Privacy Policy

Last updated: 1 October 2026

1. Who we are

Precision Medicine International Limited ("PMIL", "we", "us") is a New Zealand company (company number 3786616) based in Christchurch, New Zealand. We develop and operate the XY Leap™ Omics Platform, clinical decision support software registered with Medsafe.

We are responsible for the personal information we collect and hold. If you have a question about this policy or your information, email us at info@precisionmedicineinternational.com with "Privacy" in the subject line. Our privacy officer will respond.

This policy is written for New Zealand's Privacy Act 2020 and the Health Information Privacy Code 2020.

2. What this policy covers

This policy covers personal information we handle when you:

  • visit www.precisionmedicineinternational.com or contact us through it;

  • use the XY Leap platform, as a patient, consumer or clinician, including reports delivered to your healthcare provider;

  • take part in our education programs for doctors and pharmacists; or

  • deal with us as a partner, supplier, investor or job applicant.

Information held for healthcare providers. When a clinic, pharmacy, hospital or other healthcare provider gives you access to XY Leap, we process your platform information on that provider's behalf. The provider remains responsible for it under the Privacy Act and their own privacy policy. This policy explains how we handle it for them.

3. Information we collect

  • Platform data: genotype data from an accredited laboratory, medicines and health details, and the reports XY Leap generates. This does not identify you: it reaches us under a code, without your name or contact details, and only your healthcare provider can link it to you.

  • Website inquiries: name, email, organization and message sent through our contact form or email.

  • Clinician and education details: name, professional registration, practice details and course enrollment.

  • Website and device data: IP address, browser, pages visited and cookies, aggregated for analytics.

We do not collect patients' names, contact details or other direct identifiers. Because genetic data is unique to each person, we still protect coded platform data to the standard the Health Information Privacy Code sets for health information. We never try to re-identify anyone, and we do not sell genetic or health information.

4. How we collect and use it

We collect information directly from your healthcare provider, from the accredited laboratory that produces your genetic data, and from partners who offer XY Leap, with your authorization.

We use your information to:

  1. produce your XY Leap analysis and reports, and deliver them to you and the clinicians you choose;

  2. keep your reports up to date as new evidence is published, if you have a subscription;

  3. run our education programs and respond to inquiries;

  4. maintain, secure and improve the platform, including quality and safety monitoring required of us as a medical device manufacturer;

  5. bill you and meet our legal, regulatory and accounting obligations.

Your healthcare provider obtains your express consent before your genetic information is analyzed. We use genetic and health information for the provider's purposes. We also use de-identified data, which cannot be linked back to you, for research and to develop and improve the models behind XY Leap, where the provider has authorized it or you have given separate consent.

5. Who we share it with

We share your information only as needed for the purposes above:

  • Clinicians and providers you choose, or who ordered your analysis;

  • Laboratories that process your sample or supply your genetic data;

  • Service providers that host, secure and support our systems, process payments, or send emails, under contracts that require them to protect it;

  • Distribution partners that provide XY Leap in your country, limited to what they need to serve you;

  • Regulators, courts or authorities where the law requires it; and

  • a buyer of all or part of our business, under confidentiality and only with continued protection of your information.

We never share genetic or health information with employers or insurers without your express consent.

Overseas disclosure. Some providers store or process information outside New Zealand, including Squarespace in the United States, which hosts our website, and the cloud providers that host the XY Leap platform. Before disclosing information overseas, we make sure the recipient is subject to comparable privacy safeguards, as required by information privacy principle 12. Where a country's law requires local storage, for example for health data, we keep that data in that country.

6. Storage, security and retention

We protect your information with reasonable safeguards, including encryption in transit and at rest, access limited to staff who need it, and audit logging.

We keep health information for as long as needed to provide your reports and meet legal requirements. In New Zealand, health records must generally be kept for at least 10 years after the last service, under the Health (Retention of Health Information) Regulations 1996, which apply to our records. Other information is kept only as long as we need it, then securely deleted or de-identified.

If a privacy breach is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as soon as practicable, as the Privacy Act requires.

7. Your rights

You can ask us to:

  • access the personal information we hold about you, including your reports;

  • correct information you believe is wrong, or attach a statement of the correction you asked for;

  • withdraw consent to further analysis or to optional uses, such as research; and

  • delete your account and data, subject to what the law requires us to keep.

Because platform data reaches us under a code, we cannot identify you from it. For access, correction or deletion of your analysis and reports, contact your healthcare provider, who holds the link to your identity; we will act on their instructions.

Send requests to info@precisionmedicineinternational.com with "Privacy" in the subject line. We will respond within 20 working days, as the Privacy Act requires, and will not charge for access. We may need to verify your identity first.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

8. Cookies and website analytics

Our website runs on Squarespace, which uses cookies that are needed for the site to work, plus analytics cookies that tell us how visitors use the site. Analytics data is aggregated and is not used to identify you. You can decline non-essential cookies in the cookie banner or in your browser settings. We do not use marketing or third-party advertising cookies.

9. Other countries, children and changes

Other countries. If you use XY Leap outside New Zealand, local privacy laws may give you additional rights, such as those under the EU and UK GDPR or Saudi Arabia's Personal Data Protection Law. We will honor those rights where they apply. A country-specific notice may apply to services provided through a local partner or subsidiary.

Children. XY Leap is not offered directly to anyone under 16. A child's information is only processed when a parent or guardian, or the child's clinician, provides it with appropriate consent.

Changes. We may update this policy. The current version is always on our website, with its date at the top. We will tell platform users about significant changes before they take effect.