Privacy Policy

About this Privacy Policy

Navo Care Pty Ltd (ACN 697 641 517 / ABN 96 697 641 517) ("NAVO", "we", "us", "our") operates the NAVO application and website at meetnavo.com ("the Platform"). NAVO is a personal information organiser that helps adult Australians manage and store important information about their ageing parents and family members.

This Privacy Policy explains how we collect, use, hold, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.

By creating an account or using the Platform, you agree to the collection and use of your information as described in this Policy. If you do not agree, please do not use the Platform.

We may update this Policy from time to time. We will notify you of material changes by email and by posting a notice on the Platform. Continued use of the Platform after notification constitutes your acceptance of the updated Policy.

Who this Policy applies to

This Policy applies to:

• Account holders – the person who creates a NAVO account and manages one or more profiles
• Profile subjects – the person (such as a parent or family member) whose information is stored in a profile
• Family members – people invited by the account holder to view or contribute to a profile
• Visitors – people who visit meetnavo.com without creating an account

What personal information we collect

We collect personal information that you voluntarily provide when using the Platform. The type of information collected depends on how you use NAVO.

Account information

• Full name and email address
• Login is passwordless – we send a secure one-time "magic link" to your email. We do not create or store passwords of any kind.
• Subscription and payment information (processed by Stripe – we do not store full card numbers)

Profile information

Information you enter about yourself or another person (the "profile subject"), which may include:

• Full name, date of birth, gender, nationality, and address
• Medicare card colour, and the type and location of other government-issued identifiers (e.g. "DVA card kept at home") – NAVO does not collect or store the actual numbers on these documents
• Current medications, dosages, and administration instructions
• Known allergies and adverse reactions
• Blood type
• GP name, phone number, and practice details
• Preferred hospital
• Other medical notes you choose to enter
• Legal document references (e.g. which firm holds a Will, who the executor is) – secure upload of the documents themselves is a planned future feature via a specialist storage partner, not currently available
• Final wishes (burial or cremation preferences, organ and tissue donation wishes, funeral arrangements) – shared only with family members you explicitly choose to grant access to
• Practical arrangements for someone acting on your behalf (pets, plants, neighbours to notify, ongoing commitments)
• Financial institution names and a free-text note on where account details are kept (e.g. "Commonwealth Bank" plus where the statements are held) – NAVO does not collect account numbers, BSBs, or balances, and no such field exists
• Digital account references (if entered by you)
• Final wishes and personal messages

Technical and usage information

• IP address and device type
• Browser type and operating system
• Pages visited and features used within the Platform
• Date and time of access
• Error logs and crash reports

Communications

• Emails or messages you send to us
• Support requests and feedback

Sensitive information

Some of the information you may enter into NAVO – including medication lists, allergy information, blood type, organ and tissue donation wishes, and other health-related details – is classified as "sensitive information" under the Privacy Act 1988 (Cth).

We treat sensitive information with a higher level of protection. We will only collect, use, or disclose sensitive information:

• With your express consent, which you provide when you create an account and agree to this Policy
• Where it is reasonably necessary for the primary purposes for which you provided it
• Where required or authorised by Australian law

How we collect personal information

We collect personal information:

• Directly from you when you create an account, set up a profile, or use any feature of the Platform
• Automatically via cookies and similar tracking technologies when you use the Platform
• From other family members you have authorised to contribute to a shared profile

We do not collect personal information from third-party data brokers or marketing lists.

How we use your personal information

Providing the Platform

• Creating and managing your account
• Storing and displaying your profile information
• Enabling family sharing and collaborative profile management
• Processing subscription payments
• Sending account-related emails (magic link sign-in emails, subscription receipts)

Improving the Platform

• Analysing how users interact with features (using aggregated, de-identified data only)
• Diagnosing technical errors and improving reliability
• Developing new features based on usage patterns

Legal and compliance

• Complying with our legal obligations under Australian law
• Enforcing our Terms of Use
• Responding to lawful requests from courts, regulators, or law enforcement

Communications

• Sending you transactional emails related to your account
• Sending you service updates or changes to this Policy
• Sending optional product updates or newsletters (only with your consent – you may unsubscribe at any time)

We will not use your personal information for purposes other than those listed above without your consent, unless required by law.

How we hold and protect your information

Encryption

• All data is encrypted at rest using AES-256 encryption
• All data in transit is protected by TLS 1.2 or higher (HTTPS)
• Login uses one-time magic links, not passwords, so there are no passwords in our systems to store or leak

Access controls

• Row-Level Security (RLS) is enforced at the database level – each user can only access their own data and profiles they have been explicitly invited to
• Family members can only access the sections of a profile that the account holder has specifically permitted
• Financial and digital accounts sections are hidden from all family members by default

Infrastructure

• The Platform is hosted on SOC 2 Type II certified infrastructure
• We use Supabase (supabase.com) as our database and authentication provider
• We use Netlify (netlify.com) for application hosting, with continuous deployment from our source code repository

Internal access

• Access to production data by NAVO staff or contractors is restricted and logged
• We do not access your profile data except to provide technical support at your request, or to comply with a legal obligation

Despite these measures, no system is completely secure. We cannot guarantee absolute security and encourage you to keep your email account secure, since it is the key to signing in to NAVO.

For more detail, see our Security & Trust page.

Who we share your information with

We do not sell your personal information. We do not share your information with advertisers. We share your information only in the following limited circumstances.

Service providers

We use a small number of trusted third-party service providers to operate the Platform:

Each provider is bound by contractual obligations to protect your information and to use it only for the purpose of providing services to us.

Family members you invite

If you invite a family member to access a profile, they will be able to see the sections you have permitted. You control this access and can revoke it at any time.

Legal requirements

We may disclose your personal information if required to do so by law, or in response to valid legal process (such as a court order or subpoena), or where we believe disclosure is necessary to protect the rights, property, or safety of NAVO, our users, or the public. Where we are legally permitted to do so, we will notify you of any such disclosure.

Business transfers

If NAVO is acquired by or merged with another company, your information may be transferred as part of that transaction. We will notify you by email before any such transfer occurs, and you will have the option to delete your account beforehand.

Overseas disclosure

Your core profile and health information is stored in our database (Supabase), which is hosted in Australia (Sydney). Some of our other third-party service providers, used for hosting, payments, and email delivery, are located outside Australia, including in the United States and Japan. By using the Platform, you consent to the transfer of your personal information to these overseas recipients.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles your information in a manner consistent with the Australian Privacy Principles, including through data processing agreements.

Please be aware that overseas recipients are subject to the laws of their own jurisdiction, which may differ from Australian law.

GDPR (European Union and United Kingdom)

If you are located in the European Union or United Kingdom, you may have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR. These include the right to data portability, the right to object to processing, and the right to lodge a complaint with a supervisory authority. We are implementing full GDPR compliance – please contact privacy@meetnavo.com with any GDPR-related requests.

California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) may provide you with additional rights regarding your personal information, including the right to know what information we collect, the right to delete it, and the right to opt out of the sale of your personal information. NAVO does not sell personal information. To exercise your CCPA rights, contact privacy@meetnavo.com.

Your rights

Access

You have the right to request access to the personal information we hold about you. You can access most of your information directly within the Platform. To request a full data export, email privacy@meetnavo.com – we will prepare and send it within 30 days.

Correction

You have the right to request correction of personal information that is inaccurate, out of date, or incomplete. Most corrections can be made directly within the Platform. For account-level corrections, contact privacy@meetnavo.com.

Deletion

You may delete your account and all associated profile data at any time from the Settings section of the Platform. Upon deletion:

• Your account and all profile data will be permanently deleted from our active database within 30 days
• Backups containing your data will be purged within 90 days
• Some information may be retained where required by law (for example, financial transaction records for taxation purposes)

Withdrawal of consent

Where our processing of your sensitive information is based on your consent, you may withdraw that consent at any time by deleting your account. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Complaints

If you believe we have mishandled your personal information, please contact us first at privacy@meetnavo.com. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

Cookies and tracking

The Platform uses cookies and similar technologies to maintain your session (keeping you logged in), remember your preferences, and improve performance.

• Essential cookies – required for the Platform to function (session management, authentication). Cannot be disabled.
• Analytics cookies – help us understand how users interact with the Platform. These are anonymised and aggregated.

We do not use advertising cookies or share cookie data with advertisers. You can manage cookies through your browser settings, though disabling essential cookies will prevent the Platform from functioning correctly.

Data retention

We retain your personal information for as long as your account is active, or as long as necessary to provide you with our services.

If you delete your account, your data will be deleted as described in Section 09 above.

We may retain certain information for longer periods where required by law – for example, financial transaction records required for Australian taxation purposes (generally 5–7 years under the Income Tax Assessment Act 1997).

De-identified, aggregated data (from which individual users cannot be identified) may be retained indefinitely for the purpose of improving the Platform.

Children's privacy

The Platform is intended for use by adults aged 18 and over. We do not knowingly collect personal information from children under 18.

If you believe a child under 18 has created an account or provided personal information to us, please contact privacy@meetnavo.com and we will delete that information promptly.

Direct marketing

We will only send you direct marketing communications (such as product updates or newsletters) if you have opted in to receive them. You may opt out at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Updating your notification preferences in the Settings section of the Platform
• Emailing privacy@meetnavo.com

We will never use your sensitive information (including health data) for direct marketing purposes.

Government-related identifiers

NAVO does not collect or store the actual numbers on government-issued identifiers such as Medicare cards, DVA cards, pension cards, passports, or driver's licences. This is a deliberate design decision, not a temporary limitation.

Where this information may be relevant in an emergency, the Platform instead lets you record the type of document, the colour of a Medicare card (so it can be visually identified by a paramedic), and a free-text note on where the physical document is kept. We take the view that a family member or emergency responder needs to know where to look, not for NAVO to hold the identifier itself, and that not collecting these numbers removes the associated risk entirely, rather than managing it through additional security measures.

Contact us

For all privacy-related enquiries, requests, or complaints:

We will acknowledge receipt of your enquiry within 5 business days and respond substantively within 30 days.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will:

• Post the updated Policy at meetnavo.com/privacy
• Update the effective date at the top of this page
• Notify you by email if the changes materially affect how we handle your personal information

Your continued use of the Platform after notification constitutes your acceptance of the updated Policy. If you do not agree to the changes, you should delete your account before the changes take effect.