How we handle personal information

1. Who we are

BaseNexa is a product of Basecare Services Pty Ltd (ABN 50 683 649 381) ("we", "us"), which operates the BaseNexa platform at app.basenexa.com.au and this website at basenexa.com.au. You can contact us about anything in this policy at hello@basenexa.com.au.

2. Two kinds of information, two different roles

This distinction shapes everything else in this policy, so it comes first.

Information about our customers

When an organisation signs up for BaseNexa, we collect information about that organisation and its staff directly: names, work email addresses, the organisation's details, and billing records. For this information we are the collector and we decide how it is handled, as described in this policy.

Records our customers keep in the platform

Subscribing providers use BaseNexa to hold records about their NDIS participants and their workers: rosters, progress notes, incident reports, compliance documents, service agreements and invoices. Those records belong to the provider. The provider decides what is collected, who in their organisation can see it, and when it is corrected or deleted; we store and process it on their behalf and on their instructions. If you are a participant, a participant's nominee, or a support worker and you want to access or correct records about you, the right place to start is the provider you deal with. We will help them meet that request.

3. What we collect directly

• Account details. Name, work email address, organisation name, and the role you hold in your organisation's BaseNexa account.
• Billing details. Your plan, invoices and payment history. Card details go directly to Stripe, our payment processor; we never see or store full card numbers.
• Support and feedback. Emails you send us and feedback submitted inside the product, including the page it was sent from (with identifiers masked).
• Operational logs. Standard technical logs (IP addresses, timestamps, requests) kept for security and troubleshooting. Our logs deliberately exclude passwords, session tokens, progress note content, health details, incident descriptions and document contents.

4. What we hold on behalf of providers

Provider records routinely include health and disability information about participants, which Australian law treats as sensitive information deserving the highest protection. We treat every provider record to the same standard as the most sensitive record in it. We do not use participant or worker records for any purpose beyond operating the platform for that provider: no profiling, no advertising, no training of anything on it, no sale, ever.

5. Why we use information

• To provide, secure and support the service
• To bill for it
• To tell customers about service changes that affect them
• To meet legal obligations

We do not send marketing email. If that ever changes, it will be opt-in, and every message will carry a working unsubscribe.

6. Cookies and tracking

The application uses essential cookies only: the session cookie that keeps you signed in. This marketing website sets no cookies at all and runs no analytics, no advertising pixels, and no third-party scripts. Emails we send contain no open tracking and no link rewriting.

7. Where information lives

The platform, its database and all uploaded documents are hosted in Amazon Web Services' Sydney region, in Australia. Data is encrypted in transit and at rest. Two narrow exceptions involve overseas processing:

• Email delivery. Transactional email (password resets, invitations, signing requests, invoices) is delivered through Resend, whose infrastructure processes messages outside Australia while delivering them. The records themselves stay in Sydney; only the email in transit leaves.
• Payments. Stripe processes subscription payments and holds billing details under its own privacy policy.

8. Who we share information with

We share personal information only with the service providers below, and only what each needs:

• Amazon Web Services (Sydney): hosting, storage and backups
• Stripe: subscription billing
• Resend: transactional email delivery

Beyond that, we disclose personal information only if the law requires it (for example a court order), and where lawful we will tell the affected customer first. We never sell or rent personal information to anyone.

9. How we protect it

Security is described in engineering detail on our Security page. In brief: every record is isolated to one organisation and access is checked on the server for every request; roles limit what each person sees; an audit trail records who changed what without copying sensitive values; documents sit behind authenticated routes, never public links; two-factor authentication is available on every account; and backups are encrypted and restore-tested.

10. How long we keep it

We keep customer records while the subscription is active. When a subscription ends, the provider can request an export of their data. Records are deleted from the live system within 90 days of termination, and encrypted backups age out on their own cycle after that. We keep billing records for as long as tax law requires.

11. Access and correction

Account holders can see and update most of their own details in the product, and can email us for anything else; we respond within 30 days. For participant and worker records, ask your provider first (see section 2); providers can correct their own records directly, and we will assist where needed. If we decline a request we will say why in writing.

12. Data breaches

We are subject to the Notifiable Data Breaches scheme. If a breach occurs that is likely to result in serious harm, we will notify the affected customers and the Office of the Australian Information Commissioner as the scheme requires, and we will tell affected customers what happened, what information was involved, and what we are doing about it.

13. Complaints

If you think we have mishandled your personal information, email hello@basenexa.com.au with "Privacy complaint" in the subject line. We will acknowledge it within 7 days and respond within 30. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

14. Changes to this policy

If we change this policy, the new version will be published here with a new date, and customers will be told about any material change before it takes effect.