Privacy Policy

1. About this policy

Nuvela Pty Ltd (ABN 66 700 098 004) operates nuvela.com.au and provides NDIS management software to Australian disability service providers. We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the National Disability Insurance Scheme Act 2013 (Cth). This policy explains what information we collect, how we use it, and the choices you have.

2. What information we collect

The information we hold depends on how you use the Platform. We collect the following categories:

(a) Provider and administrator information

Name, email address, phone number, job title, organisation name, ABN, NDIS registration number, bank details, and billing information.

(b) Support worker information

Name, email address, phone number, date of birth, address, emergency contacts, tax file number, superannuation fund, bank details, certifications (such as NDIS Worker Screening Check and Working With Children Check), GPS clock-in/out data, timesheets, and progress notes.

(c) NDIS participant information (processed on behalf of providers)

Name, date of birth, NDIS number, address, disability diagnosis, health conditions, medications, care needs, NDIS plan details, funding budgets, service agreements, progress notes, incident reports, medication records, and contact details for family members, plan managers, and support coordinators.

(d) Technical information

IP addresses, browser type, device information, and usage logs.

(e) Location information

When you clock in or out of a shift, and while a shift or drive is active, we collect your device's location to verify attendance at the agreed location and to record the distance travelled for reimbursement and billing. Location may be collected in the background while a shift or drive is active, so tracking continues when the app is not in the foreground. We collect location only in connection with work activities. You can control location permissions through your device settings, but some features will not work without them.

(f) Photographic evidence

Photographs you capture as evidence in the course of your work — for example, to document the start or end of a sleepover shift or to record the kilometres you have travelled.

3. How we collect information

We collect information:

• Directly from users when they create an account or use the Platform.
• From providers who input participant data into the Platform.
• Automatically via cookies and similar technologies.
• From third-party integrations you choose to connect.

We do not collect NDIS participant data directly from participants. Providers supply this information and are responsible for having the appropriate authority and consent to do so.

4. How we use information

We use information to:

• Provide, operate, and maintain the Platform.
• Process payroll and generate NDIS invoices and claims.
• Structure and format progress notes using AI (provided by Anthropic). The AI assists with formatting and organisation only — it does not make clinical decisions, and all output is fully editable by you.
• Send transactional emails via Resend.
• Provide customer support.
• Improve and develop the Platform.
• Comply with our legal obligations.

Automated processing and AI disclosure. Nuvela uses automated tools to calculate payroll and billing and to help structure progress notes. These tools assist your team — they do not make automated decisions that have legal or similarly significant effects on any individual without human review. AI-assisted notes are always presented for review and editing before they are saved or relied upon, and you remain responsible for verifying their accuracy.

5. Health and sensitive information

NDIS participant records contain sensitive information, including health information. We only process this information to provide our services to the provider responsible for the participant. Sensitive information is stored securely and encrypted, and is never used for marketing or shared for commercial purposes.

6. How we store and protect information

We protect your information using TLS encryption in transit, encryption at rest, role-based access controls, and regular security reviews.

Overseas disclosure. Some of the service providers we use to run Nuvela store or process information outside Australia, including in Singapore (hosting), the United States (payments, email and AI processing) and Ireland and the United States (advertising measurement on our public marketing pages — see section 10). We take reasonable steps to ensure they protect your information to a standard consistent with the Australian Privacy Principles.

Data breach notification. If a data breach occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

7. Who we share information with

We do not sell your data. We share information only with the following third parties, and only as needed to provide the Platform or comply with the law:

• Supabase — infrastructure and data hosting.
• Anthropic — AI processing of progress notes (de-identified where possible).
• Resend — email delivery.
• Xero and QuickBooks — if you connect these integrations.
• Stripe — subscription payment processing (for provider billing only).
• Meta Platforms (Ireland and the United States) — advertising measurement on our public marketing pages only. No participant, worker or Platform data is shared with Meta. See section 10.
• Google LLC (United States) — Google Ads conversion measurement on our public marketing pages only. No participant, worker or Platform data is shared with Google. See section 10.
• The NDIA and NDIS Quality and Safeguards Commission — for PRODA claims and incident notifications, as required by law.
• Law enforcement and regulators — where required by Australian law.

8. Your rights

You have the right to access the personal information we hold about you, request corrections, make a complaint, and request deletion (subject to our retention obligations). To exercise these rights, contact us at hello@nuvela.com.au. We will respond within 30 days.

Anonymity and pseudonymity. You may deal with us anonymously or by using a pseudonym for general enquiries where it is lawful and practicable to do so. However, the Nuvela service itself cannot be used anonymously, because it depends on identifying workers and the people they support in order to record shifts, payroll, and care accurately.

9. Data retention

We retain provider, administrator, and support worker data for the duration of the subscription plus seven years. We retain participant records for seven years from the last service provided. On account closure, data is archived and then securely deleted in line with these retention periods.

Enquiries. If you contact us about a demo or send us a general enquiry, we keep the details you give us for 12 months and then delete them, unless you become a customer — in which case the retention periods above apply instead.

10. Cookies and advertising measurement

Inside the Platform. When you are signed in, we use session cookies only, to keep you signed in and operate the Platform. We do not use tracking or advertising cookies anywhere in the application.

On our public marketing pages. Our public pages — the homepage, About, Resources, this Privacy Policy and our Terms of Service — load two advertising measurement tags: the Meta Pixel, provided by Meta Platforms, and Google Ads conversion tracking, provided by Google. We use them to understand which ads bring people to the site and whether those visits lead to a demo enquiry.

Both tags send the provider your IP address, your browser and device user agent, and the address of the page you are viewing. The Meta Pixel stores a cookie in your browser so Meta can recognise a return visit. The Google tag reads the click identifier that Google adds to the web address when you arrive from one of its ads, and stores an advertising cookie, so that a later enquiry can be matched back to the ad you clicked.

If you submit the demo form, each tag records that an enquiry happened. Neither one ever receives your name, email address, phone number, organisation or anything else you typed into that form — only the fact that a submission occurred.

They are not loaded on the application. Neither tag runs on any signed-in page — not on the provider dashboard, not in the support worker app, and not on our sign-in, account, subscription or account-deletion pages. No participant, worker or shift information is ever sent to Meta or to Google.

How to opt out. You can stop both tags by blocking third-party tracking in your browser settings, by using your browser's tracking protection or private browsing mode, or by installing an ad or tracker blocker — the tags simply do not load, and the rest of the site works normally. To control how Meta uses advertising data it already holds about you, use the ad preferences and off-Facebook activity settings in your Facebook or Instagram account. For Google, use the My Ad Center and Ads Settings controls in your Google account. You can also ask us to delete the enquiry details we hold about you at any time (see section 8).

11. Children's privacy

The Platform is not directed at children and is intended for use by NDIS providers, workers, and administrators. Participant records relating to people under 18 are handled with the same strict protections that apply to all sensitive information.

12. Changes to this policy

We may update this policy from time to time. We will notify you of any significant changes by email. Continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.

13. Contact and complaints

For any privacy question, access request or complaint, contact our Privacy Officer:

Privacy Officer, Nuvela Pty Ltd — hello@nuvela.com.au

We will respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.