Privacy Policy

On this page

1. 1. Who We Are
2. 2. What Information We Collect
3. 3. How We Collect Information
4. 4. How We Use Your Information
5. 5. Service Providers
6. 6. Disclosure of Information
7. 7. Your Clinical Notes, Storage and Retention
8. 8. Cybersecurity and Data Breach Notification
9. 9. Use of Artificial Intelligence
10. 10. Clinical Supervision
11. 11. Your Rights
12. 12. Cookies
13. 13. Changes to This Policy
14. 14. Contact Us

This Privacy Policy explains how Mindwell Ltd (“Mindwell,” “we,” “us,” or “our”) collects, holds, uses, and discloses personal information and health information. We are committed to protecting your privacy in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.

1. Who We Are

Mindwell Ltd is a New Zealand company that runs an online psychology practice, arranging sessions with independent, registered psychologists. You can contact us at team@mindwell.co.nz.

Mindwell is responsible for the information it holds for booking, payment, your intake form and our communications with you. Each psychologist is an independent practitioner and is responsible for the clinical notes they keep about you (see section 7).

For privacy matters, please contact our Privacy Officer at team@mindwell.co.nz with the subject line “Privacy Enquiry.”

2. What Information We Collect

We collect the following categories of personal and health information:

• Identity information: full name, date of birth, gender
• Contact information: email address, phone number, location (region)
• Health information: your intake form answers (including wellbeing questionnaires), presenting concerns, and any other health information you share with us. Your psychologist’s clinical notes are covered in section 7
• Session recordings and transcripts: unless you ask for AI note-taking not to be used, the audio of your sessions may be recorded and transcribed by Carepatron’s AI note-taking tool so your psychologist can prepare your notes (see section 9)
• Emergency contact and medical details: your nominated emergency contact (name, relationship, and phone number) and your GP or other healthcare provider’s details, collected as part of your intake form
• Payment information: payment card details (processed and stored by Stripe; we do not store full card numbers)
• Technical information: IP address, browser type, and usage data collected via our website
• Communications: emails, messages, or other correspondence you send to us

3. How We Collect Information

We collect information:

• Directly from you when you book a session, complete our intake form, or contact us
• From your psychologist in the course of providing services through Mindwell
• From other people, such as your GP or another health provider, with your knowledge
• Automatically through our website (e.g. cookies and analytics tools)
• From our service providers (Carepatron, Stripe) in the course of delivering services

When we or your psychologist collect information about you from someone else, we will let you know, unless an exception under the Health Information Privacy Code 2020 applies.

4. How We Use Your Information

We use your personal and health information to:

• Arrange and manage your psychology sessions
• Process payments securely
• Send appointment confirmations, reminders, and administrative communications
• Keep administrative records (bookings, payments, intake and consent forms, and correspondence) as required by law
• Comply with our legal and regulatory obligations
• Improve our services (using de-identified data only)
• Respond to your enquiries

We will not use your health information for marketing purposes without your explicit consent.

5. Service Providers

We share information with service providers only for the purpose of delivering our services. The main ones are:

• Carepatron: our practice management platform (Carepatron is a New Zealand company). It stores appointment records, intake forms, session recordings and transcripts, and, where your psychologist chooses to keep them there, clinical notes. Carepatron uses secure cloud servers, which may be located outside New Zealand, and stores this information on behalf of Mindwell and your psychologist under its security and privacy terms.
• Stripe: our payment processor. Card data is handled directly by Stripe and is subject to PCI-DSS compliance standards. We do not store full payment card details.

We do not sell, rent, or trade your personal information to any third party for commercial purposes.

6. Disclosure of Information

We may disclose your information in the following limited circumstances:

• To your psychologist, so they can provide your care
• Where the law requires or allows it, for example a court order or a request from a regulatory authority
• Where disclosure is necessary to prevent or lessen a serious threat to your life or health, someone else’s, or public safety, as the Health Information Privacy Code 2020 allows
• Where disclosure to another healthcare provider is reasonably expected in the circumstances and is directly related to the purpose for which your information was collected, for example writing to your GP, or replying to a GP, psychiatrist or other health professional who referred you
• With your consent

Your health information will not be disclosed to any other party without your consent, except where the law requires or allows it or where there is a serious safety concern.

7. Your Clinical Notes, Storage and Retention

Who holds your clinical notes: Your psychologist keeps your clinical notes and is responsible for them. They may keep them in Mindwell’s Carepatron system or in their own secure system. Either way, they must keep them secure and confidential under the Health Information Privacy Code 2020.

What Mindwell stores for your psychologist: Session recordings and transcripts, and your clinical notes if your psychologist keeps them in Carepatron, are stored by Mindwell on your psychologist’s behalf. Mindwell does not read them for its own purposes, with one narrow exception: if a detail we need for billing or for closing your file (for example, when an appointment was cancelled) is missing from the appointment record and your psychologist cannot provide it, we may check the relevant session entry for that detail only. Otherwise we would only access them with your or your psychologist’s agreement (for example, to help resolve a complaint), to arrange your ongoing care if your psychologist is unable to, or where the law allows or requires it.

How long records are kept: New Zealand law (the Health (Retention of Health Information) Regulations 1996) requires health records to be kept for at least 10 years after the last time you received a service. Your psychologist is responsible for keeping your clinical notes for that period, including if they stop working with Mindwell, and for arranging for someone to look after them if they retire or die. Mindwell keeps its own records (bookings, payments, intake and consent forms, and correspondence) for the same period.

Security: Information is stored using encryption, and we take reasonable steps to protect it from loss and from unauthorised access, use or disclosure. No system is completely secure, but we choose providers with strong security and remain responsible for the information they store for us.

8. Cybersecurity and Data Breach Notification

Security measures we take: Mindwell takes reasonable and appropriate technical and organisational steps to protect your personal and health information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls limiting who within Mindwell can access client information
• Using Carepatron and Stripe, which are built for handling health and payment data
• Regular review of our security practices

Video session security: All sessions are conducted via Carepatron’s secure video platform, which runs in your browser with no download required. If there is a technical problem with Carepatron, your psychologist may switch to another secure video platform as a backup. While we take reasonable steps to ensure session security, we cannot guarantee that video transmissions are entirely free from interception. You are responsible for ensuring you conduct sessions in a private environment using a secure network connection.

Your responsibilities: You are responsible for keeping any account credentials, booking confirmation emails, and video links confidential. You must not share your session link with any unauthorised person. Mindwell is not liable for any unauthorised access resulting from your failure to keep your credentials or links secure.

Data breach notification: In the event of a privacy breach that is likely to cause you serious harm, Mindwell will notify you and the Office of the Privacy Commissioner as required under Part 6 of the Privacy Act 2020. We will take prompt steps to contain the breach and reduce harm, and notification will be made as soon as practicable after we become aware of the breach. If a breach involves your psychologist’s own system, your psychologist is responsible for notifying you and the Privacy Commissioner, and must also tell us.

Reporting a security concern: If you believe your account or information may have been compromised, please contact our Privacy Officer immediately at team@mindwell.co.nz with the subject line “Security Concern.”

9. Use of Artificial Intelligence

Mindwell and the psychologists working through it use AI tools to help with note-taking and the day-to-day running of the practice, such as drafting correspondence, organising information and routine administration. These tools support our team and do not make clinical decisions. AI-generated content is reviewed before it is relied on, and your psychologist remains responsible for all clinical decisions and for what is in your notes.

• AI note-taking: Unless you ask for it not to be used, your sessions may be recorded (audio only) and transcribed by Carepatron’s AI note-taking tool, which drafts a note for your psychologist to review and edit. The recording and transcript are kept securely in Carepatron. Carepatron states that your information is not used to train AI. This is explained in your consent form.
• Saying no: AI note-taking is optional. If you would prefer it not to be used, tell your psychologist at any time, or email team@mindwell.co.nz before your session, and it will be switched off for your session. Your psychologist will then take notes themselves. Saying no won’t affect your care.
• Clinical reasoning support: Carepatron also includes an AI assistant your psychologist may use to help think through clinical ideas or documentation. It supports their professional judgement and does not replace it.
• How we protect your information: Where AI tools handle personal or health information, we limit the information used to what is needed for the task. We take reasonable steps to make sure the tools have appropriate security and confidentiality protections, do not use your information to train their AI models, and are used consistently with the Privacy Act 2020 and the Health Information Privacy Code 2020. Mindwell requires psychologists to remove anything that could identify you before using any AI tool other than Carepatron’s for their clinical work.

Who processes it: Carepatron and its technology providers process this information on behalf of Mindwell and your psychologist, under their security and privacy terms. We take reasonable steps to make sure they maintain appropriate security and privacy standards.

Your rights to access and correct your information (section 11) apply whatever tools are used.

10. Clinical Supervision

As required by the New Zealand Psychologists Board and the Code of Ethics for Psychologists, psychologists providing services through Mindwell engage in regular clinical supervision. Supervision is a professional and ethical requirement designed to support the quality and safety of care provided to you.

Your psychologist may discuss case material in supervision in order to better understand how to support you. Identifying information about you is kept out of supervision wherever possible. Your name and contact details are not usually shared. For more information about supervision, please speak with your psychologist.

11. Your Rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

• Access the personal and health information held about you, by Mindwell and by your psychologist
• Request correction of inaccurate or incomplete information, and if it is not corrected, ask for a statement of the correction you wanted to be attached to it
• Complain about a breach of your privacy rights

To exercise these rights, contact your psychologist or our Privacy Officer at team@mindwell.co.nz. If your request is about your clinical notes, we will pass it to your psychologist. You will receive a response within 20 working days, unless we let you know that more time is needed, as the Privacy Act allows.

If you are not satisfied with the response, you may lodge a complaint with the Office of the Privacy Commissioner at www.privacy.org.nz or phone 0800 803 909.

12. Cookies

Our website uses cookies to improve your experience. You may disable cookies in your browser settings; however, this may affect the functionality of our website.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always on this page with the date of the last update. If we make a significant change, we will let you know by email.

14. Contact Us

For any privacy-related questions or concerns, please contact:
Privacy Officer, Mindwell Ltd
team@mindwell.co.nz