Privacy policy

Who is responsible

Haven and Haven Capture are operated for Beach Haven Clinic, 352 Rangatira Road, Beach Haven, Auckland 0626, New Zealand. This policy describes information handled in Haven’s finance, employment and receipt workflows.

Contact the clinic’s privacy administrator at admin@bhmc.co.nz for privacy questions, access, correction or deletion requests. General support is available at help@bhmc.co.nz.

Information collected and its purpose

Haven holds information supplied by authorised users and enabled integrations: account and contact details, financial transactions, invoices, bills, receipts, uploaded documents and, where applicable, employment, payroll and timesheet records. It also records authentication and audit events needed to protect accounts and explain changes.

Information is used to provide the features requested by the clinic: bookkeeping, document filing, bank matching, payroll administration, reporting and account security. Records may identify customers, suppliers, employees and other people mentioned in documents. Users must have authority to provide that information and give any required notices to those people.

Account information is needed to use private features. Connecting a mailbox or Google Drive is optional; you can upload appropriate receipts manually without those connections.

Receipt capture: Gmail, Microsoft email and Google Drive

• Gmail: after you consent, Haven receives read-only mailbox permission. It searches messages, reads message metadata such as sender, subject, date and attachment information, reads message bodies and downloads supported attachments to identify receipts and invoices. Google’s permission covers the mailbox; it is broader than receipts alone. Daily scans cover the preceding 24 hours. Manual scans cover the period you choose, including email-body receipts.
• Microsoft email: a separate optional connection reads the authorised mailbox and supported attachments for the same receipt purpose.
• Google Drive: a separate optional read-only permission allows Haven to list folders and file metadata and download supported documents from the folder trees a manager selects. Google’s permission is broader than those selected folders.

Haven uses these documents to extract suggested filing details and find possible bank matches. It stores imported original files, extracted details, source identifiers and audit information in Haven. Email content is inspected within Haven. When the receipt is in the email body, Haven saves a JPEG capture of the sanitised email, with its sender, subject and received date. Remote images, trackers and active content are not loaded. Filters look for finance documents but cannot guarantee that every unrelated or sensitive document will be excluded.

These receipt-capture Google connections do not send email, modify or delete Gmail messages, or edit Google Drive originals. Haven stores encrypted refresh tokens so requested scans can continue without asking you to sign in each day. It does not receive your Google password.

Personal submission email

Staff can separately authorise Haven to send their timesheet, leave, onboarding and document or contract submission notices from the exact personal email registered on their Haven account. This connection requests permission to send email and confirm the mailbox identity; Haven does not use it to read the inbox. It is separate from manager receipt capture.

Beach Haven Clinic stores the mailbox address, provider account identifier, connection dates and encrypted authorisation token. Notices identify the staff member and relevant dates or document title, and go to the authorised manager through the connected Google or Microsoft provider. The provider processes the notice and may retain a copy in Sent; processing may occur outside New Zealand. Secure links still require the recipient to sign in to Haven.

Connecting is optional. Submissions remain saved in Haven if the mailbox is not connected; their emails wait. Staff can connect and send waiting notices in My Profile. Disconnecting removes Haven’s saved token and stops further personal-mailbox sending, but does not erase already sent email, submission records or audit history. Staff can also revoke access through their provider’s account settings. Contact the clinic’s privacy administrator to request access or correction.

Document reading and optional AI

Mailbox intake and Capture use PDF text extraction and OCR within Haven, including OCR for scanned PDF pages. Photo cleanup runs in your browser and saves the cleaned image alongside the original.

The AI reading setting in Haven Inbox also controls AI suggestions for Capture receipts and email-body receipts. If an authorised manager enables it after reviewing the in-app notice, extracted document text can be sent through Vercel AI Gateway to Microsoft Azure running an OpenAI model to suggest filing details. Original files are not sent through this AI feature. Requests require the configured zero-data-retention route; analysis stops if that route is unavailable. Processing may occur outside New Zealand.

The AI option is for authorised, non-clinical business documents. Do not submit patient or health information, payroll documents or other sensitive records to it without a separately approved processing arrangement. Suggestions can be incorrect and need review.

Access, sharing and protection

Saved finance documents are available to authorised Haven managers. A receipt-capture mailbox connection is controlled by the manager who connected it; importing a document makes that saved document part of the clinic’s manager-accessible finance records. Staff access is restricted to their authorised functions and records.

Haven uses Vercel hosting and its existing PostgreSQL/Neon storage, together with enabled email, bank-feed and document services. Those providers process information needed to supply their services and may operate outside New Zealand. Managers may also deliberately export or share records through Haven’s document workflows. Information may be disclosed when legally required.

Haven uses authenticated access, role checks, private file-download controls, encrypted connection tokens and audit records. Necessary session cookies support sign-in, and browser storage supports application preferences and installation.

Google account data is used only for the document and personal submission-email features described here. It is not sold, used for advertising, or used to train general-purpose AI models. Haven’s use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting, retention and deletion

Use Disconnect in Haven’s email or Google Drive connection panel to stop future scans and remove the saved connection token. You can also remove Haven’s access in your Google Account’s third-party connections settings. Disconnecting does not erase documents already imported or their accounting history.

Originals, derived images, extracted details and audit records are retained for the relevant bookkeeping, employment and legal record-keeping purposes. Removing a filed item from the active Inbox does not delete its attachment from the transaction, bill or invoice.

To request account deletion, open Account deletion in My Profile. You can submit and track your request inside Haven. The request does not immediately disable your account or erase records. The clinic will confirm the completion date, assess associated personal information and explain any specific legal reason and period for retention. For access, correction, imported-data requests or help if you cannot sign in, contact admin@bhmc.co.nz. Backup copies may remain until the applicable backup lifecycle completes.

Haven on iPhone and iPad

The native app connects to the same Haven service and uses your existing account, MFA and permissions. Session cookies and website data can remain on the device to support sign-in. Device unlock is optional: Apple checks Face ID, Touch ID or your passcode locally, and Haven receives the result rather than your biometric information.

Photos and files you choose to upload are sent to the relevant Haven workflow. Share to Haven sends the files you select to Inbox after pairing. A paired capture credential is stored in the app’s Keychain to authorise receipt uploads; pairing does not grant access to other staff records.

Native document previews use temporary protected files. The app removes these when the preview is dismissed, when it is cleared after backgrounding, or on the next launch. Copies you deliberately export to Files or another app remain in that destination until you remove them.

Privacy and support information are available from the app’s options menu. Signing out or enabling device unlock does not delete records stored in Haven; use Account deletion in My Profile.

Your choices and requests

You can ask what personal information Haven holds about you and request access or correction. Identity and authority may need to be checked first. Where a historical financial record must be preserved, a correction can be recorded without silently replacing the original.

Contact the privacy administrator with concerns. You may also contact the New Zealand Office of the Privacy Commissioner. Material changes to these practices will be reflected in this policy and, where necessary, in updated in-app notices and consent requests.