In short: a patient’s name, date of birth, answers and clinical note stay in the browser on the device you use and are never sent to us. We keep an anonymous usage count for each assessment, your practice’s account details, security records of staff logins, and anonymous website page counts. We do not sell or share information for marketing, and we use no advertising or analytics companies.
1. Who we are
MyVaak is provided by MyMate Limited (NZBN 9429052964442), Auckland, New Zealand. Our Privacy Officer is Ajit Kumar Nair, Director. We aim to handle personal information in line with the Privacy Act 2020 and, where it applies, the Health Information Privacy Code 2020.
2. Patient information - stays on your device
During an assessment, the clinician may type the patient’s name, date of birth and their own name. The patient’s answers and the clinical note are built in the browser. All of this is held in the browser’s session storage on that device only. It is not sent to our servers, and we cannot see or recover it.
It is removed when the clinician taps End and clear, after 10 minutes without activity on the summary screen, when a new assessment is started, or when the browser tab is closed.
Patients never create an account or log in.
3. What we do store
| Information | What it includes | Why |
|---|---|---|
| Assessment usage row | Practice, date and time, language, number of questions answered, number of answers flagged "review first" or "notable", whether the patient chose the final "something else" option, pain score (0-10), and the clinician’s helpfulness rating if given. No patient name, date of birth, individual answers, note text or clinician name. | To show each practice its own usage, improve the service, and report anonymous totals. |
| Practice account | Practice name, contact email, username, password (stored only as a secure hash), optional logo, subscription dates and status, Stripe customer and subscription references, number of locations. | To run your account, verify your email, and manage your subscription. |
| Staff login records | Practice, date and time, IP address and session reference for each practice login. | Security, and to detect a login being shared beyond the licensed number of locations. |
| Sign-up and login protection | IP addresses of sign-up attempts and of failed logins. | To stop automated abuse. |
| Founding Practice applications and emails | What you send us: name, role, practice, suburb, email, phone and your message. | To respond to you. |
| Website page counts | Public page name, date and time, the website you came from (domain only), a broad device type, and campaign tags in the link. No IP address, cookie or visitor identifier. | To understand which pages are useful. |
| Web server logs | Our hosting provider keeps standard access logs, including IP addresses. | Security and fault finding. Not used for analytics. |
Because a practice knows who it saw and when, a practice could in theory link one of its own usage rows to a patient visit. We never share usage rows between practices, and any figures we publish are totals across practices.
4. Who else handles information
We use these providers to run MyVaak. Some are outside New Zealand, so information may be stored or processed overseas. We choose providers with appropriate security, and we do not allow them to use your information for their own purposes beyond providing their service.
| Provider | What for | Where |
|---|---|---|
| HostPapa Inc. | Website and database hosting, and sending our emails | Canada |
| Stripe, Inc. | Card payments. Card details go directly to Stripe and never touch our servers. | United States and others |
| Cloudflare, Inc. (Turnstile) | Checking that sign-up and application forms are sent by a person, not a bot | United States and others |
| Google Fonts | Displays non-Latin scripts on the home page. Your browser requests the fonts from Google, which sees your IP address. | United States |
| YouTube (Google) | The demo video, only if you press play. We use YouTube’s privacy-enhanced mode. | United States |
Question audio uses recordings on our own server, or the voice built into your device. No question text or answer is sent to any speech service by MyVaak.
We do not sell personal information, and we only disclose it to others if the law requires us to.
5. How long we keep it
- Assessment usage rows: 24 months, then deleted automatically.
- Staff login records: 12 months, then deleted automatically.
- Website page counts: 12 months, then deleted automatically.
- Sign-up and failed-login protection records: short-term, usually less than a day.
- Practice accounts: while the account is open. After it closes we delete it on request, except payment records we must keep for tax purposes (generally 7 years).
6. Cookies
Public pages and the assessment itself set no cookies of our own. The practice login area and our admin area use one session cookie to keep a signed-in user signed in; it expires when the browser closes. The payment page loads Stripe, which sets its own fraud-prevention cookies. We use no advertising, tracking or analytics cookies.
7. Security
The site is served over HTTPS only. Passwords are stored as one-way hashes. Logins are rate-limited, sessions are renewed at sign-in, and admin actions are protected against cross-site requests. No system is perfectly secure; if we become aware of a privacy breach likely to cause serious harm, we will notify affected people and the Privacy Commissioner as the Privacy Act requires.
8. Your practice’s responsibilities
When a clinician copies or prints a MyVaak note into the patient’s record, that information becomes part of your practice’s health records, and your practice is responsible for it under the Health Information Privacy Code. On shared devices, use End and clear after each patient.
9. Your rights
You can ask for access to, or correction of, personal information we hold about you. Email info@myvaak.co.nz. We will respond within 20 working days. We do not hold patient information, so requests about a patient’s clinical note should go to the practice that recorded it.
If you are not happy with how we handle a privacy concern, you can contact the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.
10. Changes and contact
We will update this page when our practices change and show the date at the top. If we ever planned to store patient details on our servers, we would tell subscribing practices in advance.
Privacy Officer: Ajit Kumar Nair, MyMate Limited - info@myvaak.co.nz - 021 034 8850.
See also: Terms of Service and Disclaimer.