The short version
We take privacy seriously, because much of what people share with us is sensitive. This policy explains what we collect, why, where it is stored, who can see it, how long we keep it, and how you can access or correct it. If anything here is unclear, please contact us and we will explain it plainly.
This policy is provided by 3 Big Things Limited [confirm NZBN], which trades as 3 Big Things and is referred to here as “we”, “us” and “our”. It covers this website (3bigthings.co.nz) and the online tools on it.
It does not cover our separate online platform at tools.3bigthings.co.nz — for example the Wellbeing Defenders and teen anxiety tools — which is governed by its own, more detailed privacy policy. Nor does it cover the clinical records we hold for people we work with directly, which are governed by our clinical records processes and by the Health Information Privacy Code 2020.
What we collect
We collect the following through this website.
- Contact and enquiry details. When you complete a form or start a conversation, we collect your name, email address, and anything you choose to tell us in your message.
- Tool results — only if you choose to send them. Most of our online checks and screeners, including the anxiety, burnout and neurodiversity screeners, run entirely in your browser. Your answers and your result stay on your device and are not sent to us. A small number of tools, such as our EAP check and coaching checks, let you email your result to us so we can follow up. Only if you enter your email address and submit do we receive your answers, your result, and your email. This can include information about your health and wellbeing.
- Booking details. If you book an appointment, some details are handled through Microsoft Bookings. See “Who can see your information” below.
- Website usage data. We use privacy-focused analytics to understand how the site is used. See “Analytics and cookies” below.
We do not collect more than we need, and you can use most of the site, including every self-check and screener, without giving us any personal information.
Why we collect it, and how we use it
We collect this information to respond to your enquiry, to arrange and provide our services, to improve the website, and to meet our professional and legal obligations. Where you choose to send us a tool result, we use it to give you your result and suggest what might help. We will not use your information for a different purpose without your agreement, unless the law allows or requires it.
We do not sell your information, and we do not use it for advertising.
Health information
Some of what we collect, particularly a tool result you choose to send us, is health information. We treat it accordingly, in line with the Health Information Privacy Code 2020. We collect it directly from you, we tell you why, and we hold it securely. You are never required to complete a tool or send us a result, and you can ask us to delete a result at any time.
Who can see your information
Inside our practice, your information is accessible only to the people who need it to respond to you or provide a service, such as our administrative team and the relevant psychologist.
We use trusted third-party providers to run the website and our tools. These include:
- Amazon Web Services (AWS). We use Amazon SES in Sydney, Australia (ap-southeast-2) to send transactional email, such as your confirmation and our reply. These emails may contain the details you submitted.
- Netlify. Hosts the website (the pages and forms). It does not store your submissions.
- Supabase. Stores form and opt-in tool submissions in a secure database hosted in Sydney, Australia (ap-southeast-2).
- Plausible Analytics. Privacy-focused website analytics. See below.
- Microsoft (Microsoft 365 and Microsoft Bookings). Handles appointment bookings and email correspondence. 3 Big Things is part-owned by UniMed and shares a Microsoft 365 tenancy with UniMed, so booking and email information is handled within that shared Microsoft environment.
Some of these providers store data outside New Zealand. Where that happens, we take reasonable steps to ensure the information is protected by comparable safeguards, as required by the Privacy Act 2020.
We will otherwise only disclose your information where you have agreed, or where we are required or permitted by law, for example a serious and imminent risk to someone’s safety.
Analytics and cookies
We use Plausible Analytics, which is designed to respect privacy and does not use tracking cookies or collect personally identifiable information for advertising. For our online tools we record only an anonymous “completed” event, for example that an anxiety check was completed. We do not send your result, your score, or any of your answers to our analytics provider. This is aggregate usage information and is not linked to your name or email.
Where your information is stored, and for how long
Your information is stored securely with the providers listed above. Both storage and transactional email are located in Sydney, Australia (ap-southeast-2): form and opt-in tool submissions are held in our Supabase database, and email is processed through Amazon SES.
We keep information only as long as we need it for the purpose we collected it, or as long as the law requires. Enquiry and tool data collected through the website is automatically deleted two years after it is received (a residual copy may persist in encrypted database backups for a short period afterwards before those roll off), unless it becomes part of a client record. Clinical records, where they exist, are kept in line with the Health (Retention of Health Information) Regulations 1996, which require health information to be held for at least ten years.
Your rights
Under the Privacy Act 2020, you have the right to ask us:
- what personal information we hold about you,
- for a copy of it,
- to correct it if it is wrong, and
- to delete information we no longer need to hold.
To make any of these requests, contact our Privacy Officer using the details below. We will respond as soon as we can, and within 20 working days as the Act requires. There is normally no charge.
Keeping your information safe
We use appropriate technical and organisational measures to protect your information against loss, misuse and unauthorised access. No system is completely secure, but we take our responsibility here seriously, and if a privacy breach ever posed a risk of serious harm, we would notify you and the Office of the Privacy Commissioner as the law requires.
Children and young people
Some of our services support young people, for example our teen anxiety programme. Where a young person uses a tool or service, we handle their information with particular care, and involve a parent or guardian where that is appropriate. [Confirm the approach for under-16s and any school-delivered tools.]
Complaints
If you are concerned about how we have handled your information, please contact our Privacy Officer first, so we can try to put it right. If you are not satisfied, you can raise it with the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.
Contact
Trudi Ashcroft, Privacy Officer, 3 Big Things Limited.
Email: contact@3bigthings.co.nz. Phone: 0800 324 484.
Changes to this policy
We may update this policy from time to time. The current version is always the one on this page, and the date at the top shows when it last changed.