Privacy Policy

In this Privacy Policy:

AI Provider means any third-party provider engaged by FindAMind to provide artificial intelligence or machine-learning related processing services.

Client means a person using the Platform to search for, identify, contact or engage a Practitioner.

Personal Information has the meaning given to that term in the Privacy Act 2020.

Platform means the FindAMind website, matching system, software, applications and associated services operated by FindAMind.

Practitioner means a person or entity listed on the Platform that provides professional services to Clients.

Privacy Act means the Privacy Act 2020.

Service Provider means any third-party supplier engaged by FindAMind to provide hosting, payment, AI processing, storage, communication or related services.

User means a Client or Practitioner using the Platform.

The information collected by FindAMind differs depending on whether you are using the Platform as a Client or as a Practitioner.

Client Information

FindAMind does not require Clients to create an account in order to receive Practitioner recommendations.

During the matching process, FindAMind may process:

• Questionnaire responses.
• Preference selections.
• Free-text descriptions voluntarily entered by Clients.
• Information submitted through practitioner enquiry forms.

Clients are encouraged not to include personally identifying information within free-text responses unless necessary.

Clients acknowledge that information submitted through questionnaire responses or enquiry forms may contain sensitive Personal Information. Users are solely responsible for determining what information they choose to provide and should avoid disclosing unnecessary Personal Information or information relating to other individuals without their authority.

Examples of Personal Information include:

• Full names.
• Phone numbers.
• Email addresses.
• Home addresses.
• Dates of birth.
• Employment details.
• Information capable of identifying another individual.

Practitioner Information

FindAMind may collect information provided by practitioners including:

• Name.
• Professional title.
• Contact information.
• Practice details.
• Professional biography.
• Registration information.
• Professional qualifications.
• Areas of expertise.
• Availability information.
• Subscription and billing information.
• Verification documents.

When a Client completes the FindAMind matching questionnaire, the Platform processes:

• Selected preferences.
• Questionnaire responses.
• Voluntary free-text descriptions.

Questionnaire responses and free-text descriptions are processed for the purpose of generating practitioner recommendations and are not retained in their original form beyond the period reasonably necessary to generate those recommendations, except where temporary retention is required for technical, security, backup or legal purposes.

The Platform retains a limited, non-identifiable matching record containing:

• Matching concepts extracted from the questionnaire responses;
• A short verbatim excerpt (approximately 10 words or less) associated with those concepts; and
• A record of which Practitioners were presented to the Client.

The retained matching record is designed not to identify an individual Client and does not include:

• Names.
• Email addresses.
• Phone numbers.
• IP addresses.
• Device identifiers.
• Account identifiers.
• Questionnaire identifiers.
• Any information intentionally collected for the purpose of identifying an individual.

Because Clients do not create client accounts in order to receive recommendations, FindAMind is generally unable to link the retained matching record to a specific individual.

FindAMind collects and processes information for the purposes of:

• Generating practitioner recommendations.
• Operating the matching system.
• Verifying practitioner credentials.
• Managing practitioner subscriptions.
• Facilitating practitioner enquiries.
• Investigating technical issues.
• Investigating complaints.
• Ensuring platform security.
• Complying with legal obligations.
• Improving platform functionality.

Information will only be used for the purposes described in this Privacy Policy, for purposes reasonably related to those purposes, or as otherwise authorised or required by law.

FindAMind uses limited AI-assisted technology as part of its practitioner matching process.

The AI system is used solely to analyse the first free-text response entered by a Client.

The AI system:

• Selects from a predefined internal list of focus areas.
• Does not create new categories.
• Does not select practitioners.
• Does not rank practitioners.
• Does not diagnose conditions.
• Does not assess risk.
• Does not provide treatment recommendations.
• Does not replace professional judgement.
• Does not provide healthcare or any advice.

Practitioner rankings are generated separately using predefined matching rules and scoring criteria.

If the AI component is unavailable, FindAMind may utilise alternative matching methods including predefined phrase matching and questionnaire responses.

FindAMind does not warrant the accuracy, completeness or suitability of any AI-generated categorisation and Users acknowledge that AI-assisted processing may produce imperfect or incomplete results.

For the purpose of identifying relevant focus areas, FindAMind may send the following information to its AI service provider:

• The free-text response submitted by the Client.
• FindAMind's predefined focus-area vocabulary.

FindAMind does not intentionally transmit:

• Names.
• Email addresses.
• Phone numbers.
• Account identifiers.
• IP addresses.
• Questionnaire identifiers.
• Tick-box responses.

Clients should avoid including personally identifying information within free-text responses.

FindAMind does not intentionally permit User information to be used for AI model training and configures its AI services to disable training and retention where such controls are available.

The AI service is used solely for processing and categorisation purposes.

FindAMind currently uses OpenRouter as its AI-processing provider.

FindAMind has configured its AI services to request zero data retention and to reject providers that require prompt logging where available.

AI requests are submitted on a stateless basis and do not include Client account identifiers.

However, FindAMind cannot make guarantees regarding the internal systems, infrastructure or retention practices of third-party providers beyond the controls offered by those providers.

Clients may choose to contact Practitioners through the Platform.

Where a practitioner enquiry is submitted:

• The Client's email address is provided for communication purposes.
• The enquiry content is not processed through the matching AI system.
• The enquiry content is not retained by FindAMind.

For administrative and complaint-handling purposes, FindAMind may retain:

• A unique enquiry reference number.
• The practitioner identifier.
• The date and time of the enquiry.

This information may be used to investigate complaints or platform-related issues.

FindAMind uses authorised service providers located outside New Zealand.

As a result, some information may be stored or processed overseas.

Where Personal Information is disclosed to overseas service providers, FindAMind will take reasonable steps to ensure that the information receives comparable safeguards to those required under the Privacy Act 2020, where required by law.

Information may be processed or stored in:

• Australia for database hosting.
• The United States of America for AI processing services.
• Other jurisdictions utilised by approved service providers.

By using the Platform, the User acknowledges and consents to the transfer, storage and processing of information in jurisdictions outside New Zealand where required for platform operation.

FindAMind may engage third-party service providers to assist in operating the platform.

Current service providers include:

• Vercel for application hosting and storage.
• PlanetScale for database hosting.
• OpenRouter for AI processing.
• Stripe for payments and subscriptions.
• Zoho for email service provider.

FindAMind may replace or add service providers from time to time where reasonably necessary to operate the platform.

While FindAMind undertakes reasonable due diligence when selecting service providers, FindAMind does not control and is not responsible for the privacy practices, security measures, acts or omissions of independent third-party service providers.

To the maximum extent permitted by law, FindAMind excludes liability for any loss, damage, unauthorised access, disclosure or misuse of information arising from the systems, infrastructure or services of any third-party service provider.

Practitioner subscription payments are processed by Stripe.

Payment card information is collected directly by Stripe and is not stored on FindAMind servers.

FindAMind may retain limited billing-related information including:

• Stripe customer identifiers.
• Subscription status.
• Subscription plan details.
• Trial information.
• Subscription dates.
• Invoice dates.
• Payment amounts.
• Currency information.
• Card brand.
• Card expiry date.
• Last four digits of payment cards.

This information is retained solely for subscription administration and billing purposes.

FindAMind takes reasonable steps to protect information against loss, misuse, unauthorised access, disclosure and alteration.

Security measures may include:

• Encryption of data in transit.
• HTTPS-only access.
• Secure API connections.
• Password hashing.
• Secure session management.
• Authentication controls.
• Role-based administrative access.

Passwords are never stored in plain text.

Authentication tokens and password reset tokens are stored only in hashed form.

While FindAMind implements reasonable technical and organisational safeguards, no method of electronic transmission or storage is completely secure. FindAMind cannot guarantee the absolute security of information and, to the maximum extent permitted by law, disclaims liability for unauthorised access, loss, disclosure or alteration resulting from events outside its reasonable control.

Practitioner registration and licensing documents are stored separately from publicly visible content.

Verification documents:

• Are not publicly accessible.
• May only be accessed by the practitioner who uploaded the document, and authorised administrators conducting verification activities.

Administrative actions relating to verification decisions may be logged, including:

• The administrator responsible.
• Approval or rejection decisions.
• Date and time of the action.

FindAMind uses only essential first-party cookies required for the operation of practitioner accounts and platform functionality.

These may include:

• Session cookies.
• Authentication cookies.
• Account-type display cookies.

FindAMind does not currently use:

• Google Analytics.
• Microsoft Clarity.
• Hotjar.
• Marketing pixels.
• Retargeting technologies.
• Third-party behavioural tracking tools.

Clients completing the matching questionnaire without signing into an account are not issued tracking cookies.

FindAMind does not currently use third-party analytics platforms.

Where usage information is collected, it is limited to aggregated platform statistics intended to assist platform administration and performance monitoring.

FindAMind does not use visitor tracking profiles or cross-site behavioural tracking technologies.

Client Data

FindAMind does not retain questionnaire inputs submitted through the matching process.

Questionnaire responses are processed into matching concepts and then discarded.

Where a practitioner enquiry is submitted, FindAMind may retain:

• Practitioner information.
• Enquiry timestamps.
• Enquiry reference identifiers.

This information is retained solely for platform administration, complaint investigation and service integrity purposes.

Practitioner Data

Practitioner records are retained for the duration of the practitioner's subscription.

Following account closure or subscription cancellation:

• Practitioner profiles are deleted after 90 days.
• Verification records are deleted after 90 days.
• Registration documents are deleted after 90 days.
• Associated verification files are removed from storage rather than merely hidden or disconnected.

The 90-day period exists to allow subscription reconciliation, dispute management and administrative processing.

Practitioners may request access to information held about them and may request correction of inaccurate information.

Because client matching records are intentionally designed not to identify individual Clients, FindAMind may be unable to retrieve, amend or delete questionnaire records relating to a specific individual.

Access and correction requests will be dealt with in accordance with the Privacy Act 2020, subject to any lawful grounds for refusal.

FindAMind may update this Privacy Policy from time to time.

The current version will be published on the platform and will take effect from the date stated in the document.

Continued use of FindAMind following publication of an updated Privacy Policy constitutes acceptance of the revised Privacy Policy.

Individuals who have concerns regarding the collection, use, disclosure or handling of their Personal Information may contact FindAMind using the contact details published on the Platform.

FindAMind will investigate privacy complaints and respond within a reasonable timeframe.

If an individual is not satisfied with FindAMind's response, they may refer the matter to the Office of the Privacy Commissioner.

By using the Platform, creating a practitioner account or submitting information through the Platform, the User acknowledges that:

• They have read and understood this Privacy Policy.
• They understand how FindAMind processes information.
• They understand that limited AI-assisted processing forms part of the matching process.
• They understand and consent to certain information being stored or processed outside New Zealand.
• They acknowledge that information may be processed by independent third party service providers located within or outside New Zealand and that such providers may have their own privacy policies, practices and security procedures.
• They consent to the collection, use, storage and processing of information as described in this Privacy Policy.