Privacy Policy

Effective Date: June 18, 2026

This Privacy Policy describes how Sona Speech Therapy (“we,” “our,” or “us”) collects, uses, protects, and discloses your personal information and health information when you use our speech therapy services.

We are committed to protecting your privacy and complying with the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020.

Definitions

Company refers to Sona Speech Therapy, a speech therapy practice located at 4 Normanby Street, Newtown, Wellington, New Zealand.

Health Information means any information about your physical, mental health, disability, or health services provided to you.

Personal Information means information about an identifiable individual, including health information.

Services refers to our speech therapy services, including assessments, treatments, consultations, and related healthcare services provided in-person or via telehealth.

You or Patient means the individual receiving our services or their authorized representative.

Information We Collect

Health Information

As a registered speech-language therapist, we collect health information necessary for providing professional speech therapy services, including:

Clinical Information: Speech, language, voice, and swallowing assessment results
Medical History: Relevant medical conditions, medications, and previous treatments
Treatment Records: Therapy notes, progress reports, and outcome measures
Referral Information: Details from referring healthcare providers

Personal Information

We collect personal information necessary for service delivery:

Contact Details: Name, address, phone number, email address
Appointment Information: Booking details, scheduling preferences
Payment Information: Billing details, payment method preferences
Emergency Contacts: Next of kin or emergency contact information

Video Course Purchases

If you buy one of our self-paced video courses, we collect:

Your email address, which is how your access is identified and how we send you a sign-in code
A record of the purchase, held by our payment provider Stripe. We never receive or store your card number
Anonymous playback statistics, such as how much of a module was watched. These are not tied to you: our player runs without cookies and we do not set a viewer identifier

We treat the fact that you have bought a condition-specific course as sensitive, because it can imply something about your health even though you are not our patient. In practice that means:

We do not confirm to anyone, including through our own sign-in form, whether a given email address has bought a course. If you ask for a sign-in code, the reply is the same whether or not there is an account
Course purchase records are kept separately from clinical records, and buying a course does not create a clinical file
We do not use course purchase information to market therapy services to you unless you ask us to

Buying a course does not make you our patient and does not create a therapist and patient relationship.

Technical Information

When you use our website or telehealth services, we may collect:

Website Usage: Basic website functionality data
Telehealth Data: Video/audio connection information for session quality

Third-Party Services

We use these essential service providers. Some are based outside New Zealand; where data leaves the country we have ensured providers meet appropriate privacy and security standards.

Cal.com (United States): appointment booking, scheduling, and telehealth video sessions
Resend (United States): secure transactional email used to deliver medical referral and contact form submissions to our clinical team, including patient-identifying information sent by referring clinicians
Google Workspace (Google LLC, United States): our clinical email inbox, where medical referral and contact form submissions, including patient-identifying clinical information, are received and stored
WhatsApp (Meta Platforms, Inc., United States): an optional messaging channel we offer for general and urgent enquiries; any message you choose to send us this way, which may include health information, is processed by Meta
PostHog (United States): cookieless, anonymous product analytics used to understand how visitors navigate the website and which pages lead to enquiries. All PostHog traffic is routed through our own domain, no cookies are set, no session recordings are made, and our referral and contact forms are excluded from capture, so no health information is collected
Stripe (United States): payment processing for our self-paced video courses. Stripe receives your email address and billing address and handles your card details directly; we never see or store your card number. Stripe also holds the record of your purchase, which is what our website checks to confirm your access
Mux (United States): video hosting and streaming for our video courses. Our player is configured without cookies, so playback statistics are anonymous and are not linked to you
Vercel Web Analytics (United States): cookieless, anonymous website traffic metrics (no health information collected)
Vercel (United States): website hosting and content delivery

All providers maintain appropriate security standards and data protection measures, and are bound by contractual data-protection obligations.

Cookies and Website Technology

Our website uses essential cookies required for appointment booking and basic website function. You can disable cookies in your browser settings, though this may affect booking functionality.

Our website analytics are cookieless: PostHog and Vercel Web Analytics set no tracking cookies, store nothing on your device, and do not identify you personally. Because no personal information is stored on your device for analytics, no cookie-consent banner is required under the New Zealand Privacy Act 2020.

How We Use Your Information

We use your information solely for legitimate healthcare and business purposes:

Clinical Care: Conducting assessments, developing treatment plans, monitoring progress
Treatment Delivery: Providing speech therapy services in-person and via telehealth
Professional Communication: Reporting to referring healthcare providers
Appointment Management: Scheduling, confirmations, reminders, and rescheduling
Payment Processing: Billing, invoicing, and payment collection
Legal Compliance: Meeting professional registration and healthcare standards

We maintain strict confidentiality and only share your information in limited circumstances:

Healthcare Providers

Referring Doctors: Clinical reports and progress updates as requested
Other Healthcare Professionals: With your written consent for coordinated care
Emergency Situations: When necessary to prevent serious harm to health or safety

Service Providers

Booking and telehealth platform: Cal.com handles scheduling, video sessions, and patient-facing booking pages
Referral and contact form email: Resend delivers referral and contact form submissions to our clinical team by secure transactional email
Email inbox: Google Workspace hosts our clinical email, where referral and contact form submissions are received and stored
Messaging: WhatsApp (Meta) carries any messages you choose to send us for general or urgent enquiries
Hosting: Vercel serves the website and stores no patient information
Analytics: PostHog and Vercel Web Analytics collect anonymous, aggregated, cookieless usage metrics. No cookies are set, no individuals are identified, and our referral and contact forms are excluded from analytics capture

Legal Requirements

We may disclose information when required by court orders, professional registration body investigations, health and safety authorities, or other legal obligations under New Zealand law.

International Data Transfers

Our service providers (Cal.com, Resend, Google Workspace, WhatsApp/Meta, Stripe, Mux, and Vercel) are based in the United States and process data internationally. We ensure all international transfers comply with New Zealand privacy law requirements and use providers with adequate privacy protections.

Data Retention

Health Records: Retained for minimum 10 years after last treatment (New Zealand standard)
Child Records: Retained until age 26 (if applicable)
Payment Records: 7 years for tax and accounting purposes
Course Purchase Records: kept for as long as your access lasts, which does not expire, so that you can sign back in. Held by Stripe alongside the payment record
Website Data: 2 years maximum for operational purposes

Data Security

We implement appropriate measures to protect your information:

Physical Security: Secure premises and locked filing systems
Technical Security: Encrypted data transmission and secure password policies
Access Controls: Limited access on a need-to-know basis
Staff Training: Regular privacy and security training

Your Rights

Under New Zealand privacy law, you have the right to:

Access: Request copies of your personal information
Correction: Request correction of inaccurate information
Deletion: Request deletion of information (subject to legal retention requirements)
Restriction: Request limits on how we use your information
Portability: Request transfer of your information to another provider
Complaint: Lodge a complaint with the Privacy Commissioner

Contact Information

For privacy-related enquiries or to exercise your rights:

Sona Speech Therapy
4 Normanby Street, Newtown, Wellington 6021
Phone: 021 169 3694
Email: sacha@sonaspeech.co.nz

For complaints about our privacy practices:
Office of the Privacy Commissioner
Website: privacy.org.nz
Phone: 0800 803 909

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, through direct communication.

This policy was last updated on September 9, 2026.