Privacy Policy

Introduction

Endo45 understands your concerns about privacy and your interest in knowing how your information is used and shared. We are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and disclose your personal information and the rights you have concerning your data, especially in accordance with the EU General Data Protection Regulation (GDPR), the New Zealand Privacy Act 2020, and US Privacy Laws, including the California Consumer Privacy Act (CCPA) and other relevant state and federal regulations.

Throughout this document, "Endo45," "we," "our," or "us" refers to Endo45 Limited.

If you disagree with any aspect of this policy, your only recourse is to stop using our website and app immediately.

‍

Table of Contents

1. Personal Data We Collect from You

2. How We Use Your Personal Data

3. Your Privacy Rights

4. Third Parties Data Processing

5. Retention of Your Personal Data

9. International Data Transfer

10. Compliance with International Privacy Laws

6. Security of Your Personal Data

7. Children's Privacy

11. Complaints

12. Review and Updates to This Policy

13. Contact Us

‍

1. Personal Data We Collect from You

We collect and process personal data to deliver and enhance the app’s functionality, provide support, and manage your subscription. The categories of data collected include:

• Personal Identifiers: Name and email – processed for account creation, customer support, and communication.

• Health-Related Data: Endometriosis-related information for personalised services within the app, processed with your explicit consent.

• Payment Data: Handled securely by third-party processors like Apple and Google, not retained by Endo45.

• Technical Data: Includes IP addresses, browser information, and device identifiers, processed for security, analytics, and troubleshooting purposes.

• Marketing Data: Email and notification preferences for newsletters and promotional materials, processed based on your consent.

Under CCPA, additional categories of collected data may include:

• Geolocation Data: Approximate location based on IP address.

• Internet/Network Activity: Interactions with our website and mobile app.

• Inferences Drawn from Other Data: Preferences based on app usage patterns.

2. How We Use Your Personal Data

Under GDPR, Endo45 processes your personal data based on the following legal grounds:

1. Consent – For marketing purposes, sending newsletters, and processing non-essential cookies.

2. Contractual Necessity – For managing your account, providing services you request, and fulfilling our obligations.

3. Legitimate Interests – For improving the user experience, maintaining our website and app, and conducting analytics, provided these interests do not override your data protection rights.

4. Legal Obligations – For complying with legal obligations (such as tax regulations) and responding to legal requests from government authorities.

Under CCPA and US Privacy Laws, Endo45 processes personal data based on:

1. Notice and Transparency – Providing clear details on the types of personal data collected and how it is used.

2. Consumer Control & Opt-Out Rights – Allowing users to opt out of the sale or sharing of personal data.

3. Purpose Limitation – Ensuring data is only used for the purposes disclosed.

4. Security Measures – Implementing appropriate protections for sensitive information.

3. Your Privacy Rights

Under GDPR, your rights include:

1. Right to Access: Request a copy of the personal data we hold about you.

2. Right to Rectification: Request corrections to any inaccurate or incomplete personal data.

3. Right to Erasure (Right to be Forgotten): Request the deletion of your data when it is no longer necessary for the purposes for which it was collected.

4. Right to Restrict Processing: Ask us to restrict the processing of your data under certain conditions.

5. Right to Data Portability: Receive your data in a structured, commonly used format and have it transferred to another controller.

6. Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.

7. Right to Withdraw Consent: Where consent is the basis of processing, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Under CCPA & US Privacy Laws, your rights include:

1. Right to Know: Request information about what personal data we collect, use, and disclose.

2. Right to Delete: Request the deletion of personal data we have collected.

3. Right to Opt-Out: Opt out of the sale or sharing of personal data.

4. Right to Non-Discrimination: Exercise your rights without facing discriminatory treatment.

5. Right to Correct Inaccuracies: Request updates to incorrect or outdated data.

To exercise these rights, please contact us at support@endo45.co.nz. We will respond within one month.

4.Third-Party Data Sharing and Processing

Endo45 does not sell or share your personal data with third parties, except as required by law or necessary for providing the App and its functionality to you (for example, with service providers such as Google Analytics, Apple Pay, RevenueCat and Google Pay). These service providers have their own privacy and security policies that you are required to consent to use their services.

5. Retention of your Personal Data

We retain personal data only as long as necessary for its intended purposes, including legal, accounting, or reporting requirements.

• Health-related data: Retained as long as you use the app or until you request its deletion.

• Payment data: This is processed securely by third-party providers like Apple and Google. Endo45 does not receive or store this data.

• Marketing data: Retained until you unsubscribe from marketing emails or withdraw consent.

6. International Data Transfers

Your personal data may be transferred outside of New Zealand to service providers located in other countries. When such transfers occur, Endo45 ensures that adequate safeguards are in place to protect your data, such as Standard Contractual Clauses (SCCs) or reliance on adequacy decisions.

We commit to ensuring the security and confidentiality of your data during these transfers, complying with Articles 44-49 of the GDPR.

7. International Privacy Law Compliance

Endo45 complies with GDPR, New Zealand Privacy Act 2020, CCPA, and other US privacy laws through:

• Transparency in Data Practices – Clearly outlining how personal data is collected, stored, and used.

• Data Security Measures – Implementing industry-standard encryption and security controls.

• User Control & Consent Management – Providing clear options for users to manage their data preferences.

8. Children’s Privacy

The app and website are intended for users aged 16 and over in the EU, Switzerland, and the UK. For users under 18, parental consent is required in all other jurisdictions, including New Zealand and the US. We do not knowingly collect data from children under these age thresholds, and any such data will be deleted upon discovery.

9. Security of Your Personal Data

If the data retained by Endo45 is breached in any way, we will notify affected individuals and the relevant authority within 72 hrs of becoming aware of the breach, in compliance with article 33 of the GDPR.

10. Complaints

If you believe that Endo45 has infringed your data protection rights, you may lodge a complaint with the New Zealand Privacy Commissioner.

We encourage you to contact us first at support@endo45.co.nz to resolve the issue, as we understand your concerns and are happy to help in any way.

11. Review and Updates to This Policy

We may update this policy from time to time and will notify you of significant changes by posting the revised policy on our website and app. Continued use of our Services after updates constitutes acceptance of the changes.

12. Contact Us

📧 Email: support@endo45.co.nz

‍

PRIVACY POLICY EFFECTIVE DATE

This Privacy Policy is effective as of 11 Feruary 2025

If you have any question regarding the privacy policy, please contact us through the contact page.

‍