytics tools or social media features.

Where required, visitors may be provided with options to accept or decline non-essential cookies through the website’s cookie settings or consent banner.

Information processed directly by Wix is also handled in accordance with the Wix Privacy Policy and applicable Wix terms.

Other service providers

Embrace Education Services may also use service providers for functions including:

email, telephone and electronic communication;
accounting and bookkeeping;
assessment administration and scoring;
electronic signatures and document management;
cloud storage and backups;
website analytics;
printing and postage;
professional advice;
information technology support; and
general business administration.

These providers may change over time as our systems and business needs change.

We take reasonable steps when selecting and using service providers to consider their privacy, confidentiality and information-security practices.

Overseas processing and disclosure

Some third-party providers may store, access or process personal information outside Australia.

The countries involved may vary depending on the provider, its infrastructure, subcontractors and the service being used.

Where personal information may be handled overseas, Embrace Education Services takes reasonable steps to:

understand how the provider manages and protects personal information;
limit the information provided to what is reasonably necessary;
use appropriate account security and access controls;
select reputable providers with privacy and security safeguards; and
comply with applicable Australian privacy requirements.

A person may contact Embrace Education Services for further information about the technology providers used to handle their personal information.

11. How we store and protect information

Participant records are primarily stored electronically within Embrace Education Services’ Splose practice management system. Other information may be held within password-protected email, accounting, assessment, website and business administration systems.

Information may be stored in:

secure electronic participant-management systems;
password-protected cloud and business systems;
email and communication systems;
accounting and payment systems;
electronic assessment platforms;
secure devices; and
locked physical storage, where paper records are retained.

We use reasonable safeguards appropriate to the nature of the information, which may include:

individual user accounts;
passwords and multi-factor authentication;
role-based access;
restricted staff access;
secure backups;
confidentiality requirements;
staff training;
secure transfer and disposal processes; and
procedures for responding to suspected data breaches.

No electronic or physical system can be guaranteed to be completely secure. Where an eligible data breach is likely to cause serious harm, Embrace will notify affected individuals and the Office of the Australian Information Commissioner as required.

12. How long we retain information

We retain information for as long as it is required for:

providing and reviewing services;
participant safety and continuity of support;
legal, insurance and professional obligations;
NDIS and financial record-keeping requirements; and
responding to complaints, incidents or disputes.

Where NSW health-record retention requirements apply:

records collected for an adult are generally retained for at least seven years after the last health service was provided; and
records collected while the participant was under 18 are generally retained until the participant reaches 25 years of age.

Information may be retained for longer where another legal, professional, contractual, insurance or risk-management requirement applies.

When information is no longer required, we take reasonable steps to securely destroy it or permanently de-identify it, subject to applicable record-retention requirements.

13. Accessing personal information

A participant, parent, guardian or authorised representative may request access to personal information held by Embrace.

Requests may be made by contacting:

Privacy Officer
Embrace Education Services
Name: Michelle Gilchrist
Email: hello@embraceeducationservices.com.au
Phone: 02 6047 0305
Address: 6/512 Swift Street, Albury, NSW, 2640

We may need to confirm the identity and authority of the person making the request.

Access may be refused or limited where permitted by law, including where providing access would unreasonably affect another person’s privacy or create a serious risk to health or safety. Where access cannot be provided, we will generally explain the reason and available complaint options.

14. Correcting information

We aim to keep personal information accurate, current and complete.

A person may ask us to correct or update information by contacting the Privacy Officer. We may request supporting information where needed.

We may also ask families to notify us when relevant contact, funding, health, safety, education or consent information changes.

15. Changing or withdrawing consent

Consent may be changed or withdrawn by contacting Embrace Education Services.

A change to consent will generally apply to future collection, use or disclosure. It may not require Embrace to:

delete information that must be retained by law;
withdraw information already lawfully provided to another person;
retrieve printed or publicly copied material; or
stop using information where its use is otherwise required or authorised by law.

Withdrawing consent may affect our ability to provide a particular service where the information is reasonably necessary to provide that service safely and appropriately. We will explain any likely effect before making changes where practical.

16. Privacy complaints

Privacy concerns or complaints should first be directed to:

Privacy Officer

Embrace Education Services

Name: Michelle Gilchrist

Email: hello@embraceeducationservices.com.au

Phone: 02 6047 0305

Address: 6/512 Swift Street, Albury, NSW, 2640

Please provide enough information for us to understand and investigate the concern.

We will:

acknowledge the complaint;
review the circumstances and relevant records;
seek further information where needed; and
provide a response within a reasonable period, generally within 30 days.

Where a person is not satisfied with our response, they may contact:

the Office of the Australian Information Commissioner;
the Information and Privacy Commission NSW;
the NDIS Quality and Safeguards Commission, where the matter relates to NDIS supports; or
another relevant regulator or complaints body.

17. Website links

Our website may contain links to third-party websites or services.

Embrace Education Services is not responsible for the privacy practices, security or content of external websites. People should review the privacy policies of those services before providing personal information.

18. Changes to this policy

We may update this Privacy Policy when:

our services or systems change;
privacy or NDIS requirements change;
new technology or providers are introduced; or
improvements are identified.

The current version will be published on our website with the date it was last updated.