Privacy Policy / Kaupapahere Tūmataiti

1. About Us / Mō Mātou

MyMate Limited
NZBN: 9429052964442
Registered with the New Zealand Companies Office
Website: mylog.co.nz | mymate.co.nz
Contact: info@mylog.co.nz | 021 034 8850

Privacy Officer:
Ajit Kumar Nair, Director
Email: info@mylog.co.nz
Phone: 021 034 8850

MyLog is a private online diary platform designed for people with disabilities and their support workers to record daily experiences, preferences, and continuity notes.

2. Our Commitment to Privacy / Tō Mātou Tūmanako ki te Tūmataiti

We are committed to protecting your privacy and complying with:

• Privacy Act 2020 (New Zealand)
• Consumer Guarantees Act 1993
• Fair Trading Act 1986

3. Information We Collect / Ngā Mōhiohio e Kohia ana e Mātou

3.1 Account Information

When you register for MyLog, we collect:

• Your name (first name, last name)
• Email address
• Password (stored only in hashed form)
• Your role (Family Admin or Caregiver)

3.2 Care Profiles

For each person supported, the Family Admin may record:

• Full name, preferred name and date of birth
• A profile photo (optional)
• Communication preferences
• What helps them and what they find difficult
• Goals, and how each goal is tracking over time

3.3 Diary Entry Information

When you create diary entries, we collect:

• Date and time of entry
• Wellbeing ratings across physical, cognitive, social and spiritual domains
• Activities undertaken and achievements recorded
• Health observations (non-clinical notes)
• Support notes and observations
• Incident records and details
• Carer and whānau wellbeing information
• Photos and PDF documents uploaded (optional)
• Name of the person who created the entry

3.4 Funding Information (MyFunds)

If the Family Admin uses MyFunds, we store the funding streams they enter: funder, funding type, amounts, dates, and spending records. Only the Family Admin can see this information.

3.5 Technical Information

We and our hosting provider automatically collect:

• IP address
• Browser type and version
• Device information
• Access times and dates
• Pages viewed
• Referring website addresses

3.6 Payment Information

When you subscribe to a paid plan:

• Payment processing is handled by Stripe (a certified PCI-DSS Level 1 payment processor)
• We do NOT store your credit card details
• We receive only: transaction ID, payment amount, date, and subscription status

4. How We Use Your Information / Me Pēhea Mātou e Whakamahi ana i ō Mōhiohio

4.1 Why We Collect It

We use your information to:

• Provide and maintain the MyLog service
• Enable you to create, view, and manage diary entries
• Allow authorised family members and caregivers to access your family’s private diary
• Process payments and manage subscriptions
• Send service-related notifications (for example password resets, caregiver invitations and subscription updates)
• Provide customer support
• Improve and develop our service

4.2 Our Approach

• Purpose: We collect only the information needed to provide MyLog
• Your choice: You decide what to record and who to invite
• Legal obligation: We keep certain records for tax and legal compliance

5. Data Sharing and Disclosure / Te Tuhi me te Whakapuaki Raraunga

5.1 Who Can See Your Information

Within your family group:

• The Family Admin and the Caregivers they invite can view the diary entries of the people they support
• Each entry shows who created it and when
• The Family Admin controls who is invited, and can remove access at any time
• MyFunds and PDF export are available to the Family Admin only

We DO NOT:

• ❌ Share your diary entries with other families
• ❌ Share your information with third parties for marketing
• ❌ Sell your data to anyone
• ❌ Share with government agencies unless legally required
• ❌ Look at the content of your diary entries, except when you ask us to for support, or the law requires it

5.2 Service Providers We Use

We share limited information with trusted service providers who help us operate MyLog:

All service providers are bound by their own confidentiality and data protection obligations.

5.3 Legal Disclosures

We may disclose your information if:

• Required by law (for example a court order)
• Necessary to prevent or lessen a serious threat to someone’s safety
• Needed to enforce our Terms of Service
• Requested by authorities with lawful power to require it

6. Data Security / Te Haumarutanga o ngā Raraunga

6.1 How We Protect Your Information

• Encryption in transit: All data sent between your device and our servers uses HTTPS/TLS encryption
• Password protection: Passwords are stored only as secure hashes, never in readable form
• Access controls: Family-based access controls keep each family’s data separate
• Administrator restrictions: Diary content is hidden from administration screens and the API
• Server logs: Our hosting provider keeps standard server logs (such as IP addresses and access times) for security. These do not contain diary content
• Regular updates: We keep our software up to date with security patches
• Secure hosting: Data is stored on private VPS infrastructure

6.2 Your Security Responsibilities

You must:

• Keep your password confidential and secure
• Use a strong, unique password
• Not share your login details
• Log out when using shared devices
• Tell us straight away if you suspect unauthorised access: info@mylog.co.nz

6.3 Data Breach Response

Notifiable privacy breaches: Under the Privacy Act 2020, we must notify you and the Privacy Commissioner if a privacy breach has caused, or is likely to cause, serious harm.

How we assess “serious harm”:

• Sensitivity of the information involved
• Nature of the harm that may result (identity theft, financial loss, emotional distress, loss of dignity)
• Whether unauthorised recipients may misuse the information
• Actions we have taken to reduce the harm
• Whether individuals can take protective steps

If a notifiable breach occurs:

• We will notify affected individuals within 72 hours of determining the breach is notifiable
• We will notify the Privacy Commissioner as required
• We will tell you what happened, what information was affected, what we are doing about it, what steps you can take, and how to contact us

7. Your Privacy Rights / Ō Mōtika Tūmataiti

Under the Privacy Act 2020, you have the right to:

7.1 Access Your Information (IPP 6)

• Request a copy of the personal information we hold about you
• We will respond within 20 working days
• This is free of charge

7.2 Correct Your Information (IPP 7)

• Request corrections to inaccurate or incomplete information
• You can update profile and account details yourself
• Diary entries cannot be edited once saved, so the record stays reliable. You can add a new entry noting a correction, or ask us to attach a statement of correction

7.3 Delete Your Information

• Request deletion of your account and all associated data
• We will delete your data within 30 days of your request
• Some information may be kept for legal or tax purposes (see Data Retention)

7.4 Get a Copy of Your Data

• PDF reports: You can export these yourself at any time from the diary page
• On request: We can provide your entries in a machine-readable format, and your photos, free of charge within 20 working days

7.5 Raise a Concern About How We Use Your Information

• You can tell us if you are unhappy with how we use your information
• Note: some changes may limit our ability to provide the service

7.6 Make a Complaint

Step 1: Contact us first

• Email: info@mylog.co.nz
• Phone: 021 034 8850
• We will acknowledge your complaint within 2 business days
• We will investigate and respond within 20 working days

Step 2: Privacy Commissioner (if you are not satisfied)

• Office of the Privacy Commissioner
• Website: privacy.org.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz

8. Data Retention / Te Pupuri Raraunga

8.1 While Your Subscription Is Active

• We keep all diary entries while your subscription is active
• Diary entries are kept for the account holder and their authorised caregivers. We do not look at them in the course of running the platform
• Entries cannot be edited or deleted once saved, so the record stays reliable. Contact us if an entry needs to be removed
• When a care profile is removed, its entries and photos are permanently deleted

8.2 When Your Subscription Ends

• Your account becomes read-only for 30 days: you can view and export, but not add or change anything, and your Caregivers lose access
• After 30 days, your entries, profiles and photos are permanently deleted
• If you resubscribe within the 30 days, everything is kept
• Account information is removed or anonymised, apart from the records in 8.3

8.3 Legal and Tax Records

We keep for 7 years (as required by New Zealand tax law):

• Payment records
• Subscription history
• Basic account information (name, email, dates)

9. Children and People Who Need Support to Decide / Te Tūmataiti o ngā Tamariki

MyLog may be used to record information about children and young people with disabilities.

• Only parents or legal guardians can create accounts for children
• Caregivers must be authorised by the family
• We do not knowingly collect information directly from children under 13
• Parents and guardians control all access to their child’s information

Legal authority requirements:

For children under 16:

• You must be the child’s parent or legal guardian

For adults who lack capacity:

• You must have legal authority through:
  • Enduring Power of Attorney (Personal Care and Welfare), OR
  • Welfare Guardian appointed under the Protection of Personal and Property Rights Act 1988, OR
  • Other legal authority

For adults with capacity:

• You must obtain their informed consent before recording or sharing their information

Documentation:

• We may ask for evidence of your legal authority if questions arise

10. International Data Transfers / Ngā Whakawhiti Raraunga ā-Ao

Where data is stored and processed:

• MyLog data: Canada (HostPapa Inc.)
• Payment processing: United States and other countries (Stripe Inc.)
• Website analytics: United States (Google LLC), with no diary content

Canada (HostPapa, data storage):

• Canada’s PIPEDA provides safeguards comparable to New Zealand’s Privacy Act 2020
• HostPapa stores data on our behalf and does not use it for its own purposes

United States (Stripe, payments):

• Stripe is PCI-DSS Level 1 certified
• Stripe maintains its own published privacy commitments and international data transfer safeguards
• We do NOT store your credit card information

Your consent: By using MyLog, you agree to these overseas transfers with the safeguards described.

11. Cookies and Analytics / Ngā Pihikete me te Whai

11.1 Essential Cookies

• Session cookies: Keep you logged in
• Security cookies: Help prevent unauthorised access
• These cannot be turned off without breaking the service

11.2 Analytics

We use Google Analytics (through Google Site Kit) to understand how many people visit our public website pages and which pages are useful. This uses cookies and collects information such as pages viewed, approximate location and device type. It does not collect diary content.

You can block analytics cookies in your browser settings, or use Google’s Analytics opt-out browser add-on.

12. Changes to This Policy / Ngā Panoni ki tēnei Kaupapahere

• Changes will be posted on this page
• The “Last updated” date will be revised
• Material changes will be notified by email at least 30 days in advance
• Continued use of MyLog after changes take effect means you accept them

13. Health-Related Observations

13.1 MyLog’s Status

MyLog is NOT a health agency under the Health Information Privacy Code 2020. We are a personal diary and communication tool for disability support.

13.2 What MyLog Is NOT

• ❌ NOT a medical record system
• ❌ NOT a clinical care management system
• ❌ NOT a replacement for formal disability support documentation
• ❌ NOT intended for medical diagnoses or treatment plans

13.3 What MyLog IS

• ✅ A personal life log and diary
• ✅ A continuity tool for daily observations
• ✅ A communication tool between family and caregivers
• ✅ A record of preferences and experiences

13.4 Health Observations

Diary entries may contain health-related observations. These are non-clinical observations made by family and caregivers, not formal medical records. We protect all information, including health observations, under the Privacy Act 2020 Information Privacy Principles, and we follow the principles of the Health Information Privacy Code 2020 for health-related information.

13.5 If You Need Medical Records

For formal medical records, contact your GP, specialist, or registered health provider.

14. Contact Us / Whakapā Mai