Privacy Policy

Nuviya Tech Ltda. — Australian Privacy Policy

Version 1.0 — effective 3 September 2026

1. Who we are and who this policy covers

Nuviya is operated by Nuviya Tech Ltda., a limited liability company incorporated in Brazil (CNPJ 65.537.603/0001-72), registered office Rua Olimpíadas 134, 2nd floor, Vila Olímpia, São Paulo, SP 04551-000, Brazil ("Nuviya", "we", "us"). We are not an Australian company and we do not hold an Australian Business Number.

Because we offer our services to people in Australia, we treat ourselves as bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). This policy explains how we handle your personal information, including your health information, when you use nuviya.com.br/au, the MyNuviya patient portal (app.nuviya.com.br), our phone line 1800 783 144, our email, chat and voice assistant ("Nara"), and our patient-coordination service ("Services").

We are also subject to Brazil's Lei Geral de Proteção de Dados (LGPD). Where the two laws differ we apply whichever gives you the greater protection. Our Portuguese-language policy for Brazilian patients is at nuviya.com.br/privacy.

Privacy Officer: privacy@nuviya.com.br — or write to the address above, marked "Privacy Officer". We aim to acknowledge privacy enquiries within 5 business days and to resolve them within 30 days.

2. The information we collect

Identity and contact details: name, email, phone, home suburb/postcode and state, date of birth, home address, departure city and airport, and (if you ask us to arrange a Brazilian eSIM) a Brazilian phone number.

Health information (sensitive information): the procedure you are considering, the result you are hoping for, height, weight and calculated BMI, year of birth, smoking status, previous cosmetic surgery and notes about it, pre-existing conditions, medications, allergies, blood type, medical history, organ-donor status, pre-departure health checks and any test results, photographs or clinical images you upload, and your surgeon's and hospital's records relating to your care. We only collect health information with your consent (see section 4).

Travel and identity documents: passport details and image, Brazilian e-visa details and image, travel dates, flight and accommodation bookings, travel-companion details, and emergency-contact details.

Financial information: your budget, package pricing and payment plan, payment records and receipts, and whether you asked to be referred to a finance provider. We do not store full card numbers; card payments are processed by our payment processor. We do not receive your loan application or credit assessment — that is handled directly between you and the credit provider.

Preferences: surgeon gender preference, price/experience and consultation-style preferences, preferred city, importance of before-and-after photos, travel season and accommodation tier.

Insurance enrolment information: the details needed to enrol you in the complimentary Nuviya Medical Travel Insurance benefit — name, date of birth, contact details, travel dates, procedure type and facility — and the resulting policy documents and enrolment reference.

Communications: emails, messages sent through MyNuviya, call recordings and notes (we tell you at the start of a call if it is being recorded), consultation-preparation notes, feedback and reviews, and transcripts of conversations with Nara.

Technical and usage information: IP address, approximate location derived from it, device and browser type, pages viewed, the page you arrived from, campaign tags (UTM parameters), advertising identifiers such as Google's click ID, and cookie data (see section 10).

If you provide us with personal information about someone else (for example a travel companion or emergency contact), you must have their permission to do so and tell them about this policy.

3. How we collect it

• Directly from you — through the surgeon-match questionnaire, the free-guide form, the savings calculator, MyNuviya, phone, email, chat, video consultations and forms you complete for us.
• Automatically — through cookies, analytics and logs when you use our sites (section 10).
• From third parties, where needed to deliver the Services — your matched surgeon and hospital in Brazil (clinical notes, quotes, clearance to fly), our insurance partner (enrolment status and policy documents), airlines and accommodation suppliers (booking confirmations), our credit-referral partner (only whether a referral was made and its outcome, never your financial details), social-media platforms when you submit a lead form on their platform, and Pirk (see section 6) if you first contacted us through Pirk.

You can deal with us anonymously or under a pseudonym when browsing our public pages or asking general questions. We cannot match you with a surgeon, arrange travel or insurance, or coordinate care without identifying you.

4. Why we use your information

We collect, hold, use and disclose your information to:

1. match you with plastic surgeons in Brazil suited to your procedure, goals, health profile and preferences, and send you those matches;
2. prepare cost estimates, package pricing and itineraries;
3. arrange and manage your surgery booking, video consultations, pre-departure health checks, flights, accommodation, transfers, e-visa assistance and in-country support;
4. enrol you in the complimentary medical travel insurance benefit and assist you with any claim;
5. refer you, only if you ask us to, to an Australian credit provider;
6. run MyNuviya and your account;
7. communicate with you about your enquiry, plan and care, and respond to your questions and complaints;
8. send you marketing about our services (you can opt out at any time — section 9);
9. measure and improve our website, Services and marketing, including through analytics and advertising platforms;
10. verify identity, prevent fraud and misuse, and keep our systems secure;
11. meet our legal obligations in Australia and Brazil and deal with regulators, insurers and legal claims; and
12. produce de-identified statistics about how Australians use cosmetic surgery abroad.

Health information — your consent. Health information is "sensitive information" under the Privacy Act. We only collect it with your consent, and only what is reasonably necessary for the purposes above. When you enter your height, weight, procedure or other health details in our questionnaire and click to submit, you are consenting to us collecting that information and using and disclosing it as described in this policy. You may withdraw consent at any time by contacting us, though we may then be unable to continue providing the Services.

We do not use or disclose your health information for direct marketing.

5. Automated matching and decision-making

Our Instant Surgeon Match uses a computer program to shortlist and rank surgeons from our network for you. It uses the procedure, goals, BMI, timing, destination, gender, price/experience and consultation-style preferences you give us, together with information we hold about each surgeon (specialties, experience, credential-verification status, indicative pricing, patient-review data and language). It does not use your name, contact details or identity documents.

The program produces a shortlist and ranking; it does not decide whether you are a suitable candidate for surgery, whether a surgeon will accept you, or your price. Those decisions are made by the surgeon, following a consultation with you. A Nuviya patient advisor reviews every match before it is sent. You can ask us at any time to explain a match, to have a person review it, or to be matched manually.

Our Nara assistant uses artificial-intelligence models to answer questions and route enquiries to a person. It does not give medical advice or make decisions about your care.

6. Who we share your information with

We disclose your personal information only as needed for the purposes in section 4, to:

We do not sell your personal information. Our surgeon partners pay Nuviya a fee for patient introductions; this is a fee for our service, not a payment for your data, and it does not change which surgeons you are shown.

7. Where your information is stored, and overseas disclosure

Storage. Your account, questionnaire, health, travel and insurance information is stored in our database and file storage hosted by Supabase in Sydney, Australia (AWS ap-southeast-2). Copies of some information are also held in the third-party systems listed in section 6, in the locations shown.

Access from Brazil. Nuviya's team is based in São Paulo and Rio de Janeiro, Brazil, with patient advisors and a Director of Medical Tourism in Australia. Staff in Brazil access your information from Brazil to deliver the Services.

Overseas disclosure and your consent. Your surgery takes place in Brazil, so disclosing your health and personal information to surgeons, hospitals, clinics and support providers in Brazil is essential to the Services. Our insurance partners are in the United States and Guernsey and our technology providers are in the countries listed above. These recipients are not bound by the Australian Privacy Principles, and you may not have the same remedies against them under Australian law that you would have against an Australian organisation. By using our Services you consent to these overseas disclosures on that basis. We nonetheless require each recipient to handle your information only for the agreed purpose and to protect it, and Brazilian recipients are bound by the LGPD and by Brazilian medical-confidentiality rules.

8. Security and retention

We protect your information with encryption in transit and at rest, role-based access controls, audit logging of administrative access, multi-factor authentication for staff, network controls and regular review of access. Identity documents and health uploads are stored in restricted file storage and are not visible to surgeons until you choose that surgeon. No system is completely secure; you are responsible for keeping your MyNuviya password secure and for the security of the device and network you use.

We keep information for as long as it is needed for the purposes in section 4 and to meet our legal obligations, and we then de-identify it (so that it can no longer be linked to you) rather than keep it in identifiable form:

• Patients who have surgery through Nuviya: at least 20 years after your procedure. This matches the minimum period Brazilian medical councils require surgeons and hospitals to keep clinical records, and reflects that complications, revision requests, insurance claims and legal claims can arise many years after cosmetic surgery. We keep the file identifiable for that whole period so we can support you, your surgeon and your insurer.
• Enquiries that do not proceed to surgery: 7 years from your last contact with us, which is the longest limitation period that could apply to a claim about our services and allows us to reconnect if you return.
• Financial records: at least 7 years, as required by Australian and Brazilian tax law.
• Call recordings and Nara transcripts: 7 years, or longer if they form part of a patient file.
• De-identified statistics are kept indefinitely.

You can ask us to delete your information sooner (section 9).

We are subject to the Notifiable Data Breaches scheme. If a breach is likely to cause you serious harm we will notify you and the Office of the Australian Information Commissioner (OAIC) as required, and where required also the Brazilian ANPD.

9. Your rights and choices

You can:

• access the personal information we hold about you and receive a copy;
• correct it if it is inaccurate, incomplete or out of date (you can update much of it yourself in MyNuviya);
• delete it, subject to our legal retention obligations;
• withdraw consent to our handling of your health information;
• opt out of marketing at any time using the unsubscribe link in any email, replying STOP to any SMS, or contacting us. We will still send you service messages about an active enquiry or booking. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth);
• ask for human review of an automated surgeon match (section 5); and
• complain about how we have handled your information.

Contact privacy@nuviya.com.br. We will respond within 30 days and will not charge you for making a request, though we may charge a reasonable cost for supplying copies. We may need to verify your identity first.

If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Brazilian data-subject rights under the LGPD (including complaints to the ANPD) are also available to you.

10. Cookies, analytics and advertising

We use:

• Necessary cookies — to run the site, keep you signed in to MyNuviya and remember your questionnaire progress.
• Analytics — Google Analytics, to understand how the site is used.
• Advertising and measurement — Google Ads, Meta (Facebook/Instagram) Pixel and TikTok Pixel, to measure our campaigns and show you relevant ads on those platforms. These platforms may combine this data with information they already hold about you under their own privacy policies. We may share a hashed version of your email or phone with these platforms to measure conversions.

You can control cookies through your browser settings and opt out of personalised advertising through Google's Ads Settings, Meta's Ad Preferences and TikTok's privacy settings. Disabling necessary cookies may stop parts of the site working. We do not respond to browser "Do Not Track" signals.

11. Children

Our Services are for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The current version is always at nuviya.com.br/au/privacy with its effective date. If a change materially affects how we handle your health information we will notify you by email before it takes effect.

13. Contact

Nuviya Tech Ltda. — Privacy Officer Rua Olimpíadas 134, 2nd floor, Vila Olímpia, São Paulo, SP 04551-000, Brazil privacy@nuviya.com.br · Australia: 1800 783 144 (Mon–Fri 9am–6pm, Sat 9am–5pm AEST)