Privacy Policy

1. About This Policy

MyDayWin ("the App") is an Assistive Technology application designed to support participants of the National Disability Insurance Scheme (NDIS) with daily independence. This policy explains how we collect, use, store, and protect your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

2. Information We Collect

We collect the following types of personal information:

• Identity information (name, email, NDIS number)
• Health information (medications, side effects, mood entries, sleep data)
• Routine and activity data
• Goal progress and decision logs
• Safety check-in data (including location when you choose to share it)
• Emergency contact details
• Accessibility preferences
• Usage patterns for adaptive learning (processed on-device)

3. How We Collect Information

We collect information directly from you when you enter data into the App. We do not collect information from third parties without your explicit consent. Location data is only collected when you initiate a safety check-in and grant location permission.

4. Purpose of Collection

We use your information to:

• Provide the App's assistive technology features
• Generate personalised insights through on-device adaptive learning
• Sync your data across devices (when you choose to)
• Share data with your NDIS provider (only with your explicit consent)
• Generate NDIS-compliant invoicing

5. Data Storage

On-device storage:Your data is primarily stored on your device using local storage (IndexedDB) protected by your device's security controls. The App works offline — your data stays on your device when there is no internet connection. We recommend enabling device-level encryption (e.g., BitLocker, FileVault, or Android/iOS device encryption) for additional protection of locally stored data.

Cloud backup: When you choose to sync, data is stored in Australian data centres (AWS Sydney, ap-southeast-2). Your data never leaves Australia.

6. Disclosure

We only share your information:

• With your NDIS provider — only with your explicit consent via the Provider Bridge
• You control exactly what data types are shared (routines, mood, goals, medications, safety)
• You can revoke consent at any time
• We do not sell or share your data with advertisers or other third parties

7. Data Security

We protect your data through:

• HMAC-signed session cookies with timing-safe comparison
• HTTPS encryption for all data in transit
• Row-level security on cloud database
• Role-based access controls
• Regular security reviews

8. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access your personal information at any time (Settings > Export my data)
• Request correction of inaccurate information
• Request deletion of your data
• Withdraw consent for data sharing at any time
• Complain to the Office of the Australian Information Commissioner (OAIC)

9. Adaptive Learning

The App uses on-device pattern recognition to provide personalised insights. This processing happens entirely on your device — no data is sent to external AI services. The adaptive learning engine analyses your routines, mood, and medication patterns to identify correlations and suggestions.

10. Data Breach Response

In the event of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the OAIC as soon as practicable after becoming aware of the breach, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.

11. Contact

For privacy inquiries, complaints, or requests for access or correction, please contact our Privacy Officer at [email protected].

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.