Privacy Policy

1. Who we are

KinsWell is a care coordination tool for families and care providers. This policy explains what personal information we collect, why we collect it, how we use it, and the choices you have.

KinsWell is the data controller for the personal information you provide to us. This policy doesn’t limit or exclude any of your rights under the New Zealand Privacy Act 2020. You can contact us at [email protected].

2. Who the data is about, and whose law applies

KinsWell coordinates care across three categories of people, and we treat each category’s data accordingly:

• The person being cared for, typically an ageing parent, an adult with a disability, or someone recovering at home. This person is resident in New Zealand. Their personal information (name, address, daily care, medication reminders, photos, visit notes) is governed primarily by the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020 where it applies.
• The account holder and other family members, the people who use KinsWell to coordinate that care. They may be located anywhere in the world. Their personal information (email, name, comments, account activity) is governed by the New Zealand Privacy Act, and, where applicable, by the data protection law of the country in which they reside (for example, the UK Data Protection Act for UK residents, the Australian Privacy Act for Australian residents, the General Data Protection Regulation for EEA residents).
• Carers visiting the home, the people who scan the QR code and log visits. Their personal information (name, visit times, notes they leave) is governed by the New Zealand Privacy Act.

If you are a family member outside New Zealand, you can exercise your local data protection rights with respect to your own account data by contacting [email protected]. We may need to verify your identity before responding, and we will do our best to respond within the timeframe required by your local law.

We do not act as the GDPR controller (or equivalent under other extraterritorial frameworks) for the cared-for person’s data, because that person is resident in and receiving care in New Zealand. Their information is governed by New Zealand law.

3. What we collect, and from whom

We collect the following categories of personal information:

• Account details: your name, email address, password (stored as a hash by our authentication provider).
• Household details: household name, timezone, carer PIN (stored as a bcrypt hash).
• Care data: tasks, medications, schedules, visit records, photos, voice notes, text notes, comments, and incident reports (for example falls, injuries, medication errors, medical emergencies, missed care, near misses, or safeguarding concerns, with their severity, a description, and any action taken), recorded by family members and carers to coordinate the care of a loved one. Some of this information, including medications and incident reports, is health information and is handled in line with the Health Information Privacy Code 2020.
• Carer records: names of carers who have accessed the QR-code-based checklist.
• Usage data: server logs, including IP address and user agent, retained for security and debugging purposes.

Much of this information, especially about the person being cared for, is provided by the account holder and the family members and carers they invite, rather than by the person it is about. Families and carers record information about a loved one so the care team can coordinate. If you set up or contribute to a household, you are responsible for making sure the person being cared for is aware that their information is recorded in KinsWell, to the extent they are able to understand it. Where we can, we collect information directly from the person it is about.

4. Why we collect it

• To provide the KinsWell service to you.
• To let family members, carers, and care providers coordinate care for a shared household.
• To maintain an immutable audit trail of who did what and when, which is core to the product’s value.
• To bill you and take payment for your subscription.
• To respond to your enquiries and support requests.
• To send you service messages about your account (for example, sign-in, invitations, and important notices). We don’t send marketing emails; if that ever changes, it will be opt-in and you can unsubscribe.
• To keep the service secure and prevent abuse.
• To establish, exercise, or defend legal claims, and to comply with our legal obligations.

5. Who we share it with

We do not sell your personal information. We share it only with:

• Supabase (our database and authentication provider), which hosts and processes the data on our behalf.
• Other members of your household who have been invited and accepted an invitation.
• The care provider organisation, if your household is managed by one. Providers who own a household subscription have full visibility into that household’s visit records, free-form notes, photos, comments, and medication details. This is how they coordinate care across their team. When your household is provider-managed, the organisation’s name is shown on your dashboard, and we notify you at the moment you accept an invite. A provider that manages your household is a separate agency under the Privacy Act and is responsible for how it handles your information; see our Terms of Service.
• Authorised government or legal authorities when we’re required by law to disclose information.
• A buyer or successor, if KinsWell’s business or assets are sold, merged, or reorganised. We’d let you know if your information became subject to a different privacy policy as a result.

6. Where your information is stored

KinsWell’s data is hosted by Supabase on servers in Sydney, Australia. This is the only place your information is stored, which means it is held and processed outside New Zealand.

We’re satisfied this is consistent with the New Zealand Privacy Act 2020: Supabase holds and processes the data on our behalf and under our instructions, does not use it for its own purposes, and Australia has privacy laws comparable to New Zealand’s. We don’t store your information anywhere else.

7. How long we keep it

We keep personal data only as long as it serves a purpose, in line with Principle 9 of the New Zealand Privacy Act 2020. After that, we delete it. This keeps the picture we hold about your loved one minimal and reduces the consequences if KinsWell were ever compromised.

Account data

We keep your account data while your account is active. When you delete your account, we remove personally identifying information immediately (your account row is soft-deleted; your name and email are replaced with placeholders). Records you authored (visit comments, tasks created, photos uploaded) remain with the household that owns them so the audit trail isn’t broken, but are attributed to “Deleted user” going forward.

Visit history (tasks, notes, comments, photos)

Visit records (tasks, notes, comments, photos) age out automatically. How long we keep them depends on your plan: family plans keep them for a period suited to ongoing home care, and provider plans keep them longer to meet care providers’ statutory record-keeping obligations. Photos are kept for a shorter period than text records. For the exact window that currently applies to your plan, see your dashboard or contact us.

Records older than the window are permanently deleted by an automated daily process. Once deleted they cannot be recovered, including by us.

You’ll see a banner on the dashboard 30 days before anything is due for deletion. You can:

• Export records as JSON or PDF from My account → Download my data, before they’re deleted.
• Upgrade to a longer-retention plan to keep them inside KinsWell.

If neither, the records auto-delete on schedule. We don’t email you about it; the banner is the only notice.

Why providers get longer windows

Care providers in New Zealand have statutory record-keeping obligations that often run to five years or more. The provider-tier windows are sized to meet typical compliance requirements; if your contract or funder requires longer, Enterprise plans support extended retention by negotiation.

Aggregated statistics we keep longer

After detailed records are deleted, we may retain aggregated, non-identifying statistics (total visit counts per carer, service dates, plan-level usage metrics) for service operations and to preserve a long-term picture for the household. These cannot be traced back to individual visits, notes, or photos.

Household data

Household data is removed when the household is deleted by its owner.

8. Data breaches

If we experience a privacy breach that has caused, or is likely to cause, serious harm, we will notify the people affected and the Office of the Privacy Commissioner, as required by the Privacy Act 2020, and we’ll tell you what you can do to protect yourself.

9. Your rights

Under the New Zealand Privacy Act 2020 and equivalent laws in other jurisdictions, you have the right to:

• Access the personal information we hold about you. You can download a full JSON export from the Account page.
• Correct information that’s inaccurate. Most fields are editable on the Account page directly.
• Delete your account. See the “Delete account” section on the Account page.
• Complain to the Office of the Privacy Commissioner if you believe we’ve handled your information improperly.

Before we act on an access or correction request, we may need to verify your identity. We may charge a reasonable cost for providing copies of your information, and we’ll tell you in advance if a charge applies.

10. Security

Data is encrypted at rest by our database provider and transmitted over HTTPS. Household PINs and user passwords are stored as bcrypt hashes; we never see them in plain text. Photos are served through signed, time-limited URLs.

11. Cookies and links to other sites

KinsWell uses essential cookies to keep you signed in and to remember which household you’re viewing. These are necessary for the app to work. We don’t use advertising or third-party tracking cookies. You can block cookies in your browser settings, but parts of KinsWell may stop working if you do.

If you follow a link from KinsWell to another website, that site has its own privacy policy. We suggest you review it before providing personal information.

12. Changes to this policy

When we change this policy, we’ll update the “Last updated” date at the top. If changes are material, we’ll notify you by email or by a prominent notice in the app.