Privacy Policy — Hanzo Health (Canada)

Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Business registration: BC1576110 (British Columbia, Canada)
Contact: quielo@hanzotechnologies.com
Website: www.hanzotechnologies.com

Effective date: 2026-06-17
Version: 2.1-CA
Jurisdiction: Canada (Federal — PIPEDA · Province of British Columbia · Quebec — Law 25)
Base policy: en/privacy-policy.md v2.1

About This Document

This is the Canadian version of the Hanzo Health Privacy Policy. It incorporates the global base policy and adds jurisdiction-specific disclosures and rights required under:

PIPEDA — Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)
Bill C-27 / CPPA — Consumer Privacy Protection Act (passed Parliament; not yet in force as of effective date — this policy is forward-compatible)
Quebec Law 25 — Act Respecting the Protection of Personal Information in the Private Sector (Loi sur la protection des renseignements personnels dans le secteur privé), as amended by An Act to modernize legislative provisions as regards the protection of personal information (2021, c. 25)
PIPEDA Breach of Security Safeguards Regulations (SOR/2018-64)

If you are a Quebec resident, please also refer to the French-language version of this policy at /fr-ca/politique-de-confidentialite.md, which contains additional Quebec-specific disclosures.

Summary

Hanzo Health is a private, on-device health journaling app. Your health data stays on your device — or in your own encrypted iCloud account if you enable sync. We do not run servers that receive your health information. We do not sell, rent, or share your health data with anyone.

Section 1 — Information Collected and How It Is Used

1.1 Apple Health Data (HealthKit)

Hanzo Health requests read-only access to the following Apple Health data types, if you grant permission in the iOS Health permissions dialog:

Sleep analysis
Step count
Heart rate (average, resting, and walking average)
Heart rate variability (HRV SDNN)
Oxygen saturation (SpO2)
Respiratory rate
Active energy burned (calories)
Basal (resting) energy burned
Exercise time and stand time
Workout type and duration
Menstrual flow
Body weight
Body mass index (BMI)
Blood pressure (systolic and diastolic)
Blood glucose
Body temperature
VO2 max
Mindful session minutes
Dietary energy consumed

Where this data goes: All values are read directly from Apple Health and stored locally on your device. If you enable iCloud sync, they are stored in your private encrypted iCloud account. Hanzo Health never transmits any of these values to our servers or to any third party.

Permission is yours to control: You can review and revoke any HealthKit permission at any time in iOS Settings → Privacy & Security → Health → Hanzo Health.

1.2 Journal and Health Log Data

When you use the journaling features, the following is stored on your device:

Daily mood, energy level, and symptom ratings you enter
Free-text notes and entries you write
Flare log entries (symptom severity and type)
Condition tags and health categories you select
Any custom fields you configure

1.3 Medication Tracking Data

If you use the medication tracking feature, Hanzo Health stores:

The names and doses of medications and supplements you enter
Daily logs of whether each medication was taken and at what time
Notes you attach to medication logs

This information is stored locally on your device and, if iCloud sync is enabled, in your private encrypted iCloud account. Medication names and adherence logs are never shared with third parties or transmitted to Hanzo’s servers.

1.4 AI Conversation History

All AI processing happens entirely on your device using Apple’s on-device Foundation Models framework. Your questions and health data are never sent to Apple’s AI servers or to any cloud AI service.

Your AI conversation history is saved on your device. If iCloud sync is enabled, this conversation history is also stored in your private encrypted iCloud account. Conversation history is never sent to Hanzo’s servers.

You can delete your conversation history at any time in Settings → Data → Delete All Data.

1.5 AI-Generated Health Insights

Periodic AI health summaries based on your journal and health data are stored on your device and, if iCloud sync is enabled, in your encrypted iCloud account. They are not transmitted to Hanzo or any third party.

1.6 Article Reading History

Records of which health articles you have read are stored on your device and in iCloud (if sync is enabled). This is used only to personalise your article feed.

1.7 App Lock and Security Data

If you enable the app lock feature, your chosen 6-digit passcode is stored in your device’s secure iOS Keychain. Your passcode never leaves your device and is not shared with Hanzo or any third party.

1.8 Biometric Status

The app may read the availability of Face ID or Touch ID to determine whether biometric authentication is available. No biometric data is ever collected, stored, or transmitted.

Section 2 — On-Device AI and Foundation Models

All AI features operate entirely on your device using Apple Foundation Models. Your health questions and journal data are never sent to Apple’s AI servers or to any third-party AI provider.

Section 3 — Data Sync and Storage

3.1 Local Storage (Default)

All Hanzo Health data is stored on your device using Apple’s SwiftData encrypted data storage.

3.2 iCloud Sync (Optional)

If you are signed into iCloud, Hanzo Health can optionally sync your data across your Apple devices using CloudKit. Data synced to iCloud includes journal entries, flare logs, medication records, AI summaries, AI conversation history, and article reading history. All data stored in iCloud is end-to-end encrypted by Apple.

Section 4 — Third-Party Services

None of the following services receive your health journal content, HealthKit data, medication records, or AI conversations.

4.1 RevenueCat (Subscription Management)

We use RevenueCat to manage subscription billing. RevenueCat may receive: a randomly generated app-vendor identifier (IDFV), your IP address, app and iOS version, and purchase event signals from Apple’s StoreKit. RevenueCat does not receive any health data. RevenueCat is a US-based service; your purchase data is transferred to the United States under RevenueCat’s standard data processing terms. See https://www.revenuecat.com/privacy.

PIPEDA cross-border note: RevenueCat’s processing of purchase data in the United States is subject to US law. You may direct questions about this cross-border transfer to our Privacy Officer.

4.2 Apple (HealthKit, iCloud, MetricKit, StoreKit)

HealthKit: Health data is stored locally or in your iCloud — not in Hanzo’s systems
iCloud CloudKit: Your encrypted data is managed by Apple under Apple’s iCloud Terms
MetricKit: Apple may deliver anonymised crash reports and performance diagnostics (OS version, app version, CPU/memory telemetry) to help us identify crashes. This data does not include your health or journal data. MetricKit diagnostics are retained for up to 90 days, then deleted
StoreKit: Apple processes all in-app purchases. We do not receive your payment information

Section 5 — Data Retention

We do not operate servers that hold your health data — you control it entirely through your device and iCloud account.

Local data: Retained until you delete it in-app or uninstall the app
iCloud data: Retained in your iCloud account until you delete it in-app or remove Hanzo Health’s iCloud access via your Apple ID settings
RevenueCat purchase records: Retained as required for subscription management and legal compliance (typically 7 years for financial records under Canadian law)
MetricKit diagnostics: Retained for up to 90 days for crash analysis, then deleted

Section 6 — PIPEDA — Canada’s Fair Information Principles

Hanzo Technologies is committed to the ten fair information principles set out in Schedule 1 of PIPEDA. The following describes how we meet each principle:

Principle	How We Apply It
1. Accountability	Ezequiel Rodriguez is designated Privacy Officer and is responsible for Hanzo Technologies’ compliance with PIPEDA
2. Identifying Purposes	The purpose of collecting personal information is identified in this policy before or at the time of collection
3. Consent	We obtain meaningful, express consent before collecting health data — which PIPEDA classifies as sensitive. Consent is obtained through the iOS HealthKit permissions dialog and the in-app onboarding consent screen
4. Limiting Collection	We collect only the personal information necessary for the stated purposes — primarily to provide the journaling and health tracking features
5. Limiting Use, Disclosure, and Retention	Personal information is used only for the purposes identified. We do not disclose health data to third parties. Purchase data is retained only as long as required by law
6. Accuracy	You can update and correct all data you enter directly in the app at any time
7. Safeguards	Data is protected by iOS device encryption, optional Keychain app lock, and end-to-end iCloud encryption. See Section 8
8. Openness	This policy is publicly available at https://www.hanzotechnologies.com/privacy and within the App
9. Individual Access	You may request access to and correction of personal information we hold about you. See Section 7
10. Challenging Compliance	You may direct privacy challenges to our Privacy Officer or to the Office of the Privacy Commissioner of Canada

Bill C-27 / CPPA Forward Compatibility

The Consumer Privacy Protection Act (Bill C-27) received Royal Assent but is not yet in force as of the effective date of this policy. When it comes into force, Hanzo Technologies will update this policy to address any additional requirements. This policy is designed to be substantially compatible with the CPPA’s framework, including its provisions on sensitive data (health information), consent, data minimisation, and individual rights.

Section 7 — Your Rights Under PIPEDA

7.1 Right of Access

You have the right to request access to personal information we hold about you and to receive an explanation of how it is being used. We will respond to access requests within 30 days (or notify you of an extension of up to 30 additional days for complex requests, with reasons provided).

7.2 Right to Correction

You have the right to challenge the accuracy and completeness of personal information we hold and to request corrections. Most of your data can be corrected directly within the app.

7.3 How to Submit a PIPEDA Request

Contact our Privacy Officer:

Ezequiel Rodriguez, Privacy Officer
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com
Subject line: “PIPEDA Privacy Request — [Access / Correction / Complaint]”

We will acknowledge your request within 5 business days and respond substantively within 30 days.

7.4 In-App Data Controls

Delete all data: Settings → Data → Delete All Data
Export data: Settings → Data → Export (PDF doctor report)
Revoke HealthKit access: iOS Settings → Privacy & Security → Health → Hanzo Health
Disable iCloud sync: iOS Settings → [Your Name] → iCloud → Hanzo Health

7.5 Complaints to the OPC

If you are not satisfied with our response to your privacy request, you may file a complaint with the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC, K1A 1H3
Toll-free: 1-800-282-1376
Web: www.priv.gc.ca

Section 8 — Quebec Residents — Law 25

If you reside in Quebec, the following additional rights and protections apply under Quebec’s Law 25 (Act Respecting the Protection of Personal Information in the Private Sector, as amended).

French-language policy: A full French-language version of this policy, with all Quebec-specific requirements, is available at /fr-ca/politique-de-confidentialite.md.

Key Quebec rights:

Right to access and correct: You may request access to and correction of personal information we hold about you
Right to portability: You may request that personal information be communicated to you or to a third party you designate, in a structured, commonly used technological format
Right to destruction / de-indexation: You may request that personal information about you be destroyed, to the extent technically feasible, or that any hyperlink providing access to such information be de-indexed
Right to object to automated decisions: If an automated decision significantly affects you, you may request a review and ask for a human review

Privacy impact assessment: Hanzo Health uses Apple Foundation Models (on-device AI) to generate health insights. A Privacy Impact Assessment (PIA/EFVP) for this feature was conducted and found that all AI processing occurs entirely on-device, with no transfer of personal information to external systems.

Complaints: Quebec residents may direct privacy complaints to:

Commission d’accès à l’information du Québec
Web: www.cai.gouv.qc.ca
Telephone: 1-888-528-7741

Section 9 — Children and Minors

Hanzo Health is intended for users aged 16 and over (13 and over in the United States and United Kingdom). In Quebec, users under 14 require parental or guardian consent.

We do not knowingly collect personal information from anyone below the applicable minimum age. If you believe a minor has provided us with personal information, please contact us at quielo@hanzotechnologies.com and we will delete it promptly.

Section 10 — Security and Breach Notification

Your data is protected at multiple levels:

On-device storage: Encrypted by iOS using your device passcode
App lock: Optional 6-digit passcode stored in iOS Secure Keychain
iCloud sync: End-to-end encrypted by Apple; Hanzo cannot access your iCloud data
HealthKit access: Read-only; the app cannot write unsolicited data to Apple Health

Breach notification — PIPEDA BSSR: In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm (RROSH) to individuals, we will:

Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible
Notify affected individuals directly if the breach poses a real risk of significant harm
Maintain a record of all security breaches (including those that do not meet the RROSH threshold) for a minimum of 24 months

Additional notifications (where applicable):

Quebec: Notify the Commission d’accès à l’information within 72 hours of becoming aware of a confidentiality incident posing a risk of serious injury
EU/EEA: 72 hours under GDPR
Australia: Within 30 days under the Notifiable Data Breaches scheme
New Zealand: Without undue delay under the Privacy Act 2020

To report a security concern: quielo@hanzotechnologies.com

Section 11 — HealthKit Entitlements

Hanzo Health holds Apple’s authorisation to access standard HealthKit data types (as listed in Section 1.1). The app does not access clinical health record (EHR) data in the current version. If this changes in a future version, this policy will be updated and users will be notified.

Section 12 — Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the effective date and notify you via an in-app notice. Continued use of the app after an updated policy is posted constitutes acceptance. Previous versions are available by contacting quielo@hanzotechnologies.com.

Section 13 — Contact

Ezequiel Rodriguez, Privacy Officer
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com
Subject line: “Privacy Request — [your request type]”

We will acknowledge your request within 5 business days and respond substantively within 30 days (PIPEDA standard).