Privacy Policy

Effective Date: 17 July 2026

Practitioner: Michaela Tutty (Desire Pathways)

Location: Taupō, New Zealand

1. Introduction

Your privacy is fundamental to our work together. Desire Pathways is committed to handling your personal information responsibly and in accordance with the New Zealand Privacy Act 2020. This policy explains how I collect, use, store, and protect your information. This applies to all clients, whether located in New Zealand or overseas.

2. Information I Collect

I collect and securely store the following personal information:

Contact Details: Name, email address, phone number, and emergency contact details.
Session Information: Signed intake forms, session goals, and somatic reflections you choose to share.
Payment Data: Processed securely via Stripe. I do not store, view, or retain your credit card details on my own servers.
Website Analytics: Non-identifiable data regarding visitor numbers and demographics to help improve my website.
Session Summaries: Internal text summaries processed by Heidi AI to ensure accurate record-keeping and professional focus.

3. Purpose of Collection

Your information is collected specifically for:

Providing safe, professional, and effective somatic coaching services.
Maintaining accurate records of your progress and our session plans.
Managing bookings and securing payments via Acuity and Stripe.
Complying with legal and professional obligations, including mandatory reporting if there is a clear and imminent risk of serious harm to yourself or others.

4. Storage, Security, and AI Rules

Digital Records: All client data is stored securely on encrypted, password-protected cloud platforms utilizing two-factor authentication (2FA). Client records are completely isolated from personal or university files.
Heidi AI Data Protection: I use Heidi AI for internal session summaries. Audio is processed solely to create a written text summary for my professional records. All temporary audio recordings are deleted automatically and permanently immediately upon summary generation. Audio streams are never permanently stored, never shared, and never used to train public AI models. Clients receive a human-written summary only.
Retention: In line with professional best practices for health and somatic services in New Zealand, client records are retained securely for a period of 7 years before being permanently and securely destroyed.
Security Disclaimer: While I use encrypted, high-security platforms, no digital transmission is 100% secure. I take all reasonable steps to protect your data from unauthorised access.

5. Disclosure & Cross-Border Data Flows

Your information is strictly confidential. It is only shared:

With your explicit, written consent (e.g., for a referral to a medical or psychological practitioner).
When legally required by a New Zealand court of law or statutory authority.
Cross-Border Data Protection (Principle 12): To run this online practice, your data is processed using reputable international cloud platforms (Acuity, Stripe, Heidi AI). Desire Pathways ensures that these providers are contractually bound to protect your personal data to a standard equivalent to the New Zealand Privacy Act 2020. Your data is never sold or disclosed for marketing purposes.

6. Your Rights & Complaints

Under the New Zealand Privacy Act 2020, you have the absolute right to:

Access the personal information I hold about you.
Request corrections to any inaccurate or outdated information.
Opt-out: You may opt out of AI-assisted note-taking at any time via your booking form or by notifying me in writing, without any disruption to your coaching.

To exercise these rights or for any privacy concerns, please contact me at michaela@desirepathways.co.

If you believe Desire Pathways has breached your privacy rights and you are unsatisfied with my internal response, you have a statutory right to lodge a formal complaint with the Office of the Privacy Commissioner at 0800 803 909 or via www.privacy.org.nz