Privacy policy
Last updated: 29 September 2026
Hypnos Medical Limited ("we", "us", "our") operates Synapse. This policy explains what personal information Synapse collects, why, and your rights under the Privacy Act 2020 (New Zealand).
1. The short version
You can use Synapse without an account and without giving us any personal information. We collect personal information only when you buy a pass (your email address) or contact us (your name, email and message). We do not use analytics, advertising trackers or cookies.
2. Information we collect
- When you buy a 24-hour pass: your email address and the payment details Stripe gives us (amount, currency, time, and Stripe's reference for the payment). Your card details go to Stripe and never reach us.
- When you redeem a code or activate a pass: which code was used and when, a random identifier generated by your browser (it does not identify you), and your browser's user-agent string. We use these to enforce the number of activations a code allows and to spot codes being shared.
- When you use the contact form: your name, email address and message.
- What the simulator does: everything you do in the simulator (drugs given, settings, scenarios) happens in your browser and is not sent to us.
3. What is stored in your browser
Synapse keeps a small amount of data in your browser's local storage: your access token, the random browser identifier above, and, after a purchase, your pass's code so we can show it to you again. It does not use cookies. Clearing your browser's site data for synapse.hypnos.one removes all of it.
4. How we use information
- to provide the access you paid for, and to email you your code;
- to answer your messages;
- to keep financial records we are required to keep;
- to prevent misuse of access codes.
We do not sell personal information, and we do not use it for marketing.
5. Where it is stored, and who processes it
We use these service providers, each processing data on our behalf:
- Stripe: payments
- Supabase: our database, hosted in Mumbai, India
- Vercel: hosting the website
- Resend: sending email
This means your information is stored outside New Zealand. Under Information Privacy Principle 12 of the Privacy Act 2020, we disclose personal information overseas only to providers subject to comparable privacy safeguards.
6. How long we keep it
Purchase records are kept for seven years, as New Zealand tax law requires. Activation records are kept for two years. Contact messages are kept for two years after we last reply.
7. Your rights
Under the Privacy Act 2020 you can ask us to confirm what personal information we hold about you, to see it, and to correct it. You can also ask us to delete it, subject to any legal obligation to keep certain records. Write to support@hypnos.one. If you think we have not handled your information properly, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
8. Security
Access to our records is restricted to named administrators, enforced by the database itself, and all connections to Synapse are encrypted.
9. Children
Synapse is intended for healthcare professionals and students, and is not directed at children.
10. Changes to this policy
We may update this policy. The version on this page, with its date, is the one that applies.
11. Contact
Questions about privacy: support@hypnos.one.