Privacy Policy

Align HealthTech Limited ("we", "us", or "our") provides Lilly, a pre-consultation tool that utilises generative artificial intelligence ("AI") to help patients prepare for medical appointments in a primary healthcare setting.

The relevant jurisdiction of our company is New Zealand, and all applicable laws of New Zealand. Our privacy policy aims to comply with the Privacy Act 2020 and the Health information Privacy Code (HIPC) 2020. This policy explains how we collect, use, protect your information.

1. Information we collect

The personal information we collect depends on how you choose to use our Services, the types of interaction you make with Lilly and information you choose to disclose.

We may collect the following information directly from you.

Personal information:

For our product that provide a 'guest mode' feature, all personally identifiable information are stored for a temporary period of time and securely deleted after as per agreed with your healthcare provider.

• Account information: First and last name, date of birth, sex, occupation, passwords, email address, preferred language and contacts.
• Technical data: Device type and timestamps to ensure our services functions correctly.

Sensitive information:

Where necessary, with your consent or as otherwise permitted by applicable law, we collect and process the following categories of sensitive information:

• Health data
• National health index number

What we do not collect:

• We do not collect your precise location (GPS).
• We do not collect voice recording or images. We only collect text inputs.
• We do not use third-party tracking cookies (such as Google Analytics) on our applications.

2. How we use Artificial Intelligence (AI)

Lilly uses a Generative AI system (powered by Microsoft Azure OpenAI service, specifically model GPT-5.2) to ingest answers you provide and create a summary for your doctor.

Processing location:

Your data is encrypted and processed in a secure Microsoft environment. Azure data centres are located in New Zealand and/or Australia.

No training clause:

We do not retain or process information you have provided to train the public AI models of our third-party providers. Your consultation data remains private to you and your doctor.

Human oversight:

The AI does not make decisions about your healthcare. Lilly only processes information for the strict purposes of assisting a qualified healthcare professional in their decision making. Your doctor remains responsible for your medical care.

3. How we share your information

We only share your health information in two ways:

1. With your healthcare professional: The summary generated by Lilly is sent strictly to the healthcare provider at a clinic you intend to visit. Note that your information will be accessible to all healthcare professionals expected to view, process or amend your information in the normal course of providing healthcare services.
2. With our staff on your request: Information you have provided may be accessed, viewed and processed if you make a request to delete information held in our database. Note that our third-party database service provider cannot access your information without consent or under special circumstances.

4. Retention

Standard retention:

We retain your health summaries for as long as you have an active account with us, plus a period of 3 years to comply with fraud prevention, troubleshooting, and other legal requirements.

Deletion request:

You have the right to request the deletion for your account and at any time by contacting us.

Note: If your doctor has already saved your summary into their medical notes (PMS), that copy becomes part of your permanent medical record and we cannot delete or make requests to delete that information.

5. Children and minors

Age limit:

Lilly is intended for users aged 16 and over.

Parental use:

If you are a parent/guardian using Lilly for a child under 16, you acknowledge that you are providing this information on their behalf and consent to its processing.

6. Security measures

We make reasonable steps to protect your information. This includes:

Encryption:

All data is encrypted in transit (while moving) and when it is stored.

Access control:

Our staff cannot read your health information or summaries unless you explicitly ask us to fix a technical error. Note that only information gathered from 'guest user' profiles will be visible to us, and only for the purposes of future product development and AI performance evaluation.

Synthetic testing:

We use fake (synthetic) data to test and improve our system. Not real patient data.

In the event of a security breach, we will notify affected individuals as soon as practicable and at least within 72 hours. For users that did not provide a means of contact such as guest users or other types of anonymous users, breaches will be made available on our website or on the mobile application.

7. Your rights

Under the Privacy Act 2020, you have the right to:

Access:

Ask for access to personal information we hold about you. Note that we cannot fetch information and provide them to you when you use 'guest' mode.

Corrections:

Ask us to correct any information you think is wrong. (You can also edit your summary and account information)

Please visit our website at www.alignhealthtech.com for more information, or please send us an enquiry to enquiry@alignhealthtech.com for any questions, concerns or clarifications.