Platform privacy notice

Braided is operated by Braided Health Limited (Company Number 9352117, NZBN 9429052935855). For platform personal and health information, our current New Zealand legal baseline is New Zealand Privacy Act 2020 and Health Information Privacy Code 2020.

We track readiness work against HIPAA, GDPR, Australian Privacy Principles, but do not present those frameworks as current certifications unless the necessary controls, contracts, and operating evidence are in place.

• Authenticate users and deliver authorised platform features.
• Support reflections, assessments, continuity, provider workflows, and user-requested AI functions.
• Operate security controls, access logs, fraud prevention, and incident response.
• Maintain consent, audit, clinical-continuity, and legal records where required.
• Respond to access, correction, export, withdrawal, and deletion requests.
• Improve the service in controlled ways consistent with the applicable authority and user expectations.

For reward, challenge, and verification features, Braided may process verification and audit evidence such as device or source provenance, timestamps, nonces, venue or reviewer identifiers, location or presence bands where enabled, and eligibility decisions. Braided uses the least intrusive proof path appropriate to the reward or verification rule, escalating to stronger checks only where the programme, value, risk, or review state requires it. These assurance records help assess whether a behaviour or event meets a product rule; they are not a guarantee that a health outcome occurred or was caused by the behaviour.

The platform currently relies on overseas service providers. Depending on the feature, information may be stored or processed outside New Zealand, including in the United States.

• Sensitive application data is encrypted at rest in Braided-controlled storage layers.
• Data is sent over authenticated HTTPS/TLS connections in production.
• Audit logging and access logging exist for sensitive backend paths. These controls do not mean that data is encrypted directly between end users.
• Braided does not sell personal or health information to advertisers or data brokers.

No internet service can promise absolute security. Contact privacy@braided.nz if you believe your account or information has been affected by a privacy or security incident.

Where a right is available in the product, start from Account → Privacy & Security. You can also email the privacy contact below.

• Users can delete connected health source data separately from account deletion where the product exposes that control. That live deletion removes Braided-held source stores for connected health integrations, related metric caches, biometric signposts, and associated search/index records.
• Guide conversations and their continuity context are not silently deleted after a fixed 90- or 180-day period. By default, Braided keeps that history while it supports the person’s ongoing relationship with the service. Users can delete individual chats or request account deletion, subject to records Braided must lawfully retain.
• Account deletion and health-source deletion do not remove records Braided must retain for audit, legal, accounting, safety, reward verification, or clinical continuity purposes.
• Automated backups and point-in-time recovery archives cannot be selectively purged for a single user. Data deleted from live systems may remain in those backup stores until the relevant backup-retention windows expire.
• When encrypted-email referral mode is enabled, the clinical form is encrypted in the referrer’s browser and is not written to Braided’s platform database. Amazon SES handles the encrypted message and routing metadata for delivery. After delivery, the recipient practice mailbox holds the encrypted referral under that mailbox operator’s access, retention, backup, and deletion settings. Braided cannot promise deletion from the recipient mailbox or delivery-provider systems. To request access, correction, or deletion review, contact privacy@braided.nz and quote the referral reference; clinical, legal, audit, or mailbox-retention duties may limit what can be removed.

Retention depends on the information, feature, clinical context, legal duties, and any valid deletion or withdrawal request. Not every processor or backup can be updated on the same timeline.

Privacy: privacy@braided.nz
Support: support@braided.nz
Legal: legal@braided.nz