Privacy policies and terms of service for Hanzo Health by Hanzo Technologies Inc.
View the Project on GitHub quielorodriguez/hanzo-health-privacy
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Business registration: BC1576110 (British Columbia, Canada)
Contact: quielo@hanzotechnologies.com
Website: www.hanzotechnologies.com
Effective date: 2026-06-17
Version: 2.1-GB
Jurisdiction: United Kingdom
Legal framework: UK GDPR (retained EU law) · Data Protection Act 2018 · Data Protection and Digital Information Act (DPDI) — awareness note
Base policy: en/privacy-policy.md v2.1
This UK Privacy Policy supplements and, for UK residents, supersedes our global base Privacy Policy. It is provided pursuant to the UK General Data Protection Regulation (UK GDPR, as retained in UK law by the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018 (DPA 2018).
UK GDPR diverges from EU GDPR following Brexit. This policy reflects UK-specific requirements, including ICO authority, UK data transfer mechanisms, and UK data subject rights.
Hanzo Health is a private, on-device health journaling app. Your health data stays on your device or in your own encrypted iCloud account. We do not run servers that receive your health information. We do not sell, rent, or share your health data with anyone.
The data controller responsible for your personal data is:
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com
UK Representative (UK GDPR Article 27): Hanzo Technologies Inc. has not appointed a formal UK Article 27 representative. This is a deliberate decision at our current company size and will be revisited as the company grows. UK users may contact our Privacy Officer directly at quielo@hanzotechnologies.com for any UK GDPR-related request.
Health data is a special category of personal data under Article 9 UK GDPR and receives the highest level of protection.
| Data Category | Examples | Legal Basis |
|---|---|---|
| Health data (HealthKit) | Sleep, heart rate, menstrual cycle, blood glucose, weight, VO2 max, and 15 other types | Explicit consent — Article 9(2)(a) UK GDPR |
| Journal and symptom data | Mood ratings, free-text notes, flare logs, condition tags | Explicit consent — Article 9(2)(a) UK GDPR |
| Medication tracking data | Medication names, doses, adherence logs | Explicit consent — Article 9(2)(a) UK GDPR |
| AI conversation history | Messages you send to the AI assistant; AI responses | Explicit consent — Article 9(2)(a) UK GDPR |
| Subscription / purchase data | App-vendor device identifier (IDFV), IP address, purchase events | Contract performance — Article 6(1)(b) UK GDPR |
| Crash diagnostics (MetricKit) | Anonymised crash reports, CPU/memory telemetry, app version | Legitimate interests — Article 6(1)(f) UK GDPR |
Withdrawing consent: You may withdraw consent at any time by revoking HealthKit permissions (iOS Settings → Privacy & Security → Health → Hanzo Health) or by deleting your data (Settings → Data → Delete All Data). Withdrawal does not affect the lawfulness of processing before withdrawal.
All health data, journal entries, medication records, and AI conversation history are stored on your device using Apple’s SwiftData encrypted storage. None of this data is transmitted to Hanzo’s servers.
If you enable iCloud sync, your data is stored in your private encrypted iCloud account managed by Apple, subject to Apple’s iCloud Terms and Privacy Policy.
None of the following processors receive your health data, journal content, medication records, or AI conversations.
Purpose: Subscription billing and entitlement management
Data transferred: App-vendor device identifier (IDFV), IP address, app version, iOS version, purchase event signals
Location: United States
Transfer mechanism: UK International Data Transfer Agreement (IDTA) issued by the ICO, or UK Addendum to EU Standard Contractual Clauses (SCCs)
Privacy policy: https://www.revenuecat.com/privacy
HealthKit: Health data stored locally or in your iCloud. Not transmitted to Hanzo.
iCloud CloudKit: Encrypted data in your personal iCloud account. Governed by Apple’s iCloud Terms and Apple’s UK data transfer agreements.
MetricKit: Anonymised crash and performance diagnostics. No health or journal data included. Retained up to 90 days.
StoreKit: Apple processes all in-app purchases. We do not receive payment data.
Hanzo Technologies Inc. is based in Canada. The UK has adopted an adequacy regulation for Canada under UK GDPR Article 45 (The Adequacy Decisions for Canada (Commercial Organisations) Regulations), meaning transfers of personal data from the UK to Hanzo Technologies are permitted without additional safeguards.
For transfers to RevenueCat (United States), we rely on the UK International Data Transfer Agreement (IDTA) issued by the ICO, or the UK Addendum to EU Standard Contractual Clauses. Copies are available on request: quielo@hanzotechnologies.com.
All AI features in Hanzo Health operate entirely on your device using Apple Foundation Models. No health data is sent to external AI systems. AI-generated content (Hanzo Score, insights, summaries) is clearly labelled within the App.
As a UK resident you have the following rights:
| Right | What It Means | How to Exercise |
|---|---|---|
| Access (Art. 15) | Right to a copy of your personal data | Contact us or use in-app export |
| Rectification (Art. 16) | Right to correct inaccurate data | Edit directly in the app |
| Erasure (Art. 17) | Right to have your data deleted | Settings → Data → Delete All Data, or contact us |
| Restriction (Art. 18) | Right to restrict processing in certain circumstances | Contact us |
| Portability (Art. 20) | Right to receive your data in a structured, machine-readable format | Settings → Data → Export; other formats on request |
| Objection (Art. 21) | Right to object to processing based on legitimate interests | Contact us |
| Withdraw consent | Right to withdraw consent at any time | Revoke HealthKit permissions or delete all data |
| Lodge a complaint | Right to complain to the ICO | See Section 9 |
Response times: We will acknowledge your request within 5 business days and respond substantively within one calendar month (extendable by two further months for complex requests, with notice).
To exercise any right:
Ezequiel Rodriguez, Privacy Officer
Email: quielo@hanzotechnologies.com
Subject: “UK GDPR Request — [Right / Type]”
You have the right to lodge a complaint with the UK data protection supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Web: ico.org.uk
Online complaint form: ico.org.uk/make-a-complaint
We would appreciate the opportunity to address your concerns before you contact the ICO — please contact us first at quielo@hanzotechnologies.com.
Hanzo Health is intended for users aged 13 and over in the UK. Consistent with the UK Children’s Code (Age Appropriate Design Code), we apply the following protections for users under 18:
If you believe a child under 13 is using the app, please contact quielo@hanzotechnologies.com and we will delete the relevant data promptly.
Your data is protected by iOS device encryption, optional Keychain app lock, and Apple end-to-end iCloud encryption.
UK GDPR breach notification (Articles 33–34): In the event of a personal data breach, we will:
The UK is developing divergent data protection law through the Data Protection and Digital Information Act. We monitor this legislation and will update this policy as relevant provisions come into force. Our current practices are designed to comply with both UK GDPR as it stands and to be compatible with the direction of the DPDI reforms.
We may update this policy from time to time. Material changes will be notified via an in-app notice. Continued use after an updated policy is posted constitutes acceptance. Previous versions available on request.
Ezequiel Rodriguez, Privacy Officer
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com
Subject: “UK Privacy Request”
Hanzo Technologies Inc. · Vancouver, BC, Canada · quielo@hanzotechnologies.com
© 2026 Hanzo Technologies Inc. All rights reserved.