Privacy Notice

Thank you for visiting the website of HypoAI Limited (“HypoAI”, “we”, “us”) and reading our Privacy Notice.

This Privacy Notice explains how we comply with the Privacy Act 2020, including the changes made by the Privacy Amendment Act 2025, and with the Information Privacy Principles (IPPs). HypoAI is software for insurance brokers that files and reads their claims emails and drafts replies. Brokers trust us with their clients’ claims, so keeping that information secure and private is central to what we do. This notice explains how we collect, use and protect personal information, including where it is stored and processed outside New Zealand.

Our Commitment to Data Minimisation

We only collect personal information that we reasonably need to provide HypoAI to broker firms. HypoAI reads only the claims mailbox a firm sets up for it, never a broker’s personal inbox. We do not sell personal information or use it for advertising, and we do not let AI providers train their models on it.

Information We Collect

We collect personal information in three ways:

• Active Collection: When brokers use HypoAI, or when anyone contacts us, we collect your name, firm name, work email, phone number, email signature, Microsoft account identifiers, adviser numbers with insurers, and the details of your enquiry.
• Passive Digital Telemetry: Our systems automatically log sign-ins and activity, including IP addresses, browser details, the pages and files opened, and when. We use these logs only for security, auditing and running the service.
• Claims Information Held for Broker Firms: When a firm uses HypoAI, we receive the emails sent to and from its claims mailbox, with their attachments, and any documents the firm uploads. These can include:
  • clients’ names, contact details and dates of birth
  • policy, vehicle and registration details
  • claim details, such as driver licence details, injuries, whether alcohol or drugs were involved, and police reports
  • details of other people involved in a claim, such as drivers, witnesses and third parties

The broker firm collected this claims information and decides how it is used. We hold it on the firm’s behalf, as its agent under section 11 of the Privacy Act 2020, and use it only to provide HypoAI to that firm, except in anonymised form (see Quality Assurance). If a firm agrees in writing, we may also use its claims information without anonymising it, to test and improve HypoAI. For that use, HypoAI is responsible for the information, and the firm tells its clients about it.

Some of this information is sensitive.

If you are a broker’s client or involved in a claim, your broker’s privacy notice applies, so please send privacy requests to your broker first. If you contact us, we will pass your request on to them and help them respond. You don’t have to give us personal information. Without it, though, a broker can’t use HypoAI, and a claim with missing details may not be ready to lodge with the insurer.

Purpose of Collection and Use

We collect each kind of information for a specific purpose:

• Claims Filing: Filing each email against the right client and claim, and keeping the claim’s history up to date.
• Claims Assistance: Reading emails and attachments to suggest claim details, flag missing information, list coverage points, and draft emails for the broker to review. Nothing is sent unless a broker approves it.
• Insurer Forms: Helping brokers fill in insurers’ online claim forms with our Chrome extension, using only details the broker has confirmed.
• Renewal Reminders: Reminding brokers when a policy is due for renewal.
• Client Support and Communication: Answering enquiries, and telling firms about important changes to the service.
• System Integrity: Signing brokers in, keeping an audit trail of changes, monitoring the service, and preventing unauthorised access.
• Quality Assurance: Checking and measuring HypoAI’s accuracy for each firm. We keep, in the firm’s claim record, what HypoAI suggested and what the broker decided. With the firm’s written agreement, our staff may review its claims to check HypoAI’s work and fix problems. We may anonymise or aggregate this information to test and improve HypoAI. Anonymised information does not identify anyone.
• Invoicing, Billing and Account Management: Keeping firm contact details for billing and managing the account.
• Compliance: Meeting our legal obligations.

With your consent, we may also send brokers news about HypoAI. We will not do this unless you have expressly agreed.

Technical and Organisational Security

In line with IPP 5, we protect personal information with both technical and organisational measures:

• Technical Measures:
  • Information is encrypted at rest and in transit.
  • Each firm’s information is kept separate from every other firm’s.
  • HypoAI can reach only the firm’s claims mailbox, and the firm controls that restriction in its own Microsoft 365.
  • Original emails are locked so they can’t be altered.
  • All staff access requires multi-factor authentication.
  • Our systems are monitored for threats.
• Organisational Measures: Access follows the principle of least privilege, so only the people who need personal information can reach it. Every staff access is logged.

How do we keep your Personal Information secure? We take reasonable steps to keep any information you give us secure. It is stored in a secure environment that only people working at or for HypoAI, or for our service providers, can access, and our service providers are bound by contract to keep it secure.

If a privacy breach is likely to cause serious harm, we will tell the Privacy Commissioner and the people affected. If the information is held for a broker firm, we will tell that firm promptly and help it notify.

Sharing and Cross-Border Data Disclosures

We store personal information in Australia, at Amazon Web Services in Sydney.

To read emails and draft replies, HypoAI sends their content to AI models through OpenRouter. OpenRouter routes each request to Anthropic, Amazon Web Services (Bedrock), Google (Vertex AI) or Microsoft (Azure), in the United States or the European Union. Every request is made under zero data retention, which means the provider processes it, keeps nothing afterwards, and does not use it for training. A firm can ask for its AI processing to stay in Australia instead.

We also share information with:

• Insurers and clients, when a broker approves an email or submits an insurer’s form.
• Microsoft, as the broker firm’s own email and sign-in provider.
• Anyone the law requires us to share it with, for example under a court order.

As IPP 12 requires, every service provider we use is bound to protect personal information in ways comparable to the Privacy Act 2020.

Automated Processing and AI

HypoAI uses AI to read emails and documents and to draft correspondence. Everything it produces is a suggestion, and a broker reviews it and decides what happens. We do not use automated decision-making that affects anyone’s legal rights or interests without a person reviewing it. HypoAI does not decide claims; insurers do. Any coverage prediction is shown only to the broker and is never sent to clients or insurers.

Data Retention and Destruction

We keep personal information only for as long as we need it for the purposes above, or for as long as the law requires:

• Claims emails, attachments and policy documents: 7 years from when we receive them.
• Backups: 35 days.
• Sign-in and access logs: 12 months.
• Broker account details: while the account is active.

When a firm stops using HypoAI, we return or delete its information as our agreement with that firm sets out. Information we no longer need is deleted securely.

Cookies and Digital Tracking

The HypoAI portal and Chrome extension store a sign-in token in your browser to keep you signed in. The extension also holds your claims list until Chrome closes. We don’t use advertising cookies or tracking pixels.

Links to Other Websites

When you leave our website, you go to a website we don’t control. That website may collect personal information, and this Privacy Notice doesn’t apply to it. Please read its privacy notice, especially before you share any personal information.

Your Rights and Contact Information

You have the right to ask for the personal information we hold about you, to ask for it to be corrected, and to make a privacy complaint.

Accessing, checking and updating the Personal Information we hold about you: We take reasonable steps to make sure the personal information we hold is accurate, complete and up to date. You can ask what personal information we hold about you, and we will tell you, subject to any legal restrictions. To protect your information, we will ask you to prove who you are first. We will correct personal information when you ask. If we don’t make a correction you asked for, you can ask us to attach your statement of the correction to the information. We will respond as soon as reasonably practicable, and within 20 working days. We don’t charge for access or correction requests.

If we hold the information for a broker firm, we will pass your request to that firm.

Ways to contact us or make a privacy complaint:

Please send requests and complaints in writing to:
Attention: Privacy Officer
Flat 2, 30a Maungarei Road, Remuera, Auckland, 1050
HypoAI’s registered office: Flat 2, 30a Maungarei Road, Remuera, Auckland, 1050
Email: marcus@hypoai.org Phone: (+64) 284095736

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz or on 0800 803 909.