Privacy policy

HealthVault365 is operated by Flintarc Limited (opens in new tab), a company registered in New Zealand (NZBN 9429053747259 (opens in new tab)). Flintarc Limited is responsible for the personal and health information you store in the service.

As a New Zealand company, we handle your information under the Privacy Act 2020, and we treat your health information under the Health Information Privacy Code 2020. Our privacy officer is the contact for anything in this policy: privacy@healthvault365.com.

We collect what you give us, and basic technical data needed to run the service:

• Account details, such as your name and email.
• Your health identifiers (such as your NHI, IHI or Medicare number), date of birth, phone, and address.
• Your allergies, conditions, and GP details.
• The documents you upload and the health records you add.
• Information about family members you add, including children who do not sign in.
• Basic technical data needed to run the service, such as error records.

All of it comes from you. When you add a family member, you give us their information, so only add someone you are the parent or guardian of, or who has agreed to it.

We use your information only to provide HealthVault365: storing, reading, and organizing your records so you can find them when you need them. We do not sell your data, we do not use it for advertising, and we do not use your health information to train AI models.

These are the people and services that handle your data so we can run HealthVault365:

• Flintarc Limited runs the service. A small number of Flintarc staff can reach the systems to run it.
• Microsoft Azure is the cloud the service runs on, including its database, file storage, and error records.
• Microsoft Azure AI services read your documents and help answer your questions. To do this, the service sends them content from your documents and records. Microsoft runs automated checks for misuse of its AI services, and authorized Microsoft staff may review content those checks flag.
• Microsoft Entra, a sign-in service from Microsoft, handles sign-in and holds the details you use to sign in.

Your documents and health records are stored in Microsoft Azure data centers in New Zealand. Some processing happens elsewhere. To read documents and answer questions, content is processed by Microsoft Azure AI services in the United States, because the AI models the service uses are not yet available in New Zealand. Microsoft Entra, which handles sign-in, holds your sign-in details outside New Zealand. Microsoft does this to run the service for us, and we remain responsible for your information under New Zealand law wherever it is processed.

Records are encrypted when stored and when sent. Records for family members you add stay in your account. The security overview has the detail.

If a privacy breach is likely to cause serious harm, we will tell you and the Privacy Commissioner as soon as we practicably can.

We use only the cookies the service needs: two sign you in and keep you signed in, and one remembers which family member you are viewing. We do not use advertising or analytics cookies.

You can see and edit most of your information in your account. You can also ask us for a copy of the information we hold about you, or ask us to correct it, by emailing privacy@healthvault365.com. We reply within 20 working days.

If we do not make a correction you ask for, we will tell you why, and you can ask us to keep your statement of the correction with the information.

• Deleting your account removes your data and your sign-in account from the service.
• Deleting your account is blocked while you manage family members or while documents are still processing.
• Copies, including your deleted sign-in account, can remain in encrypted backups, internal processing history and our sign-in directory for up to 35 days, and are then deleted automatically.

Email our privacy officer at privacy@healthvault365.com with a question or a complaint. If we cannot resolve your complaint, you can complain to the Privacy Commissioner (opens in new tab).

When we change this policy, we publish the new version here and update its effective date.