Legal
Privacy Policy
Last updated: 31 July 2026 · Applies to the MediVault Pro Android app and the web app at medivault.nextwave.au/app
The short version: your clinic's records belong to your clinic. Patient data is stored in a secured cloud vault, visible only to your clinic's team, encrypted in transit, and never sold or shared with advertisers.
1. Who we are
MediVault Pro is operated by NextWave ("we", "us"). This policy covers the MediVault Pro Android application and the MediVault Pro web application (together, the "Service"). For privacy questions or requests, contact ns@nextwave.au.
2. Roles: your clinic controls patient data
For patient health records, the clinic is the data controller and NextWave acts as the data processor / service provider. Clinic staff decide what patient information is entered; we store and process it only to provide the Service.
3. What data is stored
- Staff account data — name, email address, hashed credentials, role (owner / doctor), and two-factor authentication settings. Used to sign you in and control access.
- Clinic data — clinic name and details, team membership, and invite codes used to add doctors.
- Patient health data — patient demographics, contact details, medical history, visit notes (including SOAP-format clinical notes), and prescriptions, entered by your clinic's staff.
- Attachments — reports and documents your staff upload to patient records.
- Technical data — essential authentication tokens and basic diagnostic logs needed to keep the Service running and secure.
4. What we do NOT do
- We do not sell or rent any personal or health data.
- We do not show advertising or use advertising trackers.
- We do not share patient data with third parties, except the infrastructure providers listed below, strictly to operate the Service.
- We do not access your clinic's records except where required for support you request, security, or legal obligation.
5. Where data lives & who processes it
The Service runs on secured cloud infrastructure operated by reputable providers under their own strict security and compliance programs:
- Managed cloud database & storage — hosts the database, authentication, and file storage for your clinic's vault, with encryption at rest and in transit.
- Global content delivery & hosting — serves the web app and this site (medivault.nextwave.au) over encrypted connections.
- Google Play — distributes the Android app; Google may collect its own diagnostics per its policies.
Data may be stored in data centres outside your country. Wherever it is stored, it remains protected by the same access controls described here.
6. How data is protected
- All connections use TLS/HTTPS encryption in transit.
- Row-level access rules ensure records are visible only to members of your clinic's team.
- Optional two-factor authentication (TOTP) for every staff account.
- Role-based permissions (owner / doctor) control who can edit records and manage the team.
7. Cookies & local storage
The web app uses only essential storage: authentication session tokens and the app-shell cache that lets the installable app load quickly. There are no analytics or advertising cookies.
8. Retention & deletion
Your clinic's data is kept for as long as the clinic's account is active. Clinic owners can delete individual patient records, visits, and attachments at any time. To delete an entire clinic workspace or a staff account, contact ns@nextwave.au — we will complete verified deletion requests within 30 days, except where retention is required by law. Infrastructure backups may take up to 30 additional days to fully rotate.
9. Your rights
Depending on your jurisdiction, you may have rights to access, correct, export, or delete personal data. Staff members can exercise these through the app or by contacting us. Patients should direct requests about their health records to their clinic, which controls that data.
10. Children
The Service is intended for use by clinic staff (adults). It is not directed at children, and staff accounts must not be created for children. Patient records about minors may be entered by clinic staff as part of normal clinical care.
11. Changes to this policy
If we change this policy, the updated version will be posted at this address with a new "last updated" date. Material changes will be flagged on the landing page before they take effect.
12. Contact
NextWave · Cognitive Grid
Email: ns@nextwave.au
Web: medivault.nextwave.au