Privacy Policy
Policy version 2026-07-20. Last updated: 20 July 2026. This is a working policy for the Whakarite platform and is not a substitute for legal advice. A New Zealand privacy lawyer should review it before wide public launch.
1. Who we are
Whakarite operates an online matching platform that helps people in New Zealand seeking therapy connect with verified therapists. We are a matching and coordination service — not a clinic, hospital, or emergency service, and we do not provide therapy ourselves.
For the purposes of the Privacy Act 2020 (and, where it applies, the Health Information Privacy Code), Whakarite is the agency that collects and holds personal information through this website.
Privacy Officer: Privacy Officer (to be appointed)
Privacy / breach contact: privacy@example.comContact details are configured via NEXT_PUBLIC_PRIVACY_OFFICER_* environment variables in production.
2. Information we commonly collect
Whakarite is built for matching, not for holding a full clinical record. We do not collect National Health Index (NHI) numbers, medication lists, allergies, GP letters, lab results, insurance claim forms, or clinical consultation notes.
Information we do collect includes:
- Account details: name, email address, password (stored in hashed form by our authentication provider), and whether you are signed up as a patient or a therapist.
- Contact and demographics (patients): phone number, date of birth (used to show an age band on the matching board, not your full date of birth), and gender category.
- Matching / support information (patients): the kinds of support you are looking for (for example ADHD or ASD assessment, neurodiversity, bipolar, PTSD, ACC-funded trauma support, medication support as a category of need, or general therapy), preferred therapy approaches, location preferences for in-person or telehealth, and preferences about therapist gender, age range, languages, and session frequency. You may also add short free-text notes about what you want help with — please avoid putting identifying details in that text.
- Therapist information: professional details used for verification (such as a registration number or a CV), profile information (bio, specialties, availability), and — if you choose to publish one — a public directory listing (photo, bio, location, fees, and public contact details).
- Messages and appointments: messages you send after a match, and appointment or offer details needed to coordinate a session.
- Platform billing (therapists only): invoice and payment status for Whakarite platform fees. Patients are not charged by Whakarite for matching. We do not store full card numbers; card payments are handled by Stripe.
- Consents and reports: records when you accept this Privacy Policy and our Terms, when you agree to appear on the matching board or public directory, and any reports you submit about misuse of the platform.
3. Where we might obtain information about you
From you (or someone helping you use the site)
- Account signup and profile / onboarding forms
- Matching listings and preference updates you submit
- Messages you send through the platform after a match
- Correspondence with us in writing (for example email to our Privacy Officer or support contacts)
From therapists and other users of the platform
- Offers, appointment details, and messages exchanged after a match
- Reports about conduct on the platform (we keep these as limited as reasonably possible for safety and moderation)
From verification and payment providers
- Documents or registration details therapists upload so we can verify they are appropriately credentialed
- Payment confirmations and customer identifiers from Stripe when a therapist pays a platform invoice
Unlike a traditional medical practice, we do not routinely collect information from hospitals, laboratories, national health record systems (such as HealthOne or Health Connect South), Police, Oranga Tamariki, ACC claim files, or employers. If that ever changed, we would update this policy and explain why.
4. How your information is stored
Information is stored electronically in a secure cloud database and authentication system operated by Supabase. Our live New Zealand production database is hosted in Sydney (Australia). The website and the server functions that run it are hosted by Vercel and execute in Sydney (Australia). Therapist platform payments are processed by Stripe. Transactional emails (such as login codes or billing reminders) are sent through Resend, which processes data outside New Zealand, including in the United States. Request identifiers (not your name or health information) are processed by Upstash to prevent abuse, also in Sydney (Australia).
We do not use ambient AI tools that record or summarise therapy consultations. Therapy itself happens between you and your therapist outside this matching platform.
5. How we protect your information (in plain language)
We design Whakarite so that sensitive matching information is harder to see by default, and so that each account can normally only reach what it is meant to see. In everyday terms:
- Locked doors between accounts. Database rules (called Row Level Security) mean a patient cannot browse other patients’ profiles, and therapists only see contact details after a match is accepted — not for everyone on the board.
- Anonymous matching board. While your listing is open, verified therapists see an age band, gender category, and the kinds of support you want — not your name, email, phone number, or account ID. Your identity is shared with a therapist only when you accept their offer.
- Encrypted connections and storage. Traffic to the site uses HTTPS (the padlock in your browser). Data stored in our database provider is encrypted at rest using industry-standard encryption (AES-256).
- Strong login practices. Passwords are hashed by our auth provider (we never store them in plain text). Sign-up and password reset use one-time codes. Sessions are kept in secure cookies.
- Least access for staff tools. Admin tools used for safety and moderation are limited. They are not a free-for-all view of your intake answers, date of birth, phone number, or private message contents.
- Audit trails for sensitive lookups. When a matched therapist’s contact details for a patient are retrieved, that access is logged so we can investigate misuse if needed.
- You stay in control of leaving. In Settings you can download a copy of your data and request account deletion, which anonymises personal and matching fields and disables the login (some payment or counterpart history may be kept where we still need it for legal or accounting reasons).
How robust is this? These controls are in line with modern SaaS practice for a health-related matching product: strong access rules, encrypted transport and storage, minimised board visibility, and audited contact disclosure. No online system can promise perfect security. We do not currently encrypt every individual field separately inside the database (doing so would break matching), and like any cloud service we rely on carefully chosen subprocessors. We keep improving headers, rate limits, and retention scrubbing, and we treat privacy and security as ongoing work — not a one-off checkbox.
6. Disclosure of your information
Only people who need information to operate the matching service should access it.
- Verified therapists: see limited, non-identifying board information for open listings. After you accept an offer, the matched therapist receives your name, email, and phone so you can arrange care.
- Public directory: only fields a therapist chooses to publish appear publicly.
- Service providers:Supabase, Vercel, Stripe, and Resend process data on our behalf to host the app, store data, process therapist payments, and send emails. Upstash processes request identifiers to prevent abuse. Our database, our server functions, and our rate-limiting store all run in Sydney (Australia). Some processing still occurs outside New Zealand — in particular Resend's email infrastructure, including in the United States. We take reasonable steps under the Privacy Act to protect information when it is disclosed overseas.
- Legal / safety exceptions: we may disclose information if required by law (for example a court order), or where we reasonably believe disclosure is necessary to prevent or lessen a serious threat to someone’s life, health, or safety.
We do not sell your personal information. We do not share patient health-matching details with advertisers.
7. Platform fees and unpaid invoices (therapists)
Patients are not billed by Whakarite for matching. Therapists may receive platform invoices. If an invoice remains unpaid after reminders, we may pause the therapist’s ability to take new matches until the account is brought up to date. We do not pass patient health information to debt collectors, and we do not currently use external debt collection agencies for platform fees.
8. Complaints and concerns
If concerns are raised about our service, or about conduct on the platform, we may disclose relevant information to our legal advisers, insurers, or regulators as needed to manage and respond to those concerns — keeping disclosure as limited as reasonably possible.
You can also complain to the Office of the Privacy Commissioner (privacy.org.nz). We encourage you to contact our Privacy Officer first so we can try to resolve the issue promptly.
9. Your rights of access and correction
Under the Privacy Act 2020 (and, where applicable, Rules 6 and 7 of the Health Information Privacy Code), you have the right to request access to the personal information we hold about you, and to request correction of that information if you believe it is inaccurate.
In practice you can update many profile details and download a copy of your data from Settings. You can also contact the Privacy Officer using the details above.
10. How long we keep information
We keep information only as long as we need it for matching, safety, legal, and accounting purposes. Current engineering defaults (subject to legal confirmation) include: scrubbing closed listing health fields after about 90 days of inactivity; deleting chat messages after the soft chat window plus a short grace period; hard-purging or marking soft-deleted account remnants after about 365 days where safe; and retaining payment records for about seven years for tax and accounting.
11. Cookies and sessions
See our Cookies notice. We use authentication session cookies so you can stay signed in. We do not use third-party advertising cookies in the current product.
12. Not a clinical or emergency service
Whakarite helps people find therapists. It is not emergency care and does not replace advice from a qualified health professional. If you are in crisis in New Zealand, contact emergency services on 111 or a free crisis line such as 1737.