Data Protection & Confidentiality Policy

This policy sets out the principles the Foundation follows to protect personal information and keep casework confidential. It describes our practice and aims; it does not claim any external certification or compliance standard.

People see information only when they need it to do their role. Curiosity is not a reason to open a record.

Members, representatives, caseworkers and administrators each have different permissions. Roles are assigned deliberately and kept separate: an administrator is not automatically a caseworker.

Sensitive records are protected on our servers. Permissions are checked there each time, so hiding a menu item in the interface is never the only safeguard.

Members control their own profile, consents, communication preferences and who may act with them. See Consent & Privacy in your account.

A representative has only the access a member grants, which can be limited and withdrawn at any time.

Information is shared with another organization only for a specific case and purpose that the member has authorized.

Staff keep internal working notes separate from updates that members and authorized representatives can see. Internal notes are not shown in the member view.

Information in Ability Support Fund applications, including support applications, financial circumstances, disability-related expenses, requested assistance, program eligibility information, funding decisions, award information, assistance outcomes and funding-source references, is sensitive service information.

• It is used only for support-program administration, review, verification, decision-making, audit and reporting.
• It is not publicly disclosed, not automatically used for research and not automatically shared with partner organizations.
• It is visible only to Administrators and to staff holding a specific Support Fund role. Reviewers see only applications assigned to them; finance access is limited to awards and fulfilment records.
• Staff must not handle an application in which they are the applicant, the submitting representative or a currently represented member, or where a conflict of interest has been recorded. Conflict notes are internal and are not shown to members.
• Application-specific consents, such as sharing a limited Ability Support Summary, apply to that application only and are recorded with the application.
• Household income is not automatically treated as a proxy for a person's disability-related needs. Decisions are made by people, not by an automatic score.
• Funders and partners receive only non-identifying summary reporting unless the member separately agrees otherwise.
• Test and quality-assurance programs and applications are clearly marked, hidden from members and the public, and excluded from budgets and statistics.

This website does not process payments. Retention periods for Support Fund records have not yet been formally adopted; see Retention below.

Medical-support applications, medication information, prescriptions, professional recommendations, equipment assessments, vendor quotations, supporting-document records, equipment assignment and loan records, and medical and equipment outcomes are sensitive service information.

• These records are held in server-protected tables. They are never exposed through public pages, public addresses, program cards, sponsor reports or public analytics.
• Access is restricted to the member, a representative who has been granted the specific support-application permission, and the Administrators and Support Fund staff assigned or authorized to handle the application. Where a document record is marked for the member only, a representative does not see it.
• Quotations, vendor details, internal verification notes and warranty contract terms are staff-only and are not shown to members.
• Information is used for support administration. It is not automatically research information and is not automatically shared with sponsors; sponsors do not receive member medical records.
• Document upload is not currently available. The Foundation keeps only a register of documents requested or held outside the website until secure, server-protected file storage is introduced.
• The Foundation does not claim HIPAA compliance, encryption standards or any other certification for this information.

Information collected to deliver a service is not research data by default. Research use requires a separate authorization process and, where relevant, your separate agreement. Test and quality-assurance records are excluded from reporting.

Disability, health and personal-circumstance information is treated as sensitive. We ask for the minimum needed, limit who can see it, and do not disclose it publicly.

Staff, volunteers and administrators are expected to keep member information confidential, to use it only for Foundation purposes, and to avoid handling cases in which they have a personal involvement.

Important actions, such as changes to records and staff access, are logged so that the Foundation can review who did what and when.

Members can correct their own information, and may ask us to correct anything they cannot change themselves.

The Foundation has not yet adopted formal retention periods. Until it does, information is kept only as long as needed for its purpose and is reviewed regularly.

When information is no longer needed and is not required to be kept, we aim to delete or de-identify it securely.

If we become aware of unauthorized access or loss of information, we aim to contain it, assess who may be affected, correct the cause, and notify people and relevant authorities where appropriate or required.

See our Privacy Policy, contact us through the Contact page, or use the Complaints & Appeals Policy.