Nonimo for Australian practices
The client's TFN stays on your desk. The AI still does the work.
Nonimo swaps the numbers Australian files are full of for placeholders on your own computer, before the text reaches ChatGPT, Claude or Copilot, and puts the real ones back when the answer arrives.
For accountants, law firms and NDIS providers.
Mac with Apple silicon and macOS 14 or later · Windows 10 or later, 64-bit (x64) · under 2 MB.
The first time you open Nonimo, Windows may show a SmartScreen notice because the app is new: click “More info”, then “Run anyway”.
The 22 Australian identifiers it knows by name
Each one issued here, each with a placeholder of its own, and the real number back in the reply.
| Identifier | Where it turns up | What the AI reads |
|---|---|---|
| Tax file number | Returns, TFN declarations, ATO letters | [TFN_1] |
| Australian Business Number | Invoices, engagement letters, trust deeds | [ABN_1] |
| Australian Company Number | ASIC extracts, contracts, company searches | [ACN_1] |
| Director ID | Consents to act, ASIC Form 484, new company registrations | [DIRECTOR_ID_1] |
| Super fund member number | Member statements, rollover requests, binding death benefit nominations | [SUPER_MEMBER_NUMBER_1] |
| Bank State Branch number | Remittance advice, direct debit forms | [BSB_1] |
| Bank account number | Bank statements, EFT authorities, settlement statements | [BANK_ACCOUNT_AU_1] |
| Medicare card number | Intake forms, referrals, claims | [MEDICARE_1] |
| Individual Healthcare Identifier | My Health Record, clinical software | [IHI_1] |
| Hospital UR number | Discharge summaries, outpatient letters, pathology requests | [UR_NUMBER_1] |
| Healthcare Provider Identifier, individual | Referrals, specialist letters | [HPI-I_1] |
| Healthcare Provider Identifier, organisation | Practice letterhead, e-referrals | [HPI-O_1] |
| NDIS number | Participant plans, service agreements, plan manager invoices | [NDIS_NUMBER_1] |
| Aged Care ID | Assessment referrals, Support at Home agreements, admission packs | [AGED_CARE_ID_1] |
| DVA file number | Veteran Card claims, allied health referrals, DVA letters | [DVA_NUMBER_1] |
| Centrelink Customer Reference Number | Services Australia letters, support applications | [CRN_1] |
| Unique Student Identifier | RTO enrolments, training records | [USI_1] |
| Title reference (volume and folio) | Contracts of sale, title searches, vendor statements | [TITLE_REFERENCE_1] |
| Strata plan number | Strata searches, levy notices, owners corporation minutes | [STRATA_PLAN_1] |
| National Metering Identifier | Power bills, hardship applications | [NMI_1] |
| Vehicle registration (rego) | Incident reports, insurance claims | [PLATE_AU_1] |
| Driver licence number | Identity checks, client onboarding, accident reports | [DRIVER_LICENCE_AU_1] |
Card numbers and passports are covered wherever they were issued, and so are client names, street addresses, email addresses, phone numbers and dates of birth.
What the Privacy Act asks of a paste
Four parts of the Privacy Act 1988 decide what happens when someone at the practice drops a client file into a chatbot. None of them names a product, and none of them changes because the firm pays for a subscription.
APP 6
Use and disclosure
The OAIC's 2024 guidance on off-the-shelf AI products works through an insurer whose staff type customer details into a chatbot, and treats that as a disclosure to the company running it. The principle is engaged at the paste, not later.
APP 8
Sending it offshore
The major AI providers all sit overseas, so giving them personal information is a cross-border disclosure. The reasonable step the OAIC normally looks for is an enforceable contract that holds the recipient to the APPs.
APP 11
Keeping it, and letting it go
Reasonable steps to protect what the practice holds, and to destroy or de-identify it once it is no longer needed. A chat history on a staff member's work account is part of what you hold.
Part IIIC
Notifiable data breaches
Once a practice has reasonable grounds for suspecting a breach, section 26WH expects the assessment done within 30 days of that suspicion, not of certainty. Whether it is serious harm is weighed against the matters listed in section 26WG.
The OAIC is recommending here, not banning, and Nonimo is one practical way to act on it without giving up the tool: the identifiers are out of the text before anyone pastes it. It won't make a use of AI lawful by itself, and it doesn't replace the contract APP 8 is looking for. For the provider by provider detail, read the Privacy Act and the big four chatbots.
A summary of the law, not legal advice. A business turning over $3 million or less can fall outside the Act, unless it provides a health service or, since 1 July 2026, for the AML/CTF work lawyers and accountants now carry.
By sector
What gets covered and why, sector by sector.
Guides for Australian practices
Worked through against Australian law and the regulators who apply it.
Privacy Act sensitive information in the files your staff give AI
Privacy Act sensitive information sits in Australian payslips, leave certificates and CVs. What changes when it reaches AI, and what to take out first.
Engagement letter AI clause in Australia: solicitors and tax agents
An Australian engagement letter AI clause, drafted from rule 9, TPB(GS) 55/2026, APES 305 and APP 5, with the client data paragraph written two ways.
Ahpra AI guidelines: what patient data stays out of ChatGPT
Ahpra AI guidelines for the letters a practice drafts with AI: which patient details stay out of ChatGPT, why the Medicare number is its own problem.
De-identified vs pseudonymised: which one is enough for AI?
De-identified vs pseudonymised: the Privacy Act defines only the first. What each word means for a client file, and which one lets it go into ChatGPT.
NSW Supreme Court AI practice note: what you sign, what stays in
The NSW Supreme Court AI practice note makes an affidavit say AI was not used. What you sign, and what must never reach a chatbot before you file.
What to take out of an NDIS case note before you use AI
The NDIS Commission asked providers to de-identify first. Here is what comes out of a progress note, in what order, and the step no software does for you.
AI in Australian councils: which privacy law applies to yours
The Privacy Act does not cover your council. Which law does depends on your state, and two of them changed on 1 July 2026. Here is what binds you.
Which AI tools can you use under the Privacy Act?
No tool is compliant on its own, a use is. What APP 6, APP 8 and APP 11 ask of ChatGPT, Claude, Gemini and Copilot, and who the Privacy Act actually covers.
Does ChatGPT save your data? What OpenAI keeps and deletes
Yes, and how long depends on the account and the settings. What OpenAI stores, what turning off training does not cover, and where an Australian file goes.
Does Claude train on your data? Anthropic's answer, by plan
On a personal plan only if you allowed it, and then for five years. On Claude for Work and the API, not by default. What that does and does not settle.
Does Gemini share your data? What Google keeps and reviews
Google says it does not sell it. It also says people read a subset of chats, and that reviewed chats survive deletion. What that means for an Australian file.
Is Microsoft Copilot safe for confidential information?
It depends which Copilot and which account. What enterprise data protection covers, the queries that leave for Bing, and where an Australian tenant's data sits.
Cyber insurance in Australia: what it covers and what it excludes
Four Australian cyber policy wordings, opened and read in full. What they pay for, the exclusions that decide a claim, what it costs, and how to compare.
What it costs, and where it stands
The desktop app is available on both platforms, Mac and Windows; the browser extension and the compliance panel are in development.
Nonimo’s free plan stops at a set number of words each month. Leave an email address on our licence page and a free licence file comes back that removes the cap until 31 January 2027, with no account to set up.
- Free today, on Mac and Windows
- With a monthly word allowance
- The free licence lifts it until 31 January 2027, no account needed
Questions Australian practices ask
Does Nonimo send any client data overseas?
Nonimo itself sends none of the text you select, to us or anywhere else: detection runs on the computer in front of you. What the app does send, once a day, is a usage count, with fields such as how much of the monthly allowance has been used, the app version, the platform and an installation number. Our security page lists every field. Where the masked text goes next is up to you and your AI provider.
Does Nonimo help a practice meet its Privacy Act obligations?
Nonimo helps an Australian practice with its obligations under the Privacy Act 1988, but it does not satisfy them on its own. Taking TFNs, Medicare numbers and client names out before a paste means less personal information reaches the AI provider, which is where APP 6 and APP 8 apply, and it can be one of the reasonable steps APP 11.1 expects a practice to take to protect what it holds. The contract APP 8 looks for, the privacy policy and the practice's own decisions about AI still sit with the practice, and text it can reverse is still personal information.
Is a TFN pasted into ChatGPT a notifiable data breach?
It can be, so assess it rather than assume either way. Keeping TFNs on file makes the practice a file number recipient, section 18 binds every such recipient without asking about turnover, and section 26WE(1)(d) brings that information inside the notifiable data breach provisions. The question is then whether a reasonable person would expect serious harm, and section 26WH gives you 30 days from the suspicion to answer it.
We are a small practice. Is the Privacy Act even our problem?
Possibly not, but look at the exceptions first. The small business exemption stops at $3 million in annual turnover and never covers a business delivering a health service while it keeps health information, which the OAIC says includes a disability service provider handling health information. Since 1 July 2026 it also gives way for AML/CTF work. And the professional duties, from the solicitors’ conduct rules to the Tax Practitioners Board’s Code, apply at any size.
What does Nonimo cost?
The free plan stops at a set number of words each month, and the licence that removes the cap is free until 31 January 2027, with no account to set up.