Privacy policy.

Privacy Policy of Endo45 Limited · NZBN 9429050344680 · Registered New Zealand business · Effective 2 March 2026.

1. Introduction

Endo45 Limited ("Endo45", "we", "our", or "us") operates a digital health mobile application designed to support individuals managing endometriosis. We are committed to protecting your personal information and handling sensitive health-related data responsibly and transparently.

This Privacy Policy explains what personal data we collect, how and why we use it, the legal basis for processing, how we protect it, and your rights under applicable law. It is designed to comply with the EU General Data Protection Regulation (GDPR), New Zealand Privacy Act 2020, and applicable US privacy laws including CCPA. If you do not agree with this policy, please do not use our app or website.

2. Personal Data We Collect

2.1 Identity & Contact Data — Name (user-provided; not identity verified) and email address.

2.2 Health-Related Data (Special Category Data) — symptom tracking entries (pain, fatigue, gut health, mood, etc.), habit tracking data, longitudinal health records, and limited free-text entries (character-restricted). Health-related data is processed only with your explicit consent.

2.3 Subscription Data — subscription status, purchase metadata, country of purchase and subscription timestamps. Payment card details are processed exclusively by Apple or Google and are not stored by Endo45.

2.4 Technical & Usage Data — device type (iOS or Android), operating system, approximate country-level location derived from network information, analytics identifiers linked to your account email or internal user ID (via Mixpanel) and push notification tokens (via Firebase). Analytics events include feature interactions, session activity and engagement metrics. No symptom logs, health entries or free-text health content are transmitted to analytics providers.

We do not collect biometric data, wearable device data, GPS-level location, sexual health or fertility data, or government-issued identifiers.

3. How We Use Your Data

We use personal data to provide and operate the app, calculate and display user-specific health insights, manage subscriptions, maintain platform security, improve product performance, analyse usage patterns and engagement metrics, respond to support requests, and send marketing communications where consent is provided. We do not sell your personal data.

4. Legal Basis for Processing (GDPR)

Article 6 – Personal Data. We rely on contractual necessity (Art. 6(1)(b)) to provide the services you request; consent (Art. 6(1)(a)) for marketing and optional features; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, functional analytics and service reliability where these do not override your rights; and legal obligation (Art. 6(1)(c)) where required by law.

Article 9 – Special Category Data. Health-related data is processed under explicit consent (Art. 9(2)(a)), given when you create an account and enter health information. You may withdraw consent at any time by deleting your account.

5. Data Retention

We retain personal data only as long as necessary. Health-related data is retained while your account remains active and permanently deleted upon account deletion (subject to backup retention cycles). Subscription data is retained as required for financial and accounting obligations. Marketing data is retained until you unsubscribe or withdraw consent. Backup data follows provider-configured retention settings and is reviewed annually.

6. Data Sharing & Third-Party Processors

We do not sell your data. We use trusted service providers to operate the app: Apple and Google (subscription processing), RevenueCat (subscription management), Mixpanel (product analytics — usage events linked to account identifiers; no health log content transmitted), Google Firebase (push notifications), cloud infrastructure providers including AWS and Google Cloud Platform, and Microsoft 365 (support communications). These providers process data under contractual safeguards and applicable data processing agreements.

7. International Data Transfers

Your data may be processed in countries outside your home jurisdiction, including New Zealand, Australia and the United States. Where data is transferred internationally, we rely on Standard Contractual Clauses, adequacy decisions and vendor contractual safeguards, with technical and organisational measures in place to protect your data.

8. Security Measures

We implement appropriate safeguards including encryption at rest (AES-256 or equivalent), encryption in transit (TLS 1.2+), multi-factor authentication for administrative access, role-based access control, restricted administrative access, cloud-native logging, automated encrypted backups and GDPR-aligned incident response procedures. If a personal data breach occurs, we will notify affected individuals and relevant authorities where required by law.

9. Your Rights

Under GDPR you have the right to access your data, correct inaccurate data, request deletion, restrict processing, object to processing, request data portability and withdraw consent at any time. Requests can be made via support@endo45.co.nz. We respond within one month where required by law.

10. Children's Privacy

The app is intended for users aged 16 and over in the EU, UK and Switzerland. Users under 18 in other jurisdictions must obtain parental consent. We do not knowingly collect data from children under these age thresholds.

11. Complaints

If you believe your data protection rights have been infringed, you may contact the New Zealand Privacy Commissioner or your local supervisory authority (EU users). We encourage you to contact us first at support@endo45.co.nz.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the app or website. Continued use after updates constitutes acceptance of the revised policy.

This Privacy Policy is effective as of 2 March 2026. If you have any question regarding the privacy policy, please contact us through the contact page.