Privacy Policy — Hanzo Health (Australia)

Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Business registration: BC1576110 (British Columbia, Canada)
Contact: quielo@hanzotechnologies.com
Website: www.hanzotechnologies.com

Effective date: 2026-06-17
Version: 2.1-AU
Jurisdiction: Australia
Legal framework: Privacy Act 1988 (Cth) · Privacy and Other Legislation Amendment Act 2024 (Cth) · Australian Privacy Principles (APPs) · Notifiable Data Breaches (NDB) scheme

Summary

Hanzo Health is a private, on-device health journaling app. Your health data stays on your device or in your own encrypted iCloud account. We do not run servers that receive your health information. We do not sell, rent, or share your health data with anyone.

Section 1 — Who We Are

The APP entity responsible for your personal information is:

Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com

Privacy Officer:
Ezequiel Rodriguez
Email: quielo@hanzotechnologies.com
Subject: “Australian Privacy Request”

Section 2 — The Australian Privacy Principles (APPs)

Hanzo Technologies is bound by the 13 Australian Privacy Principles under Schedule 1 of the Privacy Act 1988. This policy describes how we comply with each relevant APP.

Section 3 — Personal Information We Collect

3.1 Health Information (Sensitive Information)

Health information is sensitive information under the Privacy Act (s. 6) and is afforded the highest level of protection. We collect health information only with your express consent (APP 3.3(a)).

Health information collected from Apple Health (HealthKit) — only if you grant permission:

Sleep analysis
Step count
Heart rate (average, resting, walking average)
Heart rate variability (HRV SDNN)
Blood oxygen saturation (SpO2)
Respiratory rate
Active and basal energy burned
Exercise time and stand time
Workout type and duration
Menstrual flow
Body weight and BMI
Blood pressure (systolic and diastolic)
Blood glucose
Body temperature
VO2 max
Mindful session minutes
Dietary energy

Health information you enter directly:

Daily mood, energy, and symptom ratings
Free-text journal entries and notes
Flare logs (symptom severity and type)
Condition tags and health categories

Medication data (if you use medication tracking):

Medication names, doses
Daily adherence logs and notes

3.2 Other Personal Information

Category	Content	Purpose
AI conversation history	AI chat inputs and outputs	Providing AI health insights
Purchase / subscription data	Device identifier (IDFV), IP address, purchase events (via RevenueCat)	Subscription management
Crash diagnostics	Anonymised crash reports and performance data (via MetricKit)	App stability and improvement

Section 4 — How We Collect Personal Information (APP 3)

We collect personal information:

Directly from you when you enter data into the App
From Apple HealthKit when you grant permission for health data access
From Apple MetricKit automatically (anonymised, aggregated crash data only)
From RevenueCat when you purchase a subscription

We do not collect personal information from third parties or public sources.

Section 5 — How We Use Personal Information (APP 6)

We use personal information only for the primary purpose for which it was collected — to provide the App’s health journaling and wellness features to you. We do not use health information for any secondary purpose without your express consent.

Section 6 — Disclosure of Personal Information (APP 6)

We do not disclose your health information, journal content, medication records, or AI conversations to any third party.

We disclose limited non-health personal information to the following overseas recipients:

Recipient	Country	Information	Purpose
RevenueCat, Inc.	United States	Device identifier (IDFV), IP address, purchase events	Subscription management
Apple Inc. (MetricKit)	United States	Anonymised crash diagnostics	App stability

Section 7 — Cross-Border Disclosure (APP 8)

Before disclosing personal information to RevenueCat (United States), we have taken reasonable steps to ensure that RevenueCat does not breach the APPs in relation to that information (APP 8.1). RevenueCat maintains contractual commitments to handle personal information in a manner consistent with the APPs. See https://www.revenuecat.com/privacy.

Canada: Hanzo Technologies is based in Canada. Australia does not have a formal adequacy list, but Canada’s PIPEDA provides a broadly comparable level of protection to the Privacy Act. We take reasonable steps to ensure that your personal information handled in Canada is protected to an equivalent standard.

Your health information, journal data, medication records, and AI conversations are never disclosed overseas — they remain on your device or in your personal iCloud account.

Section 8 — AI Features

All AI features operate entirely on your device using Apple Foundation Models. No health data is sent to external AI systems. AI-generated content is clearly labelled within the App.

Section 9 — Data Quality and Accuracy (APP 10)

We take reasonable steps to ensure that the personal information we hold about you is accurate, up to date, complete, and relevant. You can update most information directly within the App at any time.

Section 10 — Data Security (APP 11)

We take reasonable steps to protect personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure:

On-device storage: Protected by iOS device encryption
App lock: Optional 6-digit passcode stored in iOS Secure Keychain
iCloud sync: End-to-end encrypted by Apple; Hanzo cannot access your iCloud data
HealthKit access: Read-only; we cannot write unsolicited data to Apple Health

When personal information is no longer needed for any purpose, we take reasonable steps to destroy or de-identify it (APP 11.2).

Section 11 — Notifiable Data Breaches (NDB) Scheme

In the event of an eligible data breach — one that is likely to result in serious harm to individuals — we will:

Assess the breach as soon as practicable
Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable after becoming aware
Notify affected individuals directly, or publish a statement on our website if direct notification is not practicable

Timeframe: We aim to notify the OAIC and affected individuals within 30 days of becoming aware of an eligible breach, or sooner where practicable.

Section 12 — Privacy and Other Legislation Amendment Act 2024

The Privacy and Other Legislation Amendment Act 2024 introduced significant changes to the Privacy Act. Key provisions relevant to Hanzo Health:

Statutory tort for serious invasions of privacy: A new cause of action allows individuals to sue for serious invasions of privacy. We are committed to handling your personal information in a way that respects your reasonable expectation of privacy.
Children’s Online Privacy Code: A children’s privacy code is being developed. Once enacted, we will comply with its requirements. We do not knowingly collect personal information from children under 15.
Automated decision-making: Where AI-generated insights might have a significant effect on you, we ensure transparency. All Hanzo Health AI outputs are clearly labelled and are intended for personal wellness use only — not clinical decisions.
Direct right of action: Individuals may now seek compensation for serious invasions of privacy directly. Our data handling practices are designed to avoid any such breach.

Section 13 — Your Privacy Rights (APP 12 and APP 13)

Right to access (APP 12): You have the right to access personal information we hold about you. Most information is accessible directly in the App. For additional access requests, contact our Privacy Officer.

Right to correction (APP 13): You have the right to request correction of personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading.

In-app controls:

Delete all data: Settings → Data → Delete All Data
Export data: Settings → Data → Export (PDF)
Revoke HealthKit: iOS Settings → Privacy & Security → Health → Hanzo Health

Submitting a request:
Email: quielo@hanzotechnologies.com
Subject: “Australian Privacy Request — [Access / Correction / Complaint]”
We will respond within 30 days.

Section 14 — Privacy Complaints (APP 1.4)

If you believe we have breached the APPs, you may:

Contact us first: quielo@hanzotechnologies.com — we will endeavour to resolve your complaint within 30 days
If unresolved, lodge a complaint with the OAIC:

Office of the Australian Information Commissioner (OAIC)
GPO Box 5218, Sydney NSW 2001
Telephone: 1300 363 992
Web: oaic.gov.au
Online: oaic.gov.au/privacy/privacy-complaints

Section 15 — Children

Hanzo Health is intended for users aged 16 and over in Australia. We do not knowingly collect personal information from children under 15. Given the sensitive health data the App handles — including menstrual cycle information — we strongly encourage parental supervision for users under 18 approaching the minimum age threshold.

Once the Australian Children’s Online Privacy Code is enacted, we will update our practices accordingly.

Section 16 — Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you via an in-app notice. Continued use after an updated policy is posted constitutes acceptance.

Section 17 — Contact

Ezequiel Rodriguez, Privacy Officer
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com
Subject: “Australian Privacy Request”