Privacy Policy

1. About this policy

Nuvela Pty Ltd (ABN pending) operates nuvela.com.au and provides NDIS management software to Australian disability service providers. We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the National Disability Insurance Scheme Act 2013 (Cth). This policy explains what information we collect, how we use it, and the choices you have.

2. What information we collect

The information we hold depends on how you use the Platform. We collect the following categories:

(a) Provider and administrator information

Name, email address, phone number, job title, organisation name, ABN, NDIS registration number, bank details, and billing information.

(b) Support worker information

Name, email address, phone number, date of birth, address, emergency contacts, tax file number, superannuation fund, bank details, certifications (such as NDIS Worker Screening Check and Working With Children Check), GPS clock-in/out data, timesheets, and progress notes.

(c) NDIS participant information (processed on behalf of providers)

Name, date of birth, NDIS number, address, disability diagnosis, health conditions, medications, care needs, NDIS plan details, funding budgets, service agreements, progress notes, incident reports, medication records, and contact details for family members, plan managers, and support coordinators.

(d) Technical information

IP addresses, browser type, device information, and usage logs.

(e) Location information

When you clock in or out of a shift, and while a shift or drive is active, we collect your device's location to verify attendance at the agreed location and to record the distance travelled for reimbursement and billing. Location may be collected in the background while a shift or drive is active, so tracking continues when the app is not in the foreground. We collect location only in connection with work activities. You can control location permissions through your device settings, but some features will not work without them.

(f) Photographic evidence

Photographs you capture as evidence in the course of your work — for example, to document the start or end of a sleepover shift or to record the kilometres you have travelled.

3. How we collect information

We collect information:

• Directly from users when they create an account or use the Platform.
• From providers who input participant data into the Platform.
• Automatically via cookies and similar technologies.
• From third-party integrations you choose to connect.

We do not collect NDIS participant data directly from participants. Providers supply this information and are responsible for having the appropriate authority and consent to do so.

4. How we use information

We use information to:

• Provide, operate, and maintain the Platform.
• Process payroll and generate NDIS invoices and claims.
• Structure and format progress notes using AI (provided by Anthropic). The AI assists with formatting and organisation only — it does not make clinical decisions, and all output is fully editable by you.
• Send transactional emails via Resend.
• Provide customer support.
• Improve and develop the Platform.
• Comply with our legal obligations.

Automated processing and AI disclosure. Nuvela uses automated tools to calculate payroll and billing and to help structure progress notes. These tools assist your team — they do not make automated decisions that have legal or similarly significant effects on any individual without human review. AI-assisted notes are always presented for review and editing before they are saved or relied upon, and you remain responsible for verifying their accuracy.

5. Health and sensitive information

NDIS participant records contain sensitive information, including health information. We only process this information to provide our services to the provider responsible for the participant. Sensitive information is stored securely and encrypted, and is never used for marketing or shared for commercial purposes.

6. How we store and protect information

Information is hosted on Supabase infrastructure located in Singapore (AWS ap-southeast-1). We protect it using TLS encryption in transit, encryption at rest, role-based access controls, and regular security reviews.

Data residency. Data is currently stored in Singapore. If your organisation requires Australian data residency, please contact us at hello@nuvela.com.au.

Data breach notification. If a data breach occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

7. Who we share information with

We do not sell your data. We share information only with the following third parties, and only as needed to provide the Platform or comply with the law:

• Supabase — infrastructure and data hosting.
• Anthropic — AI processing of progress notes (de-identified where possible).
• Resend — email delivery.
• Xero and QuickBooks — if you connect these integrations.
• Stripe — subscription payment processing (for provider billing only).
• The NDIA and NDIS Quality and Safeguards Commission — for PRODA claims and incident notifications, as required by law.
• Law enforcement and regulators — where required by Australian law.

8. Your rights

You have the right to access the personal information we hold about you, request corrections, make a complaint, and request deletion (subject to our retention obligations). To exercise these rights, contact us at hello@nuvela.com.au. We will respond within 30 days.

Anonymity and pseudonymity. You may deal with us anonymously or by using a pseudonym for general enquiries where it is lawful and practicable to do so. However, the Nuvela service itself cannot be used anonymously, because it depends on identifying workers and the people they support in order to record shifts, payroll, and care accurately.

9. Data retention

We retain provider, administrator, and support worker data for the duration of the subscription plus seven years. We retain participant records for seven years from the last service provided. On account closure, data is archived and then securely deleted in line with these retention periods.

10. Cookies

We use session cookies only, to keep you signed in and operate the Platform. We do not use tracking or advertising cookies.

11. Children's privacy

The Platform is not directed at children and is intended for use by NDIS providers, workers, and administrators. Participant records relating to people under 18 are handled with the same strict protections that apply to all sensitive information.

12. Changes to this policy

We may update this policy from time to time. We will notify you of any significant changes by email. Continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.

13. Contact and complaints

For any privacy question or complaint, contact us at hello@nuvela.com.au. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.