Insyt Privacy Policy (Pilot App)

Last updated: 16 September 2026

Version: 1.0

1. Who we are

Insyt is operated by All In Tech Limited, a New Zealand company (NZBN 9429053311337), based in Auckland. In this policy, "we", "us" and "our" mean All In Tech Limited. "You" means a person using the Insyt pilot app.

We are responsible for the personal information described in this policy. Our privacy officer is Hannah Dryland, contactable at hannah@insyt.health.

2. What this policy covers

This policy covers the Insyt pilot app for iPhone and the Polar band we provide with it. It explains what information we collect, why, who we share it with, and your rights.

The app collects health information. We handle it in line with the Privacy Act 2020 and the Health Information Privacy Code 2020.

Please read this policy before you create an account. By creating an account, you confirm you have read it.

3. What we collect

Account information

• Your email address and password (stored in a scrambled, hashed form).
• If you sign in with Apple or Google: your name and email address from that service, and a sign-in token.
• Your display name, time zone, and the date you created your account.

About you

• Sex, date of birth, height and weight.
• Typical activity level, exercise frequency and duration, training background, and sleep goal.

Symptoms and questionnaires

• Flare logs: when a flare started, how long it lasted, how severe it was, your stress level, your symptoms, whether it was expected, whether you pushed through or changed plans, and any notes you write.
• Daily check-ins: whether you had a flare that day, and any note you add.
• Questionnaires: your answers to the IBS Symptom Severity Score (IBS-SSS) and the Perceived Stress Scale (PSS-10), and your scores.

Please don't include other people's personal information in your notes.

Information from your Polar band

• Heart rate and beat-to-beat intervals, recorded throughout the day and night, with quality information (such as skin contact and movement).
• Heart rate variability, breathing rate and Polar's Nightly Recharge recovery measures.
• Sleep timing, sleep stages, sleep cycles, alarm and snooze times, and your own sleep rating.
• Skin temperature.
• Steps, distance, calories, activity levels and time spent inactive or not wearing the band.
• Band details: name, device ID, firmware version, battery level, charging status, which wrist you wear it on, and the time difference between the band and your phone.

Information we work out

• Daily summaries of your nervous system state and recovery, calculated from your band data.
• Your personal baseline, which helps us compare each day to what is normal for you.
• Records of how much data we have for each day.

Device and time zone

• Your phone's time zone, and a record of each time it changes. Because time zone changes can show when you travel, we treat this record as personal information.

What we don't collect

• We don't collect your precise location, contacts, photos, camera, microphone or Apple Health data.
• We don't collect advertising identifiers or other identifiers for your phone.
• We don't use advertising, analytics or crash-reporting tools in the app.

4. How we collect it

• From you: when you create an account, complete your profile, answer questionnaires, and log flares or check-ins.
• From your Polar band: over Bluetooth, directly to the app on your phone. Your band data is not sent to Polar.
• From Apple or Google: your name and email, if you choose to sign in with them.
• From your phone: your time zone.

5. Why we use it

We use your information to:

• run your account and let you sign in securely;
• show you insights about your nervous system state, sleep and recovery, and how these relate to your flares;
• calculate your personal baseline so insights reflect your own body;
• check that the band and app are working and syncing properly;
• send you account emails, such as sign-in codes and password resets;
• improve the app and the way it works out insights, including training and testing our own models that predict nervous system state and flares. Before training, we remove details that directly identify you, such as your name and email. Our models are built and run by Insyt. We don't send your information to outside AI companies;
• evaluate the pilot and understand whether nervous system state predicts IBS flares (see section 11); and
• meet our legal obligations.

We won't use your information for any other purpose unless you agree, or the law allows it.

We never sell your information. We don't use it for advertising.

6. Who we share it with

We only share your information with service providers who help us run the app. They may only use it to provide their service to us:

We may also share your information if the law requires it, or if needed to prevent a serious threat to someone's life or health.

We will not share your information with researchers or clinicians unless you agree first.

7. Where your information is stored

Your information is stored by Supabase in Seoul, South Korea. Resend processes account emails in Tokyo, Japan.

These providers hold and process your information on our behalf and don't use it for their own purposes. We remain responsible for it under New Zealand law.

8. How we keep it safe

• Your information is sent over encrypted connections and encrypted when stored.
• Database rules mean each account can only access its own records.
• Our administrative keys are kept on our servers and never included in the app.
• Your sign-in session and band pairing details are stored in your iPhone's secure storage. The band's device ID may remain there after you delete the app, but it contains no health information.
• Some recent summaries (such as last night's sleep) are saved on your phone so the app opens quickly. These are removed when you sign out or delete the app.
• Only Insyt team members can access user data, and only when needed to run or fix the app.

No system is completely secure. If you think your account has been compromised, contact us straight away.

9. How long we keep it

When you delete your account, we delete all your information from our database straight away. Copies may remain in our secure backups for up to 7 days before they are removed.

Once you delete your account, we won't use your information to train any new models. Models we have already trained don't store your records, but they may still reflect patterns learned from them.

10. Your rights

You can:

• Access the personal information we hold about you.
• Correct it if it is wrong. You can update most of your profile in the app.
• Delete your account and all your data at any time, in the app under Profile > Delete account. If you signed in with Apple, we also cancel Insyt's access to your Apple ID.

To ask for a copy of your information or a correction, email hannah@insyt.health. We will respond within 20 working days. We may need to confirm your identity first. We won't charge you for this.

11. Pilot research

This app is part of a pilot. We may analyse information from all pilot users to learn whether nervous system state helps predict IBS flares. Any results we publish or share will not identify you. We will ask for your separate consent before using your information in any other research, or sharing it with anyone outside Insyt.

12. Who can use the app

You must be 18 or older to use the Insyt pilot app.

13. Privacy breaches

If a privacy breach happens that is likely to cause you serious harm, we will tell you and the Office of the Privacy Commissioner as soon as practicable.

14. Changes to this policy

We may update this policy. If we make a significant change, we will tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.

15. Contact and complaints

For questions or concerns, contact our privacy officer:

Hannah Dryland

All In Tech Limited

19 Motu Place

Mount Wellington, Auckland

New Zealand

hannah@insyt.health

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.