Privacy Policy
Engineering draft (policy version 2026-07-19) — not legal advice. A NZ privacy lawyer must review and sign off before patient go-live. Last updated: 19 July 2026.
1. Who we are
Whakarite operates a matching platform that helps people seeking therapy connect with verified therapists in New Zealand. For Privacy Act 2020 purposes, Whakarite is the agency that collects and holds personal information through this website.
Privacy Officer: Privacy Officer (to be appointed)
Privacy / breach contact: privacy@example.comContact details are configured via NEXT_PUBLIC_PRIVACY_OFFICER_* environment variables in production.
2. What we collect and why
- Account: name, email, password (hashed by Supabase Auth), role (patient/therapist).
- Patients: phone, date of birth (age shown on board), gender, support categories, therapist preferences — used to match you with therapists. Name/email/phone are revealed to a therapist only after you accept an offer.
- Therapists: verification documents, professional details, optional public directory listing (photo, bio, contact).
- Payments: therapists may pay a platform fee via Stripe; we store payment status and Stripe session IDs, not full card numbers.
- Messages: content between matched parties while the chat window is open.
- Consents: we store records when you accept Privacy / Terms, board visibility, or directory publishing.
3. Board visibility (patients)
Open listings show age band, gender, support categories, and preferences to verified therapists only — not the general public. Your patient UUID, name, email, and phone are not shown on the board.
4. Processors and overseas disclosure
We use: Supabase (database/auth — production region Sydney / ap-southeast-2), Vercel (hosting), Stripe (payments), Resend (email). Some subprocessors may process data outside New Zealand. We take reasonable steps under Privacy Act s11 / HIPC to protect information when it is disclosed overseas.
5. Security
Encryption in transit (HTTPS/TLS), encryption at rest (Supabase AES-256), Row Level Security, match-gated contact disclosure, and access logging for patient contact lookups.
6. Access, correction, and deletion
You can update profile details and download a copy of your data in Settings. You may request access or correction via the Privacy Officer. Self-service account deletion anonymizes profile and health-intent fields and bans the login; payment and counterpart history may be retained where required.
7. Retention
Engineering defaults (pending lawyer confirmation): scrub closed listing health fields after ~90 days inactive; chat messages deleted after the soft chat window plus grace; soft-deleted account tombstones hard-purged or marked after ~365 days when cascade-safe; payment records retained for tax (~7 years).
8. Cookies / sessions
See our Cookies notice. We use authentication session cookies only. No third-party advertising cookies are used in this MVP.
9. Not a clinical service
Whakarite is a matching marketplace, not emergency care. If you are in crisis in New Zealand, contact emergency services (111) or a crisis line such as 1737.