Essential Plan Support Services (EPSS) ABN 94 638 628 574 · NDIS Provider No. 4050064635
Last updated: 28 August 2026
Essential Plan Support Services provides plan management services to National Disability Insurance Scheme (NDIS) participants. To do that, we collect and hold personal information about participants and the people involved in their plans.
This policy explains what we collect, why we collect it, who we share it with, how we protect it, and what you can do if you want to see it, correct it, or raise a concern. We handle personal information in accordance with the Australian Privacy Principles.
If anything here is unclear, or you would like this information explained in another way, please contact us. We are happy to talk it through.
What information we collect
The information we collect depends on your relationship with us.
If you are a participant, we may collect:
- Your name, date of birth, contact details and NDIS number
- A copy of your NDIS plan, including your funding and budget details
- The details of your plan nominee, child representative, guardian or other authorised representative, where you have one
- The details of your Support Coordinator, Recovery Coach and service providers
- Invoices from your providers, and records of claims made and payments issued
- Your bank details, where you are being reimbursed directly
- Your communication preferences, and how you would like us to contact you
- Records of our correspondence with you
Some of this is sensitive information, because it relates to disability and support needs. We collect it only where we need it to manage your plan, and we handle it with additional care.
If you are a provider, Support Coordinator, or another person involved in a participant’s plan, we generally collect only your name, role, organisation and contact details, along with any correspondence and invoices you send us.
How we collect it
Wherever possible we collect information directly from you, or from your authorised representative.
We also receive information from the NDIA, from Local Area Coordinators, from Support Coordinators, and from providers who invoice us — for example, when a referral is made or a new plan is issued.
EPSS operates as a digital service. We do not meet participants in person, so information reaches us by email, telephone, our website and our secure systems.
Why we collect it and how we use it
We collect and use personal information to deliver plan management services. That means:
- Setting up and maintaining your plan management with EPSS
- Reviewing invoices against your NDIS plan and NDIS requirements
- Submitting claims to the NDIS and making payments to your providers
- Giving you and the people you have authorised access to current funding information, through the dashboard and monthly statements
- Responding to your questions, feedback and complaints
- Meeting our obligations under the NDIS Act, NDIS Practice Standards and other laws
We use your information only for the purpose it was collected, unless you agree otherwise or the law requires or permits us to use it another way.
Who we share it with
We share your information only where you have consented, or where we are required or authorised by law.
With your consent, we may share information with:
- The National Disability Insurance Agency (NDIA)
- Your Support Coordinator or Recovery Coach
- Your service providers, where it is reasonably required to process their invoices
- Your plan nominee, child representative, guardian or other authorised representative
We usually record your consent on our Consent to Share form. Where completing that form is not reasonably practicable, we may rely on other written evidence of your authority — for example, NDIA documentation, a Support Coordinator service agreement that includes information-sharing authority, referral documentation from the NDIA or a Local Area Coordinator, or written confirmation from you or your authorised representative. Any decision to rely on alternate documentation is approved by the Director and recorded on your file.
You may withdraw your consent at any time. If withdrawing consent affects our ability to manage your plan, we will explain what that means before anything changes.
We may also share information with the third parties who provide the systems we use to run our service, such as our secure software and data storage providers. They are bound by agreements requiring them to protect your information and to use it only for the purpose we engaged them for.
We do not sell personal information, and we do not use it for marketing.
How we store and protect it
Your information is held in secure, cloud-based systems. Our protections include:
- Encrypted storage and encrypted backups
- Role-based access, so staff can reach only the information their role requires
- Two-factor authentication on our systems
- Access logs, reviewed routinely for anything unusual
Where your information is held
Participant records held in our client management system are stored in Australia.
We also use established third-party business systems to run our service, including email and document storage, accounting software, and an external IT support provider. Some of these providers may store information, or allow their staff to access it, outside Australia. Where that occurs, we take reasonable steps to ensure your information is protected to the standard required by the Australian Privacy Principles.
Withdrawing or changing your consent
You can withdraw or change your consent at any time. Just contact the Director using the details below. We will record the change and the date, and it takes effect from then.
Withdrawing consent does not undo information we have already shared properly, or sharing we are required or allowed to do by law.
If withdrawing consent would affect our ability to manage your plan — for example if it would stop us talking to your Support Coordinator or your providers — we will explain what that means before anything changes.
How long we keep it
We keep records relating to plan management services for a minimum of seven years after your Service Agreement ends or our services conclude.
Where the participant is a child, we keep records until they turn 25.
Once those periods have passed and we no longer need the information, we destroy it securely.
Accessing and correcting your information
You may ask to see the personal information we hold about you, and you may ask us to correct it if it is wrong, out of date or incomplete.
To make a request, contact the Director using the details below. We may need to confirm your identity, or your authority to act on someone else’s behalf, before we release anything.
- We will acknowledge your request within 14 days
- We will usually provide access within 30 days
- There is no charge to access or correct your information
If we cannot give you access, we will tell you why in writing and explain what you can do next. If we do not agree to a correction you have asked for, you may ask us to note your disagreement on the record, and we will do so.
If something goes wrong
If personal information we hold is lost, or accessed or disclosed without authorisation, we will act immediately to contain it and to work out who is affected.
Where a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme.
Complaints and concerns
If you are unhappy with how we have handled your personal information, please tell us. We would rather hear about it and put it right.
You can contact us by phone, email or post using the details below. We will confirm we have received your complaint, look into it, and explain the outcome and the reasons for any decision. If a matter is complex and takes longer, we will keep you informed of progress.
You do not have to complain to us first. You can go straight to the Office of the Australian Information Commissioner at any time:
Office of the Australian Information Commissioner
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Website: oaic.gov.au
Post: GPO Box 5218, Sydney NSW 2001
If your concern is about your rights under the NDIS more broadly, you can also contact the NDIS Quality and Safeguards Commission on 1800 035 544 or at ndiscommission.gov.au.
If your complaint is about our service rather than your personal information, our Feedback & Complaints page explains how that works.
Changes to this policy
We review this policy regularly and update it when our practices or obligations change. The date at the top shows when it was last updated.
Contact us
The Director
Essential Plan Support Services
Phone: 0474 329 544
Email: admin@essentialplan.com.au
Post: PO Box 85, Cannington WA 6987
If you are d/Deaf, or find it hard to hear or to speak on the phone, you can reach us through the National Relay Service. It is free, confidential and available 24 hours a day. Choose the call channel that suits you at accesshub.gov.au, or call the NRS Helpdesk on 1800 555 660 if you would like help choosing.