his notice covers the New Zealand Privacy Act 2020 and the Health Information Privacy Code, plus Singapore's PDPA and Hong Kong's PDPO for clients living there.
Who holds your information. Lisanne Davie, New Zealand. I am responsible for your information and act as my own privacy/data protection officer: lisanne@lisannedavie.com.
What I collect
Contact details: name, email, phone, city
Referral details: if a clinician refers you, the name, contact details and one-line reason they send, with your consent
Clinical information: brief session notes, assessment measures, and your emergency contact and GP details
Payment records, held by Stripe; I don't see or store your card details
Why I use it. To arrange and provide therapy, keep you safe, take payment, and meet my legal and professional duties. I don't use it for marketing and I don't sell it.
Who I share it with
No one without your consent, except where there is a serious risk to you or others, or where the law requires it
My clinical supervisor, without identifying you
Service providers who store or process data for me:
Who I share it with
No one without your consent, except where there is a serious risk to you or others, or where the law requires it
My clinical supervisor, without identifying you
Service providers who store or process data for me:
Provider, Purpose, Where data is stored
Google Workspace, Email and backup video calls, Google's global data centres (mainly United States)
Microsoft 365 (Teams), Video sessions (not recorded) and records, New Zealand
Heidi Health (optional), AI-assisted note-taking; audio is transcribed live and not stored
Stripe (including Apple Pay), Payments; I never see your full card details, United States
AI note-taking. With your permission, I use Heidi, an AI tool that listens during sessions and drafts my notes. The audio is not stored, and I check and edit every note. You can say no at any time, and I will take notes by hand instead.
Sending information overseas. If you live outside New Zealand, your information moves between your country and New Zealand, and may be stored by the providers above in other countries. I only use providers with safeguards comparable to NZ law (IPP 12). By starting therapy, you agree to this transfer.
How long I keep it. Clinical records are kept for 10 years after our last contact, then securely destroyed. Enquiries that don't lead to therapy are deleted after 12 months.
Security. Information is held in password-protected, encrypted systems. Please don't email detailed clinical information; I can arrange a secure route.
Your rights. You can ask to see or correct your information, or withdraw consent for future use, by emailing me. I will reply within 20 working days. Some records must be kept even after you withdraw consent.
Data breaches. If a breach is likely to cause you serious harm, I will tell you and the relevant regulator: the NZ Privacy Commissioner, or the PDPC in Singapore.
Complaints. Contact me first. You can also complain to the NZ Privacy Commissioner (privacy.org.nz), Singapore's PDPC (pdpc.gov.sg) or Hong Kong's PCPD (pcpd.org.hk).