Privacy Policy — Hanzo Health (New Zealand)

Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Business registration: BC1576110 (British Columbia, Canada)
Contact: quielo@hanzotechnologies.com
Website: www.hanzotechnologies.com

Effective date: 2026-06-17
Version: 2.1-NZ
Jurisdiction: New Zealand
Legal framework: Privacy Act 2020 (NZ) · Information Privacy Principles (IPPs)

Summary

Hanzo Health is a private, on-device health journaling app. Your health data stays on your device or in your own encrypted iCloud account. We do not run servers that receive your health information. We do not sell, rent, or share your health data with anyone.

Section 1 — Who We Are

The agency responsible for your personal information is:

Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com

Privacy Contact:
Ezequiel Rodriguez
Email: quielo@hanzotechnologies.com
Subject: “New Zealand Privacy Request”

Section 2 — The Information Privacy Principles (IPPs)

Hanzo Technologies is bound by the 13 Information Privacy Principles set out in the Privacy Act 2020. The following sections describe how we comply with each relevant principle.

Section 3 — Personal Information We Collect (IPP 1 and IPP 3)

We collect only the personal information necessary to provide the App’s features to you (IPP 1 — purpose of collection). We collect personal information directly from you wherever reasonably practicable (IPP 2).

3.1 Health Information (Sensitive by Nature)

While the Privacy Act 2020 does not define a separate category of “sensitive” information, health information is recognised as information that can be particularly sensitive and is collected only with your express consent.

Health information from Apple Health (HealthKit) — only with your permission:

Sleep analysis, step count, heart rate, HRV, SpO2, respiratory rate
Active and basal energy, exercise and stand time, workout data
Menstrual flow, body weight, BMI, blood pressure, blood glucose, body temperature, VO2 max, mindfulness minutes, dietary energy

Health information you enter directly:

Mood, energy, and symptom ratings
Free-text journal notes and entries
Flare logs, condition tags, custom fields

Medication tracking data (if used):

Medication names, doses, and daily adherence logs

3.2 Other Personal Information

Category	Content	Purpose
AI conversation history	AI chat inputs and outputs	AI health insights feature
Purchase data (RevenueCat)	Device identifier (IDFV), IP address, purchase events	Subscription management
Crash diagnostics (MetricKit)	Anonymised crash reports and performance data	App stability

Section 4 — Notice at Collection (IPP 3)

At or before the time we collect personal information from you, we take reasonable steps to ensure you are aware of:

The fact that the information is being collected and the purpose for collection
The intended recipients of the information
The name and address of the agency collecting the information
Your right to access and correct the information

This Privacy Policy provides that notice.

Section 5 — How We Use Personal Information (IPP 10 and IPP 11)

We use personal information only for the primary purpose for which it was collected. We do not use personal information for secondary purposes without your consent, except as permitted by the Privacy Act 2020.

We do not disclose health information, journal content, or medication records to any third party.

Section 6 — Disclosure Overseas (IPP 12)

We disclose limited non-health personal information to overseas recipients:

Recipient	Country	Information	Safeguard
RevenueCat, Inc.	United States	Device identifier, IP address, purchase events	Contractual obligations equivalent to IPPs
Apple Inc. (MetricKit)	United States	Anonymised crash diagnostics	Apple’s Privacy Policy

Before disclosing personal information to RevenueCat overseas, we have ensured that RevenueCat will not hold the information in a way that, in all the circumstances, breaches the IPPs (IPP 12(1)(b)).

Canada: Hanzo Technologies is based in Canada. Canada’s privacy laws (PIPEDA) provide a comparable level of protection. We take reasonable steps to ensure your personal information in Canada is protected consistently with the IPPs.

Section 7 — AI Features

All AI features operate entirely on your device using Apple Foundation Models. No health data is sent to external AI systems. AI-generated content is clearly labelled within the App.

Section 8 — Data Security (IPP 5)

We take reasonable steps to protect personal information from loss, misuse, and unauthorised access, modification, or disclosure:

iOS device encryption (on-device storage)
Optional Keychain-secured 6-digit app lock
Apple end-to-end encryption (iCloud sync)
Read-only HealthKit access

Section 9 — Mandatory Breach Notification

Under the Privacy Act 2020, we are required to notify the Privacy Commissioner and affected individuals of any privacy breach that has caused, or is likely to cause, serious harm.

We will:

Notify the Privacy Commissioner as soon as practicable after becoming aware of a notifiable privacy breach
Notify affected individuals as soon as practicable after notifying the Commissioner (or at the same time)

To report a security concern: quielo@hanzotechnologies.com

Section 10 — Your Rights (IPP 6 and IPP 7)

Right to access (IPP 6): You have the right to request access to personal information we hold about you. We will respond within 20 working days (as required by the Privacy Act 2020).

Right to correction (IPP 7): You have the right to request correction of personal information we hold about you that is inaccurate, misleading, or not up to date.

In-app controls:

Delete all data: Settings → Data → Delete All Data
Export data: Settings → Data → Export (PDF)
Revoke HealthKit: iOS Settings → Privacy & Security → Health → Hanzo Health

Submitting a request:
Email: quielo@hanzotechnologies.com
Subject: “New Zealand Privacy Request — [Access / Correction / Complaint]”

Section 11 — Privacy Complaints

If you believe we have breached the Privacy Act 2020, you may:

Contact us first: quielo@hanzotechnologies.com — we will endeavour to resolve your complaint within 20 working days
If unresolved, make a complaint to the Privacy Commissioner:

Office of the Privacy Commissioner
PO Box 10094, Wellington 6143
Telephone: 0800 803 909
Web: privacy.org.nz
Online complaint: privacy.org.nz/your-rights/making-a-complaint

Section 12 — Children

Hanzo Health is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact quielo@hanzotechnologies.com and we will delete it promptly.

Section 13 — Changes to This Policy

We may update this policy from time to time. Material changes will be notified via an in-app notice. Continued use after an updated policy is posted constitutes acceptance.

Section 14 — Contact

Ezequiel Rodriguez, Privacy Contact
Hanzo Technologies Inc.
66 Cordova St W, Vancouver, BC, V6B 1C9, Canada
Email: quielo@hanzotechnologies.com
Subject: “New Zealand Privacy Request”