Privacy policy
Effective date: 2026-09-14
1. Who we are
EVOLVIONTECH LIMITED
Reward provider: EVOLVIONTECH LIMITED
Operator details and who can use the app
Contact address (care of SP Insurance): 216 Great South Road, Epsom, Auckland 1051, New Zealand.
EVOLVIONTECH LIMITED is the submitting developer and reward provider, responsible for reward fulfilment and handling user disputes.
Shon Health is for people aged 18 or over in New Zealand. By creating an account you confirm you are at least 18. We do not ask for your date of birth. If a child has registered, contact us so we can close the account and handle the data appropriately.
2. What we collect and why
We use account identifiers, your name, email, password hash and any phone/address details you provide to manage your account. Registration and password-reset codes verify access. With your permission, we read Runmefit steps through Apple Health on iOS or Health Connect on Android. Phone-only steps and other sources are not counted. Daily totals, dates, source app identifiers, device, platform and source breakdown are uploaded to your Shon Health account for activity history and conditional points rewards. Syncing may happen when you open or refresh the app. Distance and calorie figures are estimates from steps; the app does not write health records. Linked policy types, numbers, dates, premiums, status and administrative records support membership and points eligibility. Balances, point transactions, orders, rewards and delivery details support fulfilment. Support messages, replies, push tokens and notification records support communication. We also keep verification and request records to process account deletion.
3. Health data and service providers
With your permission, we read Runmefit steps from Apple Health or Health Connect and send daily totals, dates and source information to your Shon Health account for activity history and conditional rewards. The app does not write health records. We do not send step counts, dates, step-goal achievement, step-reward or catch-up details to Expo, Apple or Google push services. These updates remain in your account and are shown in the app. Non-health notifications may still send your push token and message content through those services. Earlier versions could send health-related notification content; previously sent messages may remain with providers and are included in deletion reviews, not automatically recalled by this change. Turning off health access stops future reads but does not remove information already uploaded or delete your account.
Service providers and international transfers
We use hosting and database services to operate Shon Health, email services for verification, support and reward messages, Alibaba Cloud OSS for product and brand images, and Expo together with Apple and Google push services for notifications. Optional address suggestions send the address text you enter to Photon. These services may process information outside New Zealand. Our configured image storage is in Singapore, and Expo describes processing in the United States. Other processing locations depend on the services and deployment arrangements.
4. Keeping and deleting your data
Request account deletion online or in Account → Settings → Delete account.
Request deletion in the app with your password, or online with an email code when enabled. If you cannot access your registered email, contact customerservice@spinsurance.co.nz. Uninstalling the app does not delete your account. An accepted request locks the account and clears profile/contact and sign-in details, steps and source records, push tokens, activity and eligibility snapshots, and related notifications. Outstanding deletion verification codes are revoked. Policy, point, order and support records follow the approved retention rules below. Requests remain pending while review or outstanding obligations are unresolved. After order contact details and internal notes are removed, numeric references, amounts, status and stock records remain and may still be linked through other systems. Email systems, uploads, push providers, logs and backups need a separate recorded cleanup review before completion. Save your request reference for support: acceptance does not mean every copy has been erased.
Retention periods and reasons
We keep account and activity data while your account is in use. On an accepted deletion request, sign-in access ends and step records and direct profile information are removed immediately. To close out account activity and rewards, app policy, points, redemption contact details and support records become due for cleanup 30 days after the request, following a staff review. Unresolved rewards, complaints and records needed by law are reviewed before removal. Necessary tax, accounting or insurance records are not destroyed just because an app account is deleted. Staff preserve required records in the appropriate business record system and explain any continued retention. Numeric order and inventory references remain for business reconciliation without the removed contact details. Deletion audit records become due for deletion 365 days after completion. Email, uploads, push services, logs and backup copies are checked separately; we review requests daily and begin routine cleanup when the 30-day retention period ends. We will explain any delay or lawful exception. Contact us with your request reference for progress or retained-record details. Verification codes expire after 15 minutes; expired verification and rate-limit records are removed during routine maintenance.
5. Security
How we protect information
Account data requires sign-in. Online deletion uses email confirmation, expiring codes, request and attempt limits, and checks against forged forms. Verification records use protected hashes in place of readable email addresses, IP addresses and codes. These controls do not guarantee that every system or transfer is risk-free.
6. Your rights and contact
Contact our privacy contact at customerservice@spinsurance.co.nz to request access, correction or deletion, withdraw health syncing, or raise a privacy concern. You may also write to Shon Health Privacy Contact at the contact address above. We may need to verify your identity. We respond to access and correction requests as soon as reasonably practicable, normally within 20 working days, and explain any permitted extension. If we cannot resolve a privacy complaint, you may contact New Zealand's Office of the Privacy Commissioner at privacy.org.nz.
Email customerservice@spinsurance.co.nz for help. Do not send passwords or verification codes.