Privacy
Policy

Introduction

Weewoo Holdings Ltd (we, us, our) complies with the New Zealand Privacy Act 2020 (the Act) when dealing with personal information. Personal information is information about an identifiable individual (a natural person).

This policy sets out how we will collect, use, disclose and protect your personal information in connection with our website at weewoo.ai (the website) and any communication between you and us, whether written or verbal.

This policy does not limit or exclude any of your rights under the Act. If you wish to seek further information on the Act, see www.privacy.org.nz.

What this policy does not cover

We do not collect, receive, hold or process any patient information, health information, incident data or emergency call data through the website or through your communications with us. The website is an informational and contact site only.

The Weewoo dispatch system is not accessible through the website. Where we supply that system to an ambulance service or other organisation, the handling of information is governed by our separate written agreement with that organisation, not by this policy.

Changes to this policy

We may change this policy by uploading a revised policy onto the website. The change will apply from the date that we upload the revised policy. Where a change materially affects how we handle personal information we have already collected, we will take reasonable steps to notify the individuals concerned.

This policy was last updated on 8 September 2026.

Who do we collect your personal information from

We collect personal information about you from you, when you provide that personal information to us, including:

• through the contact form on the website (your name, organisation, email address, your role, and your message);
• through any other contact with us, including telephone calls, emails, video calls, meetings and correspondence; and
• if you contact us about a role with us, from the material you send us, which may include a curriculum vitae.

We also collect limited technical information automatically. Our hosting provider, Cloudflare, records requests made to the website, which can include your IP address, for security, network and operational purposes. We do not use this to identify you, and we do not receive reports about individual visitors.

We also use Cloudflare Web Analytics to understand how the website is used. When you open a page it records that page view, together with the address of the page, the address of any page that referred you to it, your general location at country level, your browser and device type, and how quickly the page loaded. It does not set cookies, it stores nothing on your device, and it does not use fingerprinting or any other identifier, so it cannot recognise you from one page to the next or from one visit to the next. We see the results only as aggregate counts.

Apart from that, we collect personal information from you directly. If we collect personal information about you from someone other than you, we will take reasonable steps to notify you as required by information privacy principle 3A of the Act, unless an exception applies.

How we use your personal information

We will use your personal information:

• to respond to your enquiry and to communicate with you;
• to provide information you have asked us for, such as validation results, operational breakdowns or regional estimates, subject to any confidentiality obligations we owe to others;
• to develop and manage our relationships with ambulance services, health agencies, research partners, suppliers and prospective team members;
• to consider you for a role with us, if you have contacted us about one;
• to keep the website secure and to prevent spam and misuse;
• to understand in aggregate how the website is used, so that we can improve it;
• to protect and enforce our legal rights and interests, including defending any claim; and
• for any other purpose authorised by you or the Act.

Disclosing your personal information

We may disclose your personal information to:

• Web3Forms, which delivers contact form submissions to our inbox;
• Google, which hosts our email through Google Workspace;
• Cloudflare, which hosts the website and provides its analytics;
• our professional advisers, including our lawyers, accountants and insurers;
• a person who can require us to supply your personal information, such as a regulatory authority;
• any other person authorised by the Act or another law, such as a law enforcement agency; and
• any other person authorised by you.

We do not sell, rent or trade your personal information, and we do not disclose it to anyone for their own marketing purposes.

Web3Forms, Google and Cloudflare hold and process personal information on our behalf and on our instructions, and do not use it for their own purposes. Each is based outside New Zealand and their servers are located outside New Zealand, including in the United States, which means your personal information is held and processed outside New Zealand.

We may transfer your information in the case of a sale, merger, consolidation, liquidation, reorganisation or acquisition.

How long we keep your personal information

We keep personal information only for as long as we have a lawful purpose for holding it. In general:

• enquiries and correspondence are kept for 24 months from our last contact with you, unless we have an ongoing relationship with you;
• material you send us about a role is kept for 12 months, unless you ask us to keep it longer;
• technical request logs and aggregate analytics are kept by Cloudflare for a limited period set by them, and are not retained by us; and
• records we are required by law to keep are kept for the period the law requires.

Protecting your personal information

We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse. These steps include serving the website over HTTPS, limiting access to those in our team who need it, and requiring multi-factor authentication on our email and administrative accounts.

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected individuals, as required by Part 6 of the Act.

Accessing and correcting your personal information

Subject to certain grounds for refusal set out in the Act, you have the right to access your readily retrievable personal information that we hold and to request a correction to your personal information. Before you exercise this right, we will need evidence to confirm that you are the individual to whom the personal information relates.

In respect of a request for correction, if we think the correction is reasonable and we are reasonably able to change the personal information, we will make the correction. If we do not make the correction, we will take reasonable steps to note on the personal information that you requested the correction.

If you want to exercise either of the above rights, email us at privacy@weewoo.ai. Your email should provide evidence of who you are and set out the details of your request.

We will respond as soon as reasonably practicable, and no later than 20 working days after we receive your request. We do not charge you for access to, or correction of, your personal information.

You may also ask us to delete personal information we hold about you where we no longer need it for a lawful purpose, and we will do so unless we are required to keep it.

Complaints

If you are concerned about how we have handled your personal information, please contact us first at privacy@weewoo.ai so that we can try to resolve it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner: 0800 803 909, www.privacy.org.nz, or PO Box 10094, The Terrace, Wellington 6143. If you are outside New Zealand, you may also be able to complain to the privacy regulator where you live.

If you are outside New Zealand

We operate from New Zealand and we do not direct the website at people in any other country. Anyone can read it, however, and we handle your personal information in the same way and extend the rights described above to you wherever you are.

Internet use

While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is at your own risk.

If you follow a link on our website to another site, the owner of that site will have its own privacy policy relating to your personal information. We suggest you review that site's privacy policy before you provide personal information.

Cookies and tracking

We use Cloudflare Web Analytics, which counts page views without cookies. It stores nothing on your device and attaches no identifier to a page view, so the analytics data does not let us or Cloudflare link one page view to another, recognise a returning visitor, or connect a page view to you. What it records is set out in Who do we collect your personal information from above.

If you would rather not be counted, blocking static.cloudflareinsights.com in your browser or with a content blocker stops the beacon loading. The website works normally without it, and we do not detect or treat you differently if you do.

Apart from that, we do not use advertising cookies, remarketing tags, social media pixels, cross-site tracking, fingerprinting or session recording, and we do not use any third-party captcha service. We do not build a profile of you and we do not know who visits the website.

If you visited the website before 7 September 2026, Google Analytics cookies may still be stored on your device from that time. They are no longer read or used by us or by anyone else, and you can delete them through your browser settings.

Contacting us

If you have any questions about this privacy policy or our privacy practices, or if you would like to request access to, or correction of, your personal information, you can contact: