Privacy Policy

Effective date: 7 October 2026 · Policy version: 2026-10-02

Recomp Health Limited ("Recomp Health", "we", "us") is a company registered in New Zealand. We operate the Recomp Health mobile app, the web companion at app.recomphealth.org and the website recomphealth.org (together, the "Service"). This policy explains what personal information we collect, how we use and share it, and the choices you have. It applies wherever you live. Section 13 adds information for members in the United States.

If you live in Washington, Nevada or Connecticut, or anywhere else in the US, our Consumer Health Data Privacy Policy (recomphealth.org/consumer-health-data) also applies to your health information.

Contact: privacy@recomphealth.org · Recomp Health Limited, 21 Waimauku Station Road, Waimauku, Auckland 0812, New Zealand

Recomp Health provides informational tools for recording, organising and visualising information you provide or connect. Recomp Health is not a medical provider and does not diagnose, treat, cure or prevent disease.

1. Information we collect

Sleep and heart data from Apple Health. On iPhone, if you allow each type, we read sleep analysis (time asleep, time in bed and, when the source provides them, minutes in each sleep stage), heart rate variability and resting heart rate. We store them per day, as the source reports them, with the name of the app or device that recorded them (for example, Apple Watch), so we can show you your own values and where they came from. To tell you when a connected app or device has stopped sending data, the app also checks step counts from each source on your phone. Those per-source step counts stay on your phone; we don't store them on our servers.

We do not collect precise location, contacts, or payment card details. The Service is for adults aged 18 and over (section 11).

2. How we use it

• →To provide the Service you ask for: storing your records, showing trends and charts, generating reports, and creating images you choose to share.
• →To provide optional AI features, only if you turn them on (section 5).
• →To run your account and subscription.
• →To keep the Service secure, prevent misuse and fix errors.
• →To understand which features are used, without health information.
• →To contact you about your account, reports you request, and changes to this policy.
• →To meet legal obligations and to establish or defend legal claims.

We do not sell personal information, including health information. We do not use health information for advertising. We do not share it with data brokers, insurers or employers.

3. Your consents

Before you use the app, we ask for three separate consents. None is pre-ticked:

• 1.agreement to our Terms of Use and acknowledgement of this Privacy Policy;
• 2.consent to collect and process the health information you choose to log or connect;
• 3.consent to share that health information with the service providers in section 4, for the purposes described.

AI features need a separate, optional consent (section 5). Each decision is recorded on its own, with its wording version and time. Changes create a new record; nothing is overwritten.

You can withdraw consents 2 and 3, and turn AI off, at any time in Settings → Privacy & Consent. The app can't store or process health information without consents 2 and 3, so withdrawing either pauses the app until you consent again. Withdrawing does not delete your information. To delete it, use Delete my account and data (section 8).

4. Who we share it with

We share personal information only with service providers that process it for us, under contract, to run the Service. They may not use it for their own purposes, including advertising or sale.

Sharing you choose. When you share an image, export your data, or send a report to someone such as a clinician, dietitian or coach, you choose who receives it. Their own privacy practices then apply.

Other disclosures. We may disclose information when the law or a valid legal process requires it, to protect someone's safety, or as part of a merger, acquisition or sale of assets. In a sale, your information would stay subject to this policy, and we would tell you before it became subject to a different one.

5. AI features

AI is off until you turn it on through a separate consent screen. Our server checks for your current AI consent before every AI request. Without it, nothing is sent to our AI provider, and you see standard text instead.

When AI is on and you use an AI feature:

• →relevant information from your account is sent to Anthropic, our AI service provider. That means weight trends, body-composition data, nutrition and training information and, when you ask about them, your recorded medications and injections. Sleep and heart data from Apple Health are not currently sent;
• →we send only what the feature needs. Your name, email address and Recomp account ID are not intentionally included. Anything you type into a question is sent as written, so please don't include personal details;
• →we use the AI service only to provide the feature you asked for;
• →under Anthropic's applicable commercial terms, your AI inputs and outputs are not used to train Anthropic's models by default. Anthropic keeps API data for up to 30 days under those terms;
• →AI is optional. The Service works without it.

Recomp AI provides automated informational responses based on information available in your Recomp Health account. AI responses may be inaccurate, incomplete or inappropriate and are not medical advice, diagnosis or treatment. Do not use Recomp AI as the sole basis for medical, medication or treatment decisions.

6. Where your information is processed

Recomp Health is based in New Zealand. Your information is processed in Japan (database and email delivery), Australia (reports and database backups), the United States (AI, analytics, error monitoring, subscriptions and hosting) and New Zealand (our team and business email). Privacy laws in these countries may differ from yours. We use contracts with our providers to protect your information, and this policy applies wherever it is processed.

7. How long we keep it

8. Deleting your account and data

You can delete your account in the app: Settings → Privacy & Consent → Delete my account and data. You can also email privacy@recomphealth.org from your account email.

When you delete your account, we delete your information from our active systems: your records, photos and generated reports, your sign-in and your profile. We also ask our service providers to delete your information, or it is removed under their retention schedules, as required by applicable law.

Encrypted backup copies may remain temporarily until they expire on our backup schedule (section 7). They are not restored for ordinary use except where needed for disaster recovery, security or legal purposes. If a backup is ever restored, we delete any account that had already been deleted before the restored data is used. US residents: see the Consumer Health Data Privacy Policy for state-specific deletion rules.

Deleting the app from your phone does not delete your account. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store settings. Disconnecting Apple Health or Health Connect stops new imports but does not delete information already imported.

9. Seeing, correcting and exporting your information

You can view and correct most of your information in the app. You can export your data at any time (CSV, and FHIR where available) from the Export Centre. For anything else, email privacy@recomphealth.org.

10. Analytics, error reports and cookies

• →In the app: we use PostHog to count feature use, never your values or any medication, dose, injection site, symptom, nutrition, lab, sleep, heart-rate or photo information. Error reports go to Sentry after health values, database contents, email addresses and tokens are removed.
• →On the website: we use PostHog and Microsoft Clarity on public pages only, and only after you choose "Accept analytics" on the website's banner. If you choose "No thanks", or your browser sends a Global Privacy Control signal, they don't load. You can change your choice at any time with "Analytics choices" in the footer. Clarity is never used in the app or the web companion. Session recordings mask text. We don't sell data or run advertising, so there is no "sale" or "sharing for advertising" to opt out of. We treat Global Privacy Control signals as an opt-out of anything that would count as either.

11. Children

The Service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you think a minor has given us information, email privacy@recomphealth.org and we will delete it.

12. Security and security incidents

We protect your information with encryption in transit and at rest, access controls that let each account reach only its own records, limited administrative access, and the removal of health information from error and usage data. No system is completely secure, and we can't promise an incident will never happen.

If a security incident affects your information, we will investigate and contain it, and notify you and the relevant authorities where the law requires. That includes the New Zealand Privacy Commissioner and, in the US, the Federal Trade Commission under its Health Breach Notification Rule.

13. If you live in the United States

• →Rights: you can ask to:
  • access the personal information we hold about you, and get a portable copy;
  • correct it;
  • delete it;
  • withdraw your consents.

We give these rights to every member, whatever state you live in.

• →How to ask:
  • use the in-app controls, or email privacy@recomphealth.org from your account email;
  • we confirm requests by checking you control that email;
  • someone you authorise in writing can ask for you.
• →Response times:
  • we respond within 45 days, extendable once by 45 days when reasonably necessary (we'll tell you);
  • if we decline, you can appeal by replying with "Appeal" in the subject line. We answer appeals within 45 days;
  • if you're still not satisfied, you can contact your state Attorney General.
• →Fair treatment: we will not treat you differently for using these rights.
• →Consumer health data: Washington, Nevada and Connecticut residents have further rights over health information. See the Consumer Health Data Privacy Policy.

14. Changes to this policy

When we make a material change, we will update the effective date and tell you in the app. Where the change affects something you consented to, we will ask for your consent again before it applies to you.

15. New Zealand and Australia

We handle personal information in line with the New Zealand Privacy Act 2020, and the Australian Privacy Principles where they apply. You can complain to the Office of the Privacy Commissioner (privacy.org.nz) or, in Australia, the OAIC (oaic.gov.au), though we'd like the chance to fix things first: privacy@recomphealth.org.