Privacy Notice

1. What this Privacy Notice covers

We respect your personal privacy and are committed to protecting your personal information. We are committed to ensuring that all your information, including personal and sensitive information, is collected, and stored within Australia in strict adherence to Australian privacy laws.

This notice describes how we collect, use, store, and protect information when you access and use the NexusMD.ai Service.

It covers:

• This privacy policy applies to all doctors, experts, and medical institutions using our products, as well as patients involved in medical activities generating information.
• We respect your personal privacy and are committed to protecting your information.

Important: You are responsible for ensuring you have obtained valid patient consent before entering or recording any patient information into the NexusMD.ai Service. NexusMD.ai acts as a service provider processing patient information solely on your instructions.

2. How we collect personal information

2.1 User (practitioner) information

We collect your personal and professional information when:

• You provide it directly to us for example when registering for an account, updating your profile, or contacting support).
• You visit our website, use our NexusMD.ai Service or ask for support, we will ask you for personal information to enhance your experience.
• You visit our website or use the NexusMD.ai Service. For example, we collect data such as usage logs and device information about your interactions within our website or service.

2.2 Patient information

You may record or enter patient data during a consultation. This may include sensitive health information. You must:

• Obtain the patient’s consent for their data to be processed using the NexusMD.ai Service
• Inform them that NexusMD.ai will process the information to generate clinical notes, and that data is stored in Australia and typically deleted within 14 days (unless you request otherwise).

We do not collect patient data directly from patients – only from you, the practitioner.

3. Types of data collected and how it is sourced

We collect various categories of personal information depending on how you interact with the NexusMD.ai Service. Below is a summary of the types of data we collect and how we source that information.

3.1 User (practitioner) information

• User registration details. Name, email, phone number, work address, employer details.
• Account data. Login credentials, subscription plan, profile information.
• Payment data. Billing address, payment method.
• Usage and technical data. Login history, feature usage, support interactions, device/browser details, IP address.

3.2 Patient information (entered by you)

• Sensitive health information. Health history, consultation notes, diagnoses, treatment details, and any other sensitive information you choose to record.
• Other identifiers. Patient names or other personal identifiers you enter.

We process patient information only under your direction and solely for the purposes of generating consultation notes and providing the NexusMD.ai Service.

4. Use and processing of personal information

We collect and use user (practitioner) information to:

• Provide and manage your NexusMD.ai account
• Process payments
• Communicate service updates, invoices and support information
• Improve and maintain our services
• Ensure compliance and security

We use patient information only to:

• Generate clinical documentation on your behalf
• Comply with legal and regulatory obligations (e.g., court orders)

We do not:

• use user (practitioner) or patient information for unrelated purposes;
• sell or disclose user (practitioner) or patient information to third parties;
• combine or link personal information with other third-party data; or
• make automated decisions affecting you or your patients.

5. Data retention

Patient information is deleted within 14 days of processing unless you instruct us to store it longer. Once deleted, it is not recoverable.

User (practitioner) information is retained while you have an active account and as long as necessary for business, legal or regulatory purposes.

6. Sharing of Information

We share:

• Patient information: only with you (and your employer, if applicable) and essential service providers (e.g., Microsoft Azure Australia for hosting).
• User (practitioner) information: With third party service providers necessary to operate the NexusMD.ai Service (e.g., billing, hosting, security) and with regulators or legal bodies if required by law. We only share what is strictly necessary. Microsoft Azure (Australia), AWS (Australian) and Google Cloud Platform (Australia) are used for cloud hosting.

7. Data Security

Protecting personal information is a priority for us. We maintain appropriate technical and organisational safeguards to protect data against loss, unauthorised access and misuse.

Our key security measures:

• Data encryption: All data is encrypted during transmission using industry-standard encryption protocols to prevent unauthorised access.
• Access Control: Access to sensitive information is strictly limited to authorised personnel who require it to perform their duties. Access is role-based and subject to strict internal controls.
• Regulatory Compliance: We comply with applicable data protection laws, including:
  • Privacy Act 1988 (Cth) – Australia’s primary legislating governing the collection, use, and disclosure of personal information.
  • Health Records Act 2001 (Victoria) – which governs the handling of health information in Victoria.
• ISO 27001 Certification: We are certified under ISO/IEC 27001 for information security management systems. This international standard demonstrates our commitment to continuous improvement and our alignment with best-practice data security standards.
• Regular Audits and Risk Assessments: We routinely audit, monitor and update our security measures to address emerging threats, vulnerabilities and operational improvements.
• Data Breach Preparedness. We have a comprehensive Data Breach Response Plan in place. If a breach affecting your personal information occurs, we will respond swiftly in accordance with legal requirements and our internal protocols.

8. International transfers

We do not transfer personal information outside of Australia. All data is stored and processed within Australia.

9. Your responsibilities as a user (practitioner)

When using the NexusMD.ai Service, you must:

• Obtain informed patient consent before entering their informatio
• Ensure your use of the NexusMD.ai Service complies with appliable privacy and health record laws
• Notify us immediately of any suspected unauthorised access to patient data through your account

10. How to make a complaint

If you have concerns about how we handle your personal information, wish to make a complaint, please contact us at contact@nexusmd.ai.

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC). Details on how to lodge a complaint are available at: https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us.

11. Updates to our Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, services, legal obligations or operational needs. When we make significant changes, we will notify you through appropriate channels – such as email, announcements on our website, or in-service notifications – so that you remain informed about how we handle personal information. We encourage you to review this Privacy Notice periodically to stay up to date with our data handling practices.