Overview
My Claim Records is an independent tool for organising your own ACC claim information. It is not part of ACC and does not provide legal or medical advice.
The current beta uses your Google account to sign you in and stores claim records and attachments in an app-created folder in your Google Drive. Sensitive claim content is sent directly between your browser and Google Drive; it is not stored in the My Claim Records authentication database.
Information we handle
Google account and connection information
- Your Google account identifier, email address, and display name.
- An encrypted Google refresh token and the permissions you granted.
- The identifier of the app-created Google Drive folder.
Session information
- A random, opaque sign-in cookie and a hashed copy of its value.
- The account linked to the session and its expiry time.
Claim information
Information you add may include claim details, dates, ACC's stated decision reason, next actions, communications, contact details, filenames, and supporting documents. This content is stored in your Google Drive folder.
How we use information
We use this information only to:
- sign you in and maintain your app session;
- create and reconnect to the app's Google Drive folder;
- save, restore, and display the claim record you ask the app to manage;
- protect, maintain, and troubleshoot the service; and
- respond to privacy, support, or security requests.
We do not sell your information or use claim information for advertising.
Where information is stored
Your Google Drive
Claim data is saved as claim-record.json, with attachments stored
alongside it in the app-created Claim Record folder. Google controls
the storage and security of your Google account and Drive.
My Claim Records authentication database
The server stores encrypted Google profile details and refresh token, your Drive folder identifier, granted permissions, and hashed app-session records. It does not store the claim JSON, document contents, or attachment bytes.
Your browser
A short-lived Google Drive access token is provided to the browser while the app is open. The beta does not persist that token, your Google identity, or claim content in browser storage.
Retention and your control
- Claim records and attachments remain in your Google Drive until you delete the
individual files or the
Claim Recordfolder. - Signing out deletes the current app session. It does not delete Drive files, revoke Google access, or delete the authentication record held by the app.
- You can revoke the app's Google access from your Google Account permissions.
The beta does not yet include complete in-app account deletion. Email pricacy@myclaimrecords.co.nz to request deletion of authentication information held by My Claim Records. This limitation is one reason the beta must not be used with real claimant data.
Security
The app uses encrypted Google credentials, opaque hashed session identifiers, short-lived browser access tokens, and limited Google Drive permissions. It is designed to keep claim details, medical information, document contents, filenames, email addresses, and access tokens out of application logs and URLs.
No service can guarantee absolute security. Important controls, including application-layer document encryption, account recovery, access auditing, and a tested incident-response process, are still required before a real claimant pilot.
Your rights and contact
You can view, correct, download, or delete claim content directly in the Google Drive account you control. You may also ask to access, correct, or delete personal information held in the app's authentication database.
Email pricacy@myclaimrecords.co.nz with privacy questions or requests. We may need to verify that you control the relevant Google account before acting on a request.
We may update this policy as the beta changes. Material changes will be reflected here with a new “Last updated” date.