Last updated: 7 November 2026
1. About this policy
This policy explains how Nexavyx (we, us, our) collects, uses, discloses and protects personal information. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where it applies, Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA).
2. Information we collect
Contact details (name, email, phone, business name, role); enquiry and project details; billing details; communications with us; and website usage data such as pages visited, device and browser type and approximate location. We do not ask for health information through our website.
3. How we collect it
Directly from you when you fill in a form, book a call, email or message us, or sign a contract; from your organisation when it engages us; and automatically through analytics tools when you use our website.
4. Why we use it
To respond to enquiries, provide and support our services, manage billing and contracts, improve our website and services, meet legal obligations, and, if you opt in, send updates. Under the PDPA we rely on your consent, the performance of a contract, legal obligations or our legitimate interests, as applicable.
5. Data we process for clients
When we build or run systems for a client (for example a clinic or aged care provider), the client controls the personal information in those systems, which may include health information. We process it only on the client's documented instructions under a written agreement, and requests about that information should go to the client first.
6. Disclosure and overseas transfers
We disclose personal information to our staff and contractors, including our engineering team in Sri Lanka, and to service providers such as cloud hosting, email, booking and payment providers, only as needed to deliver our services. Where we disclose personal information outside Australia, we take reasonable steps under APP 8, including binding contracts, to make sure it is handled consistently with the APPs. Client data for Australian clients is hosted in Australia unless agreed otherwise. We never sell personal information.
7. Security
We use encryption in transit and at rest, individual user accounts with least-privilege access, multi-factor authentication, audit logs and regular backups. No system is perfectly secure, but we review our safeguards regularly.
8. AI and automated decisions
Our systems use AI to draft, summarise, forecast and flag. A person reviews outputs that significantly affect individuals; we do not make decisions with legal or similarly significant effects solely by automated means. Where required, including the APP 1 automated decision-making disclosures that apply from 10 December 2026, we explain the kinds of personal information used and the decisions involved.
9. Cookies and analytics
We may use privacy-friendly analytics to understand how our website is used. You can block cookies in your browser settings.
10. Access and correction
You can ask to access or correct the personal information we hold about you by emailing hello@nexavyx.com. We'll respond within 30 days. If we refuse, we'll tell you why and how to complain.
11. Your rights under the PDPA
If the PDPA applies to you, you may also have the right to withdraw consent, request rectification or completion, request erasure, and ask for review of a decision based solely on automated processing, subject to the exceptions in the Act.
12. Marketing
We send marketing only with your consent, and every message includes a way to unsubscribe, consistent with the Spam Act 2003 (Cth).
13. Retention
We keep personal information only as long as needed for the purposes above or as required by law, then securely delete or de-identify it.
14. Data breaches
If a data breach is likely to cause serious harm, we'll notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and the Data Protection Authority of Sri Lanka where the PDPA requires.
15. Complaints
Contact us first at hello@nexavyx.com. We aim to resolve complaints within 30 days. If you're not satisfied, you can complain to the OAIC (oaic.gov.au) in Australia or the Data Protection Authority of Sri Lanka (dpa.gov.lk).
16. Changes and contact
We may update this policy and will post the new version here with its date. Privacy contact: hello@nexavyx.com.