PainPal Privacy Statement

1. Who we are

PainPal is owned and operated by Construction Health and Safety New Zealand (CHASNZ) and will in future be transferred to Betterworx Ventures Ltd, a CHASNZ-controlled company.
PainPal is designed to help workers self-manage pain, discomfort, and injury in a non-medical and evidence-informed way.

2. What this statement covers

This Privacy Statement explains how we collect, use, store, and protect your personal information when you use PainPal (at painpal.co.nz) or any related services.

3. What information we collect

We collect:

• Registration details – name, email, workplace, and basic demographic information you provide when signing up.
• Chat data – the messages and responses exchanged with the PainPal chatbot.
• Usage data – information such as IP address, browser type, and access times for security and analytics.
• Optional self-reported information – such as pain type, body location, or level of discomfort you choose to share.

4. How we use your information

We use this information to:

• Deliver the PainPal service and personalise your experience.
• Improve our content and the way the AI responds.
• Produce aggregated company and industry insights via the PainPal dashboard. These reports contain no identifiable personal data.
• Support research and development in workplace health and safety (where data is anonymised).
• Send relevant chat, onboarding, health/wellness, and voice transcript information to third-party AI providers to generate responses, transcribe voice messages, run safety checks, and provide app functionality.

We do not use your data to provide medical advice or to make medical decisions.

5. Who can access your data

Your individual chat history is private to you.

Only nominated super-users may access chat data for safety, quality assurance, or administrative reasons.

Super-user access is strictly limited, monitored, and controlled.

Aggregated and anonymised data may be shared with your employer, research partners, or sector bodies, but no individual can be identified.

Third-party AI service providers may process the information described above on our behalf to provide AI response generation, transcription, safety checks, and voice playback. They are not permitted to use this information for their own independent purposes.

6. How we protect your data

PainPal is hosted at painpal.co.nz.
PainPal is hosted on Amazon Web Services (AWS) infrastructure located in the US East (N. Virginia) region.
All data is stored securely using encryption and industry-standard safeguards. Access controls, audit logs, and privacy reviews are in place.

7. Cross-border data

As part of providing the service, information may be processed or stored outside New Zealand or Australia. We ensure that any overseas provider meets comparable privacy and security standards.

8. Your rights

Under the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988, you have the right to:

• Access and correct your personal information.
• Ask for deletion of your data (where legally and technically possible).
• Complain if you believe your privacy has been breached.

Requests can be sent to info@chasnz.org.

9. AI ethics and transparency

PainPal uses AI to provide educational, evidence-based information.

The AI does not diagnose or prescribe treatment.

It has been developed following recognised standards for ethical and responsible AI, including transparency, fairness, privacy, and data security.

Conversations may be reviewed in anonymised form to improve system accuracy and safety.

10. Third-party AI providers

PainPal uses third-party AI service providers to provide core app functionality.

• OpenAI – we may send your messages, onboarding answers, health or wellness information you provide, voice recordings/transcripts, and relevant chat context to OpenAI to generate responses, transcribe voice messages, and support safety checks.
• ElevenLabs – if you use voice playback, we may send assistant response text to ElevenLabs to generate audio.

We only send information needed to provide the relevant feature. PainPal asks for your permission in the app before sending personal data to third-party AI providers.

We require third-party service providers to protect personal information using privacy and security safeguards that are the same as, or comparable to, the protections described in this Privacy Statement.

11. Changes to this statement

We may update this Privacy Statement from time to time. The latest version will always be available at painpal.co.nz/privacy.