1. INTRODUCTION

Medipoint Limited (NZBN 9429046211170) ("Medipoint", "we", "us", "our") is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, transfer, and protect your information when you visit our website at medipoint.co.nz and any other site, application or service we operate (the "Service").

Medipoint is the sole controller of your personal information for the purposes of all applicable privacy and data protection laws. Our affiliates, referral partners, distributors and resellers are not controllers, processors or agencies in respect of your information. Any complaint, request or regulatory inquiry regarding your information must be directed to Medipoint.

This Privacy Policy should be read together with our Terms and Conditions and, where applicable, our Affiliate Agreement.

1.1 Laws We Comply With

Depending on where you are resident or where your information is processed, we comply with:

• the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020;
• the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, including APP 8 (cross-border disclosure of personal information), where the Service is offered to or used by Australian residents;
• for residents of the United States, applicable US federal and state privacy laws including the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and other comparable state laws as they come into force; and the Children's Online Privacy Protection Act ("COPPA");
• the EU General Data Protection Regulation and the UK GDPR, where applicable to users in those jurisdictions.

Where the laws of more than one jurisdiction apply to your information, we will apply the standard that gives you the greater protection.

2. DEFINITIONS

"Health Information" means information about your physical or mental health, medical conditions, medications, allergies, blood type, healthcare providers, emergency contacts, and any related notes — including, in New Zealand, "health information" as defined in the Health Information Privacy Code 2020 and, in the United States, where applicable, "protected health information" or "sensitive personal information".

"Personal Information" means information about an identified or identifiable individual, including "personal information" under the Privacy Act 2020 (NZ) and the Privacy Act 1988 (Cth), and "personal data" or "personal information" under applicable US state privacy laws and the GDPR.

"Sensitive Personal Information" has the meaning given under the CCPA/CPRA and other US state privacy laws, and includes Health Information.

"Sell" and "Share" have the meanings given under the CCPA/CPRA. We do not Sell or Share your Personal Information.

3. INFORMATION WE COLLECT

3.1 Information You Provide

When you create a Medipoint account or profile, we may collect:

Category	Information	Purpose
Account information	Email address, name, account preferences	Account creation, verification, and notifications
Health Information	Medical conditions, allergies, medications, blood type, healthcare provider details, medical notes	Displayed on your medical profile when your QR code is scanned
Emergency contacts	Names and phone numbers of one or more emergency contacts	Displayed on your medical profile for emergency responders
Profile photo (optional)	A photo of yourself for identification on your profile	Displayed on your medical profile to help identify you
Payment information	Credit/debit card details, billing address (processed by Stripe — we do not store full card details)	Processing your card purchase
Delivery information	Postal address	Shipping your physical Medipoint card
Communications	The content of messages you send to our support team	Responding to your enquiries

3.2 Information Collected Automatically

• Device and browser information: browser type, operating system, device type, screen size.
• Usage data: pages visited, features used, time spent, referral source.
• IP address: for security, fraud prevention, rate limiting, and approximate geolocation (country/region only) to suggest a default display language.
• QR code scan events: the date and time your QR code is scanned. We do not record the identity, IP address, precise location, or device of the person scanning your code.
• Cookies and similar technologies: see Section 12.

3.3 Information from Affiliates and Referral Partners

If you sign up via a referral link or code from an affiliate, we receive the referral code identifying the partner. We do not receive any other Personal Information about you from affiliates. Affiliates do not have access to your account, profile or Health Information.

4. HOW WE USE YOUR INFORMATION

We use your information for the following purposes only:

• Providing the Service: displaying your medical profile when your QR code is scanned; maintaining your account; authenticating you via PIN or, where no PIN is set, by matching the email address used at the time of purchase.
• Order fulfilment: processing payments and delivering your physical card.
• Service communications: trial reminders, profile completion prompts, security alerts, and updates about your card.
• Security and fraud prevention: detecting and preventing unauthorised access, abuse, or misuse.
• Service improvement: aggregated and de-identified analytics about how the Service is used.
• Legal compliance: meeting our obligations under applicable laws, responding to lawful requests from authorities, and enforcing our Terms and Conditions.

4.1 Use Limitation

• sell, rent, license, trade or commercially exchange your information;
• use your information (including in de-identified or aggregated form) to train artificial intelligence or machine learning models;
• derive, infer or generate any new information about you from the information you provide (for example, we will not infer diagnoses, risk scores, behavioural traits, or category memberships);
• aggregate your information with that of other users for any purpose other than basic anonymous service-improvement metrics;
• profile you, score you, or subject you to automated decision-making;
• augment your information with data from third-party sources, data brokers, or public records;
• use your information for research, behavioural analytics, or product analytics beyond basic service-improvement metrics;
• share your information with insurers, employers, government agencies (except as required by law), advertisers, or marketing partners;
• use your information for any purpose materially different from the purpose for which it was collected.

This limitation applies for as long as we hold your information and survives termination of your account.

4.2 Legal Bases for Processing (where applicable)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the Service you have requested.
• Consent: for the collection and display of Health Information via QR code, and for any optional features.
• Legitimate interests: for security, fraud prevention, and basic service improvement.
• Legal obligation: for tax records and lawful requests.

5. HEALTH INFORMATION

Health Information is among the most sensitive categories of personal information. We treat it with particular care and in accordance with the Health Information Privacy Code 2020 (NZ) and equivalent protections in other jurisdictions.

5.1 Open Access by Design

Your medical profile is intentionally accessible to anyone who scans your Medipoint card's QR code. No password, login or app is required. This is a deliberate design choice — in an emergency, requiring authentication would defeat the purpose of the card. By using the Service you acknowledge and accept this design.

You control what information is included in your profile. You should only include information you are comfortable being seen by anyone who has physical possession of your card.

5.2 No HIPAA Covered Entity Status (US)

Medipoint is not a "covered entity" or "business associate" as those terms are defined in the United States Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Information you provide to Medipoint is not subject to HIPAA. Medipoint does not provide medical care, diagnosis, or treatment. If you are a HIPAA-regulated healthcare provider considering using the Service in connection with your patients, you are responsible for ensuring your use complies with HIPAA, and you should not assume any HIPAA-equivalent protections apply by default.

5.3 Translation

Your medical information may be displayed in multiple languages to assist healthcare providers. Translations are performed via a third-party translation service (see Section 6) and are provided as an aid only. Medipoint does not warrant the accuracy of translated medical terminology. The original-language version controls.

6. SHARING AND DISCLOSURE

We do not sell, rent, or trade your Personal Information or Health Information to third parties. We share information only in the following limited circumstances:

• QR code scanning: your medical profile is displayed to anyone who scans your QR code (this is the core Service).
• Payment processing: your payment details are shared with our PCI-DSS compliant payment processor, Stripe, to complete transactions.
• Postal delivery: your delivery address is shared with our shipping carrier to deliver your physical card.
• Hosting and infrastructure: our web hosting and database provider stores and processes information on our behalf under arrangements that require comparable protections to those in this Policy. Hosting location is set out in Section 7.1.
• Email and communications: service emails (such as account verification, trial reminders and order confirmations) are sent on our behalf by our transactional email provider.
• Translation services: where your profile is being viewed by a scanner in a different language, the text shown may be sent to a third-party translation service to render it in the scanner's language. Only the visible profile text is sent — no account credentials, payment details, or identifiers beyond what is already displayed on the open profile.
• Geolocation lookup: we use a third-party IP geolocation service to suggest a default display language; only your IP address is sent.
• Affiliate partners: where you signed up via a referral code, we share with that partner only (i) confirmation of signup, (ii) the referral code, and (iii) the date of signup, for attribution and commission tracking. We never share your name, contact details, medical profile or any other Personal Information with affiliate partners.
• Legal requirements: we may disclose information if required by law, court order, or valid government request, or to protect our rights, property or safety, or the safety of others.
• Business transfer: in the event of a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will notify affected users in advance and the recipient must agree to comply with this Policy or seek your consent to any change.

7. CROSS-BORDER DATA TRANSFERS

7.1 Where Your Data Is Hosted

Your Personal Information and Health Information are hosted on commercial cloud infrastructure. Medipoint will, on request to admin@medipoint.co.nz, confirm in writing the name of the current hosting provider and the country in which your data is stored. We transfer your information to other jurisdictions only as necessary to provide the Service, including for payment processing and translation as described in Section 6.

7.2 Compliance with Cross-Border Rules

Where your information is transferred to or processed in a jurisdiction other than the one in which you are resident:

• New Zealand residents: we comply with Information Privacy Principle 12 of the Privacy Act 2020 by ensuring the recipient is bound by privacy protections comparable to those in the Privacy Act 2020 or has agreed to comparable protections by contract.
• Australian residents: we comply with Australian Privacy Principle 8 by taking reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles.
• EU/UK residents: we rely on Standard Contractual Clauses approved by the European Commission and/or UK Information Commissioner's Office, or other lawful transfer mechanisms.
• US residents: we apply protections at least equivalent to those required under applicable US state privacy laws.

8. DATA STORAGE AND SECURITY

8.1 Security Measures

We implement administrative, technical and physical safeguards designed to protect your information. These include:

• Encryption in transit: all communication with the Service is over HTTPS / TLS, and HTTP Strict Transport Security (HSTS) is enforced for one year on all subdomains.
• Authentication: edits to your profile, and access to the document vault, require either a numeric PIN or, where no PIN is set, the email address used at the time of purchase. PINs are stored using industry-standard bcrypt hashing — your PIN itself is never stored or recoverable in plain text.
• Rate limiting and lockout: after five failed authentication attempts from the same source within a short period, further attempts are temporarily blocked to deter brute-force guessing.
• Timing-safe comparisons: PIN and email checks use constant-time comparison to defeat timing-based side-channel attacks.
• Session security: session cookies are marked Secure, HttpOnly and SameSite=Lax to reduce the risk of session theft via cross-site scripting or cross-site request forgery.
• Document vault access controls: uploaded documents are stored under randomly-generated, unguessable filenames and are served only through an authenticated streaming endpoint that verifies your session before releasing any file. Path-traversal protection prevents access to files outside your own vault.
• Bot and abuse prevention: honeypot and bot-detection measures on signup forms.
• Payment processing: all card payments are handled by Stripe, our PCI-DSS compliant payment processor — we do not see or store full card details.
• Restricted internal access: administrative access to user records is limited and controlled.
• Production hardening: error messages shown to users are generic; technical details (file paths, stack traces, internal versions) are logged privately and never exposed in the user interface.
• Ongoing review: we regularly review and update our security practices in line with the sensitivity of the information we hold.

Areas we are continuing to mature include encryption at rest, formal audit logging, periodic independent security testing, and a fully documented incident response plan. Where you require evidence of any specific control, contact us at admin@medipoint.co.nz.

No security measures are perfect. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

8.2 Notifiable Privacy Breaches

In the event of a privacy breach affecting your Personal Information or Health Information, we will:

• assess the breach to determine its nature, scope and likely consequences;
• where the breach is a notifiable breach under the Privacy Act 2020 (NZ), notify the Office of the Privacy Commissioner as soon as practicable;
• where applicable, notify the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme within the timeframe required by Australian law;
• where applicable, notify US state Attorneys General and other regulators in accordance with applicable state breach notification laws;
• notify affected individuals as soon as practicable, with a description of the breach, the information involved, the steps we are taking, and steps you can take to protect yourself;
• notify any affiliate or referral partner whose referred users are affected, so they can answer enquiries appropriately.

9. DATA RETENTION

We retain your information only for as long as necessary for the purposes set out in this Policy and as required by law:

Data Type	Retention Period
Active accounts	For as long as your account is active and your card is valid
Expired trial data	30 days after trial expiration, then permanently deleted
Deleted accounts	Permanently deleted within 10 working days of your deletion request, except where we are required by law to retain certain records
Payment records	7 years (NZ tax law); longer if required by US/AU tax law
Email verification tokens	14 days, then automatically purged
Email communication logs	90 days for service delivery purposes
Security logs	12 months for incident investigation purposes

10. YOUR RIGHTS

You have certain rights in respect of your Personal Information. Some rights apply universally; some apply only in particular jurisdictions, as set out below.

10.1 Universal Rights

• Access: request a copy of the Personal Information we hold about you.
• Correction: request correction of inaccurate or incomplete Personal Information. You can also update your profile directly at any time via your account.
• Deletion: request deletion of your account and all associated data. We will action this within 10 working days, subject to legal retention requirements.
• Withdrawal of consent: where we rely on your consent, you may withdraw it at any time.
• Complaint: see Section 13.

10.2 Rights of New Zealand Residents

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the rights set out in the Information Privacy Principles, including the right to access (IPP 6) and correct (IPP 7) your Personal Information. We will respond to access and correction requests within 20 working days.

10.3 Rights of Australian Residents

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to access (APP 12) and correct (APP 13) your Personal Information, and to make a privacy complaint. We will respond to access and correction requests within 30 days.

10.4 Rights of California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to know: the categories and specific pieces of Personal Information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete: request deletion of Personal Information we have collected from you, subject to limited exceptions.
• Right to correct: request correction of inaccurate Personal Information.
• Right to portability: receive a copy of your Personal Information in a portable format.
• Right to opt out of Sale or Sharing: we do not Sell or Share your Personal Information as those terms are defined under the CCPA/CPRA, but you may exercise this right at any time.
• Right to limit use of Sensitive Personal Information: we use your Sensitive Personal Information (including Health Information) only for the purposes set out in this Policy and do not use it for purposes that would trigger the right to limit. You may nevertheless submit a request to limit at any time.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at admin@medipoint.co.nz. We will verify your identity before responding. You may also designate an authorised agent to make a request on your behalf — see Section 10.7.

Notice of Financial Incentive: we do not offer financial incentives in exchange for the collection, sale or sharing of your Personal Information.

California "Shine the Light" (Civil Code §1798.83): we do not share your Personal Information with third parties for their direct marketing purposes.

10.5 Rights of Other US State Residents

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Jersey, New Hampshire, Kentucky, Minnesota, Maryland, Rhode Island, and other states with comparable privacy laws have substantially similar rights to access, correct, delete, and obtain a portable copy of their Personal Information, and to opt out of targeted advertising, sale of personal data, and certain profiling. We do not engage in any of these activities. To exercise your rights, contact us at admin@medipoint.co.nz. We will respond within 45 days (or such other period required by your state's law).

10.6 Appeals (US State Laws)

If we deny your request to exercise a right under a US state privacy law, you may appeal that decision by replying to our denial or contacting us at admin@medipoint.co.nz. We will respond to your appeal within 60 days (or such other period required by your state's law). If we deny your appeal, you may contact your state Attorney General to submit a complaint.

10.7 Authorised Agents

California residents and residents of other states that permit it may designate an authorised agent to make privacy requests on their behalf. We require written authorisation signed by you and proof of identity for both you and the agent.

10.8 Do Not Track / Global Privacy Control

Our website does not currently respond to "Do Not Track" browser signals because no consistent industry standard exists. Where required by applicable US state law, we treat the Global Privacy Control ("GPC") signal as a valid request to opt out of Sale or Sharing of Personal Information.

11. CHILDREN'S PRIVACY

The age at which we may collect Personal Information from a child without parental consent varies by jurisdiction:

• New Zealand and Australia: accounts may be created for children under 16 by their parent or legal guardian. The parent/guardian is responsible for the accuracy of information provided and for managing the account.
• United States (COPPA): we do not knowingly collect Personal Information from children under 13. Where a parent or legal guardian wishes to create an account for a child under 13, they must contact us directly to provide verifiable parental consent.
• EU/UK: we do not knowingly collect Personal Information from children under 16 (or such lower age as set by member state law) without verifiable parental consent.

If we become aware that we have collected information from a child below the applicable age threshold without appropriate parental consent, we will take prompt steps to delete that information. If you believe a child has provided us with information without parental consent, please contact us at admin@medipoint.co.nz.

12. COOKIES AND TRACKING

Our website uses:

• Strictly necessary cookies: for authentication and maintaining your logged-in state.
• UTM parameters: to understand how you found our service (e.g., which marketing channel or referral partner).
• Email open and click tracking: for service emails, to ensure our communications are reaching you.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. We do not allow third-party advertisers to track you on our website. We do not engage in targeted advertising.

Where required by applicable law, we will obtain your consent before placing non-essential cookies.

13. PRIVACY COMPLAINTS

If you have a privacy concern or complaint, please contact our Privacy Officer at admin@medipoint.co.nz. We will:

• acknowledge your complaint within 5 working days;
• investigate and respond substantively within 20 working days;
• escalate to senior management if not resolved at first instance.

If you remain dissatisfied, you may complain to the relevant privacy regulator:

• New Zealand: Office of the Privacy Commissioner — privacy.org.nz | 0800 803 909.
• Australia: Office of the Australian Information Commissioner — oaic.gov.au | 1300 363 992.
• United States: your state Attorney General; for California, the California Privacy Protection Agency at cppa.ca.gov.
• EU/UK: your local supervisory authority or, in the UK, the Information Commissioner's Office at ico.org.uk.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will:

• post the updated Policy on our website with a new effective date;
• send an email notification to your registered email address;
• where required by law, obtain your consent before applying the changes to your existing information.

15. CONTACT INFORMATION