No patient data is ever stored on our servers.
Every piece of information entered during a MyVaak session - patient name, date of birth, assessment responses, and the generated clinical note - exists only in your device's sessionStorage. It is automatically erased when you close the browser tab. Nothing is transmitted to or recoverable from MyVaak's servers.
1. About Us
MyMate Limited | NZBN: 9429052964442 | Registered with the New Zealand Companies Office
Website: www.myvaak.co.nz | www.mymate.co.nz
Contact: info@myvaak.co.nz | 021 034 8850
Privacy Officer: Ajit Kumar Nair, Director, MyMate Limited
MyVaak is a browser-based clinical communication aid for healthcare professionals in New Zealand, licensed to practices on an annual subscription and free of charge to the patients who use it. It enables structured clinical assessments with patients who cannot communicate in English, using text-to-speech in the patient's native language across GP, ED, pharmacy, and specialist settings.
2. Our Commitment to Privacy
MyVaak was designed with privacy as a structural constraint, not an afterthought. Because the tool is used in clinical settings involving vulnerable patients, we made a deliberate architectural decision: patient data never touches our servers. We comply with the Privacy Act 2020, Health Information Privacy Code 2020, Consumer Guarantees Act 1993, and Fair Trading Act 1986.
3. What Data MyVaak Handles and Where
| Data Category | Examples | Where It Lives | Sent to Server? | Cleared When? |
|---|---|---|---|---|
| Patient identifiers | Name, date of birth | Device sessionStorage only | NEVER | Browser tab closed |
| Clinician name | Entered at intake screen | Device sessionStorage only | NEVER | Browser tab closed |
| Assessment responses | Yes/No answers | Device sessionStorage only | NEVER | Browser tab closed |
| Generated clinical note | ABCDE summary text | Device sessionStorage only | NEVER | Browser tab closed |
| Body diagram selections | Pain location markers | Device sessionStorage only | NEVER | Browser tab closed |
| Assessment usage summary | Language, date and time, questions answered, completion, urgency flags, pain score | Server database, linked to the practice account | NO PATIENT ID | Retained for service analytics |
| Website page counts | Page visited, date and time, referring website, device type | Server database, no identifiers | COUNTS ONLY | Deleted after 12 months |
| Practice account details | Practice name, contact email, username, password (bcrypt hashed), subscription dates | Server database | ACCOUNT USE | Deleted on request or account closure |
| Card details | Card number, expiry, security code | Entered on Stripe’s form, held by Stripe | NEVER TO US | Per Stripe’s retention policy |
| Admin credentials | Admin panel login (bcrypt hashed) | Server config (hashed) | ADMIN USE | Persistent - admin only |
4. Session Data - Your Device Only
All data entered during a MyVaak session is stored exclusively in the browser's sessionStorage. This is a browser-native, device-local store. Data is accessible only within the same browser tab that created it, is automatically and permanently deleted when that tab is closed, is never written to the device's hard drive, and is never transmitted to any external server. It cannot be recovered after the tab is closed - not by MyMate Limited, not by anyone.
For clinicians: If you need to retain the clinical note, print it or copy it before closing the browser tab. Once the tab is closed, the session data is gone. This is by design.
5. Usage Logging and Website Page Counts
Assessment usage
To understand how MyVaak is being used and improve the service, our server records a short summary row each time an assessment is run: the language selected, the date and time, how many questions were answered, whether the session was completed or abandoned, whether any urgency or warning flags were triggered, and the reported pain score. That row is linked to the subscribing practice's account, so a practice can see its own usage. It records no patient name, no date of birth, no individual question responses, no clinical note text and no clinician name. We cannot identify a patient or a clinician from it.
Website page counts
Separately from the above, we count visits to the public pages of this website: the home page, For Clinics, Founding Practices, Clinical Framework, About, and the three policy pages. For each page view we record the page name, the date and time, the website you arrived from if any, and a broad device category such as mobile or desktop.
We do not record your IP address in these counts, in any form, including hashed or shortened. We do not set a cookie or write anything to your device. We do not use a visitor identifier or a device fingerprint. As a direct result of those choices we cannot count unique visitors, cannot recognise a returning visitor, and cannot connect any two page views to the same person. What we hold is a tally, not a trail. Records are deleted automatically after 12 months.
This counting is done by our own software on our own server. No analytics company, advertising network or other third party is involved, and no data leaves our server.
Page counting never runs on the assessment screens. The language selection screen, the assessment itself and the clinical note screen are excluded in code and cannot be included by configuration. Running an assessment with a patient creates no page-count record of any kind.
6. Practice Accounts and Payment
MyVaak is licensed to healthcare practices on an annual subscription. A practice account is the only circumstance in which MyMate Limited holds ordinary personal information, and it concerns practice staff, never patients.
What we hold: the practice name, a contact email address, a chosen username, a password stored only as a bcrypt hash, the subscription start and expiry dates, and whether the account is on a trial or a paid term. We use these to operate the account, send the sign-up verification email and service notices, and manage the subscription.
Payment: subscription payments are processed by Stripe. Card numbers are entered directly into Stripe's own hosted payment form and never pass through or rest on MyVaak's servers. We receive only confirmation of whether a payment succeeded and the subscription status that follows from it.
Separation from clinical use: a practice account is never linked to any patient. Patients do not register, do not log in, and are never asked to identify themselves to MyVaak.
If a practice closes its account and asks us to delete its details, we will do so. Write to the Privacy Officer listed at the end of this policy.
7. What We Do Not Collect
- Patient names, dates of birth, or any patient identifiers
- Assessment responses or clinical note content
- Clinician names or individual staff identifiers
- IP addresses in our application, our page counts, or our assessment records
- Analytics platform accounts, advertising trackers, device fingerprints, or third-party monitoring on any page
- Patient accounts of any kind - patients never register or log in
- Card numbers, expiry dates or security codes
One qualification, stated plainly. Like every website, MyVaak sits behind a web server that keeps standard access logs, and those logs include IP addresses for security and fault diagnosis. They are maintained by our hosting provider, are never connected to an assessment, a page count or an account record, and are not used for analytics of any kind.
8. Cookies and Tracking
MyVaak sets no cookies on its public pages and no cookies during a patient assessment. SessionStorage, not cookies, is used for within-session state, and it is cleared when the tab closes. No persistent client-side storage of patient or clinician data is used.
Cookies appear in only two places. The practice login area and the admin panel each use a PHP session cookie, which exists solely to keep an authorised staff member signed in. The payment page loads Stripe's payment form, which sets its own cookies for fraud prevention; those are set by Stripe rather than by us and are governed by Stripe's privacy policy.
We count visits to the public pages of this website using our own server-side software, described in Section 5. That counting uses no cookies, no visitor identifier, no device fingerprint and no IP address. Nothing is written to your browser and nothing is shared with anyone.
We do not use Google Analytics, Facebook Pixel, or any third-party tracking on any MyVaak page.
9. Third-Party Services
Web hosting: Application files are hosted on a server operated by Hostpapa Inc. (Canada). The server stores application code and anonymous usage logs only - never patient data.
Payments: Stripe, Inc. (United States) processes subscription payments. Card details are entered into Stripe’s own form and are never transmitted to or stored on MyVaak’s servers. Stripe’s handling of that information is governed by its own privacy policy.
Web Speech API: Text-to-speech is rendered entirely on your device using the browser's built-in speech synthesis engine. No audio or text is sent to any external API. No data leaves your device during speech playback.
Apart from Stripe, there are no email marketing platforms, CRM systems, advertising networks or third-party analytics services connected to MyVaak.
10. Children and Vulnerable Patients
MyVaak may be used in clinical assessments involving children and other vulnerable patients. Because no patient data is stored on our servers, the privacy risks associated with data retention are eliminated at the architectural level. Clinicians remain responsible for complying with all applicable clinical protocols, consent requirements, and professional standards.
11. Clinical Notes - Clinician Responsibility
The clinical note generated by a MyVaak session is the responsibility of the clinician who conducted the assessment. If a clinician prints, copies, or otherwise retains a MyVaak clinical note, the clinician and their employing organisation become the data custodians of that document and are responsible for handling it in accordance with applicable privacy law, the Health Information Privacy Code 2020, and their organisation's policies. MyMate Limited has no visibility into, and no responsibility for, clinical notes once they leave the device on which they were generated.
See our Disclaimer for full details on the limitations of MyVaak as a clinical communication tool.
12. Your Rights Under the Privacy Act 2020
Because MyVaak does not retain any patient or clinician personal information on its servers, there is no personal information held by MyMate Limited that could be the subject of an access, correction, or deletion request arising from a clinical session. We hold no patient records.
If you are a member of practice staff with a MyVaak account, we do hold personal information about you: the account details listed in Section 6. You may ask us to confirm what we hold, correct it, or close the account and have it deleted.
The website page counts described in Section 5 contain no identifiers of any kind, so they cannot be searched, corrected or deleted on an individual basis. There is nothing in them to attach to a person.
If you believe MyMate Limited holds personal information about you in another capacity, contact our Privacy Officer at info@myvaak.co.nz. For privacy complaints, contact the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Any material change that would result in patient data being transmitted to or stored on external servers would represent a fundamental change and would be communicated clearly before taking effect.
14. Contact Us
MyMate Limited - Privacy Officer: Ajit Kumar Nair, Director
NZBN: 9429052964442
Email: info@myvaak.co.nz
Phone: 021 034 8850
See also: Terms of Service | Disclaimer
This Privacy Policy complies with the Privacy Act 2020, Health Information Privacy Code 2020, Consumer Guarantees Act 1993, and Fair Trading Act 1986 (New Zealand).
MyMate Limited | NZBN: 9429052964442